TRW & Co · AML, sanctions and investigations
Customer Due Diligence and EDD in the UAE: The 2025 Rules in Practice
Customer due diligence UAE rules require banks, DNFBPs and virtual asset firms to identify and verify customers and beneficial owners, understand the purpose of the relationship and monitor it continuously. Higher-risk customers need enhanced due diligence, including source of funds and wealth. This guide explains the 2025 law and Executive Regulations in practical terms.
Key pointUnder the 2025 Executive Regulations, senior management approval and source-of-wealth checks apply to every high-risk relationship, not only to PEPs, so risk-rating methodology now directly decides how much work each file requires.
At a glance
New legal base
Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 replaced the 2018 law and the 2019 Executive Regulations.
Occasional transaction threshold
Financial institutions apply due diligence to occasional transactions of AED 55,000 or more, and AED 3,500 for occasional wire transfers.
Beneficial owners
Trace ownership to natural persons, using the 25 per cent federal threshold, then control by other means and senior management as fall-backs.
Enhanced due diligence
High-risk relationships need source of funds and source of wealth, senior management approval and closer, more frequent monitoring.
Five-year records
Keep due diligence and transaction records for at least five years, counted from the most recent relevant event.
Swipe or scroll →
The short answer: what customer due diligence UAE law requires
Customer due diligence UAE law requires every financial institution, designated non-financial business and profession (DNFBP) and virtual asset service provider to know who it is dealing with before and throughout a relationship. That means identifying and verifying the customer, identifying the beneficial owners, understanding the purpose of the relationship and monitoring transactions on an ongoing basis.
Where the risk is higher, enhanced due diligence (EDD) applies. Under the current rules that means establishing both source of funds and source of wealth, obtaining senior management approval for the relationship and applying closer monitoring. Politically exposed persons (PEPs) and customers linked to high-risk jurisdictions are the classic triggers.
The framework was rebuilt in 2025 with a new AML law and new Executive Regulations. This article explains the current rules in practical terms. For an overview of the whole compliance programme, see our page on AML compliance in the UAE.
The legal framework after the 2025 reforms
The core statute is now Federal Decree-Law No. 10 of 2025 on combating money laundering, the financing of terrorism and the financing of proliferation. It came into force in October 2025 and repealed Federal Decree-Law No. 20 of 2018. Among other changes, it makes continuous monitoring an express, stand-alone duty and treats a person about to enter a business relationship as a "client", so due diligence clearly starts before onboarding is complete.
Its detail sits in new Executive Regulations issued by Cabinet Decision No. 134 of 2025, published in November 2025 and in force from December 2025. They replaced Cabinet Decision No. 10 of 2019, which had governed customer due diligence UAE practice for six years. Official texts are available through the UAE Legislation portal. Our article on the new AML law covers the wider changes, including higher penalties.
Who supervises whom
| Sector | Supervisor |
|---|---|
| Banks, finance companies, exchange houses, insurers (onshore) | Central Bank of the UAE |
| Securities and capital markets (onshore) | Capital Market Authority (which replaced the Securities and Commodities Authority from 1 January 2026) |
| Real estate agents, dealers in precious metals and stones, auditors and accountants, corporate service providers | Ministry of Economy and Tourism |
| Lawyers and notaries | Ministry of Justice |
| DIFC firms and DNFBPs | Dubai Financial Services Authority |
| ADGM firms and DNFBPs | ADGM Financial Services Regulatory Authority |
| Virtual asset service providers in Dubai (outside the DIFC) | Virtual Assets Regulatory Authority |
The supervisors issue sector guidance and rules that build on the federal regulations. The DFSA and the ADGM FSRA have their own AML rulebooks, which follow the same international standards but are more prescriptive in places. Onshore DNFBPs can find the Ministry of Economy and Tourism AML guidance and registration requirements on its website.
