Inside an AML inspection: what examiners actually ask

When an SCA, CBUAE or DFSA inspection notice arrives, boards often discover that “we have policies” is not the same as “we can demonstrate a working framework.” Examiners arrive with a short list of questions — and an even shorter tolerance for theatre.

This briefing walks through what examiners actually ask, the documents they request first, and the three findings that recur in almost every UAE inspection report. Use it as a readiness rehearsal, not a checklist to photocopy.

What arrives before the interview

Document requests usually precede on-site interviews by one to three weeks. Examiners look for evidence that risk classification drives monitoring — not the reverse. Expect enterprise-wide risk assessments, customer risk methodologies, goAML filing logs, sanctions alert dispositions, and board minutes that show challenge, not endorsement only.

If any of these live in shared drives without version control, ownership, or recent testing evidence, assume they will become findings.

The questions that recur

Interview rooms focus on decision rights. Who escalated the last unusual transaction? Why was that customer rated medium? How did the MLRO’s last report change a board decision? Examiners test whether named officers understand the framework they signed — or whether consultants wrote something nobody uses.

They also probe outsourced arrangements: service-level agreements, oversight routines, and whether accountability remains with the licensed entity.

Three findings that keep returning

First, customer risk ratings that exist on paper but do not drive enhanced due diligence or monitoring intensity. Second, goAML reporting that is late, incomplete, or unexplained by quality-control evidence. Third, open remediation points from prior inspections that boards believed were closed.

None of these is exotic. All of them are preventable with partner-led design, testing, and inspection rehearsal before the notice arrives.