The Compliance Theatre Problem
In July 2024, the UAE Ministry of Economy suspended 32 gold refineries for three months after field inspections uncovered 256 AML violations: eight per facility, across every refinery examined. These were not fringe operators. They represented 5% of the country's gold sector at a moment when the UAE had just been removed from the FATF grey list in February of that year following years of remediation effort. The violations were not technical oversights in paperwork. They reflected a structural failure: entities processing physical gold from high-risk source jurisdictions had implemented compliance programmes that looked credible on paper and failed at the point where paper stops and provenance begins.
That gap between the documentary record and the physical reality of where gold originates and how it moves is the central problem that Annex II of the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (Third Edition, 2016) is designed to address. Most UAE-regulated entities handling physical metals understand the obligation in principle. Far fewer understand what discharging it actually requires.
What Annex II Actually Demands
The OECD Due Diligence Guidance, Third Edition (2016), establishes a five-step risk-based framework applicable to all companies across the mineral supply chain, from mines to end users. Annex II provides the model supply chain policy against which risk assessment must be conducted. It is not a checklist. It is a substantive standard that requires companies to identify and assess risks including serious human rights abuses, direct or indirect support to non-state armed groups, money laundering through the mineral supply chain, bribery, and fraudulent misrepresentation of chain of custody or traceability information.
The critical distinction embedded in the Guidance is between downstream and upstream obligations. Downstream companies, those that purchase refined metal, are expected to use best efforts to identify smelters and refiners and assess whether they participate in recognised audit programmes. Upstream companies, those closer to the mine, carry heavier obligations: establishing traceability or chain of custody to mine of origin and, for red-flagged supply chains, undertaking on-the-ground assessments of mines, producers and traders.
The UAE's own regulatory architecture reflects this hierarchy. Ministerial Decree No. 68 of 2024 extended the first three steps of the Due Diligence Regulations for Responsible Sourcing of Gold (effective January 2023) to all entities in the gold supply chain, not only refiners. Gold refiners and recyclers must additionally appoint an independent third-party auditor and submit annual due diligence reports to the Ministry of Economy. The LBMA Responsible Gold Guidance, which governs accreditation to the Good Delivery List, requires refiners to have their gold supply chain management systems audited by independent and competent third parties. DMCC issued practical guidance aligned with the same five-step OECD framework for members active in the UAE gold and precious metals sector.
What the regulatory architecture does not do is define how the assessment of provenance is actually conducted. It mandates the outcome. It leaves the methodology to the entity.
Where Desk-Based Review Breaks Down
The UAE's 2024 National Risk Assessment rated the Dealers in Precious Metals and Stones (DPMS) sector as medium-to-high risk, citing high cash intensity, cross-border trade volumes and weak responsible sourcing practices in certain segments. That classification carries legal weight under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism, which requires entities to calibrate due diligence measures to risk findings, not to apply a uniform standard regardless of exposure.
The DPMS sector's vulnerability is structural, not incidental. The UAE overtook the United Kingdom in 2023 to become the world's second-largest gold trading hub, with foreign trade in precious metals reaching AED 625 billion (approximately USD 170 billion) in 2024. Between 15% and 30% of global physical gold flows through DMCC alone. That volume arrives from source jurisdictions many of which appear on any credible map of conflict-affected and high-risk areas. In 2024, the UAE imported 29 tonnes of gold directly from Sudan, up from 17 tonnes in 2023, against a backdrop of civil war. Significant volumes also arrived from Egypt (27 tonnes), Chad (18 tonnes), Libya (9 tonnes), Uganda (31 tonnes) and Togo (52 tonnes): the last two countries producing negligible domestic gold output, indicating transit rather than origin. SWISSAID, citing UN Comtrade data published in May 2026, characterised the UAE as "more than ever a hub for conflict gold".
Against that sourcing landscape, the standard desk-based review consists of: sanctions screening of counterparties, review of supplier-provided documentation including certificates of origin, verification of LBMA or DMCC membership or audit participation, and assessment of declared supply chain routes against known country risk ratings. Each of these steps has its place. None of them addresses the provenance gap.
The problem is not that documentation is absent. The problem is that documentation in the gold supply chain is routinely fabricated. The Sentry's advisory on conflict gold identified fraudulent provenance, payment, import and export documentation, including false certificates of origin, as an established red flag in supply chains transiting through the UAE. UN expert group reports on the DRC and Sudan have documented the systematic misrepresentation of mine of origin, including gold mined or taxed by non-state armed groups being laundered into the commercial supply chain through a re-stamping of declared origin. A piece of paper stating that gold originated in Rwanda or Uganda, rather than in eastern DRC or the Sudanese conflict zone, satisfies the documentary check. It does not alter the physical reality.
