Simplified Due Diligence UAE: 2026 SDD Rules and Test

Simplified due diligence (SDD) is the lightest level of customer due diligence allowed under UAE AML law, and most firms either never use it or use it without the paperwork to defend it. Both are costly. This guide explains when simplified due diligence in the UAE is permitted under Cabinet Resolution No. 134 of 2025 and what you may relax. It also shows how to build a low-risk test and file note that will hold up when your supervisor reviews it.

Last updated: 5 November 2026. Reviewed against Federal Decree-Law No. 10 of 2025, Cabinet Resolution No. 134 of 2025 and Ministry of Economy and Tourism Circular No. 6 of 2025.

Quick Answer

Simplified due diligence in the UAE is allowed under Article 5(3) of Cabinet Resolution No. 134 of 2025 when a documented risk assessment shows low risk and there is no suspicion of a crime. Firms may verify identity later, refresh data less often and monitor less frequently. Sanctions screening and STR duties never relax.

Key Takeaways

SDD is lawful and expected. Article 5(3) of Cabinet Resolution No. 134 of 2025 lets financial institutions, DNFBPs and VASPs apply simplified measures where low risk is identified.
The regulator is asking for it. MoET Circular No. 6 of 2025, issued on 5 August 2025, tells DNFBPs to apply EDD to high-risk customers, standard CDD to medium risk and SDD to low risk.
Low risk must be proven, not assumed. SDD is only available after you have assessed risk under Article 5(1) and set mitigation policies under Article 5(2).
Suspicion ends SDD immediately. The article itself excludes any case where there is a suspicion that a crime has been committed.
Sanctions screening never relaxes. SDD must keep Targeted Financial Sanctions instructions from the Executive Office fully applied.
Four measures can be reduced. Timing of verification, frequency of data updates, frequency of monitoring, and how you establish the purpose of the relationship.
The file note is the defence. Inspectors test the written reason a customer was rated low, not the label on the screen.

What Is Simplified Due Diligence in the UAE?

Definition: Simplified due diligence (SDD) is a reduced set of customer due diligence measures for customers whose money laundering, terrorist financing and proliferation financing risk has been assessed and documented as low. UAE financial institutions, DNFBPs and virtual asset service providers may all apply it. It changes the depth and timing of checks. It does not remove the duty to identify the customer, screen for sanctions or report suspicion.

Simplified due diligence sits at the bottom of a three-tier, risk-based approach, and standard CDD applies to most customers. Enhanced due diligence applies to high-risk customers. SDD applies to the narrow group you can show is low risk. If you need a refresher on the middle tier, our guide to customer due diligence in the UAE covers the full set of standard measures.

What does Article 5(3) actually say?

Cabinet Resolution No. 134 of 2025, the executive regulations of Federal Decree-Law No. 10 of 2025, came into force on 14 December 2025 and replaced Cabinet Decision No. 10 of 2019. Article 5(3) says regulated entities may apply simplified measures where low risks are identified, unless there is a suspicion that a crime has been committed. They must first meet Clauses 1 and 2 of the same article and act in coordination with the Supervisory Authority.

The article then sets two conditions. The measures must be proportionate to the low-risk factors, and they must keep Targeted Financial Sanctions instructions fully applied. It lists four examples of what SDD may include:

Verifying the identity of the customer and the beneficial owner after the business relationship starts.
Updating customer data at longer intervals.
Reducing the frequency of ongoing monitoring and transaction scrutiny.
Inferring the purpose and nature of the relationship from the type of transaction or relationship, without collecting separate information.

Why is the UAE pushing firms to use SDD now?

Over-compliance has a cost the regulators now recognise. When every customer gets the same heavy file, compliance teams spend their hours on low-risk retail buyers and salaried residents instead of the complex structures that carry real exposure.

Ministry of Economy and Tourism Circular No. 6 of 2025 makes this point directly. It is addressed to real estate brokers and agents, dealers in precious metals and stones, auditors and accountants, and corporate service providers. The circular says a tiered approach lets them focus resources on higher-risk customers and avoid excessive measures for lower-risk ones, in support of financial inclusion.

