How to Maintain Sanctions Screening Records for UAE AML Audits

Sanctions screening is an important part of anti-money laundering (AML) and counter-terrorism financing compliance in the United Arab Emirates (UAE). Businesses must have appropriate procedures to identify potential matches against applicable sanctions lists, investigate alerts and take the required action when a match is identified.

However, having a screening system is not enough. Businesses must also maintain reliable records that demonstrate how screening was performed, how alerts were investigated and why particular decisions were made.

During an AML audit or regulatory inspection, incomplete records can make it difficult to demonstrate that sanctions controls are operating effectively. A business may have investigated an alert correctly but still struggle to provide evidence if the investigation was not documented properly.

This guide explains how UAE businesses can maintain sanctions screening records, build a clear audit trail and prepare supporting evidence for compliance reviews.

Why Are Sanctions Screening Records Important?

Sanctions screening records provide evidence that a business has implemented its applicable targeted financial sanctions (TFS) controls. They help compliance teams demonstrate that screening results were reviewed and that potential matches were handled according to the relevant procedures.

The UAE Central Bank's guidance on targeted financial sanctions highlights the importance of screening relevant customers and transactions, investigating potential matches and maintaining appropriate records. Other supervisory authorities may issue requirements specific to the entities they regulate.

Well-maintained records can help businesses:

Demonstrate compliance with applicable UAE AML/CFT and targeted financial sanctions requirements.
Explain why a potential match was confirmed or cleared as a false positive.
Show whether an alert was escalated to the appropriate compliance officer.
Verify that required reporting, suspension or freezing measures were considered and implemented.
Identify weaknesses in screening systems and investigation procedures.
Respond efficiently to internal audits, external audits and regulatory information requests.

Record keeping should therefore be integrated into the sanctions screening process rather than treated as an administrative task completed afterwards.

What Sanctions Screening Records Should Businesses Maintain?

The exact records required depend on the entity's sector, regulatory authority, risk exposure and applicable legal obligations. As a practical starting point, businesses should consider maintaining the following categories of evidence.

1. Screening Activity and Results

Maintain records showing when screening took place, what information was screened and what results the system generated.

Relevant records may include:

Screening date and time.
Customer, beneficial owner, counterparty or transaction reference.
Name and identifiers used during screening.
Applicable sanctions list or data source.
Screening system or process used.
Potential matches and other alerts generated.
Relevant system logs and screening outcomes.

These records help demonstrate that screening controls were applied at the appropriate stages of the customer relationship or transaction process.

Businesses should also retain evidence of relevant rescreening activities when sanctions lists change or customer information is updated, where required by their procedures and applicable rules.

2. Potential Match Investigation Records

When a screening system identifies a potential match, the compliance team should document the investigation.

The investigation file may include:

The original alert and matching information.
The name and identifying details of the listed individual or entity.
Information used to compare the customer or counterparty with the listed party.
Differences in identifiers, such as date of birth, nationality, registration details or other available information.
Supporting documents and reliable information sources reviewed.
The investigator's findings and rationale.
The date of review and the person responsible for the decision.
Details of escalation, approvals and follow-up actions.

The explanation should be specific to the case. A brief note stating "not a match" may not adequately demonstrate why an alert was cleared.

For example, if two individuals have similar names but different verified dates of birth and other identifying details, the investigation record should explain which reliable information supports the conclusion. The evidence must be relevant to the case rather than based on assumptions.

3. False-Positive Decisions

A false positive occurs when screening generates an alert because information appears similar to a sanctions-list entry, but the investigation establishes that the customer or transaction is not the listed party.

Businesses should document the basis for clearing such alerts. The record should identify the information compared, the differences found and the reason the decision was considered appropriate.

Where required, a reviewer should verify the decision before the alert is closed.

Consistent documentation is especially important when the same or similar names generate repeated alerts. It can help authorised staff understand previous decisions and determine whether updated information requires another review.

A previous false-positive decision should not automatically be reused if customer details or sanctions-list information have materially changed.

4. Confirmed and Unresolved Matches

Potential matches require careful handling. A business should not automatically classify every alert as a confirmed sanctions match, but it must not ignore an unresolved alert.

Records should show how the case was escalated, what interim measures were taken and how the final outcome was determined.

For regulated financial institutions, UAE targeted financial sanctions requirements can require funds or transactions to be frozen or suspended without delay, depending on the circumstances and the applicable procedure. Reporting obligations may also apply.

The investigation file should therefore retain evidence of relevant decisions, actions, notifications and submissions, including the applicable goAML report reference where relevant.

Businesses should follow the latest instructions from their competent authority and supervisory regulator. They should not delay a required action while waiting to complete an internal investigation.

How to Build a Clear Sanctions Screening Audit Trail

An audit trail should allow an authorised reviewer to follow the case from the initial screening alert through investigation, decision and closure or further action.

Step 1: Assign a Unique Reference to Each Alert

Use a unique case or alert number so that screening results, investigation notes, supporting documents and approvals can be connected to the same case.

Avoid storing important evidence in disconnected folders or informal messages without a clear link to the case.

Step 2: Record Dates and Responsible Staff

Document when the alert was generated, when the review started, when decisions were made and when follow-up actions occurred.

Identify the staff member who investigated the alert and the authorised person who approved or reviewed the decision, where applicable.

This helps demonstrate accountability and identify delays that may require further investigation.

