How to approach an AML and source-of-funds file for the UAE counterparty

A transaction stalls. The bank asks for source-of-funds documentation for the counterparty. The counterparty is UAE-based, the funds flow through a Hong Kong correspondent channel, and nobody on the in-house team has assembled this kind of file before. The question is not theoretical: without a satisfactory file, the payment does not move.

An AML and source-of-funds file (a structured evidentiary package demonstrating the legal origin of funds and the identity of the beneficial owner) for a UAE counterparty requires a defined sequence of steps, governed in Hong Kong by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and by the relevant regulators' AML guidelines, and in the UAE by the local AML and beneficial-ownership rules administered by the UAE's Financial Intelligence Unit and the relevant sectoral supervisors. Getting the sequence right – and anticipating the gate at each step – is what separates a file that clears from one that sits on a compliance desk for months.

This guide sets out the practical how-to: the decision the reader faces, the steps in order, the gate at each point, the common mistake, and a short checklist to use before the file goes out. The cross-border interface is Hong Kong as the banking and payment hub and the UAE as the counterparty jurisdiction. Compliance is the frame throughout.

Why the UAE counterparty creates a distinct compliance question

The UAE sits in a specific position for cross-border compliance professionals. It is a major trading and capital hub, heavily integrated with Asian, European and African supply chains, and it is a jurisdiction with which Hong Kong-based groups transact daily. It is also a jurisdiction that has been subject to heightened scrutiny from the Financial Action Task Force (the FATF – the intergovernmental body that sets global AML standards) in recent years.

What that means in practice: the compliance bar for UAE counterparty files is higher than for, say, a Singapore or UK counterpart. Correspondent banks in Hong Kong apply their own risk-based frameworks. A UAE counterparty – particularly one operating through a free-zone entity, a holding vehicle, or a sector with a higher inherent-risk profile – is likely to attract enhanced due diligence requirements rather than the standard tier.

That is not a reason to avoid the counterparty. It is a reason to build the file properly at the outset. A well-constructed source-of-funds file is the mechanism that allows the transaction to proceed through a compliant channel. In our cross-border practice, we see the same pattern repeatedly: the file is assembled reactively, under pressure from the bank, and the result is an incomplete package that generates a second round of requests and a longer delay.

The decision the reader faces is therefore upstream of the bank's request. It is whether to build the file proactively – before the payment instruction goes in – or to wait. Proactive assembly is almost always the correct route. The section below explains why, and what the file must contain.

What must the file contain? The document categories in order

A complete AML and source-of-funds file for a UAE counterparty consists of five document categories. Each category must be satisfied before the next is presented; a gap in one category will not be compensated by strength in another.

Category 1: Legal identity of the counterparty. This means the current trade licence or commercial registration issued by the relevant UAE authority – the mainland Department of Economic Development, the relevant free-zone authority, or the offshore registry, depending on where the entity is constituted. The document must be in date. A trade licence that has lapsed, even by a short period, is treated as an identity gap, not an administrative oversight.

If the counterparty is a free-zone entity, confirm which free zone. The UAE operates dozens of free zones, each with its own regulator. The compliance officer reviewing the file will check the issuing authority. "UAE company" is not a sufficient description; the registration document resolves this at the first step.

Category 2: Beneficial ownership. The UAE has a beneficial ownership register regime (a statutory mechanism requiring companies to maintain and disclose records of individuals who ultimately own or control 25% or more of the entity, or who otherwise exercise effective control). Under the relevant UAE Cabinet Resolutions and the UAE AML Law, companies must maintain and, where required, file beneficial-ownership information. A certified extract, a registry confirmation, or a signed and notarised beneficial-ownership declaration – verified against a current passport copy – is the standard deliverable for this category.

In our desk's experience, the beneficial-ownership layer is the most common gap in UAE files presented to Hong Kong banks. The counterparty may be genuinely compliant with UAE law but produce a document that does not translate usefully into the Hong Kong bank's know-your-customer (KYC) framework. The solution is a covering letter that maps the UAE document to the information the bank needs: name, date of birth, nationality, percentage of ownership, and – critically – whether any UBO is a politically exposed person (a PEP; an individual who holds or has recently held a prominent public function, and who therefore requires enhanced scrutiny under AML rules).

