Accountants and auditors in the UAE who work with small and medium enterprises are classified as designated non-financial businesses and professions under the AML Law and carry a legal obligation to identify and report suspicious indicators. The obligation is not passive: it requires active assessment of client transactions and relationships against specific risk indicators. Recognising what constitutes a red flag in practice is a compliance requirement, and failure to report carries penalties.
Transaction-Level Red Flags
The following transaction patterns represent commonly identified red flags in SME accounts that require further inquiry and, where reasonable suspicion persists, a suspicious transaction report.
Cash transactions in unusual volumes. A business that regularly receives or pays large cash amounts, particularly in amounts just below regulatory reporting thresholds, warrants attention. Structuring, the deliberate splitting of transactions to avoid reporting thresholds, is itself a red flag and a potential criminal offence.
Payments to or from jurisdictions on FATF or UAE watchlists. Transactions with counterparties in high-risk or non-cooperative jurisdictions identified by the FATF or the UAE Cabinet require enhanced due diligence. The existence of such transactions does not necessarily indicate money laundering, but it requires investigation and documentation of the commercial rationale.
Round-number transfers without supporting documentation. Payments or receipts in round numbers, particularly where no invoice, contract, or other document explains the commercial purpose, are a recognised indicator. The absence of documentation supporting a payment is itself a risk indicator.
Rapid movement of funds through accounts. Funds that enter a business account and are immediately transferred to other accounts, with no apparent business purpose for the intermediate holding, may indicate that the account is being used to layer funds rather than for genuine business operations.
Transactions inconsistent with the stated business. A trading company that receives payments with descriptions inconsistent with its stated business, or that makes payments to counterparties unrelated to its sector, warrants examination. The nature of the transaction should match the nature of the business.
Customer and Counterparty Red Flags
Reluctance to provide identification or beneficial ownership information. A client who is unable or unwilling to provide identification documents, or who provides documents that cannot be verified, is a significant red flag. The inability to identify the ultimate beneficial owner of a corporate client is a basis for declining or terminating the relationship.
Unexplained wealth relative to stated business activity. A client whose financial position appears inconsistent with their stated business activity, or whose source of funds cannot be explained by reference to their known business, requires inquiry. Accountants and auditors who become aware of such inconsistencies during the course of their work have a responsibility to document their assessment.
Politically exposed persons without enhanced due diligence. Clients who are politically exposed persons (PEPs) or who are closely associated with PEPs require enhanced due diligence under UAE AML regulations. Treating PEP-connected clients as ordinary relationships is a compliance failure.
Responding When Red Flags Are Identified
When a red flag is identified, the accountant or auditor must make a judgment about whether the indicator gives rise to reasonable suspicion. This is a judgment call that must be documented. If reasonable suspicion exists, a suspicious transaction report must be filed through the goAML platform. The report must be filed regardless of whether the suspicious transaction was completed.
Filing an STR does not amount to an accusation. It is a report to the Financial Intelligence Unit that allows them to assess the information. The confidentiality of STR filings is protected under the AML Law, and tipping off the client about an STR filing is itself a criminal offence.
Where a red flag can be resolved through additional documentation or explanation, the explanation and supporting documents should be retained on the client file. If the explanation is satisfactory, no STR is required, but the documented assessment protects the accountant or auditor in the event the matter is later reviewed by regulators.