The international standard moved the same way. In February 2025 the FATF amended Recommendation 1 and its Interpretive Note, with related changes to the notes for Recommendations 10 and 15. The aim was to give firms more confidence to apply simplified measures where risk is lower. With the UAE’s 2026 FATF mutual evaluation under way and assessors focused on effectiveness, a firm that cannot show proportionate controls has a weaker story than one that can.

When Can You Apply Simplified Due Diligence?

You can apply simplified due diligence only when three things are true together. Your risk assessment supports a low rating, your policy approves SDD for that customer type, and nothing in the file suggests suspicion. Missing any one of the three takes the customer back to standard CDD.

What are the three preconditions in Article 5?

A documented risk assessment (Article 5(1)). You must have considered customer, country and geographic, product, service, transaction and delivery channel risk before deciding the overall level. The method must be written down, kept up to date and available to the authorities on request. Your enterprise-wide business risk assessment is where low-risk segments first appear.
Approved mitigation policies (Article 5(2)). Senior management must approve the policies and controls, and they must be proportionate to the size and nature of the business. Your SDD categories belong in that approved policy.
Coordination with your supervisor. The article says SDD is applied in coordination with the Supervisory Authority. In practice, your SDD categories should match your supervisor’s guidance and the National Risk Assessment, and be visible in your policy so the supervisor can test them.

When is simplified due diligence never allowed?

SDD is off the table in the following situations, whatever the customer’s score says:

Any suspicion of money laundering, terrorist financing or proliferation financing.
Any link to a country identified by the National Committee as high-risk, or to a jurisdiction under FATF increased monitoring or a call for action.
A customer or beneficial owner who is a politically exposed person. See our PEP screening guide for the EDD steps that apply instead.
A potential or confirmed sanctions match that has not been cleared.
Doubts about the accuracy of identification data you already hold, which under Article 7(1)(c) triggers fresh CDD.
Complex ownership, nominee arrangements or structures with no clear commercial reason.

Which customers usually qualify as low risk?

The table below shows customer profiles that UAE firms commonly treat as low risk. None of them is low risk by law. Each still needs a scored assessment and a clean screening result.

Customer profile	Why it may score low	What still applies
UAE federal or local government entity	Public ownership, public accountability, known funding	Authority of the signatory, sanctions screening
Company listed on a regulated exchange with disclosure rules	Ownership is public, Article 11 relief on shareholder identification	Identity of the entity and its representatives, screening
UAE-licensed bank or insurer acting for itself	Supervised for AML by the CBUAE	Licence check, screening, monitoring at a lower frequency
UAE resident salaried individual, small and regular transactions	Verified Emirates ID, known income, low values	Identification, PEP and sanctions screening
Low-value product with capped limits	Product design limits the amount that can move	Thresholds under Article 7, linked-transaction checks

Need help defining your low-risk categories? ADZ’s compliance advisory team builds customer risk methodologies and AML policies that set out exactly where SDD applies and why. Talk to ADZ about your AML policy and risk assessment.

What Changes Under SDD, and What Never Changes?

Simplified due diligence changes timing and frequency. It does not change the core identification duty, the sanctions duty or the reporting duty. The table sets out the difference element by element.

CDD element	Standard CDD	Under SDD
Identify customer and beneficial owner	Before or during onboarding	Still required; verification may follow onboarding
Purpose and nature of relationship	Collected and recorded	May be inferred from the product or transaction type
Data refresh cycle	Set by policy for medium risk	Longer interval allowed
Ongoing monitoring	Standard frequency and thresholds	Reduced frequency of review and scrutiny
Sanctions and TFS screening	Full, at onboarding and on list updates	No change: full screening
STR and SAR reporting	Report suspicion via goAML	No change
Record retention	At least five years	No change

How does deferred verification work under Article 6(2)?

