Federal Decree-Law No. 10 of 2025
The federal AML/CFT law, on the CBUAE Rulebook.
UAE KYC, across four regulators.
A new federal AML law and Executive Regulations took effect in late 2025, applied by the Central Bank, Capital Market Authority, DFSA (DIFC) and FSRA (ADGM).
The Central Bank and FSRA name UAE Pass for verifying identity; Fill Easy returns it, with company registry records and ownership.
A summary, not legal advice: the official text governs, and your compliance team decides what your policies require.
A new federal law, four rulebooks.
Federal Decree-Law No. 10 of 2025 replaced Decree-Law No. 20 of 2018 from 14 October 2025; its Executive Regulations, Cabinet Resolution No. 134 of 2025, followed on 14 December 2025. Circulars under the old law stay in force where they do not conflict.
The Executive Regulations require identity verified from original documents, data or information from a reliable and independent source, and set a 25% ownership threshold for beneficial owners.
At a glance
- Law
- Federal Decree-Law No. 10 of 2025; Cabinet Resolution No. 134 of 2025
- Beneficial owner
- 25% or more of ownership or voting rights, or control by other means
- Records
- At least five years federally; six in the DIFC and ADGM; ten under the CMA
- Non-residents
- Customers without a UAE identity card are treated as higher risk
- Regulators
CBUAECentral Bank of the UAECMACapital Market AuthorityDFSADubai Financial Services AuthorityFSRAFinancial Services Regulatory AuthorityThe DFSA regulates the DIFC; the FSRA regulates ADGM.- Digital identity
- UAE PassThe UAE's national digital identityNamed by the CBUAE and FSRA as a way to verify identity.
Choose your sector.
Where your firm is licensed decides whose rulebook applies. Pick yours to see what it accepts, and what Fill Easy supplies.
CBUAECentral Bank of the UAECBUAE Guidance on CDD/KYC and record-keeping, 2025 (opens in a new tab)Individuals
Identify the customer
Name as on the identity card or travel document (with a copy), nationality, permanent address, date of birth, place of birth depending on risk, and employer (CDD Guidance 3.2.1; Executive Regulations Art. 9).
GovVerify · UAE PassEmirates ID number, name in English and Arabic, nationality and date of birth, shared with the customer's consent.Verify the Emirates ID
Use the ICP online validation gateway, the UAE Pass app or another UAE government-supported solution; keep a copy of the Emirates ID and its digital verification record (Digital ID Guidance 2.2; CDD Guidance 3.2.4.1).
GovVerify · UAE PassEmirates ID number, name in English and Arabic, nationality and date of birth, shared with the customer's consent.Proof of address
A utility bill from the last three months, a tenancy contract or UAE government correspondence, among others (CDD Guidance 3.2.4).
Address proof stays with your process: UAE Pass does not return an address.
Customers without an Emirates ID
Passports copied and certified "Original sighted and verified" by staff; non-residents are treated as higher risk.
GovVerifyCustomers from Hong Kong, Singapore, the UAE or Mainland China verified by their government's digital identity, where your policy accepts it.
Companies
Identify and verify the entity
Name, legal form, memorandum, head office, articles attested by a UAE authority, senior managers and signatories; evidence includes an official extract from a government-maintained corporate registry (CDD Guidance 3.2.2 and 3.2.4).
CorpVerify · registry searchThe official extract from the company's home registry, with its constitutional documents where the registry holds them.Non-resident companies
Notarised documents for the first ownership layer and complete incorporation documents for the layers above it (CDD Guidance 3.2.4).
CorpVerify · registry searchIncorporation documents from each layer's registry, in Hong Kong, Mainland China and other jurisdictions.Beneficial owners
Natural persons with 25% or more, traced up the chain; consider 10% for higher-risk customers (CDD Guidance 3.2.5; Executive Regulations Art. 10).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.
Non-face-to-face and records
- Non-face-to-face policies must be at least as stringent as face to face; a video call is still non-face-to-face (CDD Guidance 3.7).
- Onboarding that relies on reliable digital identity may present a standard or even lower level of risk (Digital ID Guidance 2.1).
- Records kept for at least five years from the latest of the relationship ending, the transaction or an investigation (Executive Regulations Art. 25).
CMACapital Market AuthoritySCA Rulebook, Chapter Five: AML guidelines (opens in a new tab)Individuals
Identify the customer
Full legal name and aliases, nationality, UAE address, date and country of birth, and the identity document: a UAE identity card, passport or GCC national identity card, with its number, place of issue and expiry (Chapter Three, Art. 1).
GovVerify · UAE PassEmirates ID number, name in English and Arabic, nationality and date of birth, shared with the customer's consent.Verify, within 30 days at most
From authentic and reliable independent sources. Verification may follow onboarding but must finish within 30 days, or the relationship ends.
GovVerify · UAE PassEmirates ID number, name in English and Arabic, nationality and date of birth, shared with the customer's consent.
Companies
Identify the entity
Legal name, place and date of incorporation, address, the commercial licence or equivalent with its number, issue and expiry dates, activity, constitution, and senior management.
CorpVerify · registry searchThe registry record and licence details from the company's home registry.Beneficial owners
25% or more; otherwise control by other means; as a last resort senior management, with a written record.
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.
Non-face-to-face and records
- Relationships run remotely through technologies such as electronic signatures are listed as a risk factor (Chapter Two, Art. 3).
- Records kept for ten years, longer than the federal minimum (Chapter Twelve, Art. 1).
DFSADubai Financial Services AuthorityDFSA Rulebook, AML module (chapter 7) (opens in a new tab)Individuals
Identify the customer
Full name, date and place of birth, nationality, legal domicile, residential address (not a PO box) and employer (Rule 7.3.2(2)).
