The MoET ML/TF/PF Risk Assessment Data Collection Process
If you are a regulated real estate entity that falls within the DNFBP category, the MoET annual ML/TF/PF risk assessment data collection process applies to you. At the end of December or in early January, you will receive an email from “amlra@economy.ae” with the subject line “MOET ML/TF/PF Risk Assessment Data Collection process”.
This guide covers all four sectors the Ministry supervises. It explains what the survey is, what it asks, how to prepare and what is at stake if you get it wrong.
Key Facts at a Glance
What is the MoET ML/TF/PF risk assessment data collection process?
The Ministry of Economy – Anti-Money Laundering Department invites UAE DNFBP sectors to participate in the ML/TF/PF risk assessment data collection process. The process collates money laundering, terrorist financing and proliferation financing data from every DNFBP sector, in accordance with Clause (1) of Article (16) of Federal Decree-Law No. (10) of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, and Clause (1) of Article (49) of Cabinet Resolution No. (134) of 2025 on its Executive Regulations.
In practice, the annual ML/TF/PF risk assessment survey is an online questionnaire that MoET requires the businesses it supervises to complete each year. You log in, report facts about your customers, products and services, jurisdictions, onboarding processes, transaction volumes and internal controls, and submit before the deadline.
MoET survey vs BWRA vs goAML registration
These are three different obligations, and none replaces the others. The survey is the Ministry’s form, on the Ministry’s deadline, for the Ministry’s purposes. Your business-wide risk assessment (BWRA or BRA) is your own document, based on your own methodology, and your policies and controls must be built on it. goAML is the platform on which you register to file suspicious transaction reports. Submitting the survey does not discharge your own assessment, and a good assessment does not mean the survey has been filed.
Who must submit the survey?
Every business that the Ministry of Economy and Tourism supervises for AML purposes. That means four groups:
- Dealers in precious metals and stones: jewellers, refineries, gold traders and bullion dealers.
- Real estate agents and brokers: firms that broker the sale and purchase of property.
- Company and trust service providers: firms that set up or administer companies and trusts for clients.
- Independent accountants and auditors: firms that prepare for or carry out specified financial transactions for clients.
Size does not exempt you. A single office with one compliance officer still has to submit; the answers are simply shorter than a large firm’s. If you hold a licence for a covered activity and the Ministry supervises you, the form applies.
Not sure if this survey is yours to file?
We confirm your scope in one call.
What the Ministry Asks
The Ministry collects this information to check whether your business is complying with the requirements. The question set is revised from cycle to cycle, so treat the list below as the shape of the form rather than a field-by-field guide, and read the current form before you start. Expect questions in six areas:
- Your customers: How many you have, what types, how many are companies rather than individuals, how many are based outside the UAE, and whether any are politically exposed persons.
- Your products and services: Which of your activities fall inside the AML rules, and the size and number of transactions running through them.
- Your geographies: The countries your customers, counterparties and payments come from and go to, and your exposure to high-risk-listed countries.
- Your delivery channels: Whether you onboard face to face or remotely, and whether you use agents, introducers or intermediaries.
- Your volumes and values: Transaction counts and amounts for the reporting period, usually in dirhams, and how much of it is cash.
- Your controls and governance: Whether you have a compliance officer, written policy, risk assessment, training records and screening arrangements, and how many suspicious transaction reports you filed.
Almost every answer should already be in your own records. If you have a current risk assessment, the questions about customers, products, geography, and channels are easy to answer. You just look them up. If you do not have one, you will have to guess under deadline pressure. Those guesses will go on the Ministry’s file with your name on them.
How the data collection workbook is organised (FY 2026 cycle)
What takes the most work in your sector
The core form is the same for everyone. What changes is which answers take the most work and how many questions you see. In the FY 2026 cycle, the form had more than 300 questions. The exact number depends on your sector and business, because the form branches. If you answer yes to one question, several more open up. A number quoted on another website is that firm’s count for one sector in one cycle. It is not your count.
The survey cycle: period, deadline and extensions
If anything below differs from the Ministry’s notice, the notice prevails.
Which reporting period does each survey cover?
Reporting opens in January, after the Ministry issues its notice. The survey always looks back at the financial year that has just closed, so the figures you report are last year’s, not this year’s to date.
What is the submission deadline?
