KYC & Customer Due Diligence Advisory

Know Your Customer (KYC) is generally used to describe the identification and verification of who a customer is — name, legal form, identity documents, beneficial ownership. Customer Due Diligence (CDD) is the broader risk-based framework that includes KYC identification but also covers understanding the purpose of the relationship, assessing and rating risk, screening against sanctions and PEP lists, and ongoing monitoring for the life of the relationship. In practice the terms are often used together or interchangeably in the UAE regulatory context, but CDD is the more complete and legally precise term used in Federal Decree-Law No. 20 of 2018.

Financial institutions regulated by the UAE Central Bank, securities and investment firms under the Securities and Commodities Authority, Virtual Asset Service Providers under VARA or the relevant emirate regulator, and Designated Non-Financial Businesses and Professions (DNFBPs) under the Ministry of Economy. DNFBPs specifically include real estate agents and developers involved in property sale/purchase transactions, dealers in precious metals and stones for cash transactions above the prescribed threshold, corporate service providers (company formation agents, registered agents, nominee directors/shareholders), and independent legal professionals and independent accountants and auditors when carrying out specified activities on behalf of a client, such as managing client funds or acting in company formation.

Operating without a documented risk assessment, CDD procedures, and goAML registration where required is a breach of Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions. Consequences on inspection or discovery can include administrative fines set out in Cabinet Decision No. 10 of 2019 (as amended), corrective action directives with mandated timelines, and in serious or repeated cases, licence suspension or referral for further regulatory or criminal action. The exact fine schedule and escalation path depend on the supervisory authority and the nature of the breach.

A beneficial owner is the natural person who ultimately owns or controls a customer, whether through direct or indirect shareholding, voting rights, or other means of control — even where that person's name does not appear on the trade licence or shareholder register. Cabinet Decision No. 58 of 2020 (as amended) sets the standard threshold at 25% direct or indirect ownership or control, though control can also arise through other mechanisms such as the right to appoint or remove directors, regardless of shareholding percentage. Entities must identify and verify these individuals, not just the immediate corporate or nominee shareholder shown on paper.

A PEP is an individual who holds or has held a prominent public function — a head of state, senior government official, senior judicial or military official, senior executive of a state-owned enterprise, or senior political party official — together with their immediate family members and close associates. UAE AML regulations require enhanced due diligence for PEP relationships regardless of the customer's home jurisdiction: senior management approval before onboarding, a documented source-of-funds and source-of-wealth assessment, and enhanced ongoing monitoring for the life of the relationship.

goAML is the electronic platform operated by the UAE's Financial Intelligence Unit (part of the Central Bank) through which regulated entities register, submit Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs), and — for certain sectors — file additional prescribed reports. Entities within scope of the AML/CFT law, including DNFBPs, are generally required to register on goAML as part of their overall compliance obligation, since the reporting mechanism has to exist and be accessible before a suspicious transaction obligation can actually be discharged.

An STR (sometimes referred to as a SAR — Suspicious Activity Report) must be filed via goAML whenever an entity has reasonable grounds to suspect that funds, a transaction, or an attempted transaction is connected to money laundering, a predicate crime, terrorist financing, or proliferation financing — regardless of the transaction amount and even if the transaction was ultimately not completed. There is no minimum monetary threshold; suspicion, not transaction size, is the trigger.

Tipping off is directly or indirectly informing a customer, or any third party, that a Suspicious Transaction Report has been filed, is being considered, or that an investigation is underway. Under Federal Decree-Law No. 20 of 2018, tipping off is a separate criminal offence from the underlying money laundering or terrorist financing conduct, because it defeats the entire purpose of the reporting mechanism — allowing the customer to move funds, destroy evidence, or otherwise evade detection once alerted.

Risk rating is built from four dimensions applied to each customer: customer risk (individual versus corporate, industry, ownership complexity), geographic risk (home jurisdiction and transaction counterparty jurisdictions, including any FATF-flagged exposure), product/service risk (nature of the transaction), and delivery channel risk (face-to-face versus remote onboarding). Simplified due diligence can apply to genuinely lower-risk customer categories where your documented risk assessment supports it, but it can never be applied automatically or as a default — and it can never apply to a customer or jurisdiction that carries elevated risk indicators regardless of how the relationship is otherwise structured.

DIFC entities regulated by the Dubai Financial Services Authority (DFSA) and ADGM entities regulated by the Financial Services Regulatory Authority (FSRA) operate under their own AML rulebooks specific to those financial free zones, which sit alongside — and are generally aligned in substance with — the federal AML/CFT framework under Federal Decree-Law No. 20 of 2018. The specific forms, reporting mechanisms, and supervisory relationship differ by free zone, so a DIFC-regulated entity's CDD programme must be built against the DFSA rulebook specifically, not a generic mainland template.

