Customer due diligence is the part of an AML programme that a Ministry of Economy and Tourism (MoET) inspector uses to judge whether the policy actually works. The inspector does not read procedures; they open a specific client file and look at which documents were requested, when, who verified them and why the firm decided the risk was standard rather than high. Cabinet Resolution No. 134 of 2025 devotes Articles 6–17 to customer due diligence in the UAE and sets out three levels: customer due diligence (CDD), enhanced due diligence (EDD) and simplified due diligence (SDD).
This article is a practical walkthrough of the KYC CDD requirements UAE firms face: when due diligence is mandatory, which documents to request from individuals and companies, how to identify the beneficial owner at the 25 percent threshold, which red flags call for enhanced due diligence and what has to be kept for five years. It is written for DNFBPs — real estate agents, dealers in precious metals and stones, accountants and corporate service providers — but the principles are the same for financial institutions and VASPs.
KYC, CDD, EDD and SDD: what the difference is
The terms are often used interchangeably, although each has its own role:
| Term | What it means | When it applies |
|---|---|---|
| KYC (Know Your Customer) | The umbrella name for the “know your customer” process: collecting and verifying data, questionnaires, the client file | Always — it is the framework within which CDD, EDD and SDD operate |
| CDD (Customer Due Diligence) | Standard due diligence: identification, verification, identifying the UBO, purpose of the relationship, monitoring | For every client once a trigger occurs |
| EDD (Enhanced Due Diligence) | Enhanced due diligence: additional documents, source of funds and source of wealth, senior management approval, more frequent monitoring | For high risk: PEPs, high-risk countries, complex structures, suspicious circumstances |
| SDD (Simplified Due Diligence) | Simplified due diligence: a reduced set of measures | Only where low risk is documented and justified, and never where there is suspicion |
When customer due diligence is mandatory
Article 6 of the regulation lists the triggers that oblige a firm to carry out CDD:
- establishing a business relationship — a contract, opening an account, taking on a client;
- a one-off transaction of AED 55,000 or more — single or a series of linked transactions, for financial institutions and for cash transactions by dealers in precious metals and stones;
- a one-off transfer of AED 3,500 or more, including VASP transactions in virtual assets;
- a gaming-sector transaction of AED 11,000 or more;
- suspicion of money laundering or terrorist financing — regardless of amount or threshold;
- doubts about the reliability of data obtained earlier.
For DNFBPs that do not handle cash — accountants, lawyers, corporate service providers — the first trigger is the one that matters: every client taken on goes through CDD before work starts. Verification may be completed after the relationship has begun only where this is necessary for the normal conduct of business, the risk is under control and the checks are completed within a reasonable time. In practice that means no later than the first transaction. All thresholds are broken down in our article on AML thresholds in the UAE.
Customer due diligence (CDD): the four elements
- Identifying and verifying the client — establishing who is in front of you and confirming it against reliable, independent documents.
- Identifying the beneficial owner (UBO) and taking reasonable measures to verify them — so the firm understands who ultimately owns and controls the client.
- Understanding the purpose and nature of the business relationship — what the client intends to do and whether that fits their profile.
- Ongoing monitoring — checking transactions against the declared activity and keeping the data up to date.
The fourth element is the one most often missed: a file assembled at onboarding and left untouched for three years is treated by the inspector as a breach.
