Customer Due Diligence Checklist for UAE Firms

Customer due diligence (CDD) is how you find out who you are dealing with, why they want your services and how much risk they bring. This checklist follows the order most UAE businesses use when they onboard a new customer. Treat it as a working sequence, not a substitute for your own procedures or your supervisor's guidance.

1. Identify the customer

Collect the basic identity details before anything else. What you need depends on whether the customer is an individual or an entity.

• Individuals: full name, date of birth, nationality, identity document details and residential address.
• Legal entities: registered name, legal form, licence or registration number, registered address and principal place of business.
• Anyone acting on the customer's behalf: who they are and what authority they hold, such as a power of attorney or a board resolution.

2. Verify what you have been told

Identification is what the customer says. Verification is checking it against reliable, independent sources. For individuals that usually means a valid passport or Emirates ID. For entities it means the trade licence, the memorandum and articles of association, and the register of shareholders and directors. Keep copies, note who checked them and when, and record anything that did not match.

3. Understand ownership and control

For any entity, work out who ultimately owns or controls it. Follow the ownership chain through holding companies and trusts until you reach the natural persons at the top. Identify and verify each beneficial owner who meets the ownership or control test in your rules, and record the structure, ideally as a simple chart on the file. If no one meets the ownership test, identify who exercises control by other means, and failing that the senior managing official.

4. Understand the purpose of the relationship

Ask what the customer wants from you and what activity you should expect: the products or services, the likely volumes and values, the countries involved and how they will pay. This expected profile is what you later monitor against, so make it specific enough to be useful.

5. Screen the customer and related parties

• Sanctions lists, including the UAE Local Terrorist List and the UN Consolidated List.
• Politically exposed persons (PEPs), their family members and close associates.
• Adverse media that suggests involvement in financial crime.

Screen the customer, the beneficial owners and the people authorised to act. Record how each possible match was resolved and who decided. Our insight on why PEP screening is not a one-time check explains why this continues after onboarding.

6. Assess and rate the risk

Combine what you have learned about the customer, their geography, the product and the delivery channel into a risk rating, and write down the reasons. Another member of staff should be able to read the file and reach the same rating. The risk-based approach in one picture shows how these factors fit together.

7. Apply enhanced due diligence where the risk is higher

Higher-risk customers, including PEPs and customers linked to higher-risk countries, need more than the standard checks. Typical measures are:

• Establishing source of wealth and source of funds, with supporting evidence.
• Senior management approval before the relationship starts or continues.
• Closer ongoing monitoring and more frequent reviews.

Where your rules allow simplified due diligence for lower-risk customers, record why the customer qualifies. Simplified never means none.

8. Decide, and know when to stop

If you cannot complete CDD, for example because the customer will not explain their ownership or the documents do not hold together, do not start the relationship or carry out the transaction. Consider whether the circumstances are suspicious and should be escalated to your compliance officer or MLRO for a possible report through goAML.

9. Monitor and review

Due diligence is not a one-off. Monitor activity against the expected profile, re-screen as lists change, and review the customer file on a cycle set by the risk rating. Also review it when something changes, such as new owners, a new product or an unusual transaction.

10. Keep the records

Keep the identification and verification documents, the risk assessment, screening results and review notes for the period the law requires, in a form you can retrieve quickly for an inspection.

Need help putting this into practice? See our risk assessment and screening and monitoring services.