A Practical Guide to KYC & Customer Due Diligence Advisory
KYC & Customer Due Diligence Advisory is the engagement through which PNPC designs, implements, and remediates the Know Your Customer and Customer Due Diligence programme that UAE Designated Non-Financial Businesses and Professions, financial institutions, and Virtual Asset Service Providers are legally required to maintain under Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and its Cabinet Decision implementing regulations. This is not a policy document exercise.
What This Actually Covers
Know Your Customer (KYC) and Customer Due Diligence (CDD) are the identification, verification, and risk-assessment procedures that UAE-regulated entities must apply to every customer before establishing a business relationship and throughout its life. The legal foundation sits in Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT), as amended, together with Cabinet Decision No.
For the full scope, current process and what PNPC includes, see the dedicated KYC & Customer Due Diligence Advisory service page.
Signs This Applies to You
- Your business falls within the DNFBP categories under UAE AML law — real estate brokerage or development, dealing in precious metals and stones above the prescribed cash threshold, corporate service provision, independent legal or accounting practice — and you do not yet have a documented, risk-based CDD programme
- You are a newly licensed entity in a regulated sector (financial services, VASP, DNFBP) and need the AML/CFT policy, business risk assessment, and CDD procedures built and registered with the goAML platform before you can lawfully onboard customers
- Your existing KYC file templates and onboarding checklist have not been updated since the last material change in Cabinet Decision requirements and you are due, or overdue, for an internal review
- You have received a Ministry of Economy, Central Bank, DFSA, FSRA, or VARA inspection notice, finding, or remediation directive relating to your AML/CFT or CDD controls and need a structured response and corrective action plan
What This Doesn't Cover
- You need a historical Economic Substance Regulations (ESR) matter resolved — an outstanding notification, report, or penalty from a financial year before the regime was discontinued for periods starting on or after 1 January 2023 — and have no separate AML/CFT supervisory obligation; that sits under a dedicated ESR review engagement, distinct from CDD
- You are not a DNFBP, financial institution, or VASP and your business activity does not fall within any AML/CFT-regulated category under UAE law — confirm applicability first through a scoping call before commissioning a full programme build
- You have already been formally accused of, or are under active investigation for, money laundering or terrorist financing offences — that requires criminal defence legal representation as the primary engagement, with AML advisory support playing a secondary role
Common Questions
What is the difference between KYC and CDD — are they the same thing?
Know Your Customer (KYC) is generally used to describe the identification and verification of who a customer is — name, legal form, identity documents, beneficial ownership. Customer Due Diligence (CDD) is the broader risk-based framework that includes KYC identification but also covers understanding the purpose of the relationship, assessing and rating risk, screening against sanctions and PEP lists, and ongoing monitoring for the life of the relationship. In practice the terms are often used together or interchangeably in the UAE regulatory context, but CDD is the more complete and legally precise term used in Federal Decree-Law No. 20 of 2018.
Which UAE businesses are actually required to have a formal AML/CFT and CDD programme?
Financial institutions regulated by the UAE Central Bank, securities and investment firms under the Securities and Commodities Authority, Virtual Asset Service Providers under VARA or the relevant emirate regulator, and Designated Non-Financial Businesses and Professions (DNFBPs) under the Ministry of Economy. DNFBPs specifically include real estate agents and developers involved in property sale/purchase transactions, dealers in precious metals and stones for cash transactions above the prescribed threshold, corporate service providers (company formation agents, registered agents, nominee directors/shareholders), and independent legal professionals and independent accountants and auditors when carrying out specified activities on behalf of a client, such as managing client funds or acting in company formation.
What happens if my business is a DNFBP and has no AML/CFT programme at all?
Operating without a documented risk assessment, CDD procedures, and goAML registration where required is a breach of Federal Decree-Law No. 20 of 2018 and its implementing Cabinet Decisions. Consequences on inspection or discovery can include administrative fines set out in Cabinet Decision No. 10 of 2019 (as amended), corrective action directives with mandated timelines, and in serious or repeated cases, licence suspension or referral for further regulatory or criminal action. The exact fine schedule and escalation path depend on the supervisory authority and the nature of the breach.
Getting This Right From the Start
Talk to PNPC's Dubai team before your next inspection finds the gap for you — we build AML/CFT and CDD programmes that hold up on the file, not just on paper.
PNPC Global has advised Dubai businesses since 1986. Explore the full IPR & AML Compliance practice for related services, or go straight to the KYC & Customer Due Diligence Advisory page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.