KYC in the UAE: CDD vs EDD Explained for Regulated Businesses
What UAE AML rules require for KYC: customer due diligence, beneficial ownership, when enhanced due diligence applies, and ongoing monitoring.
Know Your Customer (KYC) is the foundation of every AML/CFT programme in the UAE. Financial institutions, virtual asset service providers and DNFBPs must identify their customers, understand who ultimately owns and controls them, and apply more scrutiny where the risk is higher. The current framework is set by Federal Decree-Law No. 10 of 2025 and its executive regulation, Cabinet Resolution No. 134 of 2025.
Customer due diligence (CDD)
Standard CDD typically covers:
- Identifying the customer and verifying their identity with reliable documents or data
- Identifying the beneficial owners and taking reasonable steps to verify them
- Understanding the purpose and intended nature of the business relationship
- Assessing the customer's risk level
- Ongoing monitoring of the relationship and transactions
When enhanced due diligence (EDD) applies
EDD is required where risks are higher, and must be proportionate to that risk. Common triggers include politically exposed persons (PEPs), customers connected to high-risk countries identified by the UAE authorities, complex or unusual structures and transactions, and other high-risk indicators identified in your risk assessment.
Typical EDD measures include:
- Obtaining additional information on the customer and beneficial owners
- Establishing the source of funds and source of wealth
- Senior management approval to start or continue the relationship
- More frequent and detailed ongoing monitoring
Simplified due diligence
Simplified measures may be permitted for genuinely lower-risk customers, but only where there is no suspicion of money laundering or terrorist financing, and the reasoning should be documented.
Making KYC work in practice
- Base your KYC levels on a documented customer risk assessment
- Screen customers against sanctions and PEP lists at onboarding and on an ongoing basis
- Keep records for the period required by law
- Refresh KYC periodically and when something changes
- For crypto businesses, add on-chain checks: screen customer wallets with KYT
Key takeaways
- UAE KYC rules come from Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.
- EDD applies to higher-risk customers such as PEPs and links to high-risk countries.
- Simplified measures need low risk, no suspicion and a documented rationale.
Related VAF services
Related licence guides
Need help with this?
Talk to our compliance team about your licence, AML/CFT framework or transaction monitoring.
This article is general information, not legal advice. Regulatory requirements change; confirm current rules with the relevant regulator.