Article 6(2) lets you complete identity verification after the relationship starts in low-risk cases, but only on three conditions. Verification must be finished as soon as possible, the delay must be necessary so normal business is not disrupted, and you must apply effective measures to control the risk in the meantime. Article 6(3) adds that you must manage the risk where the customer can benefit from the relationship before verification is complete.

A practical control is a hard cap. A customer onboarded on SDD terms cannot exceed a set transaction value or withdraw funds until verification is closed. Any file still open after a fixed number of working days goes to the MLRO. Write the cap and the deadline into your procedure so the reviewer can test them.

Is the listed-company exemption the same as SDD?

No. Article 11 is a separate rule for companies listed on a securities market whose disclosure rules make beneficial ownership transparent, and for their controlled subsidiaries. For these customers you do not have to identify or verify each shareholder or beneficial owner, and you can take the information from public registers, the customer or other reliable sources.

You still identify the entity itself and the people acting for it, and you still screen. Our guide to beneficial ownership in the UAE explains the 25% ownership test that applies to everyone else.

Why does sanctions screening never relax?

Article 5(3) ties SDD to the full application of Targeted Financial Sanctions instructions issued by the Executive Office or other competent authorities. A low-risk customer still has to be screened against the UAE Local Terrorist List and the UN Consolidated List at onboarding and every time the lists change. If a match is confirmed, freezing and goAML reporting apply exactly as they would for any other customer. The TFS guide walks through those steps.

SDD vs CDD vs EDD: How Do the Three Tiers Compare?

MoET Circular No. 6 of 2025 maps each risk rating to one tier, subject to the absence of suspicion. In a typical UAE customer book, the middle tier is the largest.

Feature	SDD	Standard CDD	EDD
Risk rating	Low	Medium	High
Legal basis	Article 5(3)	Articles 6 to 10	Article 5(2)(c), Article 23
Identity verification	May follow onboarding	Before or during onboarding	Before onboarding, plus extra sources
Source of funds and wealth	Not routinely collected	Where necessary	Reasonable measures required
Senior management approval	Not per customer	Not per customer	May be required to start or continue
Monitoring frequency	Reduced	Standard	Increased
Sanctions screening	Full	Full	Full

SDD and EDD are mirror images in Cabinet Resolution No. 134 of 2025. Article 5(2)(c) tells you to update CDD data on high-risk customers more regularly. Article 5(3)(b) lets you update low-risk data at longer intervals. Both depend on the same risk score, so a weak scoring model undermines both tiers at once.

How Do You Build an SDD Test That Survives an Inspection?

A defensible SDD test has six parts: written categories, a scoring model, hard exclusions, a decision record, a review cycle and exit triggers. Build them in this order.

Define the eligible categories in policy. List the customer types that may be considered for SDD, such as government entities, listed companies and salaried residents below set transaction limits. Anything not on the list cannot be SDD.
Score every customer, including the obvious ones. Use the same model for all customers so the low rating comes from the score, not from a judgement made at the counter.
Apply hard exclusions before the score. PEP status, high-risk country links, unresolved screening hits and complex ownership should block SDD whatever the total.
Record the decision. Each SDD file needs a short note stating the category, the score, the exclusions checked and the measures relaxed.
Set the review cycle. Decide how often SDD customers are re-rated, and say so in the policy. A longer cycle is permitted. No cycle at all is not.
Define exit triggers. List the events that move a customer off SDD immediately, and make sure your monitoring can detect them.

What does a simple scoring model look like?

The model below is illustrative. Weightings must reflect your own business risk assessment and the National Risk Assessment, and your supervisor may expect different factors.

