---
name: draft-aml-policy
description: Use when asked to draft an Anti-Money Laundering (AML) and Know-Your-Customer (KYC) policy for a financial services or fintech business. Covers the mandatory components under FATF Recommendations and jurisdiction-specific frameworks (SAMA/KSA, UAE Federal, DFSA, ADGM/FSRA, DIFC, Lebanon BDL/SIC, EU 6AMLD, US BSA/FinCEN). P0 priority for regulated entities — incomplete AML policies are a regulatory enforcement trigger.
license: MIT
metadata:
  id: draft.AML-policy
  category: draft
  practice_area: regulatory
  jurisdictions: [KSA, UAE, DIFC, ADGM, LB, EG, EU, US, GCC]
  priority: P0
  intent: [aml policy, anti money laundering, KYC, MLRO, compliance, fintech]
  related: [draft-compliance-manual, draft-board-resolution, review-regulatory-compliance]
  source: Louis — HAQQ Legal AI (github.com/sboghossian/mini-claude-for-legal)
  version: "1.0"
---

# Draft — AML / KYC Policy

## When to use this

Use this skill when:
- A regulated entity (bank, NBFI, payment service, fintech, crypto exchange, law firm, real estate agent) needs an AML/KYC policy to satisfy licensing conditions or regulatory audit.
- An existing policy requires updating after a regulatory change (new FATF guidance, local amendment).
- A new business line or product triggers fresh AML obligations.
- An annual policy review is due.

This is a P0 skill. Inadequate AML policies are among the most common triggers for regulatory enforcement action in MENA, EU, and US jurisdictions.

## Required inputs

| Input | Why it matters |
|---|---|
| Entity scope | Which group entities are covered; subsidiaries require separate policies or a consolidated group policy |
| Regulatory jurisdiction(s) | Determines the specific framework; FATF baseline + local overlay |
| Business model | Transaction types, customer types, geographies — these drive the risk-based approach |
| MLRO designation | Money Laundering Reporting Officer identity and reporting line |
| Customer segments | Retail, corporate, institutional, PEPs, VASPs (virtual asset service providers) |

## Mandatory components

### 1. Policy statement
A clear commitment from the Board of Directors (or equivalent governing body) to:
- Comply with applicable AML/CFT (Counter-Financing of Terrorism) laws.
- Maintain a risk-based compliance program.
- Allocate adequate resources to AML compliance.

The policy statement must be signed by the Board or senior management and dated.

### 2. MLRO appointment
- Full name, title, and contact information of the Money Laundering Reporting Officer (MLRO) — or equivalent role (Compliance Officer, Designated Compliance Function).
- Reporting line: MLRO reports directly to the Board or a Board Committee; must not report through a business line that generates revenue.
- Deputy MLRO: designate a deputy for absence/incapacity.
- MLRO authority: can refuse a transaction, file an STR, or escalate without commercial pressure.

### 3. Risk-based approach (RBA)
The RBA is the foundation of the FATF framework. The policy must describe:
- **Business-wide risk assessment (BWRA)**: identify and assess the ML/TF risks inherent in the entity's products, services, customers, delivery channels, and geographic exposure.
- **Customer risk categorization**: segment customers into Low, Medium, and High risk tiers with criteria for each.
- **Risk scoring model**: document the factors used (customer type, geography, product, transaction behavior, PEP status, sanctions exposure).
- Review cycle for the BWRA: at least annually and after any material change to business model.

### 4. Customer Due Diligence (CDD)

**Standard CDD** (all customers):
- Verify identity using reliable, independent documentary evidence.
- For individuals: government-issued photo ID (passport, national ID), date of birth, address.
- For entities: certificate of incorporation, memorandum/articles, register of directors, ultimate beneficial owner (UBO) identification.
- **UBO threshold**: 25% ownership or control is the FATF standard; some jurisdictions use 10% or 20% — verify local rule.
- Understand the nature and purpose of the business relationship.
- Obtain source of wealth for high-risk relationships.

**Simplified CDD**: available for demonstrably low-risk customers (listed companies on regulated exchanges, regulated financial institutions, government entities) — document the rationale.

**Ongoing CDD**: monitor the business relationship; update records when there is a material change; apply periodic review based on risk tier.

### 5. Enhanced Due Diligence (EDD)

EDD must be applied to:
- **Politically Exposed Persons (PEPs)** — current and former; domestic and foreign; including family members and close associates.
- **High-risk geographic jurisdictions** — FATF grey-listed or black-listed jurisdictions; jurisdictions with known ML/TF risk (update list at least quarterly).
- **Cash-intensive businesses** — money service businesses, real estate, precious metals/stones.
- **Virtual asset service providers (VASPs)** — additional obligations under FATF Recommendation 15 and jurisdictional VASP regimes (VARA in UAE, ADGM FSRA).
- **High-value transactions** — above a defined threshold (jurisdiction-specific; commonly $15,000 / equivalent for wire transfers).
- **Complex or unusual transaction structures**.

EDD measures include:
- Additional identity verification.
- Senior management approval for account opening.
- Source of funds and source of wealth documentation.
- Enhanced ongoing monitoring.

### 6. Ongoing transaction monitoring
- Systems and processes to monitor customer transactions for patterns inconsistent with the customer's risk profile and stated business.
- **Threshold-based alerts**: transaction amounts above defined limits trigger review.
- **Pattern-based alerts**: structuring (breaking large transactions into smaller amounts to avoid reporting thresholds), unusual geographic patterns, unusually rapid movement of funds.
- Alert review process: triage, investigation, escalation to MLRO.
- Monitoring should be both automated (transaction monitoring system) and manual (relationship manager observation).

