A UAE KYC checklist can be out of date before the first file is opened. Federal Decree-Law No. 10 of 2025 replaced the 2018 AML law, and Cabinet Resolution No. 134 of 2025 replaced the 2019 executive regulations. Some official overview pages still reference the earlier legislation. Use the current legal texts and the rules for the entity you are reviewing.
This guide focuses on customer due diligence for UAE financial services firms, including funds, administrators, banks, brokerages and asset managers. It covers the federal framework and the distinction between DIFC and ADGM supervision. It is not a complete compliance manual for every UAE sector. For operational help, see our UAE KYC services.
Identify the entity and its AML supervisor first
The federal framework addresses anti-money laundering, counter-terrorist financing and counter-proliferation financing, often shortened to AML/CFT/CPF. It applies to financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers within its scope. The additional rules depend on the licence, activity and jurisdiction.
- CBUAE-supervised institutions: banks and other institutions licensed by the Central Bank must apply the federal framework together with applicable Central Bank regulations, standards and guidance. Not every mainland financial business is supervised by the Central Bank; check the entity’s licence.
- DIFC: the Dubai Financial Services Authority (DFSA) supervises Relevant Persons for AML compliance in the Dubai International Financial Centre. Its AML Module applies alongside federal legislation. Chapters 5 to 8 address business risk, customer risk, CDD, reliance and outsourcing.
- ADGM: the Financial Services Regulatory Authority (FSRA) is the competent AML and targeted-financial-sanctions authority in Abu Dhabi Global Market. Read its AML Rulebook together with federal legislation, using the ADGM regulatory framework index.
DNFBPs and virtual asset businesses need their own supervisory assessment. A commercial free-zone licence does not make a business DFSA-regulated, and “ADGM” names a jurisdiction, not its regulator. Our scoping recommendation is to record the legal entity, licence, supervisor and policy version before allocating files.
Update the policy for the current federal framework
The Ministry’s legislation library publishes both current texts. Article 41 of Federal Decree-Law No. 10 of 2025 repeals the 2018 law while preserving earlier implementing instruments to the extent they remain consistent and have not been superseded. Article 70 of Cabinet Resolution No. 134 of 2025 expressly repeals the 2019 executive regulations. Avoid treating every older circular as either automatically obsolete or automatically current.
Article 5 of the executive regulations requires documented risk assessment, considering the customer, geography, products, services, transactions and delivery channels, as well as national and sectoral risk assessments. It also addresses proliferation-financing risk. A policy update needs to reach the working checklist, risk methodology and escalation process.
For DIFC firms, the current DFSA AML Module is version 30, April 2026. For ADGM firms, the official index links the FSRA AML Rulebook version 11, dated 21 May 2026. Its Chapter 8 covers CDD and Chapter 9 covers reliance and outsourcing. Check these texts and subsequent notices when setting the review scope.
Build CDD around identity, authority and the relationship
Articles 6 to 9 of Cabinet Resolution No. 134 of 2025 cover the timing and content of customer due diligence. Identify and verify the customer using reliable, independent sources; establish the authority and identity of someone acting on the customer’s behalf; and understand the purpose and intended nature of the relationship.
For a corporate customer, Article 9 includes legal form, constitutional documents, registered or principal address and relevant senior-management names. Understand the business and its ownership and control structure. A trade licence establishes part of that picture; it does not explain the source of a subscription or who ultimately controls the investor.
In fund work, define whether the firm is reviewing an investor, an intermediary, a corporate client or another party. Our recommendation is to connect the documents to that party’s role and the expected activity. Keep the fund’s responsibilities distinguishable from those of its manager or administrator, even when they share evidence.
Article 14 prohibits establishing or continuing a relationship, or executing a transaction, where the required CDD cannot be applied, and requires consideration of a suspicious transaction report where necessary. It also addresses situations where CDD enquiries could alert the customer to a suspicion. Route those cases to the authorised compliance team before sending another document request.
Trace beneficial ownership beyond the 25% test
Article 10 sets out the federal beneficial-owner identification sequence for legal persons. It starts with the natural person who ultimately owns a controlling interest or shares of 25% or more, alone or jointly. Where the specified doubts arise, or nobody controls through ownership, identify the natural person exercising legal or actual control through other means. If neither route identifies a natural person, identify the relevant senior-management individual or individuals.
The senior-management fallback is not a shortcut for an incomplete ownership chart. Record why the earlier steps did not identify a natural person. Legal arrangements such as trusts have separate requirements covering the settlor, trustees, protector, beneficiaries or classes of beneficiaries and other persons exercising ultimate effective control.
DFSA guidance to AML Rule 7.3.3 explains that its beneficial-owner assessment is not confined to a numerical threshold. Apply the relevant supervisor’s rules alongside the federal test. In a remediation file, our recommendation is to show the ownership chain, control findings and source evidence, with unresolved links kept open.
