DFSA licence or FSRA permission granted: what has to be running on day one

The licence is the moment everyone celebrates. Whether it's a DFSA licence or an FSRA Financial Services Permission, it's also the moment your obligations start. They apply from the date of authorisation. There's no grace period while you settle in.

Most new firms have spent months on the application: business plan, policies, people, capital. The policies describe how compliance will work. Day one is when it has to actually work, on a real client, with a real record.

Here's what needs to be running, in the order you'll need it, and the point where each part usually breaks.

0. A business risk assessment, before your first client

Before you onboard anyone, both regulators expect a firm-wide assessment of your money laundering, terrorist financing and proliferation financing risks: your products, customers, countries and channels, read against the UAE National Risk Assessment. Your customer risk ratings and your controls should follow from it.

Where it breaks. The assessment was written for the application and hasn't been touched since. The business has changed and the document hasn't. When an inspector asks how a customer's rating links back to it, nobody can show the line.

Check it. Is your business risk assessment dated and approved, and does it still describe the firm you're running today?

1. Onboarding checks on every new client, and reviews after that

Your first client is your first customer due diligence file. Identity and verification, beneficial ownership for corporate clients, the purpose of the relationship and a risk rating. Politically exposed persons and high-risk clients need enhanced due diligence and senior management approval. That's a requirement of the rules, not a choice for your policy.

Onboarding isn't a one-off. Each client needs a periodic review, more often the higher their risk rating, and a fresh look when something about them changes.

Where it breaks. The approval happens in a chat message. Six months later, nobody can find which version of the risk assessment was approved, or by whom. And the first periodic reviews fall due before anyone has put them in a calendar.

Check it. Open the file of your most recent corporate client. Can you see the risk rating, the approved version of the assessment, who approved it and when the next review is due, without asking anyone?

2. Screening, with someone reviewing each hit

Clients, their directors and their beneficial owners need screening at onboarding and on an ongoing basis. In the UAE that means the UN Consolidated List and the UAE Local Terrorist List, alongside PEP and adverse media checks.

The sanctions rules are strict on timing. When either list is updated, your existing customers need re-screening within 24 hours. A confirmed match means freezing funds immediately, without prior notice, and filing a Funds Freeze Report through goAML within five days. A partial name match means suspending transactions and filing a Partial Name Match Report within five days. Subscribe to the Executive Office for Control and Non-Proliferation (EOCN) notification system so you hear about list updates when they happen.

Where it breaks. The screening itself is fine. The reviews aren't recorded. A hit gets cleared because the analyst could see it was a different person, but nothing written down says what they compared or why they were sure. And re-screening after a list update depends on someone noticing an email.

Check it. Take the last screening hit your team cleared. Is there a written reason someone else could find? And for the last list update, can you show when your customer base was re-screened?

3. A record of every decision

This is the obligation that ties the others together. Every onboarding approval, every cleared hit, every escalation and every exception needs to show who decided, when, why, and on what evidence. Customer files, screening results, reports and training records are kept for at least six years.

Where it breaks. The record is assembled after the fact, usually the week before an inspection or a return is due. A record built after the fact is weaker evidence than one kept as the work happens, and it costs the team the week it takes to build.

Check it. Could someone who wasn't in the room explain any decision from last month using the record alone: who made it, when, and on what evidence?

4. Reporting, with dates on it

Reporting starts earlier than most new firms expect.

• goAML, in your first week. Register on goAML, the UAE FIU's system, as soon as you're authorised. The MLRO registers in two stages, first on SACM and then on goAML. Without it, you can't file a suspicious activity or transaction report (SAR/STR), or a sanctions report, on the day you need to.

• The MLRO's report to senior management. Your MLRO reports to senior management at least once a year on how the AML framework is working. For many new firms, it's the first report they write.

• The annual AML Return. For DFSA firms, it was due on 30 September in 2025. For FSRA firms, it's due by the end of April and covers the previous calendar year.

Where it breaks. The first return asks for numbers nobody was counting: clients by risk rating, screening hits, escalations, reports filed, training completed. If those weren't captured from day one, the first return becomes an archaeology project.

Check it. Is goAML registration done? And for each number your first return will ask for, is it already being counted as the work happens, or will someone have to work it out later?

Training, from the first hire

Every new joiner needs AML and sanctions training when they start, and everyone needs it again each year, with a record of who attended and when. It's easy to deliver and easy to forget to record, and the return asks for it.

The spreadsheet question

Many new firms start with spreadsheets, and for the first handful of clients, that's reasonable. The question to ask early is how you'll know when the spreadsheet has stopped working. It's usually earlier than you expect, and it's usually discovered by someone outside the firm.

A useful test: pick any client onboarded in your first month. Could you show a regulator, in under ten minutes, who approved them, what was checked, which screening hits came up and why they were cleared? If not, the gap is in the record, not the checks.

For global groups opening a UAE entity

If your group already runs compliance from head office, the question is a different one: how do you run the local obligations without building a separate process for one more licence? Group tooling often covers onboarding and screening well, but not the UAE sanctions lists and goAML reporting, the DFSA or FSRA return, the local MLRO's sign-offs, or the record the local regulator expects to see.

Where azakaw fits?

azakaw is one place to run onboarding, screening, monitoring and obligations, with every review and approval recorded as it happens. We're headquartered in Dubai, with teams across Abu Dhabi, Saudi Arabia and Qatar, and backed by j. awan & partners, with 500+ licence applications and 200+ compliance mandates behind it.