Risk factor (Article 5(1)(a))	Low (1 point)	Medium (2 points)	High (3 points)
Customer type	Government, listed, regulated FI	Private UAE company, resident individual	Trust, foundation, cash-intensive business
Country and geography	UAE only	Links to standard-risk countries	Any high-risk or monitored country
Product or service	Capped, low value	Standard	High value, cash, bearer or anonymous features
Delivery channel	Face to face or UAE PASS verified	Remote with digital ID checks	Introduced by unregulated third parties
Transaction pattern	Regular, predictable, small	Occasional larger amounts	Irregular, large or third-party payments

In this example, 5 or 6 points with no hard exclusion can qualify for simplified due diligence. A score of 7 to 11 points means standard CDD, and 12 points or more, or any hard exclusion, means EDD. If you onboard remotely, our eKYC guide covers the UAE PASS and digital ID checks that support a low channel score.

What should the SDD file note say?

Keep it short and specific, so a reviewer understands the decision in under a minute. A workable format reads:

“Customer rated LOW (score 5) under the Customer Risk Methodology v3.2. Category: UAE-listed company (Article 11 applied; ownership taken from exchange disclosures dated 2 November 2026). Exclusions checked: no PEP, no high-risk country link, sanctions screening clear on 3 November 2026. SDD measures applied: purpose inferred from service type; CDD refresh every 36 months; transaction review at reduced frequency; approved by the Compliance Officer on 3 November 2026.”

The 36-month cycle in this example is a policy choice, not a legal figure. Pick the interval your risk assessment supports and apply it consistently.

Score and screen every customer the same way. First Compliance automates customer risk scoring, sanctions screening across 1,800+ sanction lists and 5.5M+ PEP records, and goAML reporting, so each SDD decision carries a dated audit trail. See First Compliance software.

How Should DNFBPs and VASPs Apply SDD?

The four DNFBP sectors named in MoET Circular No. 6 of 2025 each have a small, identifiable low-risk segment. The examples below show where SDD tends to fit and where it does not.

Real estate brokers and agents

A UAE resident buying an off-plan unit through a bank mortgage, with the funds coming from a UAE bank account, often scores low on channel and source. Cash buyers, buyers paying through third parties, purchases in the name of a company with foreign owners, and rapid resales do not. Remember that some real estate transactions also trigger a separate goAML filing duty that SDD does not change. Our guide to money laundering through real estate in the UAE sets out the higher-risk patterns.

Dealers in precious metals and stones

Low-value retail sales paid by card to UAE residents are the clearest SDD candidates in the DPMS sector. Cash sales at or above reporting thresholds, bullion purchases and trade with counterparties in high-risk jurisdictions should never sit on SDD. The DPMS compliance guide covers the DPMSR reporting that runs alongside CDD.

Accountants, auditors and corporate service providers

Audit or bookkeeping work for UAE government entities and listed groups can justify SDD. Company formation for foreign owners, nominee arrangements, registered office services for entities with no UAE activity, and trust work almost never can. For CSPs, the risk sits in the structure being created, so the customer’s own profile is only half the score. See AML compliance for corporate service providers.

Virtual asset service providers

Cabinet Resolution No. 134 of 2025 includes VASPs in Article 5(3), so simplified due diligence is legally available to them, though the low-risk segment is small. Article 7(3) requires CDD on occasional transactions of AED 3,500 or more, single or linked, and transaction monitoring duties under the VARA rulebook still apply. Any reduced measures need clear support in your risk assessment. Our VASP compliance guide explains the VARA rulebook position.

What Triggers an Exit From SDD?

A customer leaves SDD the moment their risk changes, not at the next scheduled review. Build these triggers into your ongoing monitoring so they fire automatically:

Any internal suspicion report or unusual activity alert.
A sanctions or PEP screening hit, even if later cleared, until the review is complete.
A change of beneficial owner, controller or country of residence.
Transactions above the values or volumes the low rating assumed.
A new link to a high-risk or monitored jurisdiction after a FATF plenary or a National Committee update.
Doubts about the accuracy of data already on file.

If suspicion arises, you file an STR through goAML and take care not to tip off the customer. Article 14(2) allows you to stop CDD steps where they might alert the customer, as long as you report and record your reasons. The STR filing guide explains the process. Failing to report a suspicious transaction can lead to a fine of up to AED 5,000,000 under Federal Decree-Law No. 10 of 2025.