No date is set until the Ministry issues its notice. The window normally stays open for about 30 days, so the deadline usually falls in late January or February. Treat that as a planning assumption, not a date, and confirm it from the notice.
Will the Ministry extend the deadline?
That depends on the Ministry. Do not wait for an extension. Start early and submit your data on time.
The notice lands in January. The window is short.
We prepare and file the whole submission.
What happens if you file late, incompletely or inconsistently
There are three separate risks, and people do not understand them equally well:
- Missing the deadline: This is a failure on your record. It is also the easiest risk to avoid. It usually happens because the notice goes to the wrong person, not because someone decides not to file.
- Filing incomplete or guessed answers: Numbers made up in a rush stay on the Ministry’s file. If a later inspection finds different numbers in your own systems, you will have to explain the difference instead of talking about the risk.
- Filing answers that do not match your own documents: This is the most harmful of the three, and the one people talk about least. It suggests that your records cannot be trusted, or that you filled in the survey without looking at them.
Penalty exposure
Late submission, inconsistency, or failure to file the annual ML/TF/PF risk assessment can result in a warning, a fine of not less than AED 10,000 and not more than AED 5,000,000 per violation, a sector bar, restriction or suspension of the responsible people, suspension of the activity, licence revocation, publication of the penalty, and an increased fine on recurrence within a year under Article 17(3).
How the process works, step by step
Now that you know what the survey is and what is at stake, here is how the process works in practice: what to gather, how to prepare your answers, how to submit, and what to do afterwards.
What documents and data do you need before you start?
Gather these ten things: your trade licence and ownership records, customer register, due diligence and screening files, records of politically exposed persons, data on the countries you deal with, transaction numbers and values, cash figures, the number of suspicious transaction reports, policy and training records, and last cycle’s submission. If you have them, filling in the form is just copying. If you do not, you will spend a week guessing.
How to prepare your answers from your own records
Answer the survey from your documents, not from memory. Some firms find this hard because they open the form in the last week of January and start guessing. Other firms find it easy because they copy the numbers from records they already keep. Four sources do most of the work:
- Your customer register: The number of customers, how many are individuals and how many are companies, how many are outside the UAE, and any politically exposed persons you have flagged.
- Your own risk assessment: The countries you deal with, your products, and how you deliver them. This should already be done. If it is up to date, most of the survey is just looking up answers.
- Your transaction records: The number and value of transactions, and the share paid in cash, for the reporting period.
- Your compliance file: The date of your policy, your training records, how you screen customers, and the number of suspicious transaction reports you filed.
Then do the one thing most firms skip. Before you submit, compare your draft answers with your own risk assessment.
Here is an example. The survey says most of your customers are low risk. But your own risk assessment says your biggest risk is high-risk buyers who live outside the UAE. Now you have given the Ministry two answers that do not match, and your name is on both.
Supervisors do compare the two. Answers that do not match are a much worse start to an inspection than a high number that you report honestly.
If you do not have a current risk assessment, the survey will show this quickly, because its questions assume you have one. Build the risk assessment first. Then fill in the survey from it. This is also cheaper than doing both in a rush before the deadline.
Our business risk assessment service can do the assessment for you.
We then use it as the source for your submission.
Logging in and submitting on the Risk Assessment Portal
Where do I log in?
The survey is on the Ministry’s Risk Assessment Portal. The address has stayed the same in every cycle, so bookmark it. What changes is how you get access. With each notice, the Ministry sends you login details or a way to register. Always follow the instructions in your latest notice.
Sometimes the notice goes to a person who has left the company, or to an email address that nobody checks. Then you may not hear about the survey until after the deadline. Keep the contact details on your licence up to date. Also make sure more than one person sees every message from the Ministry.
The submission process
1
Watch for the notice. Check that the contact details on your licence are up to date. Tell the person who gets the Ministry’s messages to pass them on right away.
2
Open the current form. Read the whole form before you answer anything. Then you will know what data you need.
3
Collect your numbers for the reporting period. You need the number of customers, the number and value of transactions, the countries you deal with, and the number of suspicious transaction reports you filed.
4
Write your answers from your records. Use your risk assessment, customer register, and transaction reports. Do not use memory.
5
Ask senior management to review the answers before you submit. After you submit, the answers are on the record. They should match your own documents.
6
Submit, then save your proof. Keep the confirmation, a copy of your answers, and the date. A supervisor may ask to see them.
What if you did not receive the survey link?