Category 3: Source of funds. This is the category that causes the most confusion. "Source of funds" means the specific origin of the money being transferred in this transaction – not the general wealth of the counterparty, though that may also be required. For a trade transaction, the source is the commercial contract, the invoice, and the payment history demonstrating that the funds represent payment for goods or services. For a capital contribution or investment, the source is the investment agreement, the capitalisation records, and, for the UBO's personal funds if those are the source, the wealth-generation evidence (salary, dividends, asset sale, inheritance).

A common mistake is to provide source-of-wealth documents when source-of-funds documents are requested. The two are related but distinct. Source of funds is transaction-specific. Source of wealth is biographical. Both may be required for an enhanced due diligence file, but conflating them wastes time and signals to the compliance officer that the file has been assembled without professional input.

Category 4: Sanctions and watchlist confirmation. Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. The Hong Kong bank's compliance framework will nonetheless include its own screening against multiple international lists, because the bank operates globally and manages its own correspondent-banking relationships. The file should include a sanctions-screening record for the counterparty entity and all named UBOs, generated against the UN consolidated list at a minimum, with a note on the date of the screen. This is not a legal opinion; it is an administrative record that the check was done.

Category 5: Transaction context and purpose. A brief explanatory note – one to two pages – setting out the commercial rationale for the transaction, the parties' relationship, the expected payment frequency, and the business purpose. This is not a legal document; it is the narrative that allows a compliance officer to understand the file quickly without needing to reconstruct it from first principles. Well-drafted, it reduces the number of follow-up queries. Poorly drafted or absent, it guarantees them.

For the sequence above, the practical rule is: complete each category in full before presenting the file. A partial file invites a partial response.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the file is won or lost. To discuss how the Anti-Money Laundering and Counter-Terrorist Financing Ordinance applies to your cross-border position, contact info@lockhartyip.com.

How does the Hong Kong AML regime govern the process?

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance is the primary statute in Hong Kong. It applies to financial institutions and designated non-financial businesses and professions. The relevant regulators – the Hong Kong Monetary Authority for banks and deposit-taking institutions, and the Securities and Futures Commission for licensed firms – each publish AML guidelines that set out the risk-based approach their supervised entities must follow.

The practical consequence for the transaction counterparty or its counsel is that the bank in Hong Kong is not conducting an investigation; it is discharging a statutory obligation. Understanding this reframes the exercise. The bank is not accusing anyone of wrongdoing. It is satisfying the customer due diligence and enhanced due diligence requirements that the Ordinance and the guidelines impose. A file that meets those requirements clears the obligation. A file that does not will trigger escalation, delay, or, in the worst case, a declined payment and a suspicious-transaction report.

For a UAE counterparty assessed at an elevated risk tier, the guidelines support – and in practice the banks apply – a heightened standard. That means the five document categories above are a floor, not a ceiling. The bank may request additional items. The appropriate response is to engage with those requests specifically, rather than re-submitting the original file with a covering letter. Each additional request should be read carefully: it identifies a gap the bank has found, and it tells the file-builder exactly what to add.

The Ordinance also governs the obligations of Hong Kong professional advisers who assist in the preparation of such files. Legal and compliance advisers working on cross-border matters involving UAE counterparties are themselves subject to customer due diligence obligations under the Ordinance's designated non-financial businesses and professions rules. The file-building process, in other words, is not one-directional.

Our Sanctions & AML practice covers the full spectrum of AML advisory work, from initial risk assessment through to the preparation of compliance files and the engagement with Hong Kong financial institutions on source-of-funds queries.

What is the gate at each step – and what stops the process?

Each step in the file-assembly sequence has a specific gate: a condition that must be met before the process can proceed. Knowing the gate in advance prevents the most common sources of delay.

Gate 1 – Legal identity: The trade licence or registration document must be current, certified, and match the name on the payment instruction exactly. A discrepancy of even one character in the entity name – a transliteration variation, a "LLC" versus "L.L.C." distinction – is sufficient to halt the process. The gate is: exact-name match, current document, certified by the issuing authority or a notary.

