Prompt Pack Aml Kyc Policy

AML/KYC Policy

When to use this

Use this skill when a fintech company or financial institution needs a formal AML/KYC policy to:

• Comply with licensing requirements from a financial regulator
• Satisfy correspondent banking due diligence
• Establish internal controls for money laundering and terrorist financing prevention
• Document compliance with FATF standards

This skill is particularly relevant for:

• Fintech startups preparing for CBUAE, SAMA, DFSA, FSRA, or ADGM FSRA licensing
• E-money institutions, payment service providers, crypto asset service providers, and lending platforms
• Established financial institutions updating their AML framework after a regulatory examination

Prompt template

Draft an AML/KYC policy for [FinTech Company] operating in [jurisdiction]. Cover customer identification, risk assessment, ongoing monitoring, suspicious activity reporting, record keeping, training requirements, and regulatory filing obligations.

Use [[conversation-clarifying-questions]] to elicit [bracketed] inputs before drafting.

Required inputs

Document structure

1. Policy purpose and scope

• Business description and AML risk context
• Legal and regulatory basis: the applicable AML law and regulations
• Scope: who is covered (all employees, agents, outsourced service providers)
• Policy owner (typically MLRO — Money Laundering Reporting Officer)

2. Regulatory framework

Key applicable frameworks by jurisdiction:

All frameworks follow FATF 40 Recommendations as the baseline standard.

3. Customer due diligence (CDD)

3.1 Standard CDD — natural persons

Minimum identification requirements:

• Full legal name (as on government-issued ID)
• Date and place of birth
• Nationality and country of residence
• Occupation
• Government-issued ID (passport, national ID, residency permit): number, expiry, issuing authority
• Address (residential and/or correspondence)
• Source of funds (for higher-risk customers or transactions above threshold)
• Source of wealth (for PEPs and high-risk customers)

Verification methods: physical ID check; eKYC (permitted in UAE, KSA, DIFC for regulated entities); certified copies for non-face-to-face onboarding.

3.2 Standard CDD — legal entities

• Full legal name and trading name
• Jurisdiction of incorporation and registration number
• Registered address and principal place of business
• Certificate of incorporation / commercial registration
• Articles of association
• Identification of beneficial owners (UBO): individuals who own or control 25% or more (some jurisdictions: 10%) of the entity, and the natural persons who exercise ultimate effective control
• Director identification

UAE: UBO information must be registered with the relevant authority (Ministry of Economy or free zone) under Cabinet Resolution 58/2020 on UBO.

3.3 Enhanced due diligence (EDD)

Apply EDD when:

• Customer is a Politically Exposed Person (PEP) or close associate/family member of a PEP
• Customer or transaction involves a high-risk jurisdiction (FATF grey or black list; company jurisdiction is a secrecy jurisdiction)
• Transaction type is inherently high-risk (large cash; correspondent banking; cross-border wire to high-risk jurisdiction; crypto asset transactions)
• Customer is a legal entity with complex or opaque ownership structure

EDD requires:

• Senior management approval for onboarding
• Source of wealth documentation and verification
• Enhanced ongoing monitoring (lower transaction thresholds for review)
• More frequent periodic review (at least annually vs. standard 2–3 years)

3.4 Simplified due diligence (SDD)

Permitted only where risk is demonstrably low — typically for regulated financial institutions as customers (themselves subject to AML rules), listed companies on regulated exchanges, and government entities. Document the basis for SDD application.

4. Risk assessment and risk-rating

A written risk assessment is required by FATF and all MENA AML frameworks. The risk assessment must:

• Identify the money laundering and terrorist financing risks inherent in the business model
• Assess the residual risk after controls
• Be reviewed at least annually and on material business changes

Customer risk rating factors:

• Customer type (natural person / legal entity / PEP / high-risk business)
• Product/service used (cash-intensive / cross-border / crypto / trade finance)
• Geography (high-risk vs. standard vs. low-risk jurisdictions)
• Transaction behavior (patterns consistent with declared purpose?)

