AML And RegTech In The UAE

Hala Harb Associate hala.harb@bsabh.com

Rima Mrad Partner rima.mrad@bsabh.com

The growing concern for transparency and need for reporting indicates a stronger mission to combat Money Laundering activities. Today, regulators in every part of the world are preoccupied with developing frameworks and procedures to uncover illicit funds. Their position has drastically moved from a reactive to a proactive one reflected through the issuance of various regulations pertaining to Anti-Money Laundering (AML) and Terrorism Financing (TF). This has resulted in onerous and cumbersome obligations on financial institutions, Designated Non-Financial Businesses and Professions (as further explained below), and any entity subject to the AML reporting obligations (the “Reporting Entities”). 

Failure to comply with the ever-growing AML requirements, will subject Reporting Entities to hefty penalties and reputational damages. Mindful of the serious implications resulting from money laundering activities, Reporting Entities are relying on Regulatory Technology (RegTech) to ensure utmost compliance with AML regulations and mitigate their risks. RegTech is becoming indispensable particularly in the lack of available human resources in the AML industry coupled with a growing demand of financial services. 

The United Arab Emirates (UAE) is showing rising interest in combatting money laundering activities through the use of RegTech as further described herein.

AML Legal Landscape in the UAE

UAE Mainland
The UAE has reaffirmed in recent years its commitment to combat money laundering and counter terrorist financing notably with (i) the introduction of AML legislations since 2018, (ii) the establishment of a National Committee to oversee the implementation of AML legislations and (iii) the creation of an anti-money laundering reporting platform under the name of “goAML”.

While the AML legal framework in the UAE is characterized with 4 pillars of legislations, the main piece of legislation is Federal Decree-Law No. 20/2018 On Combating Money Laundering Crimes, the Financing of Terrorism and the Financing of Unlawful Organisations (the “AML Regulation”). Furthermore, the UAE Central Bank regularly issues circulars to provide further guidance to the application of the AML Regulation.

For example, in line with international standards and following the recommendations of the Financial Action Task Force, the UAE has issued Circular No.3/2020. Pursuant to such circular, the UAE has started applying higher scrutiny on Designated Non-Financial Businesses and Professions (DNFBPs) which play an important role in controlling the flow of funds.

DNFBPs include activities involving brokers and real estate agents, dealers in precious metals and precious stones, trust and company service providers, auditors, accounting service providers and lawyers. DNFBPs are exposed to several risk areas relating to money laundering and terrorist financing and as such must follow elaborated customer due diligence processes and comply with hefty record keeping requirements.

Financial Free Zones
It is worth noting that Financial Free Zones such as the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) are also subject to the federal AML Regulation in addition to developing their own AML framework which should be read in conjunction with the federal AML Regulation.

For instance, the DIFC has put in place the DFSA AML Rulebook and relies on its own regulatory body, The Financial Crime Prevention Team to oversee financial crime risks and ensure compliance with all AML legislations, rules and requirements that apply in the DIFC.

As for the ADGM, the federal AML Regulation is complemented by the Anti-Money Laundering and Sanctions Rules and Guidance (AML) and overseen by the ADGM’s financial regulator, the Financial Services Regulatory Authority (FSRA).

What is RegTech?

In light of the above, Reporting Entities are on the lookout for time and cost-efficient processes to comply with their regulatory obligations and have found RegTech to come in handy. RegTech (short for Regulatory Technology) is the use of a software application by companies to manage regulatory compliance through various technologies such as automation, use of big data artificial intelligence and machine-learning technology.

One of the areas RegTech provides solutions for is AML compliance. As previously explained above, AML represents all efforts to detect and prevent financial crimes.

We have seen a worldwide rise in the use of RegTech, including in the UAE. This is because, traditional compliance teams and manual processes are no longer sufficient for real time monitoring of financial activities, notably digital payments. This have pushed Reporting Entities to rethink their existing approach to AML compliance.

We note that, in addition to private companies, governmental entities responsible for overseeing AML operations have been heavily relying on RegTech as well. As such, RegTech presents 2 main angles: supporting regulators in overseeing AML compliance as well as supporting Reporting Entities in monitoring their financial operations and completing their filings.

Consequently, the recourse to RegTech has become more and more crucial and has gained popularity in recent years considering the benefits it offers. The main goal of RegTech, among others, is to solve the challenges arising from a technology-driven economy.

For example, some RegTech companies offer their users a Screening Software for their “Know Your Customer” and “Customer Due Diligence” procedures required to onboard client. These procedures are a common obligation under worldwide AML regulations to identify the customer’s risk level depending on various components. For instance, it is crucial to determine if a client is subject to a sanctions list, PEP list or adverse media publications. Considering the extensive research required for this assessment and the massive volume of data available in this regard, manual controls have become almost impossible. Screening Softwares were created to address these difficulties and provide automated means to conduct the assessment.