UAE AML law requires customer identification records, CDD documentation, and transaction records to be retained for a minimum prescribed period following the end of the business relationship or the date of the transaction, and to be made available to the competent supervisory authority on request within the timeframe given. The precise retention period and any sector-specific variations should be confirmed against the current Cabinet Decision and any relevant sector-regulator rulebook applicable to the entity, since retention requirements have been refined through amendments over time.

The Compliance Officer (often referred to as the Money Laundering Reporting Officer, or MLRO) is responsible for the entity's ongoing AML/CFT programme: reviewing escalated customer relationships, approving higher-risk onboarding, deciding whether an internal escalation rises to the level of an STR/SAR filing, maintaining the risk assessment and policy documents as current, coordinating staff training, and acting as the primary point of contact for the Ministry of Economy, Central Bank, or relevant sector regulator during any inspection or correspondence.

PNPC can provide retained AML advisory support to a designated internal Compliance Officer, and in appropriate structures can support the compliance function on an ongoing outsourced basis, depending on the entity's regulatory category and what the applicable rulebook permits for that role. The specific arrangement — advisory support versus a formally designated function — is scoped based on your sector, size, and supervisory requirements, and confirmed in writing before the engagement begins.

No — they were always separate regimes with separate triggers. Economic Substance Regulations under Cabinet Decision No. 57 of 2020 and Ministerial Decision No. 100 of 2020 tested whether a UAE entity carrying out a defined 'relevant activity' (such as holding company business, IP business, or distribution and service centre business) maintained adequate substance in the UAE. Importantly, the Ministry of Finance discontinued the ESR notification and report filing requirement for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024 — so for most entities today, ESR is a closed historical-period question rather than a live ongoing filing obligation, while AML/CFT and CDD obligations continue on an ongoing basis for any entity whose licensed activity falls within a regulated financial or DNFBP category. An entity can have historical ESR exposure, current AML/CFT exposure, both, or neither — the two applicability tests were always independent of each other.

Yes. Corporate service providers — entities that form companies, act as a registered agent, or provide nominee director, nominee shareholder, or company secretary services — are explicitly captured within the DNFBP category under UAE AML law when carrying out those activities for clients. This means CDD must be applied to the ultimate client requesting the company formation or nominee service, with beneficial ownership identification extending through to the natural person who will actually control the entity being formed — not just the immediate instructing party.

Yes, materially. Accepting or facilitating virtual asset transactions can bring an entity within the scope of Virtual Asset Service Provider (VASP) regulation — supervised in Dubai by VARA, and by other frameworks in other emirates and free zones — which carries its own, generally more stringent, AML/CFT and CDD requirements, including specific travel-rule-style obligations for transferring identifying information alongside virtual asset transfers. A business that starts accepting crypto payments without reassessing its regulatory scope risks operating outside a licensing framework it did not realise applied.

AML/CFT compliance is the broader framework addressing money laundering, terrorist financing, and proliferation financing risk through CDD, monitoring, and reporting. Sanctions compliance specifically addresses screening against designated persons and entities lists — the UAE Local Terrorist List, UN Consolidated Sanctions List, and other applicable lists — to ensure the entity does not deal with a sanctioned party. Sanctions screening is a mandatory component within a complete AML/CFT and CDD programme, not a separate, optional add-on.

Real estate brokers and developers are explicitly designated DNFBPs when involved in transactions concerning the buying and selling of real estate on behalf of clients. High-value, often cash-adjacent property transactions, layered ownership structures (including foreign and offshore buyers), and the historical role of real estate in laundering typologies make this a sector supervisors scrutinise closely. CDD obligations apply to both the buyer and seller side of a transaction the broker or developer facilitates, with beneficial ownership identification extending through any corporate or trust purchasing vehicle.

At minimum annually, and additionally whenever there is a material change in the business — a new product or service line, entry into a new customer segment or geographic market, a change in ownership or control, or a relevant new Cabinet Decision, Ministerial Decision, or FATF guidance update. A risk assessment that has not been revisited in several years, regardless of how well-drafted it originally was, is itself a common inspection finding because it no longer reflects the business as it currently operates.

Typically: the AML/CFT policy and risk assessment documents, a sample of customer onboarding files across different risk ratings, the beneficial ownership register, screening records and evidence of periodic re-screening, staff training records, any STRs filed (or a defensible explanation of why none have been filed, if applicable), the Compliance Officer's designation and reporting evidence, and goAML registration confirmation. Inspectors typically walk through several actual customer files in detail to test whether the documented procedure matches what staff actually did.

No — if the business falls within a regulated category (DNFBP, financial institution, VASP), the AML/CFT and CDD obligation applies regardless of size or transaction volume. The scale and complexity of the programme can and should be proportionate to the size and risk profile of the business — a small corporate service provider's procedures will look different from a large real estate developer's — but 'we are too small to need this' is not a recognised exemption under UAE AML law.

