Talk to usTry the demo

Country Guide, United Arab Emirates: Remote Customer Onboarding Under the Central Bank Rules

Regulation and standards

For: Compliance officer or product owner at a licensed financial institution in the UAE, or at a provider that serves one

A reading of the Central Bank of the UAE Rulebook on digital identification for customer due diligence: what licensed institutions are expected to do when a person is onboarded remotely.

For information; not legal advice.

You are designing or reviewing a remote onboarding flow for an institution licensed by the Central Bank of the United Arab Emirates, and you want to know what the central bank's own text asks when a customer who is a natural person is identified without meeting anyone. This guide reads the CBUAE Rulebook, mainly the Guidance for Licensed Financial Institutions on Digital Identification for Customer Due Diligence, together with the current federal decree-law and Cabinet Resolution that now carry the due diligence duties the Guidance describes and the FATF Recommendations behind them, and answers one question: what must the flow do, and what does the regulator leave to the institution's judgement?

Everything below is taken from the published texts, and the rules are described in their own words where possible. The guide covers customer identification and verification at onboarding for individuals. It does not cover legal entities or institutions outside the central bank's scope.

What the Rulebook is and how binding the Guidance is

The CBUAE Rulebook is a service of the central bank that gives public access to the regulations, standards and guidelines it has issued. Its home page contains a caution that matters for anyone quoting it:

the CBUAE Rulebook has no legal effect and the CBUAE does not assume any liability for its contents, and the regulations, standards and guidelines as issued through the formal channels such as the UAE Official Gazette shall prevail and be binding in case of any inaccuracy in the Rulebook.

That is why this guide cites the Rulebook as a reading source and not as the legal instrument.

The Guidance itself states its own status. It says it was issued to assist the understanding and effective performance by licensed financial institutions, called LFIs, of their statutory obligations, and it sets out how it relates to the law:

this Guidance neither constitutes additional legislation or regulation nor replaces or supersedes any legal or regulatory requirements or statutory obligations, it sets out the expectations of the CBUAE for LFIs to be able to demonstrate compliance with these requirements.

If the Guidance and the legal framework differ, the Guidance says that the latter will prevail. It also states that LFIs are expected to demonstrate compliance within one month from its coming into effect. The Rulebook shows the Guidance as effective from 31/10/2022 and in force. A central bank press release dated 11 January 2023 announced the same guidance, saying that it comes into effect immediately and that it requires LFIs to demonstrate compliance in line with the relevant CBUAE notice.

Who is covered

The Guidance applies, unless otherwise noted, to natural and legal persons licensed or supervised by the central bank. The listed categories are national banks, branches of foreign banks, exchange houses, finance companies, issuers and providers of stored value facilities, licensed retail payment service providers, card schemes, registered hawala providers and other LFIs, together with insurance companies, agencies and brokers.

Firms in the two financial centres have their own financial services regulators, which this guide does not cover. The Dubai Financial Services Authority describes itself as the independent regulator of financial services conducted in or from the DIFC, a purpose-built financial zone in Dubai. The ADGM website, for Abu Dhabi's international financial centre, links to a public register for its Financial Services Regulatory Authority.

The Guidance says it builds on Federal Decree-Law No. (20) of 2018 on anti-money laundering and combating the financing of terrorism, as amended by Federal Decree Law No. (26) of 2021, and on Cabinet Decision No. (10) of 2019, which it calls the AML-CFT Decision. Both of those instruments have since been replaced, and the current texts are the ones to build a flow on. Article (41) of Federal Decree by Law No. (10) of 2025 repeals Federal Decree by Law No. (20) of 2018, and the Rulebook shows the 2025 decree-law as effective from 14/10/2025 and in force. Cabinet Resolution No. (134) of 2025 is the executive regulation of that decree-law; the Rulebook shows it as effective from 14/12/2025 and in force, and its Article (70) repeals Cabinet Resolution No. (10) of 2019. Article (41) of the decree-law also keeps in effect the executive regulations, resolutions and circulars issued under the 2018 decree-law, insofar as they do not conflict with the new decree-law, until superseding ones are issued. The Rulebook page of the Guidance still shows the status In-Force and still names the repealed instruments as its legal basis, and the page does not say how the Guidance applies after the repeal. This guide therefore takes the legal duties from the current instruments and reads the Guidance as the central bank's published expectation on digital identification; ask the central bank which of its notices currently governs the Guidance.