OECD Step 2 requires identification of the factual circumstances of extraction, transport, handling and trading, and assessment of risks by reference to Annex II. Identifying factual circumstances from documents provided by the counterparty whose provenance claims you are assessing is not identification of factual circumstances. It is the replication of whatever claim the counterparty chose to make.
What Source-Level Verification Actually Entails
The OECD Guidance is explicit on what upstream companies in red-flagged supply chains are expected to do: maintain or engage on-the-ground assessment teams capable of generating and maintaining verifiable, reliable, up-to-date information on the qualitative circumstances of mineral extraction, trade, handling and export. For companies further downstream that purchase from refiners or traders rather than directly from source, the expectation at minimum is to assess whether the refiner's own due diligence has been independently audited and whether the audit was conducted against a standard aligned with OECD Guidance.
The compliance failure pattern that produced the July 2024 enforcement action in the UAE was not primarily a failure of audit participation. It was a failure to conduct meaningful supply chain risk assessment at the point before metal enters the refining process. Many refiners rely on their Good Delivery accreditation or their DMCC membership as a proxy for supply chain integrity. Neither accreditation is a representation about the provenance of the specific consignment being processed. They confirm that management systems and audit frameworks are in place. They do not confirm that those systems produced accurate information about the specific gold on the floor.
Source-level verification for high-risk supply chains involves operational work that desk reviews cannot replicate. It includes:
• Reference interviews with suppliers and their business partners conducted by personnel who can assess credibility and detect evasion.
• Physical verification that declared mine output is consistent with known geology, capacity and production data.
• Cross-referencing of transport documentation against actual logistics routes, including identifying transit jurisdictions that function as laundering points rather than commercial hubs.
• Intelligence-led assessment of whether the individuals and entities in the supply chain have verified associations with armed groups, sanctioned parties or corrupt officials.
This is investigative work. It requires human sources, operational access and the tradecraft to assess the reliability of what those sources report. It is fundamentally different from a document review, regardless of how thorough that review is.
Practitioner Implications
For compliance officers, general counsel, investment professionals and family office principals whose counterparties or investees operate in the UAE physical metals sector, the following positions are not defensible under the current regulatory framework:
• Treating LBMA Good Delivery listing or DMCC membership as a substitute for supply chain provenance assessment on specific consignments sourced from medium-high or high-risk jurisdictions.
• Accepting certificates of origin and supplier declarations as conclusive evidence of mine of origin when the declared source country is known to function as a transit or laundering point for conflict-affected gold.
• Conducting CDD on the refiner or trader as a legal counterparty without separately assessing the provenance of the physical metal being processed or traded.
• Relying on automated screening platforms as the primary mechanism for identifying Annex II risks. Sanctions lists do not capture non-state armed group financing or fraudulent origin documentation; they are a necessary but structurally insufficient control.
The appropriate response to a DPMS relationship involving metal sourced from a medium-to-high risk jurisdiction is to require evidence that the counterparty has conducted, and can document, active supply chain risk assessment for specific consignments: not only that a management system policy exists. Where that evidence cannot be provided, the risk assessment should reflect an inability to verify provenance, and enhanced measures including transactional controls and escalated monitoring should follow accordingly.
Entities regulated by ADGM FSRA or DFSA that provide financial services to physical metals traders, including trade finance, custody or investment management, face correspondent exposure to supply chain risk through their clients. The FSRA and DFSA AML frameworks require firms to understand the nature of their clients' business activities, including the source of the assets they hold or finance. A client's gold trading activity that involves supply chains from identified conflict-affected and high-risk areas without documented provenance verification creates an exposure that standard client onboarding checks will not capture.
The Standard Has Not Changed
The OECD Guidance is not new regulation. The Third Edition has been in force since 2016. UAE-specific instruments, including the Due Diligence Regulations for Responsible Sourcing of Gold (effective January 2023) and Ministerial Decree No. 68 of 2024, have codified equivalent obligations into domestic law. The enforcement action of July 2024, which suspended 32 refineries following 256 documented violations, confirmed that regulators are conducting field inspections and finding that compliance programmes which satisfy paper review do not satisfy the substantive standard.
The provenance gap is not an unknown risk. It is a known risk that the industry has managed by treating documentary compliance as equivalent to substantive verification. The regulatory and enforcement trajectory in the UAE makes that equivalence increasingly untenable. The question for operators and their counterparties is not whether the standard applies. It is whether the current programme can actually demonstrate that it has been met.