KYC & Customer Due Diligence Advisory

Know Your Customer (KYC) is generally used to describe the identification and verification of who a customer is — name, legal form, identity documents, beneficial ownership. Customer Due Diligence (CDD) is the broader risk-based framework that includes KYC identification but also covers understanding the purpose of the relationship, assessing and rating risk, screening against sanctions and PEP lists, and ongoing monitoring for the life of the relationship. In practice the terms are often used together or interchangeably in the UAE regulatory context, but CDD is the more complete and legally precise term used in Federal Decree-Law No. 20 of 2018.

Financial institutions regulated by the UAE Central Bank, securities and investment firms under the Securities and Commodities Authority, Virtual Asset Service Providers under VARA or the relevant emirate regulator, and Designated Non-Financial Businesses and Professions (DNFBPs) under the Ministry of Economy. DNFBPs specifically include real estate agents and developers involved in property sale/purchase transactions, dealers in precious metals and stones for cash transactions above the prescribed threshold, corporate service providers (company formation agents, registered agents, nominee directors/shareholders), and independent legal professionals and independent accountants and auditors when carrying out specified activities on behalf of a client, such as managing client funds or acting in company formation.

Operating without a documented risk assessment, CDD procedures, and goAML registration where required is a breach of Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions. Consequences on inspection or discovery can include administrative fines set out in Cabinet Decision No. 10 of 2019 (as amended), corrective action directives with mandated timelines, and in serious or repeated cases, licence suspension or referral for further regulatory or criminal action. The exact fine schedule and escalation path depend on the supervisory authority and the nature of the breach.

A beneficial owner is the natural person who ultimately owns or controls a customer, whether through direct or indirect shareholding, voting rights, or other means of control — even where that person's name does not appear on the trade licence or shareholder register. Cabinet Decision No. 58 of 2020 (as amended) sets the standard threshold at 25% direct or indirect ownership or control, though control can also arise through other mechanisms such as the right to appoint or remove directors, regardless of shareholding percentage. Entities must identify and verify these individuals, not just the immediate corporate or nominee shareholder shown on paper.

A PEP is an individual who holds or has held a prominent public function — a head of state, senior government official, senior judicial or military official, senior executive of a state-owned enterprise, or senior political party official — together with their immediate family members and close associates. UAE AML regulations require enhanced due diligence for PEP relationships regardless of the customer's home jurisdiction: senior management approval before onboarding, a documented source-of-funds and source-of-wealth assessment, and enhanced ongoing monitoring for the life of the relationship.

goAML is the electronic platform operated by the UAE's Financial Intelligence Unit (part of the Central Bank) through which regulated entities register, submit Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs), and — for certain sectors — file additional prescribed reports. Entities within scope of the AML/CFT law, including DNFBPs, are generally required to register on goAML as part of their overall compliance obligation, since the reporting mechanism has to exist and be accessible before a suspicious transaction obligation can actually be discharged.

An STR (sometimes referred to as a SAR — Suspicious Activity Report) must be filed via goAML whenever an entity has reasonable grounds to suspect that funds, a transaction, or an attempted transaction is connected to money laundering, a predicate crime, terrorist financing, or proliferation financing — regardless of the transaction amount and even if the transaction was ultimately not completed. There is no minimum monetary threshold; suspicion, not transaction size, is the trigger.

Tipping off is directly or indirectly informing a customer, or any third party, that a Suspicious Transaction Report has been filed, is being considered, or that an investigation is underway. Under Federal Decree-Law No. 20 of 2018, tipping off is a separate criminal offence from the underlying money laundering or terrorist financing conduct, because it defeats the entire purpose of the reporting mechanism — allowing the customer to move funds, destroy evidence, or otherwise evade detection once alerted.

Risk rating is built from four dimensions applied to each customer: customer risk (individual versus corporate, industry, ownership complexity), geographic risk (home jurisdiction and transaction counterparty jurisdictions, including any FATF-flagged exposure), product/service risk (nature of the transaction), and delivery channel risk (face-to-face versus remote onboarding). Simplified due diligence can apply to genuinely lower-risk customer categories where your documented risk assessment supports it, but it can never be applied automatically or as a default — and it can never apply to a customer or jurisdiction that carries elevated risk indicators regardless of how the relationship is otherwise structured.