Contact MoET and ask for it. Do not wait until the deadline has passed. Do not assume the survey does not apply to you just because you did not get a notice. The most common cause is an old contact address on your licence, so update it at the same time.
What if the questionnaire shows the wrong sector?
Stop and tell the Ministry before you answer. If the form is for the wrong sector, it asks the wrong questions. If you answer it, you put wrong information on your record. Contact the Ministry, explain what activity your licence covers, and ask for the correct form.
What happens after you submit?
Submitting the survey is not the end of the cycle. Keep one file for each cycle. Put in it the notice, your login details, your completed answers, the submission confirmation, and the date. This takes only a few minutes. If a supervisor asks what you told the Ministry and when, you can show them the file. If you do not have it, you will have to remember your own submission from memory.
If the Ministry asks for clarification
Use the same records you used for your first submission. Do not make a new guess. If your new answer does not match your first answer, that is worse than the original gap. Keep all messages about this in your cycle file.
If a response is returned for resubmission
Fix the exact point the Ministry raised, and resubmit within the time they give you. Then check the rest of your answers for the same mistake. One flagged answer often means there is a problem in your data that affects other answers too.
How long should you keep the file?
Keep each cycle’s file for at least as long as your other AML records. Cabinet Resolution No. 134 of 2025, Article 25 says you must keep transaction and dealing records for at least five years. You must also give them to the supervisor quickly when they ask. A supervisor may ask to see several years of submissions at once.
Frequently Asked Questions
Yes, if the Ministry supervises your business. The law says every supervisory authority must assess the risk of money laundering, terrorism financing, and proliferation financing in the businesses it supervises [Federal Decree-Law No. 10 of 2025, Article 16(1)]. The survey is how MoET does this. No article names the survey itself, so the duty and the deadline come from the Ministry’s notice. If you do not file, it is a supervisory failure on your record.
Your supervisory authority issues it, not the law. For most designated businesses, this is MoET. Each cycle, MoET sends the notice, the form, and the deadline.
Yes. It happens once a year. It opens in January after the Ministry sends its notice, and it covers the financial year that just ended. This is separate from your own risk assessment. The law says you must keep that one up to date at all times.
The survey is the Ministry’s form. You complete it by the Ministry’s deadline so the Ministry can see the risk across the whole sector. Your own risk assessment is your own document, built with your own method. The law says you must identify, understand, manage, assess, and record your business risks, and keep them up to date. You must also keep the risk assessment study and give it to your supervisor if they ask [Federal Decree-Law No. 10 of 2025, Article 19(1)(a); Cabinet Resolution No. 134 of 2025, Article 5]. You need both. Filing one does not replace the other.
In the FY 2026 cycle, there were more than 300. But there is no fixed number. The number depends on your sector, your business, and your situation, and the form opens new questions as you answer. Plan for the data you need, not for a number of questions.
Only as a starting point, and only if you check every number. The reporting period is different. Your customers and volumes have probably changed. The form also changes from cycle to cycle. If you submit last year’s figures for this year, a supervisor can spot the mismatch easily.
Your compliance officer usually prepares it. Senior management should review the answers before you submit. The form has no signature section, unlike some returns from other regulators. But the answers still bind your firm. Treat them like anything else you send to your supervisor in the firm’s name.
It is a supervisory failure on your record. You may also face the normal AML penalties. Administrative penalties are from AED 10,000 to AED 5,000,000 for each violation. You may also get warnings and limits on your licence [Federal Decree-Law No. 10 of 2025, Article 17].
You submit online, using the route in the Ministry’s notice for that cycle. Open the form, answer it, and submit before the deadline. There is no paper option and no permanent link.
No. goAML is the reporting system of the Financial Intelligence Unit (FIU). You register there and file suspicious transaction reports. Article 18 of Federal Decree-Law No. 10 of 2025 says you must send these reports to the FIU without delay, using the electronic system it sets. The survey is a different thing. It is a supervisory questionnaire about your whole business. Registering on goAML does not file the survey. Filing the survey does not register you on goAML.
The UAE rules now cover money laundering, terrorism financing, and proliferation financing together. Regulated businesses must deal with all three [Cabinet Resolution No. 134 of 2025, Article 5]. Whether the Ministry’s form uses the words “proliferation financing” depends on the questionnaire for that cycle, so read the current form. Your own risk assessment should cover it in any case.
