eKYC in the UAE: 2026 Digital ID Rules for AML Compliance

A Dubai exchange house onboards 400 new customers a month through its app, and not one of them walks into a branch. Its inspector will still ask the same question a branch file answers: how do you know this person is who they say they are? eKYC in the UAE is allowed, and the Central Bank of the UAE has written down exactly what it expects. This guide sets out those expectations, the national digital ID routes, and the evidence an eKYC file needs to survive an AML inspection.

Last updated: 25 October 2026. Written by the ADZ compliance advisory team for MLROs, compliance officers and product owners at UAE financial institutions, DNFBPs and VASPs.

Quick Answer

eKYC in the UAE is legal and supervised. CBUAE guidance lets licensed financial institutions verify customers remotely through UAE PASS, the ICP validation gateway for Emirates ID, or Emirates Facial Recognition. Before relying on a digital ID system, the institution must document an assurance level assessment and an appropriateness assessment, keep the verification record, and keep monitoring the customer.

Key Takeaways

Remote onboarding is permitted. UAE identification rules are technology neutral, so digital evidence can meet the same “reliable and independent source” test as a paper document.
Three national routes are named. The CBUAE points institutions to UAE PASS, the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) online validation gateway, and Emirates Facial Recognition.
Two assessments come first. An assurance level assessment, then an appropriateness assessment, both documented and refreshed on a periodic and event-driven basis.
Keep the digital proof. When you verify an Emirates ID, you keep a copy of the card and its digital verification record, for at least five years after the relationship ends.
Reliance does not move liability. If you rely on another regulated entity’s identification, ultimate responsibility for CDD stays with you.
The legal basis has moved. The guidance was written under Federal Decree-Law No. 20 of 2018, which Federal Decree-Law No. 10 of 2025 has replaced, so read its article references against the new law.
Weak eKYC is expensive. Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 set administrative fines of AED 5 million to AED 100 million for legal entities in breach.

What Is eKYC in the UAE?

Definition: eKYC (electronic Know Your Customer, also written e-KYC) is the identification and verification of a customer through digital means instead of an in-person check of physical documents. Typical eKYC tools are a national digital identity, a government validation gateway and biometric matching. In the UAE, eKYC is part of customer due diligence (CDD) under the federal AML/CFT law.

eKYC is not a separate legal regime. It is a way of meeting the identification and verification step of customer due diligence in the UAE, which also covers beneficial ownership, the purpose of the relationship and ongoing monitoring. A clean selfie match does not finish your CDD. It finishes one part of it.

Identity proofing vs authentication: what is the difference?

The CBUAE guidance splits any digital ID system into two working parts, plus one optional part:

Identity proofing and enrolment answers “Who are you?” It covers collecting identity evidence, validating that the evidence is genuine, and verifying that it belongs to the person in front of the camera.
Authentication and identity lifecycle management answers “Are you the same person we identified?” It covers logins, step-up checks and what happens when a device or credential is lost.
Portability and interoperability lets a verified identity be reused at another institution. It is optional, and the guidance does not focus on it.

For onboarding, proofing is the step your inspector tests first. Authentication matters later, because it links the person who opened the account to the person now moving money through it.

Which customer details must eKYC capture?

For a natural person, the CBUAE lists the same attributes whether you collect them on paper or on a phone:

Full name as shown on the passport or identity card
ID number, country of issue, issue date and expiry date
Nationality
Permanent residential address
Date and place of birth
Employer name and address, where applicable

A digital journey that skips any of these fields has a CDD gap, however good its biometric engine is.

Which Rules Govern eKYC in the UAE?

The CBUAE Digital Identification guidance

The core document is the CBUAE’s Guidance for Licensed Financial Institutions on Digital Identification for Customer Due Diligence. It took effect on 31 October 2022, and institutions were expected to show compliance within one month. The CBUAE Rulebook still lists it as in force.