DIFC entities regulated by the Dubai Financial Services Authority (DFSA) and ADGM entities regulated by the Financial Services Regulatory Authority (FSRA) operate under their own AML rulebooks specific to those financial free zones, which sit alongside — and are generally aligned in substance with — the federal AML/CFT framework under Federal Decree-Law No. 20 of 2018. The specific forms, reporting mechanisms, and supervisory relationship differ by free zone, so a DIFC-regulated entity's CDD programme must be built against the DFSA rulebook specifically, not a generic mainland template.

UAE AML law requires customer identification records, CDD documentation, and transaction records to be retained for a minimum prescribed period following the end of the business relationship or the date of the transaction, and to be made available to the competent supervisory authority on request within the timeframe given. The precise retention period and any sector-specific variations should be confirmed against the current Cabinet Decision and any relevant sector-regulator rulebook applicable to the entity, since retention requirements have been refined through amendments over time.

The Compliance Officer (often referred to as the Money Laundering Reporting Officer, or MLRO) is responsible for the entity's ongoing AML/CFT programme: reviewing escalated customer relationships, approving higher-risk onboarding, deciding whether an internal escalation rises to the level of an STR/SAR filing, maintaining the risk assessment and policy documents as current, coordinating staff training, and acting as the primary point of contact for the Ministry of Economy, Central Bank, or relevant sector regulator during any inspection or correspondence.

PNPC can provide retained AML advisory support to a designated internal Compliance Officer, and in appropriate structures can support the compliance function on an ongoing outsourced basis, depending on the entity's regulatory category and what the applicable rulebook permits for that role. The specific arrangement — advisory support versus a formally designated function — is scoped based on your sector, size, and supervisory requirements, and confirmed in writing before the engagement begins.

No — they were always separate regimes with separate triggers. Economic Substance Regulations under Cabinet Decision No. 57 of 2020 and Ministerial Decision No. 100 of 2020 tested whether a UAE entity carrying out a defined 'relevant activity' (such as holding company business, IP business, or distribution and service centre business) maintained adequate substance in the UAE. Importantly, the Ministry of Finance discontinued the ESR notification and report filing requirement for financial years starting on or after 1 January 2023, under Cabinet Decision No. 98 of 2024 — so for most entities today, ESR is a closed historical-period question rather than a live ongoing filing obligation, while AML/CFT and CDD obligations continue on an ongoing basis for any entity whose licensed activity falls within a regulated financial or DNFBP category. An entity can have historical ESR exposure, current AML/CFT exposure, both, or neither — the two applicability tests were always independent of each other.

Yes. Corporate service providers — entities that form companies, act as a registered agent, or provide nominee director, nominee shareholder, or company secretary services — are explicitly captured within the DNFBP category under UAE AML law when carrying out those activities for clients. This means CDD must be applied to the ultimate client requesting the company formation or nominee service, with beneficial ownership identification extending through to the natural person who will actually control the entity being formed — not just the immediate instructing party.

Yes, materially. Accepting or facilitating virtual asset transactions can bring an entity within the scope of Virtual Asset Service Provider (VASP) regulation — supervised in Dubai by VARA, and by other frameworks in other emirates and free zones — which carries its own, generally more stringent, AML/CFT and CDD requirements, including specific travel-rule-style obligations for transferring identifying information alongside virtual asset transfers. A business that starts accepting crypto payments without reassessing its regulatory scope risks operating outside a licensing framework it did not realise applied.

AML/CFT compliance is the broader framework addressing money laundering, terrorist financing, and proliferation financing risk through CDD, monitoring, and reporting. Sanctions compliance specifically addresses screening against designated persons and entities lists — the UAE Local Terrorist List, UN Consolidated Sanctions List, and other applicable lists — to ensure the entity does not deal with a sanctioned party. Sanctions screening is a mandatory component within a complete AML/CFT and CDD programme, not a separate, optional add-on.