Match enhanced due diligence to the identified risk
Article 5 describes enhanced measures for higher risks, including additional customer and beneficial-owner information, more frequent updates, source-of-funds and source-of-wealth work, increased monitoring and senior-management approval. Select and document measures that address the risk and the applicable requirements.
Article 16 distinguishes foreign politically exposed persons (PEPs) from domestic PEPs and persons holding prominent functions in international organisations. Foreign PEP relationships require the specified additional measures. For domestic and international-organisation PEPs, the specified enhanced measures apply where the relationship is high risk. The provisions also extend to relevant family members and close associates.
Source of funds explains where the money for a relationship or transaction originated. Source of wealth explains how the person accumulated their wealth. A transfer from a bank account shows the payment route but may leave the economic origin unexplained. Keep supporting evidence and the reviewer’s reasoning together.
Keep reviews current and sanctions escalations separate
Article 8 requires scrutiny of transactions against the firm’s knowledge of the customer and risk, as well as up-to-date, relevant CDD information. Article 13 addresses existing relationships on a materiality-and-risk basis. A periodic document refresh is only part of ongoing monitoring.
Set review intervals under the applicable rules and the firm’s risk methodology. Trigger events such as changed control, unexplained activity or new adverse information may require earlier work. Track overdue files and document the checks and decisions needed to bring them up to date.
Cabinet Resolution No. 74 of 2020 and the targeted financial sanctions guidance require controls for the UAE Local Terrorist List and applicable UN lists. These include screening, responses to list changes, freezing obligations and reporting. A confirmed match needs the required action without delay and without prior notice; a possible match needs prompt investigation under the relevant procedures. Neither belongs in an ordinary backlog waiting for the next review date.
Our file-work recommendation is to preserve the search results, identifiers checked, match rationale and escalation record. Agree who owns live sanctions action and transaction monitoring before outsourcing a periodic review.
Report suspicion through the UAE FIU process
Article 18 requires reporting immediately and without delay where there is suspicion or reasonable grounds for suspicion concerning transactions, attempted transactions or funds, regardless of value. Reports go to the UAE Financial Intelligence Unit (FIU) through its electronic system or another approved means. The operating platform is goAML.
Apply the supervisor’s additional requirements. For example, DFSA AML Rule 13.3.1 requires immediate notification to the DFSA following a report to the FIU. Keep the internal investigation, reporting decision and relevant supporting evidence accessible to authorised staff.
Article 19 prohibits tipping off. Operational staff should follow the MLRO’s escalation and communication instructions, particularly when chasing documents from a customer whose activity is under review. KYC outsourcing does not appoint the provider as MLRO or transfer the firm’s reporting obligations.
Set retention and outsourcing terms before sharing files
Article 25 sets a federal retention minimum of five years. The starting point depends on the record. For CDD and related records, the specified events include relationship termination, account closure, completion of an occasional transaction, inspection, investigation or final court judgment, with the most recent applicable event governing the calculation. “Five years after onboarding” is not a safe deletion rule.
DFSA AML Rule 14.4.1 requires specified records to be retained for at least six years from the relevant notification or report, end of the relationship or completion of the transaction, whichever occurs last. FSRA AML Rule 4.5.1 also requires at least six years, with its calculation including the conclusion of a related investigation or issuance of a related judgment, whichever specified event occurs last. Apply any longer preservation obligations. Records must remain retrievable; a completion spreadsheet alone cannot reconstruct a case.
Article 20 distinguishes reliance on a regulated third party from outsourcing performed under the firm’s internal policies, supervision and control. Reliance has its own conditions, including immediate receipt of identification information and access to supporting documents without delay. DFSA AML Rule 8.2.1 expressly keeps responsibility and liability with the firm that outsources CDD.
For ADGM firms, FSRA AML Section 9.3 also retains responsibility and liability with the firm. It requires a suitability and reliability assessment, a binding agreement and periodic assurance after appointment. It prohibits outsourcing CDD to a provider incorporated in or operating from a Jurisdiction Subject to a Call to Action, as defined in the rulebook.
Before file transfer, agree provider due diligence, contractual responsibilities, review standards and exception handling. Assess any regulatory notification or approval requirements and the applicable data-protection rules, including DIFC or ADGM requirements where relevant. Confirm hosting, access, cross-border transfers, retention and return or deletion arrangements in writing. Do not assume every UAE engagement requires the same hosting location.
Scope the remediation around unresolved decisions
For a backlog, we recommend separating missing evidence from unresolved risk decisions and urgent escalations. Give each open issue an owner. Agree the population, policy version, case priorities and handover standard so that a “completed” file has a defined meaning.
Our managed KYC service for UAE financial services firms covers onboarding, CDD remediation and periodic reviews under your approved policy. Agents organise the evidence and prepare the first pass; qualified compliance reviewers check the work. Your authorised team retains customer acceptance, high-risk approvals and statutory reporting. Bring the case count, regulator and target date to scope the engagement.