On this page
At a glance
- UAE DNFBPs maintain two risk assessments: a business-wide ML/FT/PF risk assessment and a per-customer risk rating — they feed different decisions.
- The business-wide assessment is understood to need to cover customer, product/service, delivery-channel and geographic risk factors, informed by the UAE National Risk Assessment (confirm against Cabinet Resolution No. 134 of 2025).
- A customer's computed risk tier (simplified, standard or enhanced due diligence) comes out of scoring those same factor categories at the individual level.
- Some factors — a confirmed sanctions hit, a FATF-blacklisted jurisdiction — force a high rating outright in groAML's engine, regardless of the total score.
- Risk assessment methodology is shifting industry-wide toward machine-learning scoring at large banks; groAML's own engine today is a transparent, weighted-factor rules engine, not an ML model, and this post is honest about which is which.
Two risk assessments, not one
"Risk assessment" gets used for two different documents, and mixing them up is a common source of confusion in an inspection:
- a business-wide (institutional) risk assessment — how exposed is your firm, as a whole, to money laundering, terrorist financing and proliferation financing; and
- a customer risk assessment — how risky is this specific relationship, which determines its CDD tier (see our CDD & KYC guide).
They're connected — the business-wide assessment should shape how you weight factors at the customer level — but they answer different questions and sit in different places in your compliance program.
The business-wide risk assessment
The Executive Regulations (Cabinet Resolution No. 134 of 2025) are understood to require every reporting entity to identify, understand and manage its ML/FT/PF risk, documenting that assessment and keeping it updated, and to cover at least four categories of risk factor. Confirm the exact requirement against the Resolution text. The four categories:
| Factor category | What it covers |
|---|---|
| Customer | The types of customers you serve — individuals vs. entities, PEP exposure, cash-intensive vs. documented income |
| Product / service | The inherent risk of what you sell — a bullion sale carries different risk than a bookkeeping engagement |
| Delivery channel | Face-to-face vs. remote, direct vs. introduced by a third party |
| Geographic | Where your customers, their funds and their counterparties are based or connected to, including FATF high-risk and increased-monitoring jurisdictions |
The Executive Regulations are understood to require the assessment to take the UAE's own National Risk Assessment into account, not just your internal view of your business, and a supervisor can be expected to look for that. Confirm the exact requirement against the Resolution text rather than relying on this summary.
The four customer risk factors
At the individual customer level, the same four categories get scored for one specific relationship: who the customer is, what product or service they're using, how the relationship was established, and where the geographic risk sits (their nationality, incorporation, and where their funds originate). This is the mechanism that turns "we think this sector is higher risk" at the business-wide level into "this specific customer needs enhanced due diligence" at the file level.
From score to CDD tier
A customer risk assessment isn't useful as a number on its own — it has to translate into an action. The usual pattern is a banded score (low / medium / high) that maps directly to the CDD tier (simplified / standard / enhanced), with specific conditions — a sanctions hit, PEP status, a blacklisted jurisdiction, undisclosed beneficial ownership — forcing a high rating and enhanced due diligence regardless of where the rest of the score lands.
Why it's never a one-time document
A risk assessment filed once at onboarding and never revisited stops reflecting reality almost immediately. It needs to move when:
- the customer's business, ownership or activity changes;
- new adverse media or a sanctions hit surfaces;
- the jurisdiction lists themselves change (see our regulatory updates guide for how often that happens); or
- the review interval tied to the customer's current rating comes due — shorter for high-risk customers than for low-risk ones.
Negative-news checks typically need to run on a tighter cycle than a full periodic review: adverse media is an event that can land the week after onboarding, not something that waits politely for your next scheduled review.
Why risk-scoring methodology is changing industry-wide
Traditional transaction monitoring and customer risk scoring across the banking industry has mostly relied on fixed, rules-based thresholds — a pattern familiar from compliance programs everywhere, DNFBPs included. That is changing at the largest banks. Google Cloud's AML AI, developed in partnership with HSBC, replaces that rules-based transaction monitoring with a machine-learning model that assigns each customer a dynamic risk score and flags which factors drove it. HSBC and Google Cloud have publicly reported substantially more suspicious activity detected and fewer false-positive alerts; we have not independently verified the published figures, so we do not repeat them here.
That's a meaningful data point about where large-institution AML technology is heading, and worth knowing about even if it doesn't change what a DNFBP is required to do today. It does not mean machine-learning scoring is mandatory, or that every firm needs it — a documented, risk-based, explainable methodology is the legal bar, whatever technology produces it.
How groAML's own risk engine works
That's a deliberate choice, not a gap waiting to be filled: a supervisor asking why a specific customer scored "high" gets an answer that names the exact factors and points involved, against a dated ruleset version — the same explainability a reviewable rules engine has always offered, and the property that matters most in an inspection, whether the number came from a rules engine or a trained model.
A risk-assessment health check
A business-wide risk assessment, and the customer risk model built on top of it, are working if you can say yes to all of these.
Saved only on this device. Nothing is sent to us.
groAML scores every customer against a documented, versioned ruleset, the same factors described above, and records exactly which ones drove each rating, so a risk score comes with its own explanation built in rather than needing to be reconstructed for an inspector after the fact.
See how it worksFrequently asked questions
Is the business risk assessment the same thing as a customer's risk rating?
How often must we update the risk assessment?
Does a high PEP risk always mean enhanced due diligence?
Is machine learning required for AML risk scoring in the UAE?
What's the UAE National Risk Assessment, and do we need to read it?
Sources
- Cabinet Resolution No. 134 of 2025 on the Executive Regulations of Federal Decree-Law No. 10 of 2025, UAE Cabinet / Central Bank of the UAE Rulebook
- Combatting Money Laundering & Terrorism Financing, UAE Ministry of Economy and Tourism. References the UAE National Risk Assessment that business-wide assessments are expected to align with
- HSBC: Cloud-Based Financial Crime Detection at Scale, Celent / Google Cloud. Independent industry case study on Google Cloud's AML AI, built with HSBC
- HSBC dynamic risk assessment AI and AML false positives (trade-press report), AI Intel Report. Secondary trade-press source for the published HSBC figures; the figures themselves are not repeated in this post
This guide is general information, not legal advice. It reflects the sources listed above as of 4 Oct 2026. Check the current EOCN guidance and confirm with your supervisory authority or a UAE-qualified adviser how these obligations apply to your business.