Individual KYC Compliance Tool: Interactive KYC Checklist for Natural Persons

The first step collects the core identifying information that every individual customer must provide, without exception.

Full name is collected as the customer commonly uses it and cross-referenced against the identity document. The tool's guidance makes an important practical distinction: minor variations - a missing middle name, a transliteration difference - are common and should be noted rather than treated as automatic red flags. A materially different name must be investigated before onboarding proceeds.

Nationality covers all citizenships for dual nationals. Both must be recorded because nationality drives the PEP and sanctions screening lists that apply and contributes to the geographic risk score.

Date of birth and place of birth are both compulsory. Date of birth is a primary deduplication field in PEP and sanctions screening. Place of birth, carried forward from Cabinet Resolution No. (10) of 2019, serves as a secondary deduplication field and can be captured by self-declaration where it does not appear on the identity document.

The second step collects the official government-issued documents that evidence the customer's identity. The applicable document depends on the customer's residency status.

Emirates ID is the primary identity document for UAE residents and citizens. Expired Emirates IDs are not acceptable.

Passport is required for non-residents or where Emirates ID is unavailable. The machine-readable zone should be verified. Expired passports must not be accepted.

Visa or Residence Permit is marked as a Best Practice item - reflected in the tool's purple badge as distinct from the green compulsory badge. Collecting the UID number, permit type, and expiry date is strongly recommended for expatriate customers because it corroborates immigration status and Emirates ID validity. An overstayed or expired visa is a red flag that must be escalated before onboarding proceeds.

The third step documents where the customer lives and, where applicable, who employs them.

Residential address must be a full street address - building, apartment, city, country. A PO Box alone is not sufficient. Address inconsistencies between what the customer declares and what appears on their documents must be explained and documented.

Address proof is a compulsory field requiring one supporting document to verify the residential address. The tool recommends accepting four document types: a utility bill (electricity, water, gas, or telecom) in the customer's name; a government-issued document showing the residential address; a tenancy contract or lease agreement registered with the relevant authority, such as Ejari in Dubai; or a bank or account statement issued by a government-regulated financial institution. The document should generally be dated within the last three months. Documents in languages other than English or Arabic should be accompanied by a certified translation.

Employer name and address is required where the customer is employed, as expressly stated in Art. 8 of Cabinet Resolution No. (134) of 2025. Self-employed customers should provide their business name and address. Employment details are cross-referenced against the source of funds to check for consistency.

The fourth step moves beyond identity into understanding why the customer is engaging your services and how transactions will be funded.

Nature and purpose of the business relationship must be documented for every customer, not just high-risk ones. A vague or undisclosed purpose is a regulatory red flag

Source of funds covers how the customer will fund the specific transactions conducted with the DNFBP. It is distinct from source of wealth. Documentary evidence should be requested where the transaction amount is significant or the declared source is unclear.

PEP self-declaration is the third field in this step and is marked as a Best Practice item. The tool's guidance is explicit on a critical point: a negative self-declaration does not replace independent PEP screening against recognised databases. Screening must be performed for every customer regardless of what they declare. A positive declaration should automatically trigger EDD and require senior management sign-off.

The summary page serves two functions: reviewing what has been collected and assigning the customer risk rating.

Collection review shows a full item-by-item breakdown across all four steps, with green ticks for collected items, red crosses for outstanding required items, and purple dashes for Best Practice items not yet collected. A status banner flags any gaps that must be addressed before onboarding is finalised.

Risk rating assignment is a deliberate decision made here - after collection - because you cannot accurately assess customer risk until you have reviewed the information. The compliance officer selects Standard or High Risk based on the information reviewed and their firm's Customer Risk Assessment methodology.

Selecting Standard Risk confirms that standard CDD is sufficient and provides a reminder about document retention and ongoing monitoring obligations. Selecting High Risk triggers the EDD outcome panel, listing the four additional items that must be collected: occupation and profession, source of wealth, volume and quantum of assets, and TIN where one exists - plus the requirement for senior management sign-off.