What a compliance function is for
A compliance function exists to know what the organisation is obliged to do, to check that it is being done, and to tell the board when it is not. The first part is where most functions are weakest: without a maintained register of obligations mapped to owners, compliance monitoring is testing whatever the team can remember.
The UAE compliance problem specifically
The volume and pace of regulatory change is the issue. Corporate Tax, transfer pricing, economic substance, ultimate beneficial ownership, anti-money laundering, data protection, sustainability disclosure and sector rules from the CMA, CBUAE, DFSA and ADGM FSRA have all moved inside a few years. Compliance functions sized for a quieter period are now covering more ground with the same people.
How CLA Emirates approaches it
We build the obligations register first, because everything else depends on it. Each obligation is mapped to a source, an owner and a control, so monitoring has something to test against. Horizon scanning is then a defined process with a named owner rather than someone forwarding regulator emails. Where a function is being set up from scratch we design the operating model and the reporting line before recruiting into it.
