CDD & KYC

Customer due diligence for UAE DNFBPs: identity, beneficial ownership and the risk-based approach

Sanctions screening tells you who you must refuse outright. CDD is how you decide everyone else: who they really are, who actually owns them, and how closely you need to keep watching.

groAML compliance team Grovisor Business Consultants FZE
Published Updated 11 min read

Checked against the Ministry of Economy's Implementation Guide on CDD and secondary compliance sources; the text of Cabinet Resolution No. 134 of 2025 (Executive Regulations, in force 14 December 2025) has not been re-verified

On this page

At a glance

  • CDD applies at onboarding and is also triggered by occasional transactions and wire transfers above monetary thresholds (reported as AED 55,000 and AED 3,500 under Cabinet Resolution 134/2025; confirm against the Resolution). For some DNFBP sectors, such as dealers in precious metals and stones and real estate, AED 55,000 is also tied to cash-transaction reporting, a separate duty from CDD. Confirm which applies to you.
  • Beneficial ownership is traced to the natural person(s) who ultimately own or control the reported threshold of 25% or more (confirm against the Resolution), falling back to the senior managing official when no one meets it.
  • The risk-based approach has three tiers — simplified, standard and enhanced due diligence — and the tier follows the customer's risk score, not a fixed rule per customer type.
  • Our approach is to treat a sanctions hit, PEP status, a high-risk jurisdiction or opaque ownership as triggers for enhanced due diligence regardless of the computed score.
  • CDD is not a file you close at onboarding: ongoing monitoring and periodic review are a separate, continuing obligation.
Who this is for:Real estate brokers and agentsDealers in precious metals and stonesCorporate service providersAuditors and accountantsLawyers and notaries

What CDD actually requires

Customer due diligence is the work of answering three questions about everyone you do business with: who are they, who actually stands behind them, and how much risk does that relationship carry. It is a continuing obligation that starts before you onboard a customer and keeps running for as long as the relationship lasts.

Where this sits relative to sanctions screening Sanctions screening (see our 24-hour rule guide) is a binary check against specific lists, with its own freeze-and-report duty. CDD is everything else: identity, ownership, purpose of the relationship, and the ongoing judgement about how closely to watch it. A customer can pass sanctions screening cleanly and still need enhanced due diligence.

Verifying identity, including who's behind it

For a natural person, that means a valid, unexpired identity document (passport, Emirates ID) and enough supporting detail — nationality, date of birth, address — to be confident you have the right individual. For a legal person or arrangement, identity verification extends to:

  • the entity's constitutional documents, trade licence and registered address;
  • the names of directors, partners and anyone with authority to bind the entity;
  • the ownership and control structure, down to natural persons; and
  • the purpose and intended nature of the business relationship.

Verification means checking that documentation against an independent, reliable source — not simply accepting what the customer hands you.

Beneficial ownership: down to the natural person

This is where most CDD files fall short in practice. A company's shareholder register tells you who owns shares; it doesn't tell you who ultimately benefits or controls, especially once holding companies, trusts or nominee arrangements are involved. Cabinet Resolution No. 134 of 2025 is reported to define a beneficial owner as a natural person who ultimately owns or controls 25% or more of the shares or voting rights, directly or indirectly, or who exercises control by other means. Confirm the threshold against the Resolution text.

No one meets the threshold? Say so. If ownership is diffuse enough that no natural person crosses 25%, you fall back to identifying the senior managing official — and you record, explicitly, that no beneficial owner above the threshold could be identified. That statement, dated and reasoned, is the correct outcome in some structures. A blank beneficial-ownership field is not.

Multi-layer and offshore structures need the chain traced all the way through, not just to the first holding company. A customer who can't or won't produce an ownership chain is itself a risk signal, and one that typically pushes the relationship toward enhanced due diligence rather than a shrug.

