Compliance Audit Preparation Guide — Regulatory Examination Readiness for UAE VASPs

Compliance Audit Preparation Guide

Regulatory audits and supervisory examinations are an inevitable part of operating as a licensed VASP in the UAE. Whether conducted by VARA, ADGM-FSRA, DFSA, external auditors, or internal audit functions, examinations test the operational effectiveness of compliance programs — not just their documentary existence.

The Morpheus Software (Fuze) enforcement case resulted in appointment of a skilled person — an involuntary version of what a proactive compliance audit achieves voluntarily. This guide prepares compliance officers for the audit process.

Types of Compliance Examinations

Regulatory Supervisory Examination: Conducted by the regulator’s supervisory team to assess ongoing compliance with licensing conditions and regulatory requirements. May be scheduled (part of routine supervisory cycle) or triggered by specific concerns.

External Financial Audit: Annual financial statement audit by registered auditors, which includes assessment of internal controls and compliance-related financial reporting. Required across all three UAE regulatory jurisdictions.

Internal Audit Review: Periodic assessment by the internal audit function (or outsourced internal audit provider) of compliance program adequacy and effectiveness. Mandated by governance requirements across VARA, ADGM, and DFSA.

Thematic Review: Regulator-initiated review focusing on a specific compliance area (e.g., AML program effectiveness, travel rule implementation, marketing compliance) across multiple regulated entities.

Pre-Audit Preparation Checklist

Documentation Readiness

Ensure the following are current, complete, and accessible:

• AML/CFT compliance manual with version control and approval records
• KYC/CDD procedures with evidence of implementation
• Travel rule procedures with technical integration evidence
• STR procedures with filing records
• Enhanced due diligence procedures with case examples
• Enterprise-wide risk assessment (current version with approval date)
• Board and committee meeting minutes documenting compliance oversight
• Training records with attendance and assessment documentation
• Transaction monitoring rule documentation with calibration records
• Sanctions screening procedures with list update evidence
• Customer file samples demonstrating CDD completeness
• Staff organizational chart showing compliance function independence

Evidence of Operational Effectiveness

Auditors assess whether compliance programs work in practice, not just on paper:

• Transaction monitoring alert statistics: Volume, false positive rates, escalation rates, and investigation outcomes
• STR filing statistics: Number of filings, filing timeliness, and FIU feedback
• KYC refresh completion rates: Percentage of customers with current KYC against required refresh schedules
• Training completion rates: Percentage of staff completing required training within mandated timeframes
• Compliance testing results: Results of compliance function self-testing, including identified issues and remediation status
• Technology platform evidence: Blockchain analytics reports (Chainalysis, Elliptic, Crystal Blockchain) demonstrating operational use

Common Audit Findings

Based on enforcement patterns and industry experience, common compliance audit findings include:

1. Outdated policies: Compliance manuals not updated to reflect current regulatory requirements (such as VARA’s 2026 circulars)
2. Incomplete KYC files: Customer files missing required documentation or verification evidence
3. Uncalibrated monitoring: Transaction monitoring rules not adjusted to reflect actual transaction patterns, resulting in excessive false positives or missed genuine alerts
4. Insufficient board reporting: Board minutes lacking evidence of substantive compliance oversight discussion
5. Training gaps: Staff training records incomplete or training content not updated for recent regulatory changes
6. EDD deficiencies: High-risk customers not subject to enhanced procedures or lacking senior management approval

Post-Audit Response

When audit findings are identified:

• Acknowledge findings without defensiveness
• Develop a remediation plan with specific actions, responsible persons, and deadlines
• Implement remediation actions within agreed timeframes
• Document remediation completion with evidence
• Report remediation status to the board and the regulator as required

Audit Readiness for Specific Compliance Areas

Each component of the compliance program requires specific audit preparation:

AML Program Audit Readiness: Prepare the enterprise-wide risk assessment document (current version with board approval evidence), AML policies and procedures (with version control showing update history), MLRO appointment documentation and board reporting records, staff training records (attendance, content, assessment results), and suspicious transaction reporting logs with disposition records. The Morpheus Software (Fuze) case specifically cited AML programme control failures — auditors will assess whether controls are operationally effective, not just documented.

KYC/CDD Audit Readiness: Compile customer onboarding records showing identity verification results, risk assessment outcomes, and enhanced due diligence records for high-risk customers. Ensure the KYC platform maintains complete audit trails of verification decisions, including rejected applications and the reasons for rejection. Document the periodic KYC refresh process with evidence of refresh completion rates by risk tier.

Transaction Monitoring Audit Readiness: Document the configuration and calibration of blockchain analytics platforms (Chainalysis, Elliptic, or Crystal Blockchain), including alert threshold settings, alert volume metrics, false positive rates, investigation completion times, and STR conversion rates. Auditors assess whether monitoring rules are appropriately calibrated to the firm’s risk profile and transaction patterns. See our transaction monitoring guide for calibration best practices.

Travel Rule Audit Readiness: Document the travel rule compliance solution deployed, counterparty VASP identification processes, originator/beneficiary information collection procedures, and the handling of incomplete travel rule information. Following VARA’s February 2026 Travel Rule circular, this area will receive increased audit attention.

FATF High-Risk Jurisdiction Screening Readiness: Maintain records of jurisdiction risk screening results, EDD measures applied to customers with nexus to listed jurisdictions, and evidence of screening system updates following FATF plenary list updates. The January 2026 VARA circular on FATF jurisdictions establishes specific requirements.

Common Audit Findings and How to Avoid Them

Based on regulatory enforcement patterns and common compliance deficiencies, VASPs should anticipate and address these potential findings:

1. Policy-procedure gaps: Policies exist but operational procedures do not fully implement policy requirements. Ensure every policy statement has a corresponding documented procedure.
2. Stale risk assessments: Enterprise-wide risk assessments that have not been updated to reflect current business activities, customer base changes, or regulatory developments. Update at least annually.
3. Insufficient board reporting: Board-level compliance reporting that lacks substance or frequency. Ensure regular, documented board reporting on AML program status.
4. Monitoring rule documentation: Transaction monitoring alert rules that are not formally documented, including the rationale for threshold settings and the date of last calibration review.
5. Training deficiencies: Incomplete training records or training content that does not cover jurisdiction-specific requirements (VARA circulars, ADGM rules, DFSA modules).
6. Record retention gaps: Records that do not cover the full retention period required by the applicable regulator, or records stored in formats that are not readily accessible.

Engaging External Support for Audit Preparation

Advisory firms (Deloitte Middle East, PwC Middle East) offer pre-audit review services that simulate the regulatory examination process. These mock audits identify deficiencies before the regulator discovers them, enabling proactive remediation. The cost of a pre-audit review (typically USD 30,000 to USD 80,000) is significantly lower than the cost of responding to adverse audit findings, which may include skilled person appointments (as seen in the Morpheus/Fuze case), financial penalties, or operational restrictions.

For the complete compliance framework, see our AML program design guide and compliance calendar. For licensing processes that establish audit requirements, see guides for VARA, ADGM, and DFSA.

For enforcement context demonstrating consequences of failed compliance, see our enforcement cases section, enforcement action dashboard, and VARA enforcement powers deep dive.

For regulatory context, visit UAE Tokenization Regulations and Dubai Tokenisation.