The articles of the Resolution read for this guide do not mention remote, digital or biometric identification. The one technology provision is a duty to assess the money laundering, terrorist financing and proliferation financing risks of new products, new business practices and new delivery mechanisms, including new or developing technologies, and to do so before launch or use, with appropriate measures to manage and mitigate those risks. That is Article (24) of the Resolution. A new remote onboarding flow is a new delivery mechanism in the ordinary sense of that wording, so the assessment is worth keeping on file. The sections below take, in turn, the articles of the Resolution that matter most to a remote flow.

Identify and verify

Article (9) is where identification and verification of the customer are required. Its first paragraph requires institutions to identify the customer, permanent or occasional, to determine whether the customer is a natural person, a legal person or a legal arrangement, and to verify that identity using original documents, data or information obtained from a reliable and independent source. For a natural person the data to obtain are the name as stated in the identity card or travel document, the nationality, the address, the date and place of birth and, where applicable, the name and address of the employer, together with a true copy of a valid identity card or travel document. Further paragraphs require verifying that any person acting for the customer is authorised and identifying that person in the same way, understanding the purpose and intended nature of the business relationship, and understanding the nature of the customer's business and its ownership and control structure.

When verification must happen

Article (6) requires institutions to verify the identity of the customer and the beneficial owner before or during the establishment of a business relationship or the opening of an account, or before carrying out a transaction for a customer with whom there is no such relationship. Paragraph 2 allows institutions, in cases of low crime risk, to defer the completion of customer identity verification until after the relationship is established, subject to three conditions: verification is completed as soon as possible, the deferral is necessary so as not to disrupt the normal course of business, and appropriate and effective measures are applied to control the risks. The deferral covers customer identity verification only, and verification of the beneficial owner stays required before or during the establishment of the relationship under paragraph 1. Where the customer can benefit from the relationship before verification is complete, institutions must take measures to manage the risks. Article (7) requires due diligence when a business relationship begins, when a crime is suspected, and when there are doubts about the accuracy or adequacy of identification data obtained earlier. For occasional transactions it sets thresholds of AED 55,000 for financial institutions, whether in one transaction or in several that appear to be linked, and AED 3,500 for wire transfers; virtual asset service providers apply due diligence from AED 3,500.

When due diligence cannot be completed

Article (14) prohibits establishing or continuing a business relationship, or executing a transaction, where the institution is unable to apply due diligence, and tells it to consider submitting a suspicious transaction report whenever necessary. If an institution suspects a crime and has reasonable grounds to believe that applying the measures may alert the customer, it may refrain from applying them, and it must then submit a suspicious transaction report stating why. Article (19) prohibits institutions, and their directors, officers and employees, from disclosing to the customer or any other person, directly or indirectly, that a suspicious transaction report has been or is about to be submitted, without prejudice to information sharing within the financial group under Article (32). A refusal message in a flow should be written with that prohibition in mind.

Ongoing monitoring

Article (8) requires institutions to apply due diligence measures and to conduct ongoing monitoring of the business relationship. It includes scrutinising transactions throughout the relationship to ensure they are consistent with what the institution knows about the customer, the nature of their activities and their risks, including where necessary the source of funds, and ensuring that documents, data or information obtained through due diligence are up to date and relevant, with particular emphasis on records of high-risk customer categories.

Reliance on a third party

Article (20) allows institutions to rely on a third party to apply due diligence for identifying the customer and the beneficial owner and understanding the nature of the customer's business, taking into account the countries identified by the National Committee as high-risk and, to the maximum extent possible, the available information on country risks. The relying institution remains responsible for the accuracy of those measures. It must ensure that the third party is regulated and supervised and complies with the due diligence and record-keeping requirements, immediately obtain from the third party the necessary identification data and information, and take the necessary steps to be able to obtain copies of the necessary documents without delay on request. Reliance does not include the use of external sources, such as outsourcing or agency services, to perform due diligence on the institution's behalf, where the services are carried out under the institution's own policies and procedures and the external sources are subject to its supervision and control and apply fitness and propriety standards and effective audit procedures to their staff.

