Customer due diligence and risk rating for the UAE, from the AED thresholds to enhanced due diligence after a report.
Customer due diligence that follows risk: a six-factor rating model, weighted and banded from your Article 19 risk assessment and the national risk assessment, sends high-risk customers into enhanced due diligence and puts every manual override in front of a second reviewer.
The UAE's rules in brief.
- Risk-based duty
- Identify, assess, document and keep updating your crime risks, and scale customer due diligence and continuous monitoring to them and to the national risk assessment (Federal Decree by Law No. 10 of 2025, Art. 19)
- When CDD applies
- For every reporting entity: when a relationship starts, on suspicion, and when earlier identification data is in doubt, with the customer and beneficial owner verified before or during the relationship, or before a one-off transaction (Cabinet Resolution No. 134 of 2025, Arts 6 and 7)
- AED triggers
- Financial institutions: occasional transactions of AED 55,000 or more, single or linked, and occasional wire transfers of AED 3,500 or more. VASPs: occasional transactions of AED 3,500 or more
- Exchange houses
- Currency exchange: CDD from AED 35,000 and EDD from AED 55,000 within 90 days. Money transfers: CDD at any value and EDD from AED 55,000 within 45 days. Legal persons and PEPs: EDD every time
- Beneficial owners
- Every natural person who ultimately holds 25% or more of a legal-person customer, alone or jointly (Cabinet Resolution No. 134 of 2025, Art. 10(1))
- Politically exposed persons
- Foreign PEPs always get enhanced measures; domestic and international-organisation PEPs get them when the relationship is high risk (Art. 16)
- High-risk countries
- Transactions linked to countries on the National Committee's high-risk list are reported to the FIU as HRC reports and may only proceed three working days later, if the FIU does not object
- After an STR
- MoET's March 2026 guidance for DNFBPs: rate the customer high risk and apply enhanced due diligence; ending the relationship is not required unless the risks cannot be mitigated
- Review intervals
- Dubai VASPs: client risk assessments at least every three months (VARA). MoET-supervised DNFBPs: risk assessments at least annually. Exchange houses: customer profiles annually or when the ID expires, whichever comes first
Checked against primary sources on 1 October 2026.
What the UAE requires, and how the module handles it
Article 19 of the 2025 Decree by Law and Articles 6, 7, 10 and 16 of Cabinet Resolution No. 134 of 2025 set the core duties. Supervisors add sector rules on top; depending on the business, yours may be the Central Bank, the Capital Market Authority (formerly the Securities and Commodities Authority), VARA for virtual assets in Dubai, the Dubai Financial Services Authority in the DIFC, or the Ministry of Economy & Tourism for DNFBPs in the mainland and commercial free zones. The duties, their sources and the risk-rating features behind them:
| What the UAE requires | Where it sits | How the module handles it |
|---|---|---|
| Identify, assess and document your money-laundering, terrorist-financing and proliferation-financing risks, keep them current, and size customer due diligence to them | Decree by Law No. 10 of 2025, Art. 19 | The rating weighs six factors that you weight and band yourself: where the customer is (country), what they do (industry or business type), the product, how they reach you (delivery channel), how they behave, and any PEP or sanctions exposure. |
| Build the 2024 national risk assessment into business-wide and customer risk assessments; MoET-supervised DNFBPs update them at least annually and on material change | MoET Circular No. 4 of 2025 and its NRA guide; VARA circular of 11 June 2025 | Weights and bands are settings rather than code, so compliance can re-tune the model when a national or sectoral finding moves, or when the business does. |
| Match due diligence to the rating: enhanced for high risk, standard for medium, simplified for low where nothing is suspected; exchange houses apply EDD to every legal person and PEP | MoET Circular No. 6 of 2025; CBUAE Standards for exchange business, 16.7 and 16.13 | A high-risk rating routes the customer to the EDD workflow, and periodic reviews are scheduled for each band automatically, so the file is looked at again on time. |
| After a suspicious transaction report, treat the customer as high risk and apply enhanced due diligence | MoET STR/SAR guidance for DNFBPs (March 2026) | A rating changed by hand goes to another authorised reviewer for approval, with the reason stored, so the move to high risk after a report is controlled and on record. |
| Identify the natural persons who own 25% or more of a corporate customer, and strengthen checks on owners and nominees | Cabinet Resolution No. 134 of 2025, Art. 10(1); MoET NRA guide (June 2025) | Entity resolution and a beneficial-owner graph connect a legal-entity customer to its owners, and their exposure flows into the company's rating. |
| Apply enhanced measures to foreign PEPs, and to domestic PEPs where the risk is high; follow MoET's circular on the FATF's high-risk jurisdiction lists | Cabinet Resolution No. 134 of 2025, Art. 16; MoET Circular No. 2 of 2026 | Country is one rating factor and PEP or sanctions exposure another, so either can raise a customer's band. |
Summaries of the primary texts as checked on 29 September and 1 October 2026: Federal Decree by Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025, the CBUAE's Standards for exchange business, MoET's circulars, NRA guide and STR/SAR guidance, VARA's rulebook and circulars, and the 2024 national risk assessment. Not legal advice.