What records must you keep for SDD customers?

The same records you keep for everyone else.

Article 25 requires CDD records, monitoring results and analysis to be kept for at least five years. The period runs from the latest of these: the end of the relationship, account closure, completion of an occasional transaction, or the end of an inspection, investigation or court case. The SDD file note, the score and the screening results are part of that record. Our record-keeping guide covers how to organise files so individual transactions can be reconstructed.

What SDD Mistakes Do UAE Inspectors Pick Up?

In our work preparing UAE firms for inspections and independent audits, the same SDD weaknesses come up repeatedly:

Silent SDD. Staff apply lighter checks to familiar customers without any SDD category in the policy. This is non-compliance with Article 5, not proportionality.
Labels without scores. The system shows “Low” but nobody can show how the rating was calculated.
No review date. Low-risk files are never refreshed because the policy sets no interval.
Screening skipped on low-risk files. This breaches the TFS condition in Article 5(3) directly.
Deferred verification with no deadline. Files opened under Article 6(2) stay incomplete for months.
No exit triggers. A customer’s activity grows tenfold and the rating never moves.

Each of these weakens a firm’s defence when its simplified due diligence files are sampled. Fines on legal persons convicted of money laundering range from AED 5 million to AED 100 million under Federal Decree-Law No. 10 of 2025, and supervisors also impose administrative penalties for control failures. Our guide to preparing for a UAE AML inspection shows how reviewers sample files.

Test your SDD files before the supervisor does. ADZ conducts independent AML/CFT audits for CBUAE, DFSA and VARA-regulated entities, including file sampling of low-risk customers. Book an independent AML audit.

Frequently Asked Questions

When can simplified due diligence be applied in the UAE?

Only when your documented risk assessment rates the customer as low risk, your approved policy allows SDD for that customer type, and there is no suspicion of money laundering, terrorist financing or proliferation financing. Article 5(3) of Cabinet Resolution No. 134 of 2025 also requires coordination with your Supervisory Authority.

Is simplified due diligence mandatory for low-risk customers?

No. Article 5(3) says firms may apply SDD, so it is a permission, not an obligation. MoET Circular No. 6 of 2025 does encourage DNFBPs to apply SDD to low-risk customers so resources go to higher-risk relationships. Applying standard CDD to a low-risk customer is not a breach.

Can DNFBPs in the UAE use simplified due diligence?

Yes. Article 5(3) covers financial institutions, DNFBPs and virtual asset service providers. MoET Circular No. 6 of 2025 tells real estate brokers and agents, precious metals and stones dealers, auditors, accountants and corporate service providers to apply SDD to customers identified as low risk.

Do you still screen low-risk customers for sanctions?

Yes. Article 5(3) requires SDD to keep Targeted Financial Sanctions instructions fully applied. Every customer, whatever the rating, must be screened against the UAE Local Terrorist List and the UN Consolidated List at onboarding and whenever the lists are updated.

What is the difference between SDD and EDD?

SDD reduces the depth and frequency of checks for low-risk customers, for example verifying identity after onboarding or refreshing data less often. EDD increases them for high-risk customers, for example collecting source of wealth, monitoring more closely and obtaining senior management approval. Both depend on the same documented risk assessment.

Can you verify a customer’s identity after onboarding in the UAE?

Yes, in low-risk cases under Article 6(2) of Cabinet Resolution No. 134 of 2025. Verification must be completed as soon as possible and the delay must be necessary to avoid disrupting normal business. You must also control the risk in the meantime, for example by capping transactions until verification is done.

How often should low-risk customer data be updated?

The law does not set a fixed interval. Article 5(3)(b) allows updates at longer intervals for low-risk customers, so the cycle is a policy decision. Set it in your approved AML policy, base it on your risk assessment and apply it consistently, alongside event-driven reviews when risk changes.