Records

Article (25) sets the retention periods. Records and documents obtained through due diligence, ongoing monitoring, account files, business correspondence and copies of personal identification documents, among others, must be kept for not less than five (5) years from the date the business relationship ends, or from the date of account closure for account holders, or after the completion of an occasional transaction, or from the completion of a supervisory inspection or an investigation, or from the issuing of a final court judgment, counted from the most recent of those dates. Customer information, including information on due diligence and ongoing monitoring, must be available to the concerned authorities promptly on request. The Guidance, which was written against the 2019 decision, says that this requirement is technology neutral, so it applies equally to records kept in digital and in physical form.

What "technology neutral" means for a remote flow

The Guidance's section on customer identification starts from the identification article of the 2019 decision, Article 8, and draws a conclusion that matters for any digital flow. It says the requirement is technology neutral and "expressly permits LFIs to use documentary as well as non-documentary sources" when performing identification and verification. It does not restrict the form, physical or digital, that identity evidence must take, and it does not limit the use of digital ID systems for linking a verified identity to a real individual, provided a reliable and independent source is used.

The Guidance then explains what "reliable" and "independent" mean in this setting:

the digital ID system used to conduct CDD relies upon technology, adequate governance, processes, and procedures that provide an appropriate level of confidence that the system produces accurate results.

It ties that reliability to two sets of mitigation measures, one for identity proofing and enrollment and one for authentication and identity lifecycle management.

Non-face-to-face is not automatically high risk

FATF treats distance as a risk factor. In the Interpretive Note to Recommendation 10, the list of product, service, transaction or delivery channel risk factors for higher risk includes non-face-to-face business relationships or transactions where appropriate risk mitigation measures have not been implemented. The CBUAE Guidance defines non-face-to-face interactions as ones in which the parties are not in the same physical location and conduct activities by digital or other non-physically present means, such as mail or telephone. It then draws the consequence:

non-face-to-face interactions that rely on reliable, independent digital ID systems with appropriate risk mitigation measures in place may present a standard level of risk, and may even present a lower level of risk where higher assurance levels are implemented and/or appropriate control measures are present.

The sentence is conditional. The lower risk is available only when the system is reliable and independent, the mitigation measures are in place, and the assurance level is adequate.

Identity proofing in four actions

The Guidance describes identity proofing as three actions followed by enrollment. It says the examples are illustrative and that there is no expectation that LFIs use any particular method of identity proofing unless otherwise required.

Collection and resolution

Collection and resolution involves obtaining attributes, collecting attribute evidence, and resolving the evidence and attributes to a single unique identity within a given population, which the Guidance calls de-duplication. The required attributes for a natural person are listed as the name as in the passport or identity card, the number, country of issuance, and the issue and expiry dates of the card or passport, the nationality, the permanent residential address, the date and place of birth, and the name and address of the employer where applicable.

The Emirates ID rule

One instruction is written in firm language. The Guidance says:

When verifying the Emirates ID card, either physically or by way of digital or electronic Know Your Customer ("e-KYC") solutions, LFIs should use the online validation gateway of the Federal Authority for Identity, Citizenship, Customs & Port Security, the UAE Pass Application, or other UAE Government-supported solutions, and keep a copy of the Emirates ID and its digital verification record.

The Guidelines on anti-money laundering for financial institutions say the same for central bank licensees in stronger words: when verifying the UAE ID card, licensed institutions "must use" the online validation gateway and keep a copy of the ID and its digital verification. Those Guidelines cite articles of the 2019 decision, and the page does not say how they apply after the repeal, so treat them with the same caution as the Guidance.

Validation

Validation determines that the evidence is genuine, meaning not counterfeit, forged or misappropriated, and that the information it contains is accurate. It is performed by checking the identity information and evidence against an authoritative and reliable source. For genuineness, the Guidance gives the examples of reviewing the evidence for alterations, checking that identification numbers follow standard formats, and checking that physical and digital security features are valid and intact. When an institution uses a physical or digital copy of an Emirates ID, it is expected to review the evidence for physical or digital abnormalities or possible alterations and decide whether it has been altered or forged.

Verification

Verification confirms that the validated identity relates to the specific individual being proofed. The Guidance names the tools:

including (but not limited to) through the use of biometric solutions like facial recognition or liveliness detection.

