Regulatory Compliance & Governance Oversight

• Ensure the exchange house is fully compliant with CBUAE guidelines, AML/CFT regulations, sanctions requirements, and financial crime prevention policies.
• Serve as the primary point of contact with the CBUAE, FIU (goAML portal), external auditors, and other regulatory authorities.
• Maintain and continuously update the Compliance Manual, AML/CFT Program, and internal procedures in line with CBUAE circulars, notices, and FATF standards.
• Ensure timely response to all regulatory queries, inspections, and information requests.
• Submit periodic Compliance Reports to the Owner/Senior Management as required.
• Document evidence of implementation of all regulatory updates and staff communication.

AML/CFT Responsibilities

· Develop, implement, and monitor the organization’s AML/CFT risk-based framework across all branches and services.

· Ensure proper execution of KYC, Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), and periodic KYC reviews for all customer categories.

· Oversee real-time and batch screening for sanctions, PEPs, and adverse media.

· Supervise daily transaction monitoring and ensure alerts are reviewed, investigated, and escalated appropriately.

· Approve onboarding of high-risk clients, PEPs, and corporate entities.

· Investigate suspicious transactions and file reports via the goAML portal, including:

o STR – Suspicious Transaction Reports

o SAR – Suspicious Activity Reports

o CMNR

o FFR

o Any other mandatory filings

· Maintain full audit trail of STR/SAR submissions and all correspondence with the FIU.

· Ensure sanctions matches are immediately escalated, frozen, or rejected in line with UAE TFS requirements.

Risk Management & Internal Controls

· Conduct periodic compliance risk assessments covering customer, country, product, and channel risks.

· Develop and maintain a Compliance Risk Register with identified gaps and mitigation actions.

· Assess compliance risks related to new products, systems, and processes before implementation.

· Coordinate with Risk & Anti-Fraud and Internal Audit functions to test controls and review findings.

· Ensure all audit and risk findings are documented, assigned to responsible owners, and closed within defined deadlines.

· Identify and mitigate gaps in operational and financial compliance processes.

· Oversee internal control testing and remediation follow-ups.

Training & Awareness

· Develop and execute an Annual Compliance Training Plan for all employees.

· Deliver induction training to new joiners within their first week of employment.

· Conduct refresher and targeted training for frontline staff on AML/KYC, sanctions, consumer protection, and fraud prevention.

· Provide specialized training following regulatory updates or new CBUAE circulars.

· Maintain comprehensive training attendance logs, assessment results, and certification records.

· Evaluate training effectiveness through post-training assessments, scenario testing, and spot checks.

· Identify training gaps and report them to the Owner/Senior Management.

· Ensure continuous professional development of the compliance team, with a minimum of 48 hours of mandatory annual training.

Reporting & Recordkeeping

• Submit all mandatory reports to the CBUAE accurately and within required timelines.
• Prepare and submit reports including:

o Monthly/Quarterly AML reports

o Semi-Annual Compliance Report

o Regulatory Implementation Reports

o Consumer Protection Returns

o Business activity reports (FX, remittance, WPS volumes)

o AML team role change notifications

• Maintain a complete audit trail of all compliance activities including:

o KYC files and customer records

o STR/SAR submissions

o Training logs and assessments

o Regulatory correspondence

• Prepare documentation and represent the organization during regulatory inspections and audits.

Technology & Systems Compliance

• Ensure proper configuration of Remitex or any core system to support compliance (e.g., user access control, transaction limits, automated alerts).
• Oversee implementation and efficiency of screening software (e.g., NameScan, World-Check).

Supervisory & Leadership Duties

• Supervise the Compliance Officers.
• Assign daily responsibilities and monitor completion of tasks.
• Escalate high-risk cases to senior management with recommendations.
• Foster a culture of integrity, accountability, and ethical behavior.

Daily Tasks:

• Review high-risk transactions flagged by the system.
• Approve or escalate unusual remittance or currency exchange activities.
• Follow up on missing KYC documentation or expired IDs.
• Respond to compliance-related queries from staff or management.
• Monitor GoAML portal for updates, messages, or feedback on STRs.

