Cabinet Resolution 134 of 2025: where training fits in AML controls

A company updates its customer-onboarding procedure. Management approves it, compliance uploads it to the shared drive, and the next inspection file contains the new version. Yet the employee taking a customer’s details still uses the old process.

This hypothetical gap explains why training appears inside the UAE’s AML controls rather than as an isolated educational requirement. A procedure cannot reliably govern work if the people performing that work have not learned what changed.

Cabinet Resolution 134 of 2025 is the executive regulation under the 2025 AML law. For training, two particularly useful provisions are Article 21 on internal policies and controls and Article 22 on the compliance officer.

Article 21 starts with the organisation

Article 21 connects internal policies, controls and procedures to the identified risks and to the nature and size of the business. Senior-management approval and ongoing review are part of that arrangement. Periodic training for compliance and relevant employees sits within it.

This matters because management cannot treat training as an unrelated administrative purchase. If the company changes its customer base or offers a new service, the controls may need to change, and the staff operating them may need additional knowledge.

Proportionality is not the same as informality. A small company may use simpler arrangements than a large institution, but it still needs arrangements that fit its risks and can actually be carried out.

Article 22 gives the work an accountable owner

The compliance officer’s responsibilities include developing, implementing and documenting ongoing training and awareness programmes. Those verbs describe different work.

Developing means deciding what people need to understand. Implementing means making the learning happen for the relevant people. Documenting means keeping a reliable account of the programme and its delivery. Purchasing access to a course may support implementation, but does not automatically complete all three tasks.

The officer also needs management support. A plan that identifies a training gap but receives neither staff time nor resources remains a plan, not an operating control.

What would the link look like in practice?

Return to the changed onboarding procedure. A useful training file would explain the change, the affected roles and what was done to prepare them. The following is an illustrative record structure, not a form prescribed by the Resolution.

The logic matters more than the number of documents. A clear record of a focused briefing can be more informative than a thick folder of generic slides disconnected from the procedure.

What the provisions do not establish by themselves

These articles should not be presented as a universal list of approved commercial courses, a fixed learning duration for every role or a guarantee that one provider’s certificate satisfies every supervisory expectation.

Specific sector requirements, supervisory directions and the firm’s own policies still need to be considered. Where a business adopts a training frequency, that becomes part of its programme to manage and explain; it should not be mislabelled as a number of hours quoted from the Resolution when it is not.

For the broader question of which staff need which learning, the role-based training guide develops that distinction.

The file should explain a living programme

A training file is most useful when it shows the sequence from an identified need to learning and follow-up. It can then explain why a new joiner received induction, why an experienced employee needed an update or why a recurring error led to a different teaching example.

That is a stronger reading of the requirement than treating the file as a shelf of certificates. The legal duty remains with the regulated entity; the educational work helps its people perform that duty in practice.