AML Compliance in the GCC: 10 Questions Compliance Officers Ask

A compliance officer in any Gulf financial institution works across three layers: international standards, national legislation that keeps changing, and the supervisor’s regulations. In the past two years all three have changed. This article answers ten questions that come up constantly in compliance work, with the latest developments.

Part one: the framework

1. What is the international reference for AML?

The reference is the Recommendations of the Financial Action Task Force (FATF): 40 recommendations that form the international standard for combating money laundering, terrorist financing and proliferation financing. GCC countries are members of FATF or of the Middle East and North Africa FATF (MENAFATF), and their regimes are evaluated against these recommendations.

2. What changed in the FATF Recommendations recently?

In February 2025 FATF amended Recommendation 1 and its interpretive note. Countries must now allow and encourage simplified measures in lower-risk situations, and the word “commensurate” was replaced with “proportionate” throughout the Recommendations. The aim is to reduce over-compliance that excludes people from financial services.

3. What is new in the UAE?

The UAE issued Federal Decree-Law No. 10 of 2025 on anti-money laundering, combating the financing of terrorism and proliferation financing, which repealed and replaced Federal Decree-Law No. 20 of 2018. Highlights include:

• The maximum fine for legal persons rose to AED 100 million, from AED 50 million.
• A new offence of providing false or misleading beneficial ownership information.
• Personal liability for managers who knew of the offence or whose breach of duty led to it.
• Some offences, such as tipping off, may carry fines with no upper limit.

4. And what is new in Saudi Arabia?

The Saudi Anti-Money Laundering Law was issued by Royal Decree No. (M/20) dated 2/2/1439H. On 17 April 2026 the Council of Ministers approved amendments, including a new article making the Permanent Committee for Combating Money Laundering responsible for developing and reviewing national risk-based AML policies, including risks linked to high-risk countries. The amendments also allow confiscation of funds disproportionate to lawful income unless a lawful source is proven.

Part two: daily practice

5. What does the risk-based approach mean in practice?

It means the institution does not treat all customers the same way. It assesses risk by customer, product, channel and geography, then focuses effort where risk is highest. Since the 2025 amendment, proportionality works in both directions: stricter where risk is high, simpler where it is low.

6. What are the steps of customer due diligence?

Identify the customer and verify their identity from a reliable source, identify the beneficial owner, rate the risk, monitor the relationship continuously, and finally report suspicious transactions and keep records for the period set by law.

7. Why is beneficial ownership now the focus?

Because intermediate companies and complex structures are the most common way to hide who really owns the money. The new UAE law makes false beneficial ownership information a standalone offence, raising the responsibility of those who collect and verify it.

8. When must a suspicious transaction be reported?

When there is suspicion, or reasonable grounds to suspect, that funds are proceeds of crime; certainty is not required. The report goes to the country’s financial intelligence unit through its designated channel. The amount does not have to be large; the pattern matters.

9. Can the customer be told about the report?

No. Tipping off is prohibited and exposes both the employee and the institution to liability. Front-line staff must be trained to handle customers without revealing the suspicion.

10. What do inspectors ask about most?

Usually three things: whether the risk assessment is current and reflects the institution’s real business, whether high-risk customer files are complete, and whether staff are trained and know when and how to escalate a suspicion internally.

Conclusion

International standards are moving towards proportionality, while GCC legislation is moving towards tougher penalties and personal accountability. A successful compliance officer combines both: an accurate risk assessment, proportionate measures, and a trained team that knows its role.