KYC documents for a natural person
| What we establish | Which documents | Note |
|---|---|---|
| Identity: full name, date of birth, nationality | Passport; for residents — Emirates ID | Copy with the photograph and expiry date visible; the original is presented in person or checked via UAE Pass |
| Status in the UAE | Residence visa or entry stamp | For non-residents — country of tax residence |
| Residential address | Utility bill, tenancy contract (Ejari), bank statement not older than 3 months | The address in a passport does not count as proof |
| Occupation and source of funds | Employment contract, salary certificate, trade licence, tax return | For standard risk a declaration in the questionnaire is enough; documents are required under EDD |
| PEP status | Questionnaire + screening against PEP databases | A politically exposed person (PEP), their family members and close associates → EDD |
| Purpose of the relationship | Questionnaire, contract | For example: buying a flat to live in, investment, running a business |
KYC documents for a UAE company or other legal entity
| What we establish | Which documents | Note |
|---|---|---|
| Existence and status of the company | Trade licence, certificate of incorporation | The licence must be valid; checked in the free zone register or with the DED |
| Legal form and authority | Memorandum and articles of association (MoA/AoA), board resolution on authority, power of attorney for the signatory | The signatory is verified as a natural person |
| Ownership structure | Shareholder register, UBO declaration, group chart for multi-tier structures | Down to natural persons holding 25% or more |
| Management | List of directors, passports and Emirates IDs of the directors | Nominee directors are disclosed separately |
| Address and real activity | Office lease, website, description of the business | A virtual office with no activity is a risk factor |
| The company’s source of funds | Financial statements, bank statements, contracts with counterparties | Mandatory under EDD; under CDD — a declaration in the questionnaire |
How to identify the beneficial owner at the 25 percent threshold
The beneficial owner is a natural person who directly or indirectly owns or controls 25% or more of the capital or voting rights. The regulation sets out the following algorithm:
- Find natural persons holding 25% or more — directly or through a chain of companies (the shareholdings are multiplied through).
- If there are none, identify the person who controls the company by other means: the right to appoint directors, veto rights, a shareholders’ agreement.
- If there is no such person either, the senior managing official — usually the general manager — is treated as the beneficial owner.
- Nominee shareholders and directors are not beneficial owners; they must be disclosed and the person on whose behalf they act must be established.
- For foundations and trusts — the founder or settlor, protector, beneficiaries and the person controlling the structure.
UBO data must be updated within 15 working days of any change. The register and liability for false information are covered in our article on UBO requirements in the UAE.
Enhanced due diligence (EDD): when and what to request in addition
EDD is mandatory when the risk associated with the client, product, country or delivery channel is assessed as high. The regulation names a number of situations outright; the rest the firm defines in its own risk assessment.
| High-risk indicator | What to request in addition | Who approves |
|---|---|---|
| The client or UBO is a PEP, a family member or close associate of a PEP | Source of wealth and source of funds with supporting documents, extended questionnaire | Senior management |
| Country on the FATF lists or the UAE National Committee list | Rationale for the relationship, confirmation of the origin of funds, enhanced monitoring | Senior management |
| Complex ownership structure, trusts, nominees | Structure chart down to natural persons, documents for every tier, explanation of the economic rationale | MLRO + senior management |
| Remote onboarding with no face-to-face meeting | Video identification, verification via UAE Pass or a certified provider, an additional document | MLRO |
| Cash transactions above the threshold, structuring of amounts | Source of the cash, explanation of the transaction, a DPMSR report for precious metals | MLRO |
| Mismatch with the profile: turnover out of line with income, unusual geography | The client’s explanation with documents; if unconvincing — consider an STR | MLRO |
| Adverse information in open sources | Verification of the source, assessment of materiality, record of the decision | MLRO |
The key difference between EDD and CDD comes down to two documents — source of funds vs source of wealth. Source of funds is where the money for this particular transaction comes from: sale of an asset, salary, dividends. Source of wealth is how the client built up their capital overall. For standard risk a declaration in the questionnaire is enough; for high risk you need evidence — contracts, bank statements, financial statements. The decision to accept a high-risk client is recorded in writing and taken by senior management, not by the sales manager.
Simplified due diligence (SDD): when it is permitted
SDD is allowed only where low risk is confirmed by the risk assessment, and it is prohibited wherever there is any suspicion. Typical cases where simplified due diligence is justified:
- the client is a UAE government body or a company with government ownership;
- a company whose shares are listed on an exchange with disclosure requirements;
- a financial institution regulated in the UAE or in a country with equivalent AML requirements;
- a product the firm has assessed as low risk — for example, a fixed, small-value service with no option to pay in cash.
Simplified does not mean no checks at all: the client is still identified, the purpose of the relationship is recorded and the rationale for the low-risk rating is written into the file. During an inspection, that rationale is exactly what the inspector will ask to see.