When customer due diligence is required
Due diligence is triggered by events, not only by account opening. The main triggers are:
- establishing a business relationship, including the steps before it is formally opened;
- carrying out an occasional transaction at or above the applicable threshold, which for financial institutions remains AED 55,000 (single or linked), with a lower figure of AED 3,500 for occasional wire transfers;
- virtual asset transactions at or above AED 3,500 for VASPs;
- any suspicion of money laundering, terrorist financing or proliferation financing, regardless of amount; and
- doubts about the accuracy of identification data already held.
DNFBPs face sector-specific triggers. Real estate agents apply due diligence to buyers and sellers in the transactions they handle; dealers in precious metals and stones are caught by cash transactions above the set threshold; and lawyers, accountants and corporate service providers are caught when they prepare or carry out specified transactions for clients, such as buying property, managing funds or forming companies. Our article on AML obligations for DNFBPs sets these out by sector.
The core elements of customer due diligence
- Identify the customer. For individuals, capture full name, nationality, date of birth, address and identity document details. For legal persons, capture name, legal form, registration details, address, constitutional documents and the names of senior management.
- Verify identity. Check the information against reliable, independent sources: original or certified documents, Emirates ID verification, the commercial register or a trusted digital identity service.
- Identify beneficial owners. Establish the natural persons who ultimately own or control the customer. The federal beneficial ownership rules use a 25 per cent ownership or voting threshold, with control by other means and senior management as fall-backs. Our article on UBO rules in the UAE explains the cascade.
- Check authority. Verify that anyone acting for the customer, such as a director or attorney, is authorised and identify that person too.
- Understand purpose and nature. Record why the customer wants the relationship, expected activity, volumes, counterparties and geographies, so later transactions can be tested against it.
- Risk-rate the customer. Assign a risk rating based on customer type, ownership, products, channel and geography, and decide whether simplified, standard or enhanced measures apply.
- Screen. Screen the customer, beneficial owners and controllers against the UN and UAE Local Terrorist lists and for PEP status and adverse media before onboarding. See our article on targeted financial sanctions and screening.
- Monitor on an ongoing basis. Review transactions against the customer profile and refresh due diligence at intervals that match the risk rating, and whenever trigger events occur.
The quality of customer due diligence UAE supervisors look for is in the "understand purpose and nature" step. Thin profiles make monitoring impossible: if the file does not say what normal activity looks like, no alert can show what is abnormal. Write the expected-activity profile as if a regulator will test every later transaction against it, because in an inspection they will.
Enhanced due diligence: triggers and measures
EDD applies wherever the institution's risk assessment or the regulations identify higher risk. Mandatory triggers include foreign PEPs and higher-risk domestic or international organisation PEPs, customers and transactions connected to jurisdictions the FATF calls on countries to act against or that the UAE designates as high risk, and complex or unusually large transactions with no apparent economic purpose.
The 2025 Executive Regulations tightened the measures. Commentary on the new regulations highlights that EDD now requires source of wealth as well as source of funds, senior management approval for any high-risk relationship rather than only for PEPs, and, in certain cases, that the first payment comes from an account in the customer's name at an institution subject to comparable due diligence standards.
| Level | When used | What changes |
|---|---|---|
| Simplified | Lower risk demonstrated by a documented risk assessment, never where suspicion exists | Reduced verification depth or frequency; identification still required |
| Standard | Most customers | Full identification, verification, beneficial ownership, purpose and ongoing monitoring |
| Enhanced | PEPs, high-risk jurisdictions, complex structures, unusual transactions, high-risk ratings | Source of funds and wealth, senior management approval, more frequent review, closer transaction monitoring |
Politically exposed persons
The PEP definition covers people entrusted with prominent public functions in the UAE or abroad, senior people at international organisations, and their family members and close associates. The new regulations expressly include senior officials of political parties. The aim is not to refuse PEPs but to understand where their wealth comes from and to monitor the relationship more closely, with senior approval for onboarding and continuation.
