UAE National ML/TF Risk Assessment 2024 – Commentary by FCN

The public edition of the NRA runs to 72 pages and provides much needed information and gives a much better explanation of the threats and vulnerabilities faced by those in the UAE but with only some of the NRA available publicly any independent assessment of the full NRA is always going to be limited. Overall the UAE has called out ML threats as highest coming from predicate crimes that are expected. Drug trafficking and Fraud are rated highest followed by goods piracy, cash and gold smuggling, foreign corruption and tax evasion and then followed by human trafficking and environmental crimes, theft and robbery and currency counterfeiting and forgery. Terrorism finance and ML risk overall are also rated at medium high. Sector vulnerabilities are also identified. All these are now summarised in the FCN Country Financial Crime Dashboard.

The following are additional observations, to reflect upon –  which whilst referring directly to the UAE NRA are common and could be made about many NRAs, especially those produced based on the World Bank Model.

1 – This NRA is a big improvement on prior NRA extracts released in 2019 and 2021, and has involved all important stakeholders to generate this report. The highest threats and vulnerabilities appear entirely consistent with what should be expected. And take into account evolving threats and better understood vulnerabilities.

2 – Nevertheless, based on independent third party data i) human trafficking is perhaps under rated in the NRA, ii) people smuggling is not referred to at all, iii) environmental crime is included as medium risk reflecting the UAEs transit role in illegal wildlife trafficking, iv) domestic corruption is mentioned but largely dismissed and not rated which may be the prevailing view and is consistent with TI CPI ratings but may be a little complacent as every country has some level of domestic corruption no matter how strong its anti corruption credentials are v) proliferation finance is not covered by this assessment.

3 – It’s good that certain methods and or typologies such as TBML, 3rd party ML, OCG and Foreign Crimes are called out as being important typologies and trends. In a different way cash and gold smuggling, virtual currencies and domestic real estate and foreign corruption are also called out – all areas that are known relatively recent hotspots where attention has been directed but risks still remain and more is accepted as needs to be done.

4 – Some of the highest rated threats are described using the headline umbrella crime such as drug trafficking and fraud. It would be helpful to have sub types and to also rate these, so the threats are even better described. For example by including fraud, which can cover so much, but it’s assumed it mainly relates to retail and business scams, making this clearer would be helpful.

5 – For the vulnerabilities, risk rated highest are registered hawala, virtual assets and real estate followed by banks, exchange houses, precious metals and stones dealers and legal persons and arrangements. Whilst many of these sectors have improved their controls effectiveness, it’s not yet making it through to improved ratings under the NRA. For example in 2019 Banks control ratings were rated “ineffective” then in 2022 rated “partially effective” resulting in an improvement in overall residual risk from High to Med/High. The residual rating Med/High for Banks (outside the ADGM/DFSA) suggests control ratings have still not improved sufficiently for a rating improvement for controls effectiveness to “largely effective”. The same can be said of Exchange Houses, Finance Companies and Insurance, which appear to have control ratings at “partially effective” as was the case in 2022 with the same Med/High residual risk ratings given in 2024. Registered Hawala, also has the same “High” residual risk rating in 2024 as it did in 2022, so it’s likely the 2022 control effectiveness rating of “Ineffective” either still persists or has been improved to “partially effective”. For DNFBPs the 2022 residual risk ratings have not changed for real estate (High), but dealers in precious metals and stones have been re rated (from High to Med/High), suggesting controls have improved to “partially effective” or the inherent risk has reduced (from High to Med/High). A new inclusion are virtual assets rated in 2024 as High residual risk (which means that if inherent risk is high, controls are either “ineffective” or “partially effective” or if the inherent risk is Med High that controls are “ineffective”. A point to note about control effectiveness ratings, revealed by the NRA 2024 is that those entities operating in the DFSA and the ADGM have the best control effectiveness ratings and or overall residual risk ratings. Ideally showing ratings for all sectors, including breakdowns for inherent risk, controls effectiveness and residual risk would be very helpful, and even better comparing these to the 2022 and 2019 sector assessments would be very valuable. Whilst this information is likely available but not in the public edition, it is recognised that not all assessments are comparable especially when earlier work is not of the standard of later work and criteria and models may be different and or that this information can be included in specific sector risk assessments, which were produced in 2022 for example covering FIs and DNFBPs. Updating these and publishing this information would be recommended at a later date.

6 – As far as the origin of financial crime risk is concerned, which is one of the aims of the World Bank NRA model, the UAE reported that it’s major ML related threats come not from the UAE itself but from overseas. It has chosen not to identify these third countries in this public NRA, which is a shame. Whilst the UAE may be seen by some as a ML risk to other countries, especially as it’s a major trading, tourist and financial centre much like the USA, UK, France, Italy, Switzerland, Hong Kong, Singapore etc, other countries present a risk to the UAE by either generating significant proceeds and or trying to place, layer or integrate these proceeds into the UAE without a sufficient or effective response to prevent this. Traditional AML Country Risk Lists are unable to reflect country risk in these terms and do need to think more deeply about country risk, but countries should also help with releasing data to enable country models to reflect origin transit and destination risks for countries which will often be unique to that country.

7 – The function of the NRA are multifaceted, but establishing highest threats and vulnerabilities is it’s primary purpose. Still these ratings are a means to an end and any risk assessment should generate new insights and new actions. They should also lead to risk based actions to tackle high threats, vulnerabilities and risks. This may beyond the scope of the NRA itself, but AML policy leaders and supervisors as well as the supervised should be focussed on how to translate the findings from the NRA into prioritised actions. Eight (8) Priority actions are included in the NRA, but these are ones that predate the NRAs publication and were released with the updated AML Strategy last year. It is assumed the findings from the NRA were well known at this stage so have been fully taken into account.

8 – Whilst not included in the NRA, the inability of Private to Private (P2P) information sharing amongst those in the sectors is likely to increase the vulnerability of the sectors to ML/TF risk. The UAE has plans to consider acting in this space to follow other leading jurisdictions like the USA, Canada, the UK, the EU, Singapore and Hong Kong. Addressing this will reduce vulnerability and ought to be an additional important priority, and final plans released are expected.

9 – Nevertheless the main risks on ML, TF, Foreign Corruption & Foreign Crimes, Tax Crimes, Drug Trafficking, Fraud, TBML, Virtual Currencies. Organised Crime, Third Party ML, Goods Piracy, Cash and Gold Smuggling, Hawala and Virtual Currency is plenty to focus on and action both in the UAE and with international partners should be the focus, including taking action to confiscate criminal proceeds and target and extradite foreign criminals as it has been doing over the last few years.

10 – Whilst actions are welcome, especially when focussed on highest threats and vulnerabilities, there are no specific targets (which could be described as risk limits) set, for example to reduce threat ratings and or vulnerability ratings for particular sectors in a given period. No country does this so it’s not a specific UAE criticism and is more a general remark about ambition and measuring improvements and accountability, which applies to pretty much every country.

Finally, one of the main UAE risks albeit neither ML or TF relates to sanctions of course which is well understood but is rightly not covered in this NRA though is relevant for a broader risk Assessment. It should be noted that the UAE released its proliferation finance risk assessment in September 2024, and should be considered when it comes to PF risks.