The Abu Dhabi Global Market (ADGM) Registration Authority (RA) has published its Common Findings Report for 2025, drawing on the results of 35 AML/TFS onsite assessments conducted across Designated Non-Financial Businesses and Professions (DNFBPs) during the year. The report addressed directly to all DNFBPs operating in ADGM, identifies persistent weaknesses and sets out clear supervisory expectations for remediation. 

The message from the RA is unambiguous: having policies and procedures on paper is no longer enough. What the regulator is looking for is demonstrable, consistently applied, and genuinely effective compliance. 

A Broader and More Intensive Review from ADGM 

The 2025 assessment programme covered 35 firms, up from 32 in 2024, spanning the full range of DNFBP sectors in ADGM: company service providers (CSPs), legal professionals, real estate agents, auditors, accountants, dealers in precious metals and stones, and dealers in high-value goods. As of 31 December 2025, the RA supervises close to 400 DNFBPs in total. 

Each assessment resulted in a Risk Mitigation Plan (RMP), and notably, all RMPs issued during 2025 were completed by the relevant firms within agreed timelines – a positive sign of industry responsiveness. However, the findings themselves point to systemic gaps that go well beyond individual firms. 

The Four Recurring Problem Areas 

1. Business Risk Assessments: Still Not Fit for Purpose 

Business Risk Assessments (BRAs) continue to be a major area of concern. Under Chapter 6 of the ADGM AML Rules, firms are required to identify and assess money laundering, Terrorist Financing (TF), and Proliferation Financing (PF) risks proportionate to their size, nature, and complexity. 

In practice, the RA found that several firms failed to assess Targeted Financial Sanctions (TFS) risks as a distinct component, instead folding them into broader money laundering assessments – an approach that limits the effectiveness of sanctions risk identification and mitigation. Others had BRAs that were simply out of date, with limited evidence of periodic reviews to reflect changes in business activities, customer profiles, or the broader financial crime environment. 

The RA’s expectation is clear: BRAs must be reviewed at least annually and updated in response to trigger events such as new products, regulatory changes, or emerging ML/TF risks. Version control and formal board or senior management sign-off are also required. 

2. Customer Risk Assessments: Inconsistency Undermining CDD 

Customer Risk Assessments (CRAs) are the foundation of proportionate customer due diligence, yet the RA found widespread inconsistency in how firms approach them. Some firms used unclear or inconsistently applied methodologies, leading to the misclassification of customer risk and the application of inappropriate levels of due diligence. Key risk factors – such as jurisdiction, ownership structure, and the nature of the business relationship – were not always adequately considered. 

The RA expects CRAs to be conducted prior to onboarding, regularly reviewed, and updated whenever material changes in customer behavior or risk indicators arise. A CRA that is accurate at onboarding but never revisited is not compliant. 

3. Enhanced Customer Due Diligence: Declarations Are Not Evidence 

Enhanced Customer Due Diligence (Enhanced CDD) is required under Chapter 8 of the ADGM AML Rules for higher-risk customers, including politically exposed persons (PEPs) and those from high-risk jurisdictions. Here, the RA identified a critical and recurring flaw: firms relying on customer-provided declarations to verify source of funds and source of wealth, without obtaining independent corroborating evidence. 

In some cases, documentation obtained was simply not sufficient to demonstrate how a customer accumulated their wealth. Additionally, a number of firms failed to consistently obtain senior management approval before onboarding high-risk clients – a basic governance control that the RA treats as non-negotiable. 

The supervisory expectation is that Enhanced CDD must go beyond self-declaration. Independent or reliable evidence must be obtained, and senior management must be visibly involved. 

4. Annual AML/TFS Reviews: Tick-Box Exercises Won’t Suffice 

Chapter 4 of the ADGM AML Rules requires firms to review the effectiveness of their AML/TFS frameworks at least once a year. The RA found that in several cases, this review either did not take place at all, or was treated as a procedural formality with little evidence that controls were substantively tested for real-world effectiveness. 

Equally concerning, some firms failed to formally report review outcomes to senior management, undermining governance and oversight at the highest level. 

The RA expects annual reviews to be substantive, evidence-based, clearly documented, and formally reported upward. Where deficiencies are found, a structured remediation plan must follow. 

What the ADGM RA Expects Next? 

The RA has recommended that all DNFBPs conduct a risk-based self-assessment against the findings in this report within three months of receipt. Where gaps are identified, firms must document and implement a remediation plan with senior management oversight. Where no remediation is required, firms may still be asked to provide evidence that a self-assessment was conducted. 

Most firms have the right frameworks in place, but too many fall short when it comes to applying them in practice. With the RA committed to a risk-based, outcomes-focused supervisory approach and enforcement action firmly on the table for material non-compliance – the 2025 findings report is both a diagnostic tool and a warning. For ADGM-supervised DNFBPs, the window to self-correct is now.