Furthermore, an attractive feature of a RegTech software is the ability to create a centralized information storage. That way, Reporting Entities can manage their filings and ensure everything is accounted for in a centralized location which reduces the risk of incorrect data or lost data.

Another interesting aspect offered by advanced RegTech tools is providing alerts about relevant regulations. This is particularly important considering the constant changes in AML regulations by helping users stay up to date with any legislation developments.

In addition to the KYC and Customer Due Diligence requirements, financial institutions (including fintech firms) have higher AML burden as they are also required to monitor their customers’ transactions and flag any fraudulent or suspicious flow of money. For that purpose, RegTech offers Transaction Monitoring tools to assist companies in monitoring transactions that take place online in real-time to identify issues or irregularities in the digital payment sphere. 

RegTech in the UAE

The increasing popularity of RegTech has been witnessed globally, including in the UAE. In fact, various initiatives have been taken by the private sector as well as the public sector to promote the use of RegTech for AML compliance purposes.

For instance, the Abu Dhabi Global Market (ADGM) has announced that it has started using a RegTech software to automate its license applications. This software identifies and immediately clarifies information and risk gaps in license applications.

The Dubai International Financial Centre (DIFC) has also expressed its interest in RegTech by hosting various events and workshops around regulatory compliance using innovative technologies.

The electronic-Know-Your-Customer (e-KYC) utility project launched in 2018 is also a prominent initiative by the DIFC, the ADGM and multiple leading financial institutions in the UAE . This initiative aims to develop a blockchain-based e-KYC solution that would provide financial institutions with a single location where customer identification and verification can be performed once for a customer.

Given the public sector’s enthusiasm towards RegTech, Global RegTech players have now expanded into the UAE market. In addition, there are several home-grown RegTech players which were recently introduced to the market.

In the presence of multiple RegTech players in the market, how can Reporting Entities select the right RegTech software? Upon selecting their RegTech providers, Reporting Entities are advised to evaluate the following criteria:

(i) Ongoing Support: When reviewing agreements with RegTech service providers, Reporting Entities must be cautious about the service level agreement offered and the RegTech’s response time in case of performance issues. This is particularly important as AML monitoring is a 24/7 requirement and any downtime of the software may open doors to fraudulent transactions. Companies must therefore carefully evaluate their agreements with RegTech companies to ensure that a satisfactory service level agreement is provided for.

(ii) Testing & Flexibility: Given the infancy of RegTech, Reporting Entities must be able to test the RegTech software before committing to a long-term agreement with the service provider. Testing is crucial to ensure that the selected software is in line with the business needs. Furthermore, there are no one-size fits all models that can accommodate the needs of those looking to comply with AML Regulations. As such, RegTech providers must be flexible and able to customize the software on a case-by-case basis depending on the operational needs of the customer. As such, Reporting Entities are advised to negotiate the inclusion of a testing phase in their agreement, during which the RegTech supplier must adapt the RegTech features to the customers’ needs.

(iii) Cost: Reporting Entities are different in size and operation. The costs associated with the adoption of a RegTech software must be reasonable and proportionate to the AML risks. For example, the RegTech budget of a medium sized law firm should be considerably lower than that of a leading financial institution.

(iv) Regular Software Updates: Considering the fast and continuous changes in the AML regulatory landscape, the selected RegTech service provider must be able to update its software on a regular basis to ensure that the features offered are in line with the evolving requirements. 

Conclusion

Reporting Entities are strongly advised to keep a watchful eye on their AML systems and turn to RegTech to remedy the lack of human resources impediment, reduce time and costs of compliance by automating routinely tasks. 

In our opinion, RegTech has a promising and broad future in the region, more specifically in the UAE. In fact, UAE regulators have become leaders in integrating cutting-edge technology to promote efficiency. Their appetite to embrace technology is backed by considerable fundings and the government’s mission to keep-up with technological developments.

In light of the welcoming and favourable environment to RegTech in the UAE, more and more investors are injecting capital in RegTech start-ups which have now reached funding records worldwide. 

While there is no doubt around the benefits of RegTech in the AML world, one should keep in mind that RegTech relies, among others, on Artificial Intelligence (AI) and that AI’s success depends on the data entry provided. 

This means that, to improve the likelihood for successful results, Reporting Entities must record their data on the RegTech software. Such data entry must be as accurate and precise as possible. Otherwise, the results provided by the RegTech software may be misleading and incorrect. Consequently, the employment of qualified human resources remains essential to operate the RegTech software and optimize its performance. 

As a final thought, we note that there are no specific licenses or regulations in the UAE overseeing the establishment and operations of RegTech providers which currently hold a general technology license. Given the stakes at hand, we anticipate regulators to interfere and impose certain conditions on RegTech entities.


This article was originally written for and published by IFC Review .