A policy document states what should happen. An operating programme is evidence that it actually does — completed onboarding files matching the documented procedure, screening records showing checks were actually run and at the stated frequency, training attendance records, and a Compliance Officer who can answer specific questions about recent decisions. Supervisors inspect the operating programme, not the policy document in isolation; a well-written policy with no supporting evidence of execution reads, on inspection, almost the same as having no policy at all.

PNPC's core engagement is the advisory and policy/procedure design work — the risk assessment, CDD framework, and compliance discipline. Where a client does not already have a screening tool, we advise on selection criteria matched to transaction volume, budget, and risk profile, and coordinate the implementation, but we are not a technology vendor ourselves. For clients who already have a screening tool, we assess whether its list sources, update frequency, and configuration actually support the documented procedure.

These are distinct regulatory regimes with no direct legal dependency — a business can be fully Corporate Tax and VAT compliant while having a materially deficient AML/CFT programme, and vice versa. That said, the same underlying accounting and transaction records that support your tax filings are often relevant evidence in an AML file review, and PNPC's integrated view across tax, accounting, and AML advisory means inconsistencies between what a customer file says and what the transaction ledger shows are more likely to be caught internally before a regulator finds them.

Source of funds refers to the origin of the specific funds used in a particular transaction — for example, the bank account or sale proceeds funding a property purchase. Source of wealth refers to the origin of a customer's overall net worth — how they accumulated their wealth over time, such as through business ownership, inheritance, or investment returns. Enhanced due diligence for higher-risk customers, particularly PEPs, generally requires both: source-of-funds evidence for the specific transaction, and a broader understanding of source of wealth to assess whether the transaction is consistent with the customer's overall profile.

PNPC scopes and quotes a fixed fee for the initial programme build — risk assessment, policy and procedure drafting, beneficial ownership framework, goAML registration, and staff training — based on entity size, customer base complexity, and sector. Ongoing annual review and ad hoc advisory support are quoted separately, typically as a retained arrangement. The exact fee is confirmed in writing before work begins; we do not start a build on a verbal estimate.

A generic template is written for no specific business — it typically does not reflect your actual customer categories, transaction profile, jurisdiction exposure, or licensed activities, and inspectors recognise template language quickly. More importantly, a template document with no underlying risk assessment specific to your business cannot demonstrate the risk-based approach that UAE AML law explicitly requires — the law does not ask for a policy that exists; it asks for a policy that reflects a genuine, documented risk assessment of your specific business.

Yes. PNPC supports clients through live inspections — preparing the documentation set in advance where notice is given, attending or coordinating the walkthrough of sample customer files, drafting the formal response to any findings, and structuring the corrective action plan and its implementation. We are also engaged after the fact by entities that received a finding using a different, or no, prior advisor and need a structured remediation response.

Every regulated entity needs its own AML/CFT programme covering its own customer relationships — PNPC's internal AML/CFT compliance as a practising CA firm governs how we conduct due diligence on our own clients, and does not substitute for a client's own obligation to run CDD on its own customers. If your business is itself a DNFBP or otherwise regulated, you need your own programme regardless of who your professional advisors are.

Common red flags include: reluctance or refusal to provide requested identification or beneficial ownership information; unusually complex or opaque ownership structures with no clear commercial rationale; requests for unusual secrecy or use of intermediaries without disclosed purpose; transaction values or structuring patterns inconsistent with the customer's stated business or profile; use of funds from unrelated third parties without adequate explanation; and urgency or pressure to bypass standard verification steps. No single red flag is automatically conclusive, but a documented, risk-based assessment of the combination is what the CDD procedure is designed to capture.

No. Accounting, payroll, and AML/CFT advisory are distinct professional services, and PNPC applies clear engagement scoping and, where relevant, information barriers between service lines to avoid any conflict. In practice, clients often find the combination beneficial rather than conflicted — the accounting team's visibility into actual transaction flows supports, rather than compromises, the integrity of the AML risk assessment.

The UAE's AML/CFT framework has been actively refined through successive Cabinet Decisions and Ministerial Decisions, partly in response to the country's FATF mutual evaluation process and subsequent follow-up commitments. PNPC tracks regulatory developments as part of the ongoing advisory relationship and proactively flags changes that affect a client's existing programme — rather than waiting for the client to discover a gap at their next inspection.

Registration on goAML involves creating an entity profile on the FIU platform, designating authorised users (typically the Compliance Officer), and completing the entity's regulatory details. Processing timelines vary and depend on the completeness of the submitted information and the FIU's current processing volumes; PNPC coordinates the registration as part of the wider programme build and manages any follow-up queries from the FIU to keep the process moving.