AML Policy Drafting for DPMS in the UAE: Compliance Requirements and Solutions

Drafting an AML policy for a Dealer in Precious Metals and Stones (DPMS) means building a documented, risk-based framework showing regulators how your business detects and reports money laundering through high-value metals and gems. In the UAE, DPMS businesses are Designated Non-Financial Businesses and Professions (DNFBPs) under Federal Decree-Law No. (10) of 2025, and the compliance trigger for most obligations is a single transaction or linked series at or above AED 55,000. The policy must reflect your actual customer base, product mix, delivery channels, and geographic exposure.

What a DPMS AML Policy Must Actually Cover

A workable policy addresses governance, risk assessment, customer due diligence, reporting, record-keeping, and training. The table maps each component to the DPMS concern it resolves.

Start With the Business Risk Assessment, Not the Template

The most common drafting mistake is starting from a generic template and forcing the DPMS business into it, producing a document that passes superficial review but fails supervisory inspection because the risk assessment does not match the actual trade.

A DPMS risk assessment should distinguish product categories. Loose high-carat diamonds, gold bullion, and investment-grade stones carry materially higher money laundering risk than finished costume jewellery or low-value silver items, because they concentrate value, are easily transported, and trade in secondary markets with limited traceability. Customer risk rises with cash-intensive buyers, politically exposed persons, customers from high-risk jurisdictions, and third-party payers. Channel risk increases with cross-border wire transfers, courier delivery, and cash payments just below the AED 55,000 threshold.

The threshold deserves careful drafting. UAE guidance treats covered transactions as those at or above AED 55,000, whether a single transaction or linked transactions that appear structured. A policy triggering CDD only at the threshold invites structuring risk. Experienced compliance officers draft explicit rules for identifying and aggregating linked transactions, such as repeated purchases by the same customer within a short period or split payments across multiple invoices.

CDD, EDD, and the Onboarding Workflow

The policy should define two onboarding workflows: one for covered transactions and one for non-covered transactions. For covered transactions, it must require identification, verification, beneficial ownership where relevant, and a sanctions and PEP screen before completion. For non-covered transactions, a lighter identification check may be acceptable, but the policy should still capture enough data to detect linked transactions over time.

Enhanced Due Diligence applies where the customer, product, or jurisdiction is high risk. The policy should specify what EDD means in practice: additional source-of-funds evidence, senior management approval, closer transaction monitoring, and possibly a documented rationale for proceeding. Vague language such as “apply enhanced measures where appropriate” is a common supervisory finding.

Reporting, Record-Keeping, and goAML

The UAE Financial Intelligence Unit operates the goAML portal, and DPMS entities must register and file Suspicious Transaction Reports, Suspicious Activity Reports, and the DPMS-specific report type (DPMSR) through it. The policy should name who is authorised to file, the internal escalation path, and the expectation that reporting happens without delay once suspicion forms. Delaying a report to gather more evidence is a recurring failure.

Record-keeping obligations generally run five years, covering identification documents, transaction records, and internal reports. The policy should state where records are stored, who can access them, and how they are produced for a supervisory request.

Governance, Training, and Policy Ownership

A named Compliance Officer is the single most important governance element. The policy should define that person’s authority, not just their title, including access to records, staff, and senior management. Training should be role-specific: sales staff need to recognise red flags in customer behaviour, while back-office staff need to understand documentation standards and reporting triggers. Annual refresher training with a short assessment is currently minimum practice for DPMS.

Firms lacking in-house expertise often engage external support for AML policy drafting, registration, and training. ADS Auditors, for example, works with UAE businesses on AML Registration, AML Policy Framework, and AML Training, and can help DPMS operators align documentation with supervisory expectations under the 2025 legislative framework.

Common Drafting Mistakes to Avoid

• Copying a policy written for a real estate agency or law firm; DPMS risks are product-specific and trade-based.

• Setting the CDD trigger exactly at AED 55,000 with no linked-transaction rule.

• Naming a Compliance Officer who has no operational authority or time allocation.

• Writing EDD as a principle rather than a procedure with named controls.

• Ignoring the goAML registration and reporting workflow until an STR is actually needed.

• Treating the policy as a one-time document rather than a living framework reviewed after regulatory changes or business shifts.

Practical Next Steps

Begin with a documented business risk assessment reflecting your actual inventory, customer types, and payment channels. Draft the policy around that assessment, not a template. Define the AED 55,000 threshold logic explicitly, including linked-transaction aggregation. Name the Compliance Officer and give that role real authority. Build the goAML reporting path into the policy, and schedule role-specific training with a refresher cycle. If internal resources are limited, consider external support to review the draft against current UAE supervisory expectations before it goes live.

Book your aml registration today