For a remote flow it gives a worked example: ask the applicant to take and send a mobile phone video or photo with other liveness checks, compare the submitted photos to the photos on the applicant's Emirates ID, passport or other valid documents, and determine that they match to a given level of certainty.

Enrollment and binding

The last action is enrollment, in which the provider registers the proofed applicant as a subscriber and binds the verified identity to one or more authenticators that the subscriber possesses and controls. Binding is also called credentialing. For the institution the practical effect is that onboarding evidence and the later authentication of the same person are linked by design.

National identity systems named in the Guidance

The Guidance tells LFIs to understand and use national-level identification systems in the UAE and names three. UAE Pass is described as the first national digital identity and signature solution, which uses biometric facial recognition to verify and register users without an in-person visit to a government services centre. The Emirates ID is described as the mandatory government-issued identity card for all citizens and residents, which uses public key infrastructure to attach identities to digital certificates and carries fingerprint biometrics. Emirates Facial Recognition is described as an initiative of the Ministry of Interior and the federal identity authority, together with private sector partners, that includes a "face fingerprint" system for digital verification of digital transactions and remote identities.

The UAE Pass website gives its own description. It presents UAE Pass as the first national digital identity for citizens, residents and visitors in the UAE, and it lists a sign-up in three steps: download the application, register an account using an Emirates ID, a GCC ID or a passport, and verify the account through face verification or a visit to the nearest kiosk. Where the UAE government has mandated a specific digital ID system for due diligence, as with the validation gateway for the Emirates ID, the Guidance says that institutions may rely on the government's assessment of that system's assurance levels.

Risks the Guidance asks you to address

The Guidance warns that digital identity systems depend on open networks and several parties, which creates many opportunities for cyberattacks. It separates risks at proofing from risks at authentication.

At identity proofing

Impersonation is defined as a person pretending to have the identity of another genuine person, including by using a stolen document of someone with a similar appearance or by combining stolen evidence with forged evidence. For two named risks it gives mitigation strategies. For falsified evidence, the provider validates the physical security features and validates the personal details with the issuer or another authoritative source. For fraudulent use of another person's identity, the provider verifies the identity evidence and the applicant's biometric against information obtained from the issuer or another authoritative source.

At authentication

The listed vulnerabilities include credential stuffing, phishing, man-in-the-middle attacks and PIN code capture and replay. It recommends multifactor authentication using a biometric factor where possible to authorise high-risk activities, which include changes to personal data, registration of third-party payee details, high-value transfers and changes to transfer limits.

Assess the system before relying on it

The section on assessing reliability and independence is the part most product and procurement teams should read twice. It says that, unless otherwise specified, the UAE permits LFIs to adopt digital ID systems of their choosing, provided that they rely upon technology, adequate governance, processes and procedures that provide appropriate levels of confidence that the system produces accurate results. To that end it asks for two assessments. An assurance level assessment lets the institution understand the assurance levels the system provides, based on its technology, architecture and governance, and determine its reliability and independence. An appropriateness assessment is a risk-based determination of whether, given those assurance levels, the system is reliable and independent enough for customer due diligence in light of money laundering, terrorist financing, fraud and other illicit financing risks.

The assessments are sequential. If an institution cannot assess a system's assurance level, or concludes that the system is not sufficiently reliable and independent, it should not proceed with using the system for due diligence unless the system can be adequately strengthened or supplemented. Both assessments should be documented, as part of the enterprise risk assessment or through a separate process, and updated on a periodic and event-driven basis.

Who performs the assurance assessment

The institution may either perform the assurance assessment itself or obtain audit or similar assurance information from an expert body. If it assesses the system itself, it should carry out appropriate due diligence on the provider, including the governance systems in place, and exercise additional caution. It should use information from an expert body, including another member of the same financial group or an independent third party, only if it has a reasonable basis for concluding that the body accurately applies appropriate, publicly disclosed assurance frameworks and standards. The Guidance does not require or recommend any particular assurance level.

Reliance and outsourcing are different

In all reliance relationships, the Guidance says, the ultimate responsibility for due diligence remains with the institution that relies on the third party.

The Guidance separates this from outsourcing. In outsourcing, the institution engages a provider to perform control functions on its behalf and in line with its own policies. In reliance, the institution uses measures that another regulated entity already carried out on its own customer under its own policies. A technology vendor that runs a verification step inside the institution's own flow is therefore not the same thing as a relied-upon regulated third party, and a team should know which of the two it has.

