Get a free trial for 5 days for WorldCompliance Online.

Get Free Trial

Checklists

UAE client onboarding checklist: customer due diligence step by step

Use this checklist before you accept a new customer. It follows the general customer due diligence expectations of Federal Decree-Law No. 10 of 2025 and its Executive Regulations, Cabinet Resolution No. 134 of 2025. Adjust it to your supervisor's guidance and your own risk assessment.

Updated 17 October 2026Legal references last reviewed 17 October 20266 minute readGeneral guidance, not legal advice

Supports your UAE AML/CFT obligations

Screening records and audit trails help firms supervised by these UAE authorities evidence their checks. Your compliance team remains responsible for meeting your regulator's requirements.

  • CBUAE

    Central Bank of the UAE

  • goAML

    UAE FIU suspicious activity reporting

  • MoE

    Ministry of Economy — DNFBP supervision

  • DFSA

    Dubai Financial Services Authority

  • ADGM

    Abu Dhabi Global Market

  • VARA

    Virtual Assets Regulatory Authority

1. Identify the customer

  • Individuals: full name, nationality, date of birth and a valid Emirates ID or passport copy.
  • Companies: trade licence, legal form, registered address and the people authorised to act for it.
  • Check that documents are current and that names match across documents.

2. Identify beneficial owners

  • Find the individuals who ultimately own or control the company — commonly those holding 25% or more.
  • Where no one meets that threshold, identify who exercises control by other means, or the senior manager.
  • Record how you reached the answer, not only the names. See what to collect in KYC and KYB.

3. Screen before you accept

  • Run sanctions screening on the customer, beneficial owners and authorised signatories, including the UAE Local Terrorist List and the UN Consolidated List.
  • Run PEP screening and adverse media checks.
  • Do not start the relationship while a potential sanctions match is unresolved.

4. Understand the purpose and rate the risk

  • Record the purpose and expected nature of the relationship, and the source of funds where relevant.
  • Assign a risk rating (for example low, medium or high) using your business-wide risk assessment.
  • For high-risk customers and PEPs, apply enhanced due diligence and obtain senior management approval.

5. Record and schedule reviews

  • Keep identification, screening results and decisions for at least five years after the relationship ends.
  • Set a review date based on the risk rating and add the customer to ongoing screening.

General guidance

This checklist summarises general UAE expectations. It is not legal advice; confirm the exact requirements that apply to your business with your supervisor.

Frequently asked questions

Can I onboard a customer before screening is finished?

Not where a potential sanctions match is unresolved. Screening should be completed and any match resolved before the relationship begins.

How long should onboarding records be kept?

UAE rules generally require records to be kept for at least five years from the end of the business relationship.

This guide is general information about compliance expectations in the UAE, written by our team. It is not legal advice and does not replace the guidance of your supervisory body. Where an obligation depends on your licence, activity or free zone, confirm it with your supervisor or a qualified adviser.

See it working on your own customer data

A short demo with our UAE team — no obligation.