When CDD is triggered, and the AED thresholds

CDD is always required when you establish a business relationship. Beyond that, Cabinet Resolution No. 134 of 2025 is reported to set specific monetary triggers for occasional (non-relationship) transactions:

TriggerThreshold
Occasional transaction (no ongoing relationship)AED 55,000 or more, single or linked transactions (as reported; confirm against the Resolution)
Wire transferAED 3,500 or more (as reported; confirm against the Resolution)

CDD is also required whenever money laundering or terrorist financing is suspected, or when you doubt the accuracy of identification data already on file — both apply regardless of transaction size.

AED 55,000 is not only a CDD trigger. For some DNFBP sectors, such as dealers in precious metals and stones and real estate, AED 55,000 is also tied to cash-transaction reporting to the FIU through goAML, which is a separate duty from CDD. Confirm which applies to you. Which dealings and report types apply to your sector, and the exact threshold, are for you to confirm with your supervisory authority or a UAE-qualified adviser.

Simplified, standard or enhanced: the three tiers

CDD is not one fixed procedure. The risk-based approach gives you three tiers, and the tier follows the customer's assessed risk, not just their category:

TierWhen it appliesWhat changes
Simplified (SDD)Lower-risk customer, supported by your own documented risk assessment, with no EDD trigger presentLighter identity verification and longer periodic-review intervals
StandardThe default tier for most customersFull identity and beneficial-ownership verification, ordinary monitoring cadence
Enhanced (EDD)Any EDD trigger is present — see belowSenior-management sign-off, source-of-wealth checks, shorter review cycles, closer transaction monitoring

How a specific customer lands in one tier rather than another is the output of a risk assessment, not a judgement call made on the spot — see our guide to risk assessment and risk scoring for how that works.

What triggers enhanced due diligence in our approach

In our approach, some conditions move a customer to enhanced due diligence regardless of what the rest of the score says:

  • a politically exposed person (PEP), their family member or close associate;
  • a customer or transaction connected to a FATF high-risk or increased-monitoring jurisdiction;
  • a sanctions or Local Terrorist List hit (which also triggers the separate freeze obligation);
  • unexplained complexity in ownership or transaction structure with no clear business rationale; and
  • adverse media alleging financial crime, even absent a conviction.

Source of funds and source of wealth

For higher-risk customers, verifying identity and ownership is not enough — you also need to understand where the money in a specific transaction came from (source of funds) and, for PEPs and other higher-risk relationships, how the customer built their overall wealth (source of wealth). Both need documentary support where reasonably available: payslips, sale agreements, audited accounts, inheritance or gift documentation. An explanation you can't tie to any evidence is a gap in the file, not a completed check.

How groAML handles this

groAML's customer case file carries beneficial ownership (with an ownership diagram), risk scoring, transaction monitoring, adverse media checks and an evidence pack in one place, with every decision kept in an append-only audit trail — so a CDD file is already organised and quick to produce when an inspector asks for it, not reconstructed from scratch.

See how it works

Ongoing monitoring: CDD doesn't end at onboarding

A CDD file that is accurate on day one and never looked at again is not compliant on day two. Ongoing monitoring means:

  1. Transaction monitoring against the customer's expected profile, flagging activity that doesn't fit;
  2. Periodic reviews at an interval set by risk rating — more frequent for higher-risk customers;
  3. Event-driven re-checks whenever something material changes: new beneficial owners, a change of business activity, a jurisdiction change, an adverse-media hit, or a transaction pattern that no longer makes sense; and
  4. Re-screening against sanctions and PEP lists whenever those lists update, not just at onboarding.

Records to keep

  • Identity documents and the beneficial-ownership chain, including how you verified them.
  • The risk assessment and its dated history, not just the current rating.
  • Source-of-funds/wealth evidence for every higher-risk relationship.
  • Every periodic review and event-driven re-check, with its outcome.

Keep all of it for the period the law requires, counted from the end of the relationship or the other events the law specifies. groAML's default retention plan is 10 years. We do not quote a statutory minimum here: confirm it against the current law or with a UAE-qualified adviser.

Your CDD readiness checklist

Tick these off for your firm. Your progress is saved in this browser, and the page prints cleanly as a handout.

CDD & KYC readiness10 items

Saved only on this device. Nothing is sent to us.