Risk categories: Low / Medium / High (define thresholds numerically where possible)

5. Ongoing transaction monitoring

• Define monitoring rules and thresholds per product type
• Automated transaction monitoring system: what rules are in force; who reviews alerts; escalation path for unresolved alerts
• Periodic review schedule: Low-risk customers: every 3 years; Medium: every 2 years; High: annually; PEPs: annually minimum
• Trigger events for ad-hoc review: adverse media; law enforcement inquiry; unusual transaction pattern; customer request for transaction outside declared purpose

6. Suspicious activity reporting (SAR/STR)

• Internal reporting: any employee who suspects money laundering or terrorist financing must report to the MLRO immediately (internal SAR form)
• MLRO review: assess within [X] business days; decide whether to file with the financial intelligence unit (FIU)
• External reporting:
  • UAE: report to goAML (FIU, part of CBUAE)
  • KSA: report to SAFIU (Saudi Financial Intelligence Unit) via goAML
  • Lebanon: report to the Special Investigation Commission (SIC)
  • Egypt: report to the Money Laundering Combating Unit (MLCU)
  • DIFC/ADGM: report to UAE FIU; notify DFSA/FSRA of material SAR filing
• Tipping-off prohibition: once an internal SAR is filed, do not alert the customer that a report has been made or is under consideration — this is a criminal offence in all MENA jurisdictions
• Freeze pending report: if transaction has not been executed, freeze pending MLRO decision

7. Record-keeping

• Customer identification records: minimum 5 years after end of customer relationship (UAE: 5 years; DIFC: 6 years; KSA: 10 years)
• Transaction records: same retention period as identification records
• SAR/STR records: retain for same period; protect from unauthorized access
• Training records: 3 years minimum
• Format: original documents or certified copies; electronic storage is permitted in most MENA jurisdictions with audit trail integrity requirements

8. Training obligations

• Initial training: all new employees before client-facing duties begin
• Annual refresher: all covered staff
• Enhanced training: MLRO, compliance team, customer-facing staff
• Content: AML/CFT obligations; red flags; internal reporting procedures; consequences of non-compliance
• Documentation: attendance records; assessment results; training materials

9. MLRO role and responsibilities

• Appoint a designated MLRO (Money Laundering Reporting Officer) and deputy
• MLRO requirements: senior; sufficient authority and resources; direct board access
• MLRO obligations: oversee AML programme; receive internal SARs; file external reports; produce annual AML report to board
• Regulatory notification: MLRO appointment must typically be notified to the regulator (DFSA: prior approval required; CBUAE: notification)

Jurisdictional notes

UAE: Virtual Asset Service Providers (VASPs)

UAE VASPs regulated by VARA (Virtual Assets Regulatory Authority) — Dubai, or by SCA (Securities and Commodities Authority) — federally. Both require an AML programme compliant with CBUAE guidance and FATF Recommendation 15 (travel rule).

KSA

SAMA has issued detailed AML/CFT Rules (2021) for banks and finance companies. New fintech entrants must comply from day one of operations. The SAFIU reporting obligation is strict — fines for non-reporting are significant.

DIFC

DFSA Sourcebook: AML Module (AML). The DFSA has taken enforcement action against firms with inadequate AML controls. CDD failures are a top enforcement priority.

Common mistakes

• No written risk assessment — required by all MENA frameworks; a policy alone is not sufficient
• PEP screening not operationalized — having a policy requirement but no screening tool or process
• Tipping-off omission — policy does not address the prohibition on alerting customers
• No MLRO appointment or MLRO without sufficient authority or resources
• Record retention periods not jurisdiction-calibrated — 5-year UAE minimum vs. 10-year KSA minimum creates issues for firms operating in both

Related skills

• [[prompt-pack-anti-money-laundering-policy]] — related policy for broader financial institution use
• [[kb-aml-mena]] — MENA AML/CFT law reference
• [[prompt-pack-bnpl-platform-agreement]] — BNPL product which carries AML obligations
• [[heuristic-always-state-jurisdiction-first]] — jurisdiction-first drafting