Annual AML review and compliance calendar for a small UAE brokerage

What the annual review has to prove

An AML review is not paperwork for its own sake. It lets you show an inspector that your brokerage assessed its own risk, wrote rules to match, trained people, tested whether people followed them, and fixed what it found. Each of those leaves a document. The calendar below is built around the documents.

One caution on wording. Annual training, an annual risk assessment and annual file testing appear on consultancy checklists. In the MoET guidance I read, the standard is a periodic review that matches the risk, with no fixed frequency. So I present a yearly cycle as my recommendation. If a regulator or a lawyer tells you a specific frequency applies to you, follow that.

The rules your calendar rests on

As listed on the Ministry's AML page (checked 2 November 2026), real estate agents and brokers on the mainland and in commercial free zones are supervised by MoET under Federal Decree-Law 10 of 2025 and Cabinet Resolution 134 of 2025, which replaced Cabinet Decision 10 of 2019. The page also lists the DNFBP Guidelines (March 2026), the Supplemental Guidance for Real Estate Agents and Brokers (2026), Circular 5/2022 on the Real Estate Activity Report (REAR), Cabinet Resolution 71 of 2024 on violations and penalties, and circulars on risk-based due diligence (2025/6), sanctions screening (2025/3), a DNFBP training programme (2025/2) and high-risk jurisdictions (2026/1). Financial free zones such as ADGM and DIFC have their own supervisors. DNFBP stands for designated non-financial businesses and professions, the category brokers fall into.

What the framework asks of a broker, in short: a business risk assessment, written policies approved by senior management, a compliance officer, customer due diligence, screening, ongoing monitoring, suspicious transaction reporting, REAR where triggered, training, goAML registration and record keeping. Brokers must keep customer due diligence and transaction records, including business correspondence and customer communications, for at least five years, counted from the latest of the end of the client relationship, the completed transaction, an inspection, an investigation or a final court judgment (Cabinet Resolution 134 of 2025, Art. 25, and MoET's DNFBP Guidelines, section 11). This is a federal AML duty, not a chat rule set by the Dubai Land Department (DLD, the emirate's property registry) or RERA (its Real Estate Regulatory Agency). The law does not name WhatsApp, so client messages tied to a customer or deal are likely to count as business correspondence, which is an interpretation.

The year at a glance: a quarter-by-quarter calendar

When	Task	Owner	Evidence
January	Refresh the business risk assessment	Compliance officer, approved by owner	Dated assessment, version number
February to March	Review policies and procedures; owner sign-off	Compliance officer, owner	Policy version history, signed approval
April to June	Staff training and test	Compliance officer	Attendance log, test results, signed acknowledgements
July to September	Sample file checks	Compliance officer or independent reviewer	Sample sheet, findings, fix dates
October to December	Independent review, gaps log, next year's plan	Owner, external reviewer	Review report, action plan
Monthly	REAR and goAML housekeeping; screening log review	Compliance officer	Month-end review sheet
On trigger	Review after a new service line, a large cash deal, a new high-risk jurisdiction list or a sanctions change	Compliance officer	Dated note

January: business risk assessment refresh

The business risk assessment asks: where could this brokerage be used to launder money? Look at your client mix (non-residents, companies, third-party payers), your deal types (off-plan, cash, crypto), your channels and the countries your clients come from. Write the answers down, rate each risk and note the controls that cover it. Update it when something material changes, not only once a year.

February to March: policy and procedure review and owner sign-off

Re-read your written policy against the current Ministry guidance. The Ministry's Circular 6 of 2025, for example, asks brokers to apply enhanced due diligence to high-risk customers, standard to medium-risk and simplified to low-risk. Check that your onboarding checklist, escalation route and record-keeping rules match, see the KYC onboarding workflow. Keep the old version and mark the new one. Owner or senior management sign-off should be dated.

Training: who, how often and what evidence to keep

Train everyone who deals with clients, and train new joiners when they start, not at the next annual session. How often is a judgment I recommend you set and write down. The evidence: date, attendees, content, a short test with results, and a signed acknowledgement that each person has read and understood the policy. E-signed acknowledgements are fine, see proving staff understood a compliance rule.