The guidance draws on the FATF Guidance on Digital Identity (March 2020), the Wolfsberg Group and the US NIST digital identity standards. It sits alongside the CBUAE’s Guidelines for Financial Institutions adopting Enabling Technologies, which set expectations on biometrics and multifactor authentication.

What changed with Federal Decree-Law No. 10 of 2025?

The guidance cites Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019. Both have been replaced. Federal Decree-Law No. 10 of 2025 came into force on 14 October 2025, and its implementing regulation, Cabinet Decision No. 134 of 2025, took effect on 14 December 2025.

In practice, the duties behind the guidance carry forward: identify and verify each customer from a reliable and independent source, monitor the relationship, and keep the records. What changes is the citation.

Your eKYC policy should quote the 2025 law and Cabinet Decision No. 134 of 2025, not the repealed articles the 2022 guidance mentions. Inspectors notice a policy that still cites a law that no longer exists.

Who does the guidance apply to?

It applies to every person licensed or supervised by the CBUAE, including:

National banks and branches of foreign banks
Exchange houses and finance companies
Stored value facility issuers, retail payment service providers and card schemes
Registered hawala providers
Insurance companies, agencies and brokers

DNFBPs supervised by the Ministry of Economy and Tourism, and firms in the DIFC, ADGM or under VARA, answer to their own supervisors. The CBUAE document does not bind them directly. It is still the most detailed written statement of what a UAE regulator expects from a digital ID system. We see DNFBP compliance teams use it as their eKYC benchmark when a supervisor asks how a remote check was validated.

Not sure which supervisor’s rules your onboarding journey must meet? ADZ maps eKYC and CDD obligations for LFIs, DNFBPs and VASPs, and is an approved channel partner for ADGM, DIFC, DMCC and 8 other free zones. Talk to ADZ’s compliance advisory team.

Which Digital ID Routes Does the CBUAE Recognise?

The guidance asks institutions to understand and use the national identification systems already running in the UAE. It names three, and it sets a separate rule for passports.

Route	What it does	What the CBUAE expects you to keep	Typical use
UAE PASS	National digital identity and signature app; registers users with biometric facial recognition, no centre visit needed	The identity data returned and the verification event	App-based onboarding of UAE residents
Emirates ID via the ICP validation gateway	Validates the card online against the issuer’s records; the card itself carries PKI certificates and fingerprint biometrics	A copy of the Emirates ID and its digital verification record	Any onboarding of a UAE resident, in branch or remote
Emirates Facial Recognition	Ministry of Interior and ICP “face fingerprint” system for verifying remote identities and digital transactions	The match result and the record of the check	Remote liveness and face match against national records
Passport (non-Emirates ID)	Physical document check	A copy taken from the original, certified “Original Sighted and Verified” and signed by the employee who did the CDD	Non-resident customers

Is UAE PASS enough on its own for KYC?

UAE PASS gives you a strong identity proofing result for a UAE resident. It does not give you the customer’s source of funds, the purpose of the relationship, PEP status or beneficial owners. Treat it as the identity layer of your CDD, then run screening and risk scoring on top. For higher-risk customers, the enhanced due diligence steps still apply in full.

What about customers who are not UAE residents?

Non-residents have no Emirates ID and usually no UAE PASS, which removes the government validation route. The guidance sets a physical certification rule for passports used in place of an Emirates ID. If your model onboards non-residents fully remotely through a private identity vendor, document why that vendor meets the reliability and independence test, and expect the inspector to read that assessment closely.

How Do You Run the eKYC Assurance and Appropriateness Assessments?

This is where most eKYC files fail. The CBUAE expects two documented assessments, run in sequence, before a digital ID system is used for CDD.

Step 1: the assurance level assessment

This assessment asks how much confidence the system’s technology, architecture and governance give you that it produces accurate results and resists manipulation. You can run it yourself, with due diligence on the provider and its governance, or rely on audit or certification evidence from an expert body. You may use an expert body’s work only if you have good reason to believe it applies a recognised, publicly disclosed assurance framework.