Frequently asked questions.
When must customer due diligence be applied in the UAE?
Every financial institution, DNFBP and VASP applies CDD when a business relationship starts, when a crime is suspected and when earlier identification data is in doubt, verifying the customer and the beneficial owner before or during the relationship, or before a one-off transaction (Articles 6 and 7 of Cabinet Resolution No. 134 of 2025). Financial institutions also apply it to occasional transactions of AED 55,000 or more, single or linked, and to occasional wire transfers of AED 3,500 or more; VASPs to occasional transactions of AED 3,500 or more. The AED 55,000 trigger now applies only to financial institutions, so corporate service providers and accountants apply CDD to every client relationship and one-off transaction. Dealers in precious metals and stones are DNFBPs for cash transactions of AED 55,000 or more.
What customer due diligence tiers apply to exchange houses?
The CBUAE's Standards for exchange business set them. For an individual's currency exchange: identification from AED 3,500, then CDD from AED 35,000 and EDD from AED 55,000 within a 90-day period. For an individual's money transfers: identification and CDD at any value, and EDD from AED 55,000 within 45 days. Legal persons, PEPs and customers who are DNFBPs or precious-metals dealers always get EDD, and a PEP's transactions need approval from the compliance officer and the manager in charge first.
Do we have to use the UAE's national risk assessment?
Yes. Article 19 of the 2025 Decree by Law ties customer due diligence and monitoring to the national risk assessment. MoET's June 2025 guide tells every DNFBP to bring the 2024 assessment into its business-wide and customer risk assessments, updated at least annually, and in Dubai, VARA told VASPs to revise their business risk assessments within 60 days of its June 2025 circular. The 2024 assessment rates the exchange-house sector Medium-High, registered hawala providers High and the virtual asset sector High.
How should transactions linked to high-risk countries be handled?
The National Committee publishes the UAE's list of high-risk countries. Transactions related to them are reported to the FIU through goAML as High Risk Country Transaction Reports (HRC) and may be executed only three working days after the report, if the FIU does not object. MoET's Circular No. 2 of 2026 brings the FATF's June 2026 lists to DNFBPs and bars them from relying on third parties in black-listed jurisdictions for CDD. MoET also warns against suspicious transaction reports raised on high-risk nationality alone.
What changes for a customer after a suspicious transaction report?
MoET's March 2026 STR/SAR guidance for DNFBPs says to follow the FIU's instructions, classify the customer as high risk and apply enhanced due diligence. Ending the relationship is not required unless the risks cannot be mitigated. Nothing about the report may reach the customer: tipping off is a crime, punishable by imprisonment and a fine of at least AED 50,000, or either.
Can an analyst override a customer's risk rating?
Yes, with a second pair of eyes: an override only takes effect once another authorised reviewer approves it, and its reason is stored with it, so the history of each rating can be shown to a supervisor.
See it on your own data.
Bring your own customers and scenarios to a live demo of the AML compliance software, set up for the country you report in.