After onboarding: monitoring, records and data

The Guidance links authentication back to ongoing monitoring. Institutions that authenticate existing customers with a digital ID system should use the data generated by authentication, such as geolocation or IP addresses, to support ongoing due diligence and transaction monitoring, for example to identify a customer transacting from a sanctioned, prohibited or high-risk jurisdiction. The UAE Financial Intelligence Unit's website points users to its goAML portal for submitting suspicious transaction reports and suspicious activity reports.

On data protection, the Guidance says digital ID involves the collection and processing of personal data, potentially including biometrics, and is therefore subject to local data protection requirements. It names, among others, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. The UAE government portal describes that law as the Personal Data Protection Law, in force since 2 January 2022, which sets requirements for the cross-border transfer and sharing of personal data for processing. The Guidance draws a practical line for hosting and storage:

Under the UAE's DPP framework, LFIs and DISPs are not permitted to transfer or store personal data, including digital or physical copies of Emirates IDs, outside of the UAE, except as permitted by Articles 22 and 23 of the Federal Decree-Law No. 45 of 2021.

Any design that sends images of Emirates IDs to a service outside the country should be reviewed against that sentence and the articles it cites.

Inclusion and alternatives

The Guidance treats exclusion as a risk of digital ID in its own right. It warns that the mandatory use of a specific digital ID that is not universally available presents challenges similar to prescribing a document that is not accessible to the whole population. A flow should therefore offer a route for people whose biometrics fail or who lack a smartphone.

Higher-risk customers

Remote onboarding does not replace enhanced due diligence. Article (5) of the Resolution requires institutions to assess their crime risks in proportion to the nature and size of their business, to consider customer, geographic, product, service, transaction and delivery channel risk factors before setting the level of mitigation, and to apply enhanced due diligence to the risks identified. Its examples of enhanced measures include obtaining and verifying additional information on the customer's identity and occupation and on the beneficial owner, taking reasonable measures to identify the source of funds and wealth, increasing the degree of ongoing monitoring, carrying out the first payment through an account in the customer's name at an institution subject to equivalent due diligence standards, and obtaining approval from senior management to start or continue the relationship. Simplified measures are possible only where low risks are identified, after the risk assessment and mitigation duties of that article are fulfilled and in coordination with the supervisory authority, and not where a crime is suspected. For foreign politically exposed persons Article (16) adds approval from senior management before starting or continuing the relationship, reasonable measures to identify the source of funds and wealth, and enhanced ongoing monitoring. Article (23) requires enhanced due diligence proportionate to the risk for business relationships and transactions with persons from countries identified by the National Committee as high-risk or as having deficiencies in their anti-money laundering systems.

Limits of the Guidance

The Guidance states that it focuses on the use of digital ID systems for customer due diligence on individuals at onboarding and for ongoing monitoring. It does not examine the use of digital ID systems to verify a legal person's representatives or beneficial owners.

A design checklist from the text

  • Do you validate the Emirates ID through the federal validation gateway or another government-supported solution, and keep a copy of the card and the digital verification record?
  • Can you show a documented assurance level assessment and a documented appropriateness assessment for each digital ID component you rely on, with a review trigger?
  • Which provider steps are outsourcing under your policies, and which are reliance on another regulated entity, and who bears responsibility in each case?
  • How does the flow detect falsified evidence, and how does it tie the evidence to the real person, for example through liveness checks?
  • What alternative route exists for people without a suitable device, or whose biometric match fails?
  • Where are identity documents and images stored, and have the transfer rules of the personal data law been checked?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The document step detects, classifies and reads IDs, including printed and handwritten text and the machine readable zone with its checksum. Document anti-fraud checks, covering screen photos, photocopies, printouts, glued photos, drawn-on elements, erasures, edited images and logical data errors, are included in every package. The liveness step is active: the person moves the face closer through two ovals. Erasure endpoints, a callback option that omits names, document data and images from the session event while keeping the session identifier, which links to the session, and encryption of the callback body give the integrating team controls for deletion and data minimisation, and retention in days is a setting of each scenario. The check results of database checks stay in the callback whatever that option says.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us