The Federal Decree by Law No. (10) of 2025 and related cabinet decisions and guidelines require DNFBPs and VASPs to adopt a risk-based approach and carry out Customer Due Diligence (CDD).

Know Your Customer (KYC) has been a crucial component of CDD requirements and we often get queries from DNFBPs and VASPs related to the legal requirements around it.

The webinar on “Decoding KYC Requirements: A Crucial Element of AML Compliance in the UAE” was conducted successfully on June 5, 2024, from 11 am to 12 pm (GST).

The webinar addressed the AML/CFT Regulatory Framework in the UAE, KYC meaning and its significance, KYC requirements for individuals and corporates, circumstances and timing for conducting KYC, common deficiency around KYC measures employed by entities, significance of KYC remediation in AML compliance, best practices for conducting KYC, UBO identification, restrictions on establishing business relationships under UAE AML regulations, and red flags associated with customers with respect to KYC.

Thanks for attending our webinar.

In case you missed it, here is a recording and presentation that recaps everything we covered. 

Registering on the go-AML portal of the UAE FIU is the main prerequisite under the AML framework. It is imperative for the regulated entity to verify that the business facts and information accessible on the go-AML site are up to date.

Having an AML Compliance Officer capable of framing and implementing AML rules and procedures is the second critical component required to drive the AML program.

To determine the appropriate controls needed to reduce the detected risk and evaluate the possible exposure to financial crime risks, regulated entities must conduct an enterprise-wide risk assessment.

Customer Due Diligence becomes inevitable at the time of entering a business relationship with a customer by the Financial Institutions, DNFBPs, and VASPs. It is a very crucial process and needs to be performed with caution and utmost efficiency.

This video explains three types of Customer Due Diligence measures:

• Simplified Due Diligence: When the risk posed by a particular customer is classified as low, then Simplified Due Diligence must be applied.
• Standard Due Diligence: When risk posed is classified as medium or when the simplified Due Diligence outcome is not satisfactory.
• Enhanced Due Diligence: When, after conducting a customer risk assessment, the customer is classified as high-risk, then Enhanced Due Diligence must be carried out.

The senior management of a regulated entity must know the status of its AML compliance. Further, regulated entities are required by law to take a risk-based approach to counter ML/TF. It is the senior management that will decide if the ML/TF risks are acceptable, considering their risk appetite. It is imperative for the compliance officers to prepare periodic reports for the senior management to comply with regulatory requirements and ensure that the proper risk management practices are in place.

An overview of the changes made to the AML rules during the period must be included in this periodic report. Reference to how these modifications impact the business operations of regulated entities is also required.

Using the appropriate technology to support AML operations is becoming important as a result of evolving financial crime typologies and shifting AML requirements.  All regulated entities need to consider utilising the capabilities of cutting-edge technologies and solutions to improve the accuracy and efficiency of their AML compliance programmes.

The AML compliance obligations placed on the company must be comprehended and assessed by the regulated entities. The entity’s compliance tasks must take into account the relevant regulatory environment as well as the findings of the Enterprise-Wide Risk Assessment.

It is very important to understand the source of funds and the source of wealth of a customer to bring transparency to the transactions, as businesses deal with high-risk customers regularly, posing an increased risk of financial crimes. It is important to determine the financial position of the customer to identify the origin of the customer’s funds and get information about the possible connection with financial crime or any other criminal activities.

When the means of funds and wealth, as disclosed by the customer, do not align with the customer’s declared wealth, it indicates suspicious activity. It helps you identify whether the transaction proposed is aligned with the customer’s source of funds and wealth.

The regulated entities must identify the suspicions related to money laundering or terrorism financing and report the same to FIU. It is very important to determine when the report is to be filed on the goAML Portal.

A Suspicious Activity Report (SAR) is to be filed when the regulated entities have reasonable grounds to believe any activity or transaction of the customer is related to any financial crime or money laundering/terrorist activities.

Identity verification is a crucial aspect of the Customer Due Diligence Process to ensure the authenticity of the identity presented. Identity Verification is the process of confirming the prospect’s claimed identity by cross-referencing the given information with official government-issued documents such as an Emirates ID in the UAE.

Various methods of identity verification:

• Document verification
• Biometric verification
• Credit Bureau-Based Authentication
• Database Identification Methods
• Knowledge-Based Authentication
• Online Verification
• Two-Factor Authentication (2FA)
• Device Verification