Customer due diligence in the UAE: the four measures, when they tighten and when they simplify

The Ministry of Economy has issued an implementation guide for designated non-financial businesses and professions on customer due diligence. Its value is that it turns general legal text into applicable steps — exactly what a business needs when it knows it has an obligation but not what that obligation looks like in practice.

The four measures

Due diligence is not one procedure but four connected measures, and omitting any one undermines the value of the rest:

1 — Identify the customer and verify their identity

Where the customer is a legal person, this covers the name, legal form and memorandum of association; the headquarters address or principal place of business; the articles of association or similar document approved by the relevant authority; and the names of those holding senior management positions.

If the legal person is foreign, the name and address of its legal representative in the State must be included with supporting documents.

2 — Identify and verify the beneficial owner

Knowing the contracting company is not enough. You must reach the natural persons behind it and take reasonable measures to verify their identity from a reliable source, such that the business is satisfied it knows who the beneficial owner is.

3 — Understand the purpose and intended nature of the relationship

Why is this customer opening this relationship, and what activity is expected? The answer is documented, and becomes the benchmark against which any unusual transaction is later measured.

4 — Ongoing due diligence

The relationship is not examined once at onboarding. The fourth measure is continuous monitoring: are the customer's transactions still consistent with what we know about them? In practice this is the most neglected of the four.

When can due diligence be simplified?

The framework permits simplified measures, but on cumulative rather than optional conditions:

• The customer is rated low risk, through an adequate analysis of risks rather than a general impression
• There is no suspicion of money laundering or terrorist financing
• The customer's transactions are in line with the expected value and pattern

The guide also makes a fine point: a customer being lower risk in one respect does not automatically mean they are lower risk for all measures — particularly for ongoing transaction monitoring.

When do they tighten?

Enhanced due diligence means applying more rigorous measures to higher-risk customers: additional documentation, deeper scrutiny of transactions, and senior approval before the relationship begins or continues.

These are typically triggered by politically exposed persons, customers from jurisdictions rated high risk or with weak controls, and complex structures with no commercial rationale.

Record keeping: five years

Firms operating in the UAE must retain relevant due-diligence records for **at least five years after the end of the business relationship**. Records may be electronic, hard copy, or both.

The documents to be kept include:

• Copies or records of official identification documents: passports, identity cards, driving licences or similar
• Evidence of sanctions screening, at onboarding and on an ongoing basis
• All documents and records obtained through due-diligence measures

Where do findings actually arise?

In our experience, the finding is rarely that a business performed no due diligence at all. The more common finding is that the step was taken and nothing evidences it.

• Verification done verbally or visually and never recorded in the file
• A client file completed at onboarding and never updated since
• Sanctions screening run once at the start and never repeated
• A beneficial owner recorded as the direct shareholder without tracing the chain
• Simplified measures applied with no documented risk analysis to justify them

The practical rule is simple: what cannot be evidenced is treated as though it never happened. That matters more since the 2025 law lowered the knowledge threshold, making your written record your first line of defence.

What to do now

• Review your due-diligence template: does it cover all four measures?
• Test a sample of client files the way an inspector would, not the way you hope
• Confirm there is a periodic refresh cycle rather than a single onboarding moment
• Document any simplification decision with written risk analysis, not assumption
• Check retention periods and calculate them from the date the relationship ended