Key Skills:

• Strong knowledge of UAE regulatory framework and international AML standards (FATF, OFAC, UN).
• Excellent analytical and investigative skills.
• Leadership and staff management ability.
• High attention to detail, especially in documentation and reporting.
• Proficiency in compliance tools and reporting portals (Remitex, GoAML, screening software).

Compliance Monitoring & Testing

· Develop and implement an Annual Compliance Monitoring Plan covering all branches.

· Conduct thematic reviews on FX, remittance, WPS, and corporate customers.

· Monitor and review KYC files, CDD/EDD records, and sanctions alerts for compliance accuracy.

· Perform branch visits and on-site compliance testing of staff AML awareness.

· Maintain and update the findings of remediation plans.

Consumer Protection

· Follow the consumer protection reporting lines/submissions to the owner and regulator

Decision-Making Authority

· Approve or reject high-risk onboarding cases.

· Freeze, block, or reject transactions in case of sanctions matches or AML suspicions.

· Escalate matters directly to Owner, CBUAE, or FIU without interference.

· Authority to demand immediate corrective action across all departments.

Senior Management Accountability

· Explicitly state that the CCO holds ultimate responsibility for the design and effectiveness of the AML/CFT program, independent of operations.

· Confirm direct escalation rights to the Owner without interference.

Targeted Financial Sanctions (TFS) & Freeze Governance

· Add responsibility for immediate freezing, blocking, and reporting of assets related to sanctioned persons/entities.

· Maintain and test a sanctions escalation protocol, including regulatory response times.

GoAML System Administration

· Oversee the organization’s goAML portal administration and user access management.

· Ensure segregation of duties for report creators, reviewers, and approvers.

· Monitor the portal for FIU feedback, requests for information, and regulatory updates.

· Conduct periodic reconciliation between internal STR/SAR logs and FIU acknowledgment receipts.

· Ensure timely response to FIU inquiries and maintain documented communication trails.

Outsourcing & Third-Party Compliance Risk

· Review and approve due diligence for third-party agents, outsourcing partners, and fintech integrations, etc..

· Ensure AML clauses and data-protection obligations are embedded in all vendor contracts.

Regulatory Change Management

· Monitor issuance of CBUAE circulars, notices, FATF updates, and immediately update policies/procedures.

· Document evidence of implementation and staff communication.

Independent Testing & Second-Line Assurance

· Commission independent testing of the AML/CFT framework (by Internal Audit or external consultants).

· Present results to the owner with corrective action plans.

MIS & Compliance Analytics

· Generate compliance dashboards (STR volumes, turnaround time, sanctions hits, complaint closure timelines).

· Benchmark performance against regulatory expectations and peer exchange houses.

Supervising Reporting Line

· The Internal Auditor reports directly to the Board or Audit Committee and maintains functional independence; therefore, operational reporting or hierarchical linkage to the Compliance Officer is not permitted. While the Compliance Officer may coordinate with Internal Audit for information or access.

Compliance Committee Oversight

· Establish and maintain a Compliance Committee to oversee regulatory adherence, compliance risk, and remediation actions.

· Ensure mandatory participation of the General Manager, Compliance team, and relevant functional heads at least quarterly.

· Oversee the preparation, review, and formal approval of meeting minutes, ensuring that discussions, decisions, and action items are accurately documented and tracked to closure.

Employee Conduct and Workplace Policies

· Mobile Phone Usage

The use of personal mobile phones during working hours is strictly prohibited unless explicitly authorized by a supervisor for work-related purposes. Mobile devices must be kept silent or turned off during duty hours to maintain focus and professionalism.

· Communication & Confidentiality

Employees are not permitted to contact clients, vendors, or other third parties using personal phones, nor are they allowed to share personal contact details (e.g., phone number, email, social media). All communication must go through official company channels to ensure confidentiality and protect company data.

· Punctuality

Employees are expected to arrive at work on time and be prepared to begin duties at the scheduled start of their shift. Repeated lateness or failure to adhere to work schedules may lead to disciplinary action. Consistent punctuality reflects professionalism and respect for the team and company operations.

· Personal Hygiene and Grooming