Source of funds versus source of wealth
The two are often confused. Source of funds is where the money for a particular transaction or relationship comes from: a salary account, the proceeds of a property sale, a dividend. Source of wealth is how the customer built their overall net worth: a business they founded, an inheritance, a career in a profession.
Good evidence is documentary and proportionate. For source of funds, bank statements showing the transfer path, sale and purchase agreements and dividend resolutions are typical. For source of wealth, audited accounts of the customer's business, tax returns from the home country, probate papers or public information about a listed shareholding can help. Record the explanation in your own words, note how each element was corroborated and flag what could not be verified.
Digital onboarding and simplified measures
The UAE permits digital identification, and many institutions now onboard customers remotely using UAE Pass, Emirates ID verification and liveness checks. Remote onboarding is not itself a reason for EDD, but it should be reflected in the risk assessment and supported by controls that achieve the same assurance as face-to-face verification.
Simplified due diligence remains available only where lower risk has been identified through a documented assessment. It reduces the depth or frequency of measures; it never removes the duty to identify the customer, and it ends the moment suspicion arises. Supervisors expect customer due diligence UAE files on simplified-measure customers to show why the lower rating was justified.
An illustrative scenario
This scenario is illustrative only; it does not describe a real client.
A Dubai real estate brokerage is approached by a buyer for a high-value villa. The buyer is a company registered abroad, owned through a trust, and the funds will come from a third-party account in another jurisdiction. One trust beneficiary is a close relative of a foreign minister.
This combination triggers enhanced measures. The brokerage needs to identify the trust's settlor, trustees, protector and beneficiaries, verify the company's ownership chain, establish why a third party is paying and document both the source of the purchase funds and the beneficiary family's source of wealth. Senior management must approve proceeding. If the explanations are inconsistent or cannot be verified, the brokerage should not proceed and should consider whether a suspicious transaction report is required through goAML.
The lesson is that customer due diligence UAE rules focus on the people behind the structure and the money, not just the named buyer.
Risks and common mistakes
Stopping at the first layer of ownership
Many files record the shareholder of the customer but not the natural persons behind it. Where ownership runs through holding companies, trusts or foundations, keep tracing until you reach individuals, and record the structure chart with sources. If you cannot identify a beneficial owner, you cannot complete due diligence and should not proceed with the relationship.
Treating onboarding as the end of the process
The 2025 law makes ongoing monitoring an express duty. Files that were complete at onboarding but never refreshed become non-compliant as customers change ownership, activity or risk. Set review cycles by risk rating, and define trigger events, such as a change of beneficial owner or a sudden increase in volumes, that force an earlier review.
Relying on third parties without control
Institutions sometimes accept due diligence performed by an introducer or group company without obtaining the underlying information promptly or checking the third party's standards. Reliance does not transfer responsibility. Where you rely on another party, obtain the core information immediately, ensure copies of documents are available without delay and document why the third party is adequately regulated.
Tipping off
When due diligence raises suspicion, staff may be tempted to ask the customer direct questions about money laundering or explain that a report is being made. Disclosing that a report has been or will be filed is a criminal offence. Train front-line staff on how to request information neutrally and escalate internally. Our article on goAML and suspicious transaction reporting explains the reporting route to the UAE Financial Intelligence Unit.
Poor record keeping
Records of identification, verification, risk assessments and transactions must be kept for at least five years, and the new regulations count that period from the most recent relevant event. Records must be retrievable quickly for supervisors and the FIU. Scattered email attachments and personal drives do not meet that standard.
The cross-border angle
Much UAE business involves customers, owners or funds from abroad. Groups operating across the UAE, Bangladesh, India, the UK, Singapore and China often want one global onboarding standard. That works if the global standard meets the strictest local rule: UAE requirements on source of wealth, senior approval and record retention should be checked against group policy rather than assumed.