GovVerify · UAE PassEmirates ID number, name in English and Arabic, nationality and date of birth, shared with the customer's consent.Verify from reliable, independent sources
Name, birth details and nationality from a current passport or official photo ID, with certified copies where there is no physical contact; information downloaded from an official government source is sufficient (Rule 7.3.1(3); guidance items 1 and 2).
GovVerifyCustomers from Hong Kong, Singapore, the UAE or Mainland China verified by their government's digital identity, where your policy accepts it.
Companies
Identify and verify the entity
Name and trading name, registered office, date and place of incorporation, a copy of the certificate of incorporation, articles, senior management and legal form (Rule 7.3.2(3)).
CorpVerify · registry searchThe certificate of incorporation, articles and officers from the company's home registry.Beneficial owners
Natural persons with a controlling ownership interest, then control by other means, then senior management (Rule 7.3.3). The DFSA sets no fixed threshold; federal law uses 25%.
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.Ongoing monitoring
Periodic refresh of passport numbers, addresses and share registers (Rule 7.6.1 and guidance).
Monitoring and remediationThe book re-checked at source from one Excel file, with director, owner, address and status changes flagged.
Non-face-to-face and records
- Non-face-to-face relationships without safeguards such as electronic signatures are a higher-risk indicator (Rule 6.1.2(1)).
- Records kept for at least six years (Rule 14.4.1).
FSRAFinancial Services Regulatory AuthorityFSRA AML and Sanctions Rulebook, Rule 8.3.2 (opens in a new tab)Individuals
Identify the customer
Full name and aliases, date and place of birth, nationality, legal domicile, residential address and employer (Rule 8.3.2(2)).
GovVerify · UAE PassEmirates ID number, name in English and Arabic, nationality and date of birth, shared with the customer's consent.UAE Pass as verification
For UAE residents, a duly authenticated UAE Pass may be used to identify and verify a customer, including address verification; a government identity document in digital form counts as valid (guidance items 1 and 4).
GovVerify · UAE PassEmirates ID number, name in English and Arabic, nationality and date of birth, shared with the customer's consent.
Companies
Identify and verify the entity
Name, trading name, legal form, addresses, date and place of incorporation, certificate of incorporation, articles, registration number and senior management (Rule 8.3.2(3)).
CorpVerify · registry searchThe certificate of incorporation, articles and officers from the company's home registry.Beneficial owners
25% or more of shares or votes, the right to appoint or remove most of the board, or significant influence; otherwise senior management (Rule 8.3.3).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.Ongoing monitoring
Periodic review of due diligence and beneficial ownership information (Rule 8.6.1).
Monitoring and remediationThe book re-checked at source from one Excel file, with director, owner, address and status changes flagged.
Non-face-to-face and records
- Electronic KYC must be at least as stringent as face to face, with several authentication factors, checks that both ID and person are genuine, and UAE biometric standards (guidance item 8).
- Records kept for at least six years (Rule 4.5.1).
Read the source
The official text.
Cabinet Resolution No. 134 of 2025
The Executive Regulations: due diligence, beneficial owners and records.
CBUAE Guidance on digital identification
UAE Pass and the ICP gateway for verifying the Emirates ID.
FSRA AML Rulebook guidance, Rule 8.3.2
UAE Pass for identity and address verification in ADGM.
Questions about UAE KYC and AML
Not covered here? Ask our team
Can we rely on the data Fill Easy returns?
Yes, as verification evidence. The Executive Regulations ask you to verify identity using original documents, data or information from a reliable and independent source (Cabinet Resolution No. 134 of 2025, Art. 9). The Central Bank names UAE Pass among the ways to verify an Emirates ID and accepts an official extract from a government-maintained corporate registry, and in the DIFC information taken from an official government source is sufficient. Fill Easy passes that data on unaltered, with its source and retrieval time. You rely on the source, not on Fill Easy as an intermediary, and the decision stays with your firm.
Does Fill Easy make us compliant with United Arab Emirates AML rules?
No. The due diligence duty sits with your firm under United Arab Emirates AML rules, and your policies decide what is enough. Fill Easy supplies the evidence those policies rely on: records from the government or registry source, each showing where and when it was retrieved.
Does UAE Pass verify the customer's address?
In ADGM, the FSRA accepts a duly authenticated UAE Pass for address verification of UAE residents. Fill Easy's UAE Pass data is the Emirates ID number, name, nationality and date of birth, so elsewhere address evidence stays with your process.
Which law applies now?
Federal Decree-Law No. 10 of 2025, in force since 14 October 2025, and its Executive Regulations, Cabinet Resolution No. 134 of 2025, in force since 14 December 2025. Circulars and guidance made under the 2018 law stay in force where they do not conflict, so some still cite the old article numbers.
Is 25% the beneficial ownership threshold everywhere?
It is the federal threshold. The Central Bank suggests considering 10% for higher-risk customers, and the DFSA sets no fixed figure, expecting a lower one where the risk calls for it.
How do we onboard customers without an Emirates ID?
Non-residents are treated as higher risk. Passport copies are certified "Original sighted and verified" by staff, and customers from Hong Kong, Singapore or Mainland China can be verified through their own government's digital identity, where your policy accepts it.
How do we verify a company registered outside the UAE?
The Central Bank expects notarised documents for the first ownership layer and complete incorporation documents for each layer above it. Fill Easy returns the incorporation documents from each layer's registry, with an English summary.
Does a video call count as face to face?
No. The Central Bank treats a relationship built over a video call as non-face-to-face, so its non-face-to-face controls apply (CDD Guidance 3.7).
How long must we keep the records?
At least five years under federal law, six years in the DIFC and ADGM, and ten years under the Capital Market Authority's rules.