What the Updated UAE Proliferation Financing National Risk Assessment Means for Regulated Firms

The recent publication of the updated UAE Proliferation Financing National Risk Assessment (‘PF NRA’) by the National Anti-Money Laundering and Combatting the Financing of Terrorism and Financing of Illegal Organizations Committee (‘National Committee’), pursuant to Decision No. (13) of 2026, serves as a timely reminder that Proliferation Financing (‘PF’) risk remains a regulatory consideration for all Relevant Persons, not only firms that directly handle customer funds.

In our experience, regulatory exposure in this area often arises not from intentional misconduct, but from insufficient translation of national risk findings into firm level controls. The updated PF NRA does not change the underlying legal framework, but it sets clear expectations on what firms must do, and what they must be able to evidence, in assessing and mitigating PF risk in practice.

PF Risk Is Driven by Exposure, Not Business Model

A common misconception is that PF risk is only relevant to banks or firms facilitating payments. This interpretation is not aligned with the UAE Anti-Money Laundering and Targeted Financial Sanctions (‘AML/TFS’) framework.

PF risk arises from whom firms deal with, where they operate, and how services are delivered, rather than whether they hold client money. Asset managers, advisers, Virtual Asset Service Providers (‘VASPs’) and Designated Non-Financial Businesses and Professions (‘DNFBPs’) may all be exposed through:

• customers or investors connected to higher risk jurisdictions
• complex ownership or control structures
• cross border investment activity
• reliance on custodians, intermediaries, or third-party service providers
• products or structures that could be misused to evade sanctions.

For regulators, these are not abstract risks; they are practical exposure points that must be addressed through systems and controls.

When National Risk Assessments Are Not Reflected Internally

A recurring theme in supervisory reviews is the disconnect between national risk assessments and internal firm frameworks. While many firms maintain comprehensive Anti-Money Laundering and Countering the Financing of Terrorism (‘AML/CFT’) policies, PF risk is often treated as implicit or assumed to be covered by sanctions screening alone.

Over time, this can result in:

• PF risks not being explicitly assessed or documented
• outdated risk assessments that do not reflect current NRA findings
• typologies not being incorporated into monitoring or escalation processes
• staff awareness remaining limited to theory rather than practical application.

From a regulatory perspective, these gaps represent weaknesses in risk management systems and controls.

Proliferation Financing Controls Are Not Theoretical — They Are Operational

The updated PF NRA places emphasis on how PF risks are mitigated in practice, including how firms identify sanctions evasion typologies, apply enhanced due diligence, and escalate concerns.

A key indicator of control effectiveness is whether a firm can clearly demonstrate:

• how PF risk has been assessed at business and customer level
• how PF considerations influence due diligence and onboarding decisions
• how suspicious behaviour linked to sanctions evasion would be identified and escalated.

Where this cannot be evidenced, firms may face increased regulatory scrutiny, regardless of their perceived risk profile.

Governance Must Remain Effective Under Scrutiny

Supervisory expectations around PF mirror broader AML governance expectations.

Effective frameworks are typically characterised by:

• clear senior management oversight of PF and TFS risks
• documented consideration of PF NRA findings
• periodic review and updating of PF risk assessments
• meaningful compliance challenge and escalation.

Where governance exists only in form, and PF risk has not been actively considered, regulatory risk increases significantly.

Practical Actions Firms Should Consider Now

The updated UAE PF NRA is best treated as a practical checkpoint: can the firm show that PF risk is understood, reflected in decisions, built into controls, and evidenced in a way that withstands supervisory review? Below are the actions that matter most.

1. Update the Firm’s PF Risk Assessment

• refresh the business-level PF risk assessment so it reflects the latest national findings and the firm’s actual services, client base, geographies, delivery channels, and third-party dependencies
• make the update specific to how the firm operates today (not a generic “PF is covered by sanctions“)
• record approval and ownership clearly, and state when the next review will occur.

Good evidence looks like: a dated PF risk assessment that references the updated national findings, includes firm specific exposure points, and shows clear approval and review timing.

2. Convert Typologies into Control Steps

• run a structured self-check to confirm PF and sanctions evasion typologies are translated into real control points across the client lifecycle
• update policies and procedures where needed, but focus on what happens in practice: onboarding checks, screening and verification steps, monitoring logic, alert handling, escalation triggers, and recordkeeping discipline
• ensure control owners can explain how PF risk would be recognised and what happens next.

Good evidence looks like: an updated onboarding and monitoring procedures, scenario or alert logic aligned to PF typologies, and case notes that show how concerns are assessed and escalated.

3. Apply Enhanced Due Diligence Where PF Risk Is Higher

• define clear triggers that prompt enhanced due diligence for PF risk, aligned to the firm’s risk profile
• make sure enhanced due diligence changes behaviour, not just paperwork: deeper verification, stronger approvals, additional checks, and closer monitoring
• document decisions and rationale so the firm can demonstrate how risk levels influenced outcomes.

Good evidence looks like: a documented trigger list, sample files showing enhanced steps were applied, approvals were obtained where required, and monitoring intensity increased where justified.

4. Make “Regular Updates” Real

• ensure the PF risk assessment and the related controls are reviewed and updated when there are material changes, such as new products, new markets, new client segments, new intermediaries, or changes to third party arrangements
• treat PF as part of the living compliance framework, not a static document.

Good evidence looks like: a simple change log showing what was updated, why, and when; plus, evidence that updates were communicated and applied.

5. Refresh Training So It Fits Roles and Real Scenarios

• provide targeted training to the people who touch risk decisions: onboarding staff, relationship teams, compliance, operations, technology support, and senior oversight
• focus on practical examples and what good escalation looks like, not just definitions
• keep attendance records and confirm understanding, especially for higher-risk roles.

Good evidence looks like: role-based training materials, attendance logs, and short scenario discussions or checks that show staff can recognise and act on PF red flags.

6. Pressure-Test the “Prove It” Question

Across all the above, the firm should be able to demonstrate, clearly and quickly:

• how PF risk was assessed at business level and, where relevant, at customer level
• how PF considerations change due diligence decisions
• how suspicious behaviour linked to sanctions evasion would be detected, escalated, and recorded
• how the firm knows the controls are operating consistently (not just documented).

These steps are not extra paperwork. They reflect what supervisors increasingly expect firms to have in place, and to be able to demonstrate with evidence.

Turning National Risk Signals into Regulatory Resilience

Firms that manage regulatory risk effectively treat NRA as early warning signals, not static publications. This typically involves conducting targeted gap analyses against current NRA findings, updating internal frameworks where gaps are identified, and ensuring PF considerations are embedded into day-to-day compliance and governance processes.

Some firms address this internally, while others seek external support to bring independent challenge, sector expertise, and regulatory insight without disrupting business operations.

In Conclusion

The updated UAE PF NRA reinforces a simple principle: effective PF control is demonstrated through implementation, not acknowledgment.

Firms that can clearly evidence how PF risks have been assessed, how controls operate in practice, and how governance supports ongoing oversight are significantly better positioned to withstand regulatory scrutiny.

Importantly, proportionate PF controls are not a barrier to business. When implemented effectively, they enhance credibility, strengthen resilience, and support long-term sustainable growth.

How Waystone Can Support Firms

Waystone supports regulated firms across the UAE in translating PF NRA findings into practical, proportionate controls. Our support includes PF risk assessment reviews, AML/CFT and CPF framework enhancement, typology integration, targeted training, and ongoing compliance advisory support.

For further information, please contact your Waystone representative or the Middle East Compliance Solutions Team.

Contact us