Gate 2 – Beneficial ownership: The UBO information must account for the entire ownership structure. If the counterparty is owned by another entity – an offshore holding company, a UAE holding vehicle, or a trust – the beneficial-ownership chain must be traced to the natural person at the top. The gate is: no legal entity at the end of the chain; a named natural person, with identity documents, at every material point.

Gate 3 – Source of funds: The documents must be contemporaneous with the transaction. A contract signed eighteen months ago for a payment being made today, without evidence of the intervening commercial relationship, leaves a gap. The gate is: documentary trail from contract through invoice through payment to the specific funds being transferred now.

Gate 4 – Sanctions screen: The screen must be dated. An undated or generically worded "no match found" statement without a reference date is not a screen; it is an assertion. The gate is: named entity, named UBOs, specific list or lists screened, date of screen.

Gate 5 – Transaction narrative: The narrative must be consistent with all other documents in the file. An inconsistency between the stated commercial purpose and the contract terms – or between the stated source of funds and the account history – is a material gap. The gate is: internal consistency across all five categories.

A micro-scenario illustrates the consequence of a gate failure. A European group with a Hong Kong treasury function was remitting a mid-market payment to a UAE free-zone supplier in the technology-services sector (spring 2026). The trade licence was current. The beneficial-ownership declaration named the correct UBO. But the source-of-funds documents showed payment for a different contract from the one referenced in the remittance instruction. The bank returned the file at Gate 3. The corrected file, with the right contract and invoices, cleared within one cycle. The delay was three weeks. The issue was an administrative error in document selection, not a compliance failure at source – but the bank could not know that from the file it received.

What do in-house teams commonly get wrong?

Three errors recur on UAE counterparty files assembled without specialist input.

Error 1: Treating the file as a one-off rather than a template. A group that transacts regularly with UAE counterparties will face this request repeatedly. Each time, the file is assembled from scratch, with the same gaps and the same delays. The better approach is to build a template for each category – with version-controlled document slots and a review calendar – so that updates are incremental rather than wholesale. The first properly assembled file becomes the model for all subsequent ones.

Error 2: Submitting the file directly to the bank's retail channel. A source-of-funds file for an enhanced due diligence case should go to the bank's compliance or correspondent-banking team, not through the standard payment interface. Submitting through the wrong channel means the file is received by a processing team that will not know what to do with it and will escalate it anyway, adding time. The correct approach is to identify the relationship manager and confirm the submission route before the file goes in.

Error 3: Conflating the UAE mainland and the free zones. UAE mainland entities and free-zone entities operate under different regulatory regimes, are registered by different authorities, and produce different corporate documents. A UAE mainland trade licence is issued by the relevant emirate's Department of Economic Development. A free-zone entity produces a certificate of incorporation or registration from the relevant free-zone authority. Presenting a mainland document for a free-zone entity – or vice versa – is immediately visible to a compliance officer and generates a first-round query that should never have been necessary.

For a comparative view of how similar source-of-funds files are assembled for CIS-region counterparties – a useful reference given the overlapping enhanced due diligence considerations – see our guide at AML and source-of-funds file for the CIS counterparty.

If an earlier filing, structure or enforcement attempt produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. Email info@lockhartyip.com to discuss the position.

The cross-border interface: Hong Kong as payment hub, UAE as counterparty jurisdiction

The cross-border interface between Hong Kong and the UAE is a busy one. Hong Kong-based financial institutions serve as the correspondent channel for a significant volume of trade and investment flows involving UAE counterparties. That position creates a specific compliance dynamic: the Hong Kong bank applies the Hong Kong AML regime, and the UAE counterparty's documentation is generated under UAE law. The two do not always produce documents in a form that translates directly.

The most common translation issue is notarisation and apostille. UAE documents are often notarised under the UAE notarial system or by a UAE court notary. Hong Kong banks may require either a standalone notarisation or an apostille (a standardised certification under the Hague Apostille Convention confirming the authenticity of a public document for use in another contracting state). The UAE is a party to the Apostille Convention; Hong Kong, as a special administrative region of the PRC, applies the convention under the arrangements applicable to the HKSAR. Parties should verify the current procedural position before acting, as the accepted method of authentication can vary by bank and by document type.