Ongoing monitoring and keeping the file up to date
The regulation requires continuous monitoring of transactions and keeping client data current. The firm sets its own review frequency based on risk; common practice is as follows:
| Risk level | File review | What is checked |
|---|---|---|
| High | At least once a year | Validity of documents, PEP status, sanctions lists, consistency of transactions with the profile, source of funds |
| Standard | Every 2 years | Expiry dates of documents, changes in ownership, sanctions lists |
| Low | Every 3 years | Expiry dates of documents, sanctions lists |
| Any — on a trigger event | Immediately | Change of UBO or director, unusual transaction, adverse information, expired documents |
What to do if the client will not provide documents
If CDD cannot be completed — the client refuses to provide documents, or the documents provided raise doubts — the regulation is explicit: do not start the relationship, do not carry out the transaction, terminate any existing relationship and consider filing an STR. There is no “let’s start work now and sort the documents out later”. A client’s refusal to explain the source of funds for a cash transaction is in itself an indicator for an internal report to the MLRO. The reporting procedure is explained in our article on STR, SAR and PNMR reports.
Record-keeping: what to retain and for how long
All customer due diligence documents, questionnaires, screening results, correspondence and transaction records must be kept for at least 5 years from the latest of the following dates: the end of the business relationship, the closure of the account, or the completion of an inspection or investigation (Article 25(2) of the regulation). The file must be available to the regulator on request without delay — in practice within one or two working days. Electronic storage is permitted provided the records are protected against alteration and can be exported.
Practical scenarios
| Situation | Level | What to request |
|---|---|---|
| A UAE resident buys a flat through an agency, paying by bank transfer | CDD | Passport, Emirates ID, proof of address, questionnaire with source of funds, purpose of the purchase |
| A non-resident buys property, paying partly in cash | EDD | Plus: evidence of source of funds, source of the cash, country of residence, senior management approval |
| A foreign company engages accounting services, two-tier holding structure | CDD → EDD if the UBO is unclear | Licence, MoA/AoA, registers for every tier, UBO declaration, group chart |
| Jewellery shop, a purchase of AED 70,000 in cash | CDD + DPMSR report | Passport/Emirates ID, questionnaire with source of the cash, entry in the transaction log |
| The client is a UAE company with government ownership | SDD | Confirmation of status, signatory, purpose of the relationship, rationale for low risk |
| The client has not responded to a document request for 30 days | Suspension | Suspend transactions, notify the MLRO, consider an STR |
Checklist: the client file is ready for inspection
- Passport or Emirates ID with the expiry date visible, copy certified by an employee and dated.
- Address confirmed by a document not older than 3 months.
- For a company: trade licence, MoA/AoA, shareholder register, list of directors, signatory’s authority.
- UBO identified down to natural persons, nominees disclosed.
- KYC questionnaire completed, with purpose of the relationship and source of funds stated.
- PEP and sanctions screening carried out, result recorded with a date.
- Risk level assigned and criteria recorded; for high risk — senior management approval.
- Date of the next file review set.
Questionnaire templates and CDD/EDD procedures are part of the package we prepare under our AML policy development service..
Conclusion
Customer due diligence in the UAE is built on three levels — CDD, EDD and SDD — and on one principle: the depth of the checks follows from the risk assessment. For a standard client, a passport, proof of address, a questionnaire covering the purpose of the relationship and source of funds, and identification of the UBO at the 25 percent threshold are enough. For a high-risk client — a PEP, a listed country, a complex structure, cash — you need documents on source of funds and source of wealth and written senior management approval. The file is reviewed on schedule and kept for five years.
If you would like to tailor your CDD and EDD procedures to your line of business, and get KYC questionnaires and a UBO identification algorithm, the specialists at Dynasty Business Adviser will prepare the package and train your staff. Find out more on our «AML compliance in the UAE» page. Contact us: +971 52 634 1022.
Get a consultation
Information correct as at 12 October 2026. This article is based on the provisions of Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and supervisory authority guidance, and does not constitute legal advice. The file review frequency and the list of documents for a specific client depend on the firm’s risk assessment.
