Why Authorised Firms Should Read the DFSA Audit Monitoring Report
Put simply, if your records are unclear, your reconciliations are weak, or your AML files do not tell a clear story, that does not just create an external audit issue. It creates a management, governance and regulatory risk.
The practical message for firms
The Report is a useful reminder that firms need to be audit-ready and regulator-ready at all times. That means being able to show, clearly and quickly, how key decisions were made, who reviewed them, what evidence supports them, and how issues were escalated and resolved.
For a DFSA Authorised Firm, the real question is: if someone reviewed the firm’s files, regulatory returns, governance packs or AML records tomorrow, would the evidence support what the firm says it does?
That is where internal audit can add real value.
Key areas firms should revisit
1. Regulatory returns
Regulatory returns should not be treated as a finance-only exercise. The figures submitted to the DFSA need to be supported by clear calculations, reconciliations, review evidence and appropriate sign-off.
Firms should be able to demonstrate a clear audit trail showing who prepared and reviewed each return, the source data used, how reported figures reconcile to management accounts or audited financial statements, whether any errors or late submissions occurred, and how any issues were identified, escalated and remediated.
This is particularly important for firms with capital monitoring obligations, Category 2 prudential requirements, or permissions to undertake Dealing activities.
2. AML business risk assessment
The AML business risk assessment should be more than a regulatory document that is updated annually. It should provide a clear and accurate assessment of the firm’s financial crime risk profile and demonstrate a comprehensive understanding of the money laundering, terrorist financing and proliferation financing risks arising from its business activities.
A robust assessment should reflect the firm’s business model, products and services, customer base, geographic exposure, delivery channels, and any reliance on group resources or outsourced arrangements. It should also consider sanctions and Targeted Financial Sanctions (‘TFS’) exposure, proliferation financing risk, relevant findings from the UAE National Risk Assessment, emerging money laundering, terrorist financing and the effectiveness of the firm’s control framework in mitigating those risks.
Most importantly, the AML business risk assessment should not exist as a standalone document. Rather, it should be reflected in the firm’s day-to-day operations and evidenced through its client onboarding processes, customer risk assessments, sanctions screening activities, alert management procedures and ongoing monitoring controls. The assessment should align with how the firm identifies, evaluates and manages financial crime risk in practice, rather than simply documenting its approach in theory.
3. Client file quality
Client files should provide a clear, complete and well-documented record of the firm’s understanding of its customers, together with the rationale supporting key decisions made throughout the customer lifecycle.
A well-maintained file should clearly demonstrate the identity of the customer, the ownership and control structure of the customer, the basis for the customer’s risk classification, the screening and verification checks undertaken, consideration of adverse media, Politically Exposed Person (‘PEP’) status and sanctions exposure, whether source of funds and/or source of wealth information was obtained and assessed, the approval process and relevant decision-makers, and the timing and requirements for ongoing review.
Where higher-risk customers, PEPs or complex ownership structures are involved, firms should maintain enhanced documentation and supporting evidence to demonstrate the customer due diligence performed, the risk assessment conducted and the rationale for the decisions reached.
4. Sanctions and screening controls
Having a screening system is only one component of an effective sanctions control framework. Firms should also be able to demonstrate that alerts are reviewed appropriately, escalated where necessary and closed with a clearly documented rationale.
From an internal audit perspective, firms should consider whether customers, beneficial owners and connected parties are subject to screening, whether ongoing screening is performed, whether sanctions list updates are captured in a timely manner, whether false positive decisions are supported by sufficient rationale, whether potential matches are escalated promptly, whether Executive Office for Control and Non-Proliferation (‘EOCN’) and IEMS alerts are actively monitored, whether screening backlogs are identified and reported to senior management, and whether screening logic and calibration are periodically reviewed to ensure they remain effective.
The focus should be on how the screening process operates in practice rather than simply confirming that a policy or procedure exists.
5. Training and awareness
Training records should demonstrate more than attendance. Firms should be able to evidence that employees have received training that is relevant to their roles and responsibilities, and that they understand how regulatory and financial crime risks apply to their day-to-day activities.
The content and depth of training should be tailored to the functions performed by different teams. For example, onboarding staff should receive practical training on Customer Due Diligence (‘CDD’) and beneficial ownership requirements, while front office personnel should understand key financial crime red flags and escalation procedures. Employees involved in dealing or execution activities should be aware of sanctions risks and how to identify unusual or suspicious instructions.
Scenario-based training, knowledge assessments and targeted refresher sessions following incidents, findings or regulatory developments can further help reinforce awareness and demonstrate the effectiveness of the firm’s training programme.
Why the DFSA Report matters for internal audit
The Report gives internal audit teams a useful lens for planning. It highlights areas where weak evidence, poor documentation or unclear ownership can quickly become regulatory concerns.
A focused internal audit review should not seek to replicate the work of external auditors. Rather, it should evaluate whether controls are operating effectively in practice and whether sufficient evidence exists to support management’s decisions and regulatory obligations.
For many firms, priority areas for review may include the AML business risk assessment, customer risk assessments and CDD files, Enhanced Due Diligence (‘EDD’) arrangements, PEP reviews, source of funds and source of wealth assessments, sanctions and TFS controls, SAR and STR escalation processes, AML training, prudential reporting, capital monitoring, governance and Management Information (‘MI’), as well as issue management and remediation activities.
How Waystone can help?
Waystone supports DFSA Authorised Firms through practical, risk-focused internal audit and assurance services tailored to their regulatory obligations and business activities. This may include reviewing the effectiveness of AML and sanctions frameworks, assessing customer due diligence and enhanced due diligence processes, evaluating governance and management information arrangements, and providing assurance over prudential reporting, capital monitoring and compliance monitoring programmes. We also assist firms with DFSA gap assessments, Annual AML Return readiness reviews and remediation validation to help ensure identified issues have been appropriately addressed.
Our approach is proportionate, evidence-led and focused on delivering practical outcomes. We work with firms to identify gaps early, strengthen control frameworks and enhance governance arrangements, helping senior management and the Board gain greater confidence that the firm is well prepared for regulatory engagement, external audit reviews and internal audit scrutiny.