Real estate brokers and developers are explicitly designated DNFBPs when involved in transactions concerning the buying and selling of real estate on behalf of clients. High-value, often cash-adjacent property transactions, layered ownership structures (including foreign and offshore buyers), and the historical role of real estate in laundering typologies make this a sector supervisors scrutinise closely. CDD obligations apply to both the buyer and seller side of a transaction the broker or developer facilitates, with beneficial ownership identification extending through any corporate or trust purchasing vehicle.

At minimum annually, and additionally whenever there is a material change in the business — a new product or service line, entry into a new customer segment or geographic market, a change in ownership or control, or a relevant new Cabinet Decision, Ministerial Decision, or FATF guidance update. A risk assessment that has not been revisited in several years, regardless of how well-drafted it originally was, is itself a common inspection finding because it no longer reflects the business as it currently operates.

Typically: the AML/CFT policy and risk assessment documents, a sample of customer onboarding files across different risk ratings, the beneficial ownership register, screening records and evidence of periodic re-screening, staff training records, any STRs filed (or a defensible explanation of why none have been filed, if applicable), the Compliance Officer's designation and reporting evidence, and goAML registration confirmation. Inspectors typically walk through several actual customer files in detail to test whether the documented procedure matches what staff actually did.

No — if the business falls within a regulated category (DNFBP, financial institution, VASP), the AML/CFT and CDD obligation applies regardless of size or transaction volume. The scale and complexity of the programme can and should be proportionate to the size and risk profile of the business — a small corporate service provider's procedures will look different from a large real estate developer's — but 'we are too small to need this' is not a recognised exemption under UAE AML law.

A policy document states what should happen. An operating programme is evidence that it actually does — completed onboarding files matching the documented procedure, screening records showing checks were actually run and at the stated frequency, training attendance records, and a Compliance Officer who can answer specific questions about recent decisions. Supervisors inspect the operating programme, not the policy document in isolation; a well-written policy with no supporting evidence of execution reads, on inspection, almost the same as having no policy at all.

PNPC's core engagement is the advisory and policy/procedure design work — the risk assessment, CDD framework, and compliance discipline. Where a client does not already have a screening tool, we advise on selection criteria matched to transaction volume, budget, and risk profile, and coordinate the implementation, but we are not a technology vendor ourselves. For clients who already have a screening tool, we assess whether its list sources, update frequency, and configuration actually support the documented procedure.

These are distinct regulatory regimes with no direct legal dependency — a business can be fully Corporate Tax and VAT compliant while having a materially deficient AML/CFT programme, and vice versa. That said, the same underlying accounting and transaction records that support your tax filings are often relevant evidence in an AML file review, and PNPC's integrated view across tax, accounting, and AML advisory means inconsistencies between what a customer file says and what the transaction ledger shows are more likely to be caught internally before a regulator finds them.

Source of funds refers to the origin of the specific funds used in a particular transaction — for example, the bank account or sale proceeds funding a property purchase. Source of wealth refers to the origin of a customer's overall net worth — how they accumulated their wealth over time, such as through business ownership, inheritance, or investment returns. Enhanced due diligence for higher-risk customers, particularly PEPs, generally requires both: source-of-funds evidence for the specific transaction, and a broader understanding of source of wealth to assess whether the transaction is consistent with the customer's overall profile.

PNPC scopes and quotes a fixed fee for the initial programme build — risk assessment, policy and procedure drafting, beneficial ownership framework, goAML registration, and staff training — based on entity size, customer base complexity, and sector. Ongoing annual review and ad hoc advisory support are quoted separately, typically as a retained arrangement. The exact fee is confirmed in writing before work begins; we do not start a build on a verbal estimate.

A generic template is written for no specific business — it typically does not reflect your actual customer categories, transaction profile, jurisdiction exposure, or licensed activities, and inspectors recognise template language quickly. More importantly, a template document with no underlying risk assessment specific to your business cannot demonstrate the risk-based approach that UAE AML law explicitly requires — the law does not ask for a policy that exists; it asks for a policy that reflects a genuine, documented risk assessment of your specific business.