The guidance encourages you to assess each component separately. Proofing, authentication and any federation layer may need different levels of reliability. If you cannot establish the assurance level, or the system is not reliable enough, you stop. You do not move on to step 2 until the gap is closed.

Step 2: the appropriateness assessment

With the assurance level known, you decide, on a risk-based approach, whether that level is appropriate for your customers, products and channels given money laundering, terrorist financing and fraud risk. A system that suits a low-limit prepaid wallet may not suit a private banking relationship or a high-value remittance corridor.

How should the assessments be documented?

Both assessments must be written down, either inside your enterprise-wide risk assessment or as a separate document, and updated periodically and whenever something changes. Any team can own them; the guidance does not require internal audit to do the work. A short evidence pack usually holds:

Evidence item	What it shows the inspector
System description and data flow	Which national routes and vendors are used, and where data goes
Assurance level rating per component	Proofing, authentication and federation assessed separately
Vendor due diligence and certifications	Who built and runs the system, and on what standard
Appropriateness decision by customer segment	Which customers and products may use eKYC, and which may not
Test results and fraud metrics	The controls work on live traffic, with pass, fail and fraud rates
Review log with triggers	Periodic and event-driven updates, such as a vendor change or a fraud spike
Senior management sign-off	Ownership of the decision at the right level

Keep the CDD trail in one place. First Compliance automates CDD, sanctions screening and goAML reporting, screening customers against 1,800+ sanction lists and 5.5M+ PEP records so every eKYC onboarding rests on a documented check. See how First Compliance works.

Is Non-Face-to-Face Onboarding Higher Risk in the UAE?

Not automatically. Under the FATF Interpretive Note to Recommendation 10, non-face-to-face relationships are an example of potentially higher risk.

The CBUAE guidance qualifies this. A remote check through a reliable, independent digital ID system with proper controls may present a standard level of risk, or even a lower one where higher assurance levels apply. Your eKYC risk rating should reflect the strength of the route used, not just the fact that the customer was remote.

What are the main eKYC fraud risks?

The guidance separates risks at enrolment from risks at login. Both feed your transaction monitoring and suspicious activity reporting.

Stage	Risk	Practical control
Enrolment	Forged or altered identity document	Validate security features and check details with the issuer, such as the ICP gateway
Enrolment	Impersonation using another person’s real document	Biometric match against issuer data, with liveness detection
Enrolment	Synthetic identity built from real and fake data	Government-source validation, device and data consistency checks
Login	Credential stuffing and phishing	Phishing-resistant authenticators based on PKI or FIDO standards
Login	SIM swap defeating SMS one-time codes	Biometric factor for high-risk actions such as new payees or limit changes
Ongoing	Sold credentials and money mules	Monitor devices, geolocation and IP data; flag many identities on one device

How do deepfakes change eKYC controls?

The 2022 guidance predates the current wave of AI-generated faces and injected video streams, but its logic covers them. An eKYC system that cannot detect a fake is not reliable, so it fails the assurance test.

In our audit work, we now put three questions to every eKYC vendor:

Does the liveness check catch a replayed or injected video feed, as well as a printed photo held up to the camera?
Is the face matched against a government source, or only against the uploaded ID image?
How often is the detection model retested against new attack types?

Record the answers in your assurance assessment. For a wider view of AI in controls, see our AI in AML compliance guide.

Why are money mules an eKYC problem?

The FATF has observed that the overwhelming majority of digital IDs misused by criminal groups were issued on the basis of legitimate identity evidence. In the straw-man pattern the CBUAE guidance describes, real people open accounts, then sell their credentials to a criminal group that runs many accounts from one phone or tablet.

A perfect eKYC proofing result does not stop this. Authentication data does. The CBUAE expects institutions to use geolocation, IP and device data from logins in their ongoing monitoring, including to spot activity from sanctioned or high-risk jurisdictions.

Can You Rely on a Third Party or Vendor for eKYC?

Yes, in two different ways, and confusing them is a common inspection finding.

