What does CPF stand for?
Countering Proliferation Financing: preventing funds from supporting the proliferation of weapons of mass destruction. The 2025 UAE framework expressly covers it alongside money laundering and terrorist financing, so complete policy sets are AML-CFT-CPF, not AML-CFT alone.
Is a written AML policy legally required?
Yes. Regulated businesses must maintain internal policies, controls and procedures proportionate to their risks, approved by senior management, and produce them to the supervisor on request.
Why not use a template?
Because supervisors read them instantly: wrong law cited, risks that do not match the business, procedures nobody follows. Template-only documentation appears repeatedly in published enforcement, and the fine dwarfs the drafting fee saved.
Does the work start with the risk assessment?
Yes, deliberately. The law requires controls proportionate to the business's risks, so the EWRA is written first and every policy clause traces back to it, which is also the logic an inspector applies.
How long does the initial set take?
Typically two to four weeks depending on the complexity of the business and how quickly information flows, with the timeline fixed at scoping.
What happens after the documents are delivered?
Board approval, a team walkthrough, and an annual review cycle. Training and inspection-readiness support follow naturally where wanted, from the same team that drafted the set.