Yes. PNPC supports clients through live inspections — preparing the documentation set in advance where notice is given, attending or coordinating the walkthrough of sample customer files, drafting the formal response to any findings, and structuring the corrective action plan and its implementation. We are also engaged after the fact by entities that received a finding using a different, or no, prior advisor and need a structured remediation response.

Every regulated entity needs its own AML/CFT programme covering its own customer relationships — PNPC's internal AML/CFT compliance as a practising CA firm governs how we conduct due diligence on our own clients, and does not substitute for a client's own obligation to run CDD on its own customers. If your business is itself a DNFBP or otherwise regulated, you need your own programme regardless of who your professional advisors are.

Common red flags include: reluctance or refusal to provide requested identification or beneficial ownership information; unusually complex or opaque ownership structures with no clear commercial rationale; requests for unusual secrecy or use of intermediaries without disclosed purpose; transaction values or structuring patterns inconsistent with the customer's stated business or profile; use of funds from unrelated third parties without adequate explanation; and urgency or pressure to bypass standard verification steps. No single red flag is automatically conclusive, but a documented, risk-based assessment of the combination is what the CDD procedure is designed to capture.

No. Accounting, payroll, and AML/CFT advisory are distinct professional services, and PNPC applies clear engagement scoping and, where relevant, information barriers between service lines to avoid any conflict. In practice, clients often find the combination beneficial rather than conflicted — the accounting team's visibility into actual transaction flows supports, rather than compromises, the integrity of the AML risk assessment.

The UAE's AML/CFT framework has been actively refined through successive Cabinet Decisions and Ministerial Decisions, partly in response to the country's FATF mutual evaluation process and subsequent follow-up commitments. PNPC tracks regulatory developments as part of the ongoing advisory relationship and proactively flags changes that affect a client's existing programme — rather than waiting for the client to discover a gap at their next inspection.

Registration on goAML involves creating an entity profile on the FIU platform, designating authorised users (typically the Compliance Officer), and completing the entity's regulatory details. Processing timelines vary and depend on the completeness of the submitted information and the FIU's current processing volumes; PNPC coordinates the registration as part of the wider programme build and manages any follow-up queries from the FIU to keep the process moving.

No. goAML is the reporting channel for Suspicious Transaction Reports and Suspicious Activity Reports — registration proves you can file a report, not that you have a working CDD programme behind it. Genuine compliance requires the documented risk assessment, standard/simplified/enhanced due diligence procedures, beneficial ownership identification, sanctions and PEP screening, a designated Compliance Officer, staff training, and ongoing monitoring operating together. A supervisor who sees goAML access but no underlying risk assessment or onboarding evidence treats that as a bigger red flag than no registration at all, because it signals the entity thought a portal login was the finish line.

Generally no. Free zone authorities sometimes provide a template AML policy as a starting reference at licensing stage, but the law requires the policy to reflect your entity's actual risk assessment — your specific customer categories, products, jurisdictions, and delivery channels — not the free zone's generic version distributed to every licensee. An unmodified template with no entity-specific risk assessment behind it does not satisfy the risk-based approach Federal Decree-Law No. 20 of 2018 requires, and inspectors are familiar with these templates and specifically test whether they were customised or simply signed and filed.

The first session is a scoping and applicability call: confirming your DNFBP category or sector-regulator status, mapping your actual customer base and transaction types, reviewing anything you already have in place (policy documents, onboarding forms, goAML registration status), and identifying any live inspection findings or historical ESR exposure that needs separate attention. We leave that call with a clear picture of what already exists, what is missing, and a realistic build timeline before any drafting begins.

No. The AML/CFT obligation attaches to your regulatory category (DNFBP, financial institution, VASP) from the point you begin operating in that capacity, not from a transaction-volume threshold. Waiting until volumes justify it, in the entity's own view, leaves every customer onboarded in the interim without a documented, risk-based assessment behind it — and those files cannot be retrofitted convincingly after the fact. A right-sized programme for a low-volume business is faster and cheaper to build now than a full remediation exercise once volumes and inspection risk have both grown.