Point	Third-party reliance	Outsourcing to a vendor
Who did the check	Another regulated entity, on its own existing customer	A provider acting for you
Whose policies apply	The third party’s own AML/CFT policies	Your AML/CFT policies and procedures
Who may be relied on	Another LFI, a DNFBP or another regulated and supervised entity	Any competent provider you have assessed
Conditions	Get the identification data immediately, including assurance levels; confirm copies are available without delay; confirm the party is regulated for CDD and record keeping; weigh country risk	Due diligence, contract terms, oversight and the assurance assessment
Who is responsible	You keep ultimate responsibility for CDD	You keep full responsibility

Our guide to third-party reliance and outsourced CDD sets out the contract clauses and testing that make either model defensible.

What Records Must an eKYC File Hold?

UAE record-keeping rules are technology neutral. A digital record is as acceptable as a paper one, provided it is complete and can be produced quickly. Retain CDD records for at least five years after the business relationship ends, in line with our AML record-keeping guide. For each eKYC onboarding, the file should hold:

The identity attributes captured, mapped to the CBUAE field list
A copy of the Emirates ID and its digital verification record from the ICP gateway or UAE PASS
The biometric match and liveness result, with timestamp and system version
Device, IP and geolocation data captured at onboarding
Screening results for sanctions, PEPs and adverse media, including clean results
The customer risk rating and the reason for it
Any manual review notes and the name of the reviewer

eKYC Implementation Checklist for UAE Compliance Teams

Use this sequence when you launch or review a digital onboarding journey:

Map the journey. List every channel, customer type and identity route, including the fallback when a digital check fails.
Update the legal references. Cite Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025 in your eKYC policy.
Run and file the assurance level assessment. Rate each component and keep the vendor evidence.
Run and file the appropriateness assessment. Decide which segments may onboard remotely and which need a branch or video check.
Set the controls. Government-source validation, liveness detection, biometric step-up for high-risk actions, device monitoring.
Connect eKYC to screening and risk scoring. Identity proof alone is not CDD.
Feed login data into monitoring. Device sharing, impossible travel and high-risk locations become alerts.
Train the people who review exceptions. Manual overrides are where fake identities slip through.
Test it independently. Include eKYC in your next independent AML/CFT audit and record the findings.

Frequently Asked Questions

Is eKYC legal in the UAE?

Yes. UAE customer identification rules are technology neutral. The CBUAE’s Digital Identification guidance, in force since 31 October 2022, expressly permits licensed financial institutions to verify customers through reliable and independent digital ID systems such as UAE PASS and the ICP validation gateway.

Can I use UAE PASS for customer due diligence?

Yes, for identification and verification of UAE residents. The CBUAE names UAE PASS as a national digital identity system institutions should understand and use. It does not replace the rest of CDD, so you still need beneficial ownership, purpose of the relationship, screening and a risk rating.

Do I need to keep a copy of the Emirates ID if I verify it digitally?

Yes. When an institution verifies an Emirates ID, physically or through eKYC, the CBUAE expects it to use the ICP online validation gateway, UAE PASS or another government-supported solution. It must then keep a copy of the Emirates ID and its digital verification record.

Is non-face-to-face onboarding automatically high risk in the UAE?

No. FATF treats non-face-to-face relationships as potentially higher risk. The CBUAE guidance adds that eKYC through a reliable, independent digital ID system with proper controls may be standard risk, or even lower risk where higher assurance levels apply.

What is an assurance level assessment for eKYC?

It is a documented review of how reliable and independent a digital ID system is, based on its technology, architecture and governance. It comes before the appropriateness assessment, and if the system’s assurance cannot be established, the institution should not use it for CDD until the gap is fixed.

Does the CBUAE digital ID guidance apply to DNFBPs?

Not directly. It applies to CBUAE-licensed institutions such as banks, exchange houses, finance companies, payment providers and insurers. DNFBPs answer to the Ministry of Economy and Tourism or their own supervisor, though many use the CBUAE guidance as a practical benchmark for remote identity checks.