CMA Examination Observations Report

Letter to licensed financial institutions summarising the Authority’s risk-based assessment of the securities sector and its AML/CFT and sanctions examination observations.

Summary

The CMA's Examination Observations Report is a supervisory letter to financial institutions licensed by the Securities and Commodities Authority (now the Capital Market Authority), including virtual asset service providers. It lists the AML/CFT and sanctions weaknesses the regulator found across the securities sector and states what it expects firms to do about them, with a reminder of the penalties available.

The letter explains that the Authority assessed each firm's money laundering, terrorist financing and proliferation financing risk profile through annual risk assessment returns. The risk indicators were drawn from the FATF Recommendations, the National Risk Assessment and topical assessments, and onsite and offsite tools then identified common shortcomings. Firms must discuss the letter with their board, review their AML/CFT and sanctions programme against it, and make sure their internal and external auditors are aware of it.

Six issues are set out, each with the regulator's expectations: governance (policies not updated, risk policies not commensurate, compliance policy not based on a risk assessment); testing and audit (internal audit not covering targeted financial sanctions controls); incomplete ML/TF/PF risk assessments; customer due diligence, including missing KYC documents, weak ownership analysis for legal persons and failure to apply enhanced or simplified due diligence; sanctions compliance programmes lacking the eight required components; and weak suspicious activity reporting procedures, red-flag guidance and front-line training.

The letter cites Article 14 of Federal Decree-Law No. 20 of 2018 for the regulator's powers: a warning, administrative penalties of AED 50,000 to AED 5,000,000 per violation, a ban from the sector, restrictions on directors' and managers' powers, restriction of the activity, and licence cancellation. That law has since been replaced by Federal Decree-Law No. 10 of 2025, so the current penalty provisions must be checked there.

Who it applies to

Financial institutions licensed by the Securities and Commodities Authority (now the Capital Market Authority), including virtual asset service providers, their boards and senior management, and the internal and external auditors who test their AML/CFT programmes.

Contents

English official text in 6 provisions. Open the full text or jump to a provision:

1. 1 — Governance Framework and management oversight
2. 2 — Testing and Auditing
3. 3 — ML/FT/PF Risk Assessment
4. 4 — Customer Due Diligence, Enhanced Due Diligence, and Ongoing Monitoring
5. 5 — Sanctions Compliance Program
6. 6 — Suspicious Activities Report / Suspicious Transaction Report

Key provisions

Obligations and deadlines

• Discuss the letter with the board and identify the actions needed.
• Make internal and external auditors aware of the letter and the material it references.
• Extend internal audit coverage to targeted financial sanctions controls.
• Maintain a sanctions compliance programme with the eight components the letter lists.

Penalties

The letter cites Article 14 of Federal Decree-Law No. 20 of 2018: warning; administrative penalties of no less than AED 50,000 and no more than AED 5,000,000 for each violation; a ban from working in the sector; restrictions on the powers of board members, managers or owners responsible, including a temporary inspector; restriction of the activity; and licence cancellation. That law has been replaced by Federal Decree-Law No. 10 of 2025.

History and citations

“Cites” and “Cited by” are built automatically from references in the full texts held in this library; they cover only instruments in the library.

Related instruments

Related Polaris services

• AML Compliance UAE — goAML, KYC