Mid-year: sample file checks

Pick a set of closed and live files and test them against the checklist: was the ID valid, were beneficial owners identified, was source of funds on file, was screening done before the deal and saved with a date, was the approval recorded, was REAR status set? Choose high-risk files first (cash, virtual assets, third-party payers, company buyers) and then a spread across agents. How many is your call. I would start with a handful per quarter for a small brokerage and increase if you find problems. For each finding, log the fix and a due date. Check the Ministry's own list of inspection findings in the sources: no KYC before the relationship, no PEP due diligence, no enhanced due diligence in high-risk cases and no ongoing monitoring have all drawn fines before.

goAML: registration, REAR and STR housekeeping

DNFBPs must register on goAML and keep the registration active, with the compliance officer as the registered user. Check each year that the login still works, the user is still employed and the contact details are current. Check periodic reports that apply to your registration inside goAML itself, because I could not confirm any due dates beyond that. For cash tracking and who files, see REAR tracking.

What a failed review can cost

The published schedule under Cabinet Resolution 71 of 2024 lists administrative fines for businesses MoET supervises: failing to keep records or make them available, AED 50,000 to 200,000; failing to register on the Unit's goAML system, AED 50,000 to 200,000; failing to promptly report suspicious transactions or give the Unit information it requests, AED 100,000 to 500,000. The Ministry may double a fine on repeat. Newer instruments replaced the laws that resolution cites and I could not confirm whether the schedule still operates unchanged, so confirm the current schedule with the Ministry of Economy.

Q4: independent review, gaps log and next year's plan

An independent look matters most when the owner is also the compliance officer. The guidance as summarised in secondary sources allows a senior person to act as compliance officer if the role is documented and conflicts are managed, and external support is permitted. I could not verify this in the primary text, so check with the Ministry. If the owner does hold the role, give the role the authority to pause a deal, and have someone outside the daily business, such as an external consultant, review the files once a year. Close the year with a gaps log and next year's plan.

The evidence folder: what goes in, who owns it and how long to keep it

• Business risk assessment, with version history.
• Policies and the sign-off record.
• Training log, test results and signed acknowledgements.
• File-sample results and fix dates.
• Screening logs and any match decisions.
• goAML filing receipts and the month-end review sheets.
• Questions asked of the regulator and the replies.
• Owner sign-off page for the year.

Keep it for at least the five-year AML period and set a keep-until date on each item. Store it with the controls in secure document storage for a UAE brokerage, with the compliance officer and owner as the only editors.

How software and AI keep the calendar running, and what only a person can decide

Concrete tasks for a small brokerage:

• Recurring tasks. Put each calendar line into your CRM (the system where you keep clients and deals) or a task tool, assigned and with due dates, so nothing lives in someone's memory.
• E-signed acknowledgements for policies and training, with an audit trail.
• Deal checklists that stop a deal moving to Contract F (the DLD sale agreement between seller and buyer) until due diligence is approved, so the policy is enforced, not only written.
• Reports. A saved list of deals with missing screening dates, cash flags or expired IDs, to pick samples from.
• Drafting. AI can turn last year's risk assessment and a list of changes into a first draft of this year's, and summarise a long circular for the compliance officer.
• Retention reminders when a keep-until date approaches.

What stays human: the risk judgment, deciding whether something is suspicious, avoiding tipping off, signing off the policy and talking to the regulator. I build compliance task workflows into brokerage CRMs as custom work, but a shared task list does most of the job.

Try it yourself with Claude (an AI assistant). Paste last year's risk assessment with client names removed and this prompt: "List the sections that need updating if we now sell more off-plan properties to non-residents and accept more company buyers. For each, suggest what to change, in plain words." Treat the answer as a draft for your compliance officer. Read the guide to uploading documents to AI tools first.

How I'd approach this

Do not start with the perfect calendar. Start by naming the compliance officer, then put the five quarterly tasks into your task tool with dates, and create the evidence folder. At the end of the year, count how many tasks have an evidence file. That number tells you whether your programme is real. Confirm the current rules with the Ministry of Economy and talk to a lawyer on anything specific.