Frequently asked questions

Is CDD the same thing as KYC?
In practice, UAE guidance uses them together. “KYC” usually refers narrowly to identifying and verifying the customer; “CDD” is the broader obligation that also covers beneficial ownership, the purpose and nature of the relationship, source of funds where relevant, and ongoing monitoring. Every KYC check is part of CDD, but CDD doesn't stop once KYC is done.
What exactly is the beneficial ownership threshold?
The Executive Regulations are reported to set it at 25% or more of the shares or voting rights, or control by other means (confirm against the Resolution text). If no natural person meets that threshold, you identify the senior managing official instead and record that you could not identify a beneficial owner above 25% — that is itself a fact to record, not a reason to leave the field blank.
When can we apply simplified due diligence?
Only where your own documented risk assessment supports a lower risk for that customer type, and our approach is never to apply it where a sanctions hit, PEP status or a high-risk jurisdiction is present — we treat those as requiring at least standard due diligence, usually enhanced. Simplified due diligence reduces the intensity of ongoing checks; it never removes the duty to identify the customer and its beneficial owners at all.
What's the difference between source of funds and source of wealth?
Source of funds is where the money in this specific transaction came from (a salary, a sale proceeds, a loan). Source of wealth is the broader picture of how the customer accumulated their overall net worth. Higher-risk customers, and PEPs specifically, need both established and documented, not just the narrower source of funds.
How often must we refresh CDD on an existing customer?
On a schedule set by the customer's risk rating (high-risk customers reviewed far more often than low-risk ones), and immediately whenever something material changes — new beneficial owners, a change in business activity, a sanctions or adverse-media hit, or a transaction pattern that no longer fits the profile on file.
Does a sanctions screening hit change the CDD outcome?
A confirmed sanctions or Local Terrorist List match isn't a CDD risk factor to weigh — it's a freeze-and-report obligation that sits outside the scoring model entirely. See our guide to the 24-hour rule for what happens next; CDD and risk scoring apply to everyone the sanctions check clears.

Sources

  1. Cabinet Resolution No. 134 of 2025 on the Executive Regulations of Federal Decree-Law No. 10 of 2025, UAE Cabinet / Central Bank of the UAE Rulebook. In force 14 December 2025; reported to set the beneficial-ownership and CDD-trigger thresholds (figures not re-verified against this text)
  2. Implementation Guide on CDD, UAE Ministry of Economy and Tourism
  3. The Complete Guide to the Ultimate Beneficial Owner Verification, AML UAE (amluae.com)
  4. UAE AML Law 2025: Complete Guide to UAE AML Compliance, Zigram. Secondary commentary (vendor blog) that repeats the AED 55,000 / AED 3,500 and 25% figures; not a primary source, so confirm against the Resolution text

This guide is general information, not legal advice. It reflects the sources listed above as of 4 Oct 2026. Check the current EOCN guidance and confirm with your supervisory authority or a UAE-qualified adviser how these obligations apply to your business.

Sanctions & TFS

The 24-hour freezing rule: a practical guide to sanctions screening for UAE DNFBPs

Which lists trigger the 24-hour freeze, what to do in the first day after a match, how to report it on goAML, and how to build a screening process that holds up in an inspection.

11 min read
 goAML reporting

STR and SAR filing on goAML: a practical guide for UAE DNFBPs

What goAML actually is, the real difference between an STR and an SAR, what triggers a filing obligation, realistic timelines, and the record-keeping duty that goes with every report you file.

10 min read
 Risk assessment

AML/CFT risk assessment for UAE DNFBPs: what it must cover, and why it is never finished

What a business-wide and customer risk assessment actually has to cover under Cabinet Resolution No. 134 of 2025, how risk scoring feeds the CDD tier, and why risk-scoring methodology is changing industry-wide.

11 min read

Make the 24-hour rule routine

groAML screens against the UAE Local Terrorist List and the UN Consolidated List, matches Arabic names properly, and keeps a dated record of every check, match and decision.

See how groAML works Talk to Grovisor