Yes, and they serve different purposes. The business-wide risk assessment is the foundational document assessing your entity's overall exposure across customer types, geography, products/services, and delivery channels — it shapes your policy and procedures. The customer risk rating is the operational output applied to each individual customer at onboarding, using the methodology the business risk assessment establishes, to decide whether standard, simplified, or enhanced due diligence applies to that specific relationship. A business risk assessment with no consistent customer-level rating process is a document with no operational teeth.

You still need your own programme if your own licensed activity falls within a regulated category. A corporate service provider's CDD obligation covers its own relationship with you as its client — it identifies and verifies you and your beneficial owners. It does not extend to, or substitute for, your separate obligation to run CDD on your own customers if your business is itself a DNFBP, financial institution, or VASP. These are two independent obligations running in parallel, not a single chain where one party's compliance covers the other.

A properly built programme covers both. New customer onboarding applies the documented procedure from day one, but existing relationships also need to be brought up to the same standard through a structured back-book remediation exercise — reviewing existing files, filling identification and beneficial ownership gaps, and applying risk ratings retrospectively. Supervisors expect existing relationships to be covered on a risk-prioritised basis (higher-risk existing customers first), not left indefinitely on the old, undocumented basis simply because they predate the new programme.

Both trigger enhanced due diligence, but the specific evidence differs. A high-risk jurisdiction exposure (a customer or counterparty connected to a jurisdiction FATF has flagged for strategic AML/CFT deficiencies) generally requires closer scrutiny of the transaction rationale, additional verification of the underlying business activity, and often more frequent ongoing monitoring. A PEP relationship specifically requires senior management approval before onboarding and a documented source-of-funds and source-of-wealth assessment tied to the individual's public role, regardless of transaction size. An entity can face either trigger independently, or both together in a single relationship, and the protocol should address each explicitly rather than applying one generic 'enhanced' label.

A dealer in precious metals and stones is captured as a DNFBP when it carries out a cash transaction, or a series of apparently linked cash transactions, at or above the prescribed threshold — commonly applied at AED 55,000 — at which point the AML/CFT obligations, including CDD on the counterparty and goAML registration, are triggered. The trap is the 'series of linked transactions' wording: splitting a single AED 200,000 purchase into four AED 50,000 cash payments does not put the customer below the line, and structuring specifically to stay under it is itself a red flag warranting an STR.

Administrative penalties for DNFBP and financial-institution AML breaches are set out in Cabinet Decision No. 16 of 2021 (which replaced the earlier penalty framework) and are applied by the supervising authority per violation category — failing to register on goAML, failing to apply CDD, failing to file an STR, failing to maintain records, and so on are each separate breaches. Because penalties attach per category and can be repeated for continuing or per-file failures, a single inspection surfacing several deficiencies across a customer book can aggregate well beyond what an entity expects from reading any one line item.

When FATF updates its lists of jurisdictions under increased monitoring ('grey list') or with strategic deficiencies, any customer, beneficial owner, or counterparty connected to a newly-listed jurisdiction can move from standard to enhanced due diligence overnight, and a de-listing can relax the position. A properly designed programme treats a FATF list change as a monitoring trigger: existing relationships connected to the affected jurisdiction are re-risk-rated, not just new ones. Doing nothing on an existing book after a list change is a live gap, because the risk profile of those relationships has objectively changed even though the customer has not.

The regulated entity registers as an organisation on goAML, and within that registration it nominates authorised users — typically the Compliance Officer / MLRO and any delegate — who hold the credentials to actually file. Both layers matter: an entity registered with no active, trained authorised user cannot discharge a real-time STR obligation, and an individual cannot file on behalf of an entity that is not itself registered. Registration also requires the entity to keep its details current, so a change of MLRO or a change of licensed activity means the goAML profile has to be updated, not left as filed at first registration.

goAML supports several report types beyond the core Suspicious Transaction Report and Suspicious Activity Report. An STR is filed where suspicion attaches to a specific transaction; an SAR where suspicion attaches to activity or conduct not tied to a single completed transaction (including an attempted or refused transaction). goAML also carries other prescribed report types such as high-value and certain funds-transfer reports for entities in scope of those obligations, and a Partial Name Match report used where a customer or counterparty screens as a possible hit against a sanctions or terrorist list. Choosing the correct report type matters — an SAR is the right vehicle when you decline to onboard a suspicious would-be customer, since there may be no transaction to report at all.