### 7. Sanctions screening
- Screen all customers, beneficial owners, and counterparties against applicable sanctions lists.
- **Lists to screen**:
  - UN Security Council Consolidated List.
  - OFAC (US Specially Designated Nationals) — required for USD transactions and US-connected entities.
  - EU Consolidated List.
  - UK HM Treasury Sanctions List.
  - Local lists (UAE CBUAE list, KSA SAFIU list, Lebanese counterterrorism list, etc.).
- **Screening frequency**: at onboarding; at each transaction where feasible; daily batch screening for name-list changes.
- **Match handling**: documented escalation procedure; freeze assets and report where required; seek regulatory guidance on complex matches.
- **Sanctions violations are strict liability** in most jurisdictions — no mental element required.

### 8. Suspicious Activity Reports (SARs / STRs)
- **Filing obligation**: when the MLRO has knowledge or suspicion (or reasonable grounds for suspicion) that a transaction involves proceeds of crime or ML/TF.
- **Filing authority**: MLRO is the sole person authorized to file; staff report suspicions internally to MLRO.
- **Tipping-off prohibition**: it is a criminal offense in most jurisdictions to disclose to the subject that a SAR has been filed.
- **Jurisdiction-specific filing**:
  - UAE: goAML platform (Central Bank UAE).
  - KSA: Financial Investigation Unit (FIU), Saudi Ministry of Interior.
  - DIFC: DFSA.
  - ADGM: FSRA.
  - LB: Special Investigation Commission (SIC), Banque du Liban.
  - EU: national FIU of member state.
  - US: FinCEN via BSA e-filing.
- **Time limits**: typically 30 days from becoming aware of the suspicion; faster for urgent matters.

### 9. Record retention
- **Standard period**: 5 years from end of business relationship or transaction (FATF baseline).
- **Extended periods**: some jurisdictions require 7–10 years (verify local rule).
- **What to retain**: CDD documentation, transaction records, STR/SAR filings, correspondence, training records.
- Records must be retrievable within a reasonable time for regulatory inspection.

### 10. Staff training
- **Annual mandatory training**: all staff must complete AML/CFT training annually; records maintained.
- **Role-specific training**: front-line staff (onboarding, relationship management), compliance team, senior management.
- **New hire training**: AML training within first 30 days of employment.
- Training must cover: red flags, SAR filing procedure, tipping-off prohibition, sanctions, and the firm's specific risk profile.

### 11. Independent audit and testing
- Annual independent review of the AML program (internal audit or external third party).
- Testing should cover: CDD quality, transaction monitoring effectiveness, SAR filing completeness, sanctions screening accuracy, training records.
- Findings and management responses documented; tracked to remediation.

## Jurisdictional overlay — key specifics

| Jurisdiction | Primary framework | Key regulator | Notable requirements |
|---|---|---|---|
| **KSA** | AML Law (Royal Decree M/20 2003, amended) + SAMA Rules | SAFIU; SAMA | Zakat-based entities have modified requirements; designated non-financial businesses (DNFBPs) regulated |
| **UAE Federal** | Federal Decree-Law 20/2018 on AML/CFT + CBUAE regulations | CBUAE; goAML | 60-day registration on goAML required; DNFBP register |
| **DIFC** | DFSA AML Module (AMI) | DFSA | Periodic AML returns filed with DFSA; DFSA AML inspections |
| **ADGM** | FSRA AML Rulebook | FSRA | Alignment with DIFC/DFSA approach but separate filing |
| **LB** | Law 44/2015 (AML/CFT) + BDL circulars | Special Investigation Commission (SIC) | Banks: enhanced CDD on cash transactions; STRs to SIC |
| **EU** | 6th AML Directive (6AMLD) + national implementation | National FIU | Cross-border information sharing; criminal liability for legal persons |
| **US** | Bank Secrecy Act (BSA) + FinCEN rules + PATRIOT Act | FinCEN; federal banking regulators | CTRs for transactions >$10,000; CIP rules; beneficial ownership rule |

## Critical for fintech and virtual assets

- **VARA (UAE)**: Virtual Assets Regulatory Authority in Dubai — VASP license requires dedicated VASP AML policy on top of standard AML program.
- **ADGM FSRA**: Virtual Asset Framework — specific CDD and ongoing monitoring for virtual asset businesses.
- **FATF Travel Rule (Recommendation 16)**: transfers of virtual assets above USD 1,000 / EUR 1,000 must be accompanied by originator and beneficiary information; the implementing jurisdiction's threshold may differ. Technology implementation (TRISA, OpenVASP, or similar) must be operational.
- **Real-time monitoring**: fintech transaction monitoring must handle high velocity and 24/7 operations; static rule-based systems are often insufficient; behavioral analytics expected.

## Implementation checklist

- [ ] MLRO appointed, mandate documented, reported to regulator where required
- [ ] Board-approved policy in place, signed, dated
- [ ] Business-wide risk assessment completed and documented
- [ ] CDD procedures in place with UBO identification
- [ ] EDD procedures defined for PEPs, high-risk jurisdictions, VASPs
- [ ] Sanctions screening tool operational with at minimum UN + OFAC + local lists
- [ ] Transaction monitoring system operational (automated alerts + manual review)
- [ ] SAR/STR filing procedure documented; MLRO trained
- [ ] Staff training delivered; records retained
- [ ] Independent annual review scheduled
- [ ] Record retention system in place for 5–7 years

## Related skills

- [[draft-compliance-manual]]
- [[draft-board-resolution]]
- [[review-regulatory-compliance]]