Yes. The answers are still your firm’s answers, and you are still responsible for them. So choose a provider who works from your records, not from a conversation. We prepare the survey, compare it with your own risk assessment, and help with any questions from the Ministry.
How AML360 helps
You now know what the survey asks and how the process works. This section explains who should prepare your submission and how AML360 supports you at each stage, from scoping to follow-up.
Who should prepare your submission?
Your compliance officer can do it. An outside firm can also do it for you. Either way, the answers are your firm’s answers, and you are still responsible for them. So the real question is: who has the records, the time, and the good judgement in January?
Firms usually ask us for help for one of three reasons:
- They do not have a current risk assessment to answer from.
- They have a risk assessment, but they are not sure the survey answers will match it.
- The notice has arrived, and there is not enough time left to do the work well in-house.
If you are choosing a provider, three questions show you which ones are good:
- Will you answer from our records, or ask us to describe our business? Answers taken from a conversation will not match your own files when someone compares them.
- Will you compare the survey with our own risk assessment? This check stops the most harmful kind of mistake. Most providers skip it.
- Will we be able to do it ourselves next year? A good provider leaves you with a process you can repeat and a list of the data you need. You should not have to depend on them.
We have completed more than 500 annual ML/TF/PF risk assessment surveys. Our sector benchmarks and data checklists come from this work. The pattern is always the same: the answers already existed, but they were spread across different systems, and nobody had read them together before.
How We Can Help with Your MoET Survey
Our service helps you prepare the survey, check your data, compare your answers with your own risk assessment, and file the survey. Most providers skip the comparison step. It makes sure your answers do not go against your own records.
1
Check if the survey is yours to file: We check your licence and the activities it covers. Then we confirm whether the Ministry’s survey applies to you.
2
Collect your data and evidence: We give you one clear list of what we need. We do not send many follow-up emails.
3
Prepare the survey: We write every answer from your records. We tell you about any answer your records cannot support.
4
Compare with your risk assessment: We read your draft answers next to your own risk assessment. We fix every difference before we file.
5
Review pack for management: This is a short summary. Your senior managers can approve it without reading the whole form.
6
Submit and keep your proof: We file the survey. Then we give you the cycle file with the notice, answers, confirmation, and date.
7
Help if the Ministry asks questions: If the Ministry comes back to you, we answer from the same records. We do not make a new guess.
Prepare your response
Your answers must match the reporting period, activities, and records of the business that the Ministry invited to respond.
We start with the current questionnaire. We check the business, sector, period, and instructions in your invitation. Then we match each answer to your records: customer data, transactions, staff, training, and compliance. If information is missing, we ask the person responsible for it. We do not fill gaps with guesses.
Your business risk assessment (BWRA) supports the survey, but the survey is a separate task. It asks for its own data.
Check the data behind your survey
Customer numbers and transaction figures are often different in your finance, onboarding, and operations systems. Before we enter any data in the survey, we check that the numbers match.
First, we agree on what the questionnaire means by active customers, transactions, risk categories, and the reporting period. Then we find the reason for any big differences. We remove double counting where it is right to do so. We also write down how we handled any information that was missing or not available.
You receive three things for your approval: a table of the checked figures, a list of where each figure came from, and a log of any exceptions. This means the same agreed figures are used everywhere in the survey.
Please send us the current survey and the records that relate to it. Then we can check the exact questions it asks.
Help with Corrections and Follow-Up Questions
If you find a mistake after you submit, you need to explain it clearly and correct it in a controlled way. We help your team understand the problem and answer any questions from MoET. We use the current instructions and the communication route that MoET allows.
We compare the submitted answer with your records. We find other answers that are linked to it, and we check whether any other answers are affected. Your response shows the correct information and the proof for it. It does not hide the original mistake.
You receive three things: a table of corrections, a draft explanation, and a tracker for what you submit and what the authority says back. We keep the original response and the record of who approved it.
Do not assume you can change a submitted survey through the original form. Whether you can change it depends on the portal and the authority’s instructions.
Example: a real estate brokerage
The deal register did most of the work. We took the number of buyers and sellers, the value of transactions, and the number of buyers from outside the UAE from the deal register and the accounting records. We used the real estate activity report filings to double-check the reported transactions. This way, the survey and the goAML filings told the same story.
Will your answers match your own records?
Send us both, and we will find the gaps first.