Beyond STR/SAR filing, entities are expected to screen against the UAE Local Terrorist List and the UN Consolidated List and to act on the Executive Office for Control and Communications notifications — freezing funds without delay and filing the relevant report through goAML where a true match arises, typically within the short mandated window after a listing. In practice most screening produces partial or 'possible' matches rather than confirmed hits, and the discipline is a documented adjudication step: recording why a possible match was cleared or escalated, so the file shows a decision was made rather than an alert being silently dismissed.

Yes — non-face-to-face onboarding is expressly a higher delivery-channel risk factor in the UAE risk-based framework, so a fully remote onboarding model generally requires additional or compensating measures: independent verification of identity documents, liveness or video verification, confirming an independent second data point, or a first transaction routed through a bank account in the customer's verified name. Remote onboarding is permitted, but it cannot be run at the same evidential depth as a face-to-face file and still satisfy the risk-based standard.

A live sanctions listing of an existing customer or beneficial owner triggers an immediate freeze obligation — funds and assets must be frozen without delay, no further transactions processed, and a report filed through goAML within the short window set by the UAE framework, all without tipping off the customer. This is the scenario ongoing monitoring exists to catch: a name that screened clean at onboarding can be listed at any time, which is why periodic re-screening against updated lists, not just onboarding screening, is a non-negotiable part of a defensible programme.

The UAE framework permits, in defined circumstances, reliance on CDD performed by another regulated third party — but reliance is narrow and conditional: the third party must be appropriately regulated and supervised, must make the underlying CDD information available to you immediately on request, and critically the ultimate responsibility for CDD adequacy remains with your entity, not the party you relied on. It is not outsourcing the liability; it is a documented arrangement where you can still produce the CDD evidence and stand behind it.

They are two entirely separate obligations. As a practising CA firm and itself a DNFBP for certain activities, PNPC applies its own CDD to you when we take you on as a client — identifying you and your beneficial owners under our own programme. The CDD programme we design for you governs how you apply due diligence to your customers. Engaging us satisfies our obligation toward you; it has no bearing on, and cannot substitute for, your separate legal duty to run CDD on your own customer base if your business is itself in scope.

Drift. The programme was accurate the day it was built, but the business changed and the paper did not: a new product line, a new customer segment, expansion into a new jurisdiction, a change of ownership, or a change of MLRO — none of which was reflected in an updated risk assessment or revised procedure. Supervisors specifically test currency: 'when was this last reviewed' and 'does the risk assessment describe the business as it operates today' are standard questions with a binary pass/fail answer, and a two-year-old assessment describing a business that has since doubled its footprint fails on its face.

The same ledgers, bank statements, and related-party data that support your Corporate Tax and VAT positions are direct evidence when assessing whether a customer's transaction pattern is consistent with their stated profile. A payment flow that looks unremarkable on a KYC intake form may look anomalous against the actual transaction ledger — third-party funding, round-tripping, or activity inconsistent with the customer's declared business. Because PNPC often holds both views, a mismatch between what a customer file asserts and what the underlying accounting shows is more likely to be caught internally before it becomes an inspection finding or an undetected suspicious relationship.

PNPC designs, implements, and remediates the CDD programme and supports inspections and findings within our professional scope. The line to independent legal counsel is crossed when the entity or an individual is under active criminal investigation for a money-laundering or terrorist-financing offence, when a formal enforcement action requires legal representation before a court or tribunal, or when a privileged legal opinion is needed on a contested point of law. In those situations AML advisory supports the legal strategy rather than leading it, and we coordinate with counsel rather than stretch the engagement past its proper boundary.

Yes, and it is a common starting point. The first step is a diagnostic against current obligations: what the existing policy actually says versus what the files evidence, whether the risk assessment is entity-specific or generic, whether goAML registration is live with an active authorised user, whether beneficial ownership was genuinely looked through, and whether any inspection finding or bank query is currently open. From that gap assessment we scope a remediation plan with owners and dates rather than blindly rewriting a document that may not have been the real problem.