A second interface point is the UAE's ultimate beneficial ownership regime and the way it is presented to Hong Kong compliance teams. The UAE Cabinet Resolution on beneficial ownership requires companies to maintain a UBO register and, in certain cases, to file with the relevant authority. The register is not fully public in all cases. A Hong Kong bank receiving a beneficial-ownership declaration that references the UAE register but does not produce the underlying data is likely to request more. The solution is to provide the full data set – not the reference – in the file itself.

The third interface point is sanctions. As noted above, Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. A UAE counterparty that appears on a unilateral list of one state but not on the UN consolidated list presents a question of the Hong Kong bank's internal policy, not of Hong Kong law. That distinction should be made clearly in the transaction narrative. It is not a legal opinion, but it is a clarification that can prevent an unnecessary escalation.

For a broader analysis of the pre-contracting compliance review applicable to offshore holding structures that are common in UAE-connected deal flows, see our analysis at Compliance review before contracting with a BVI entity.

A short decision checklist before the file goes out

Before the file is submitted, run through the following. Each item corresponds to one of the five categories above and one of the five gates.

• Entity identity: Is the trade licence or registration document current? Does the entity name match the payment instruction exactly, including punctuation and legal suffix?
• Free zone or mainland: Has the correct issuing authority been identified? Is the document type appropriate for the registration type?
• Beneficial ownership: Have all individuals with 25% or more ownership – or effective control – been identified? Is the chain traced to natural persons? Have PEP checks been run on each named UBO?
• Source of funds: Do the documents cover this specific transaction, not a prior or parallel one? Is there a contemporaneous documentary trail from contract to invoice to fund origin?
• Source of wealth (if required): Is the wealth-generation evidence biographical and credible? Does it cover the period relevant to the funds being transferred?
• Sanctions screen: Has a screen been run against the UN consolidated list? Are the entity name and all UBO names named? Is the screen dated?
• Transaction narrative: Is the narrative consistent with all other documents? Does it state the commercial purpose, the parties' relationship, and the expected payment pattern?
• Authentication: Have the UAE documents been authenticated in a form the Hong Kong bank will accept? Has the submission route been confirmed with the relationship manager?

Eight items. A file that passes all eight has a materially higher probability of clearing at the first submission. A file with gaps at any item will generate a query. The query may feel minor. The delay is not.

What the route looks like end to end

To close the guide, the full sequence in summary form.

Step 1 – Risk classification. Determine the counterparty's risk tier before assembly begins. A UAE free-zone entity in a high-risk sector with a complex ownership structure is an enhanced due diligence case from the outset. Build the file accordingly.

Step 2 – Document request to the counterparty. Send a structured document request that maps to the five categories. A well-drafted request letter prevents the counterparty from sending documents the bank will not accept. Include the specific format requirements: certified, notarised, apostilled as applicable.

Step 3 – Gap review. When documents are received, review each category against the gate before proceeding. Do not wait for the bank to identify the gap.

Step 4 – Assemble the covering narrative. Draft the transaction narrative after reviewing all other documents. It must be internally consistent with the full file.

Step 5 – Internal sign-off. The file should be signed off by a compliance officer or external adviser before submission. The sign-off is a quality-control step, not a formality.

Step 6 – Submit through the correct channel. Confirm the submission route with the relationship manager. Submit the full file, not a selection of documents with a promise to provide the rest on request.

Step 7 – Manage the follow-up cycle. If a follow-up query arrives, read it carefully, identify the specific gap, and respond to that gap only. Do not re-submit the original file.

The timeline for a well-prepared file to clear varies. A complete, first-submission file for a standard enhanced due diligence case can clear within a banking week. An incomplete file that generates two or three rounds of queries may take months. The investment in assembling the file correctly at Step 2 is recovered many times over at Step 6.

Related practices

• Sanctions & AML – Cross-border AML advisory, counterparty due diligence, and compliance-file preparation.
• Corporate Counsel – Ongoing compliance governance for international groups transacting through Hong Kong.
• Holding Structures – Structural review and beneficial-ownership mapping for UAE and offshore holding vehicles.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Sanctions Aml
• Compliance Review Before Contracting Bvi Entity Bvi Analysis
• Aml Source Funds File Cis Counterparty Cis Guide

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.