Step 3: Preserve Supporting Evidence

Retain relevant screening outputs, documents reviewed, investigation notes and system logs in an organised format.

Where a sanctions-list entry or customer identifier is material to the decision, record enough information to establish what was reviewed at the time. This can be particularly important when a list is subsequently updated.

Records should be protected against unauthorised alteration, loss or access. Access permissions should reflect staff responsibilities and the confidentiality of the information.

Step 4: Document the Final Decision and Rationale

Every investigated alert should have a clear, evidence-based outcome, consistent with the business's procedures.

Possible outcomes may include clearing a verified false positive, escalating an unresolved potential match or taking action following a confirmed match.

The record should explain the reasons for the outcome, any approvals required and the actions completed. Where a case remains open, document its status, outstanding steps and responsible person.

Step 5: Link Reporting and Corrective Actions

Where a case requires reporting or another regulatory action, retain the relevant submission confirmation, reference number, correspondence and evidence of action taken, as appropriate.

If an audit identifies a weakness in screening records, document the finding, its root cause, the corrective action, the responsible person and the completion date.

This allows the business to demonstrate not only that a problem was identified but also that it was addressed.

How Long Should UAE Businesses Retain Sanctions Screening Records?

Record-retention requirements depend on the applicable UAE legislation, the entity's regulated activity and the relevant supervisory authority.

The UAE Central Bank's targeted financial sanctions guidance sets out record-keeping obligations for licensed financial institutions, including a minimum five-year retention period for relevant records, with the applicable starting point depending on the type of record and circumstances. Other applicable UAE requirements may also establish retention obligations for financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers.

Businesses should not assume that every record has an identical retention starting date. Their policies should identify the applicable retention period and trigger for each record category, including customer records, screening results, investigations and regulatory submissions.

A practical retention procedure should:

Define the retention period for each relevant record type.
Identify when the retention period begins.
Store records securely and make them retrievable.
Restrict access to authorised personnel.
Apply legal holds or other preservation requirements where applicable.
Ensure records can be provided promptly to competent authorities when required.

Before deleting older records, businesses should confirm that no legal, regulatory, investigation or audit requirement calls for them to be retained longer.

Common Sanctions Screening Record-Keeping Mistakes

Several documentation weaknesses can make it difficult to demonstrate that screening controls are effective.

Incomplete investigation notes: An alert is closed without enough detail to explain the decision.

Missing screening evidence: The business records the final outcome but cannot retrieve the original alert or screening result.

Unclear accountability: The file does not identify who investigated the alert or approved the decision.

Inconsistent record storage: Evidence is spread across emails, spreadsheets and folders without a reliable case reference.

Outdated procedures: Staff follow retention or escalation procedures that no longer reflect current requirements.

Unverified manual screening: Manual checks are performed without appropriate documentation or quality-control review.

Missing follow-up evidence: The file records that an alert was escalated but does not show the action taken afterwards.

Businesses can reduce these weaknesses through standardised case templates, staff training, access controls, periodic quality checks and regular reviews of screening procedures.

How to Prepare Sanctions Screening Records for an AML Audit

Before an audit or regulatory inspection, compliance teams should review whether records are complete, consistent and readily retrievable.

A practical pre-audit review should confirm that:

Applicable sanctions lists and screening procedures are documented.
Screening results can be retrieved for the selected sample of customers and transactions.
Potential matches contain investigation notes and supporting evidence.
False-positive decisions include a clear rationale.
Unresolved or confirmed matches have appropriate escalation and action records.
Relevant reporting evidence is linked to the correct case.
Records are retained according to applicable requirements.
Staff access and system permissions are appropriately controlled.
Previous audit findings have been addressed and corrective actions documented.

A sample-based review can help identify recurring weaknesses before an external reviewer finds them. Businesses should also test whether an authorised reviewer can reconstruct a case using the stored records without relying on the memory of the original investigator.

For more information about the wider AML framework, read our guide to AML Compliance for Financial Institutions in the UAE.

Frequently Asked Questions

1. What are sanctions screening records?

Sanctions screening records are documents and system data showing who or what was screened, when screening occurred, what alerts were generated, how those alerts were investigated and what decisions or actions followed.

2. Why is an audit trail important for sanctions screening?

An audit trail allows a business to demonstrate that alerts were investigated, decisions were supported by evidence and required actions were considered. It also helps auditors identify gaps in screening controls.

3. How long should sanctions screening records be kept in the UAE?

The applicable period depends on the entity's sector and regulatory requirements. Relevant UAE rules require at least five years of retention for specified records, including under the CBUAE framework for licensed financial institutions. Businesses should verify the retention period and starting point applicable to each record category.

4. Should false-positive screening results be documented?

Yes. Documenting the information reviewed and the reasons for clearing an alert helps demonstrate that the decision was evidence-based. The level of review should follow the business's procedures and applicable regulatory requirements.

5. What should a business do if sanctions screening records are incomplete?

The business should assess the gap, identify whether important screening or investigation evidence is missing, document the issue and take corrective action. It should not recreate historical evidence as though it had been recorded at the time. Any retrospective reconstruction should be clearly identified and supported by available reliable information.

6. Is goAML used to report sanctions matches?

Depending on the entity, sector and circumstances, relevant UAE targeted financial sanctions procedures may require reports through goAML. Financial institutions and other reporting entities should follow the current instructions issued by their competent authorities and supervisory regulators