The CBUAE bi-annual compliance report: the evidence behind each section
For exchange houses licensed by the Central Bank of the UAE, 31 October is a fixed point in the calendar. It’s the last day for the compliance officer’s bi-annual compliance report, covering the six months to 30 June, to reach the Central Bank.
By the time it’s sent, most of the work is done. The report was prepared and was approved. What decides its quality was settled earlier still: whether the evidence behind each section existed while the work was happening.
This article covers what the report is, what it has to contain, how to prepare it, and what’s at stake if it’s late, missing or wrong.
What the report is
The bi-annual compliance report is set out in Chapter 16 of the CBUAE’s Standards for the Regulations Regarding Licensing and Monitoring of Exchange Business, at rule 16.30. Its purpose is to assess how effective the exchange house’s AML/CFT policies, procedures, systems and controls are at preventing money laundering and the financing of terrorism.
It’s prepared twice a year, for the six-month periods ending 30 June and 31 December. It isn’t a form to fill in. It’s the compliance officer’s own assessment of the period, approved by the people who are ultimately responsible for the firm.
Who prepares it, approves it and receives it
The compliance officer prepares it. The Board of Directors approves it, or the owners or partners where there’s no Board. Both names matter: the report is the compliance officer’s account of the period, and the Board’s approval makes it the firm’s position.
The timeline for each period runs like this:
Step | First half (to 30 June) | Second half (to 31 December) |
|---|---|---|
Period closes | 30 June | 31 December |
Report goes to the Compliance Committee and the Board | Within one month: by 31 July | Within one month: by 31 January |
Board approves the report and adds its comments | Before submission | Before submission |
Copy reaches the Central Bank, with the Board’s comments | Within four months: by 31 October | Within four months: by 30 April |
Rule 16.30.5, which is in force, says the copy goes by email to the Banking Supervision Department (info.ehs@cbuae.gov.ae) and the AML/CFT Supervision Department (amlcft@cbuae.gov.ae).
What it has to contain
Rule 16.30 lists 12 items. Grouped by the evidence they need, they fall into four sets.
Risk and control
An assessment of the ML/FT risks facing the business and how well the controls work; a gap analysis against the AML/CFT programme, laws, regulations, notices and the Standards, with the steps taken to close each gap; and the AML/CFT breaches noted in the latest Central Bank examination report and in internal or external audit reports. Suggested supporting evidence: a current risk assessment with its date and approver, and a log of every breach and finding with what was done about it.
Activity
Internal suspicious disclosures by employees, and how many were investigated, closed, kept open for monitoring or reported to the FIU as suspicious transaction reports; and the suspicious transactions the compliance officer detected through independent monitoring and reported to the FIU. Suggested supporting evidence: counts that can be traced back to individual disclosures, alerts and reports, not totals typed into a template.
People and policy
The AML/CFT policies and procedures reviewed or changed, and any new ones introduced; staff statistics, covering total headcount, new joiners, staff trained, and staff not trained with the reasons; and weaknesses in the training programme with proposed improvements. Suggested supporting evidence: version history for each policy, and attendance records that tie a named employee to a session and a date.
Judgement and plans
Recommendations to the Manager in Charge and the Board; requests for additional staff, systems, controls or technology; an action plan for the next six months, with the status of the previous period’s plan; and the compliance officer’s conclusion on how effective the AML/CFT function is. Suggested supporting evidence: everything above. The conclusion is only as credible as the record it rests on.
How to prepare it
A report that holds up starts from records, not memory. A practical sequence for each period:
Close the period cleanly. Fix the cut-off at 30 June or 31 December, so every count in the report covers the same six months.
Pull the numbers from the source. Disclosures, STRs, monitoring alerts, training attendance and policy versions should come from the systems where the work happened, with a way to trace each total back to the cases behind it.
Reconcile against findings. Check the breaches listed against the latest Central Bank examination report and every internal or external audit report. A finding that’s missing from the report is harder to explain than one that’s listed with its remediation.
Update last period’s action plan. Item 11 asks for its status. Mark each action as done, in progress or dropped, with the reason.
Write the conclusion last. The effectiveness conclusion should follow from the evidence above it, not lead it.
Leave time for governance. The report has to reach the Compliance Committee and the Board within one month, and the Board’s comments travel with it to the Central Bank. Build the Board meeting into the timeline rather than waiting for the next scheduled one.
What happens if it’s late, missing or wrong
The Standards are explicit that exchange houses must comply with all of their requirements at all times, and that the Board, or the owners or partners, is ultimately responsible for that compliance. A bi-annual report that isn’t submitted, arrives late, or doesn’t reflect what actually happened is a breach of the Standards in its own right.
The Central Bank’s response can sit at several levels:
Under the Standards, the Central Bank can impose non-compliance charges, levied separately for each non-compliant item, and can suspend or revoke a licence for breaches of the Standards, applicable laws or its notices. Major non-compliance can also lead it to refuse a licence renewal or grant a shorter term.
Under the federal AML law, Federal Decree by Law No. (10) of 2025, the supervisory authority can impose a warning, a fine of AED 10,000 to AED 5,000,000 per violation, restrictions on the powers of board members or managers, suspension of responsible individuals, suspension of the activity, or revocation of the licence. Repeated violations within a year can attract incremental fines, and penalties can be published.
At the next examination, the report is a starting point. A report that lists no breaches when the examination finds several, or statistics that don’t match the underlying records, raises questions about the whole AML/CFT function, not just one document.
That’s why accuracy matters as much as the deadline. A report submitted on time with numbers that can’t be traced is a weaker position than most compliance officers realise.
Where the time goes
For most compliance teams, the writing isn’t the slow part. The slow part is reconstruction: finding out how many alerts were closed in March, which staff missed the April training, and whether the policy change in May was approved before or after it took effect.
When that information sits in different systems, inboxes and spreadsheets, someone has to rebuild it. The rebuilt numbers then become the official ones, which is uncomfortable if they don’t match what an examiner later pulls from the source.
Three questions to ask before the next period closes
The second-half period closes on 31 December. Three questions are worth asking now, not in January:
Can every number in the report be traced to a record? Each statistic should be traceable to the underlying records.
Is each decision recorded when it’s made? A note written at the time is evidence. A note written for the report is a recollection.
Could someone else write the report? If only the compliance officer knows where everything is, the firm has a single point of failure in the role that signs.
Where azakaw fits
azakaw is one place to run onboarding, screening, monitoring and obligations, with the review, the decision and the evidence recorded as the work happens. That means the record behind a report like this one already exists by the time the report is due.
