UAE compliance guide
KYC in the UAE: the complete guide
Who must perform KYC in the UAE, what documents are used, how Emirates ID and UAE PASS fit in, and how to keep evidence your regulator will accept.
Short answer
KYC in the UAE means identifying and verifying every customer before a business relationship starts, screening them against sanctions and PEP lists, rating their risk, and keeping the evidence. It applies to banks, fintechs, virtual asset providers, insurers, brokers and designated non-financial businesses supervised by UAE regulators.
Last reviewed by the ITSEC compliance team. General information, not legal advice.
Who has to perform KYC in the UAE?
Any financial institution, virtual asset service provider (VASP) or designated non-financial business or profession (DNFBP) covered by the UAE's federal AML/CFT framework.
Your supervisor depends on your license: CBUAE for banks, exchange houses and payment firms, VARA for virtual asset activity in Dubai outside the DIFC, CMA for securities, DFSA inside the DIFC and FSRA inside ADGM.
What documents are used for KYC in the UAE?
For UAE residents and citizens, the Emirates ID is the primary identity document. Passports are used for non-residents and as a secondary document.
Depending on risk and your regulator's rulebook, you may also collect proof of address, source of funds and source of wealth evidence.
What does a complete KYC check include?
Document authentication, a biometric face match against the document portrait, liveness detection to prove a real person is present, and screening against sanctions, PEP and adverse media sources.
The results are combined into a risk rating that decides whether the customer is approved, referred for review or declined.
How does UAE PASS relate to KYC?
UAE PASS is the UAE's national digital identity. It can supply government-sourced identity data with the customer's consent. VerifiX UAE PASS integration is coming soon.
How long must KYC records be kept?
UAE AML/CFT rules require customer due diligence records to be retained for a minimum period after the relationship ends. Confirm the exact period in your regulator's current rulebook.
Frequently asked questions
- Is eKYC allowed in the UAE?
- Yes. UAE regulators allow digital onboarding when identity is verified to the standard their rules require, including biometric and liveness controls, and the evidence is retained.
- Is the Emirates ID enough for KYC?
- The Emirates ID is the primary identity document for residents, but a complete KYC file also needs screening, a risk rating and, for higher-risk customers, enhanced due diligence.
- What is the difference between KYC and CDD?
- KYC is the common name for the process. Customer due diligence (CDD) is the regulatory term for the baseline checks: identify, verify, understand the relationship and monitor it.
Official sources
Related on VerifiX
See VerifiX on your own onboarding flow
A 30-minute walkthrough with a compliance engineer, or a request for sandbox access.