Foreign documents raise practical questions: certification, translation into Arabic or English, and legalisation. Sanctions screening must cover the UAE lists as well as any lists the group applies for its home regulators. The UAE also evaluates its regime against FATF standards, and correspondent banks expect UAE institutions to show strong customer due diligence UAE controls, so weak files can affect banking relationships as well as regulatory standing.
Checklist for a robust customer due diligence UAE programme
- Update policies and procedures to reflect Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025.
- Refresh the business-wide risk assessment, including proliferation financing risk.
- Make source of wealth and senior management approval standard for every high-risk relationship.
- Trace ownership to natural persons and keep evidence of the chain.
- Write meaningful expected-activity profiles at onboarding.
- Set risk-based review cycles and trigger events for ongoing monitoring.
- Screen customers, owners and controllers against UN and UAE lists before onboarding and on list changes.
- Keep complete records for at least five years from the most recent event.
- Train staff on red flags, escalation and tipping off.
Where a supervisory inspection, a remediation project or an internal investigation is under way, our pages on white-collar crime and investigations and beneficial ownership and registers explain related workstreams. To review your customer due diligence UAE framework, contact TRW & Co. Where representation before UAE courts is needed, we work alongside locally licensed advocates.
Frequently asked questions
01What is the difference between CDD and EDD in the UAE?
Customer due diligence is the standard set of measures: identifying and verifying the customer and beneficial owners, understanding the purpose of the relationship and monitoring it. Enhanced due diligence adds further measures for higher-risk customers, such as PEPs or links to high-risk jurisdictions. Under the 2025 Executive Regulations, EDD includes establishing source of funds and source of wealth, obtaining senior management approval and monitoring the relationship more closely and more often.
02Who must carry out customer due diligence in the UAE?
Financial institutions, designated non-financial businesses and professions and virtual asset service providers. DNFBPs include real estate agents, dealers in precious metals and stones, auditors and accountants, corporate service providers, and lawyers and notaries when they carry out specified transactions. Firms in the DIFC and ADGM follow their own regulators' AML rules, which apply the same international standards. Other businesses still have sanctions duties even if not subject to full due diligence rules.
03When can CDD be completed after a relationship starts?
The general rule is to complete verification before establishing the relationship or carrying out the transaction. The regulations allow limited flexibility to complete verification shortly afterwards where risk is low, delay is necessary for normal business and the risks are managed. Institutions relying on that flexibility should set clear limits in their policies. It is never available where there is suspicion of money laundering or terrorist financing.
04Do I need to know a PEP customer's source of wealth?
Yes. For PEPs subject to enhanced measures, you must establish both the source of the funds involved in the relationship and the source of the customer's overall wealth, and obtain senior management approval. Under the 2025 regulations, source of wealth is required for high-risk customers generally, not only PEPs. Evidence can include employment and business records, sale documents, inheritance papers and audited accounts.
05What happens if I cannot complete customer due diligence?
You should not open the account, start the relationship or carry out the transaction, and for existing customers you should consider terminating the relationship. You must also consider whether the failure itself is suspicious and, if so, file a suspicious transaction report through goAML. Do not tell the customer that a report is being considered, because tipping off is an offence.
06How long must CDD records be kept in the UAE?
At least five years. Under the 2025 Executive Regulations the period runs from the most recent relevant event, such as the end of the relationship or the date of an occasional transaction. Records include identification documents, verification evidence, risk assessments, correspondence and transaction records, and must be retrievable quickly for supervisors and the Financial Intelligence Unit. Sector supervisors may set longer periods in some cases.
Sources and official materials
- UAE Legislation portal — Official texts of federal AML laws and Cabinet decisions
- Ministry of Economy and Tourism: Combating money laundering — DNFBP supervision, guidance and registration
- UAE Financial Intelligence Unit — goAML reporting and guidance
- ADGM Financial Services Regulatory Authority — AML rules for ADGM firms
- Central Bank of the UAE: Targeted financial sanctions — Screening and freezing obligations for licensed institutions
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
