Clear Horizon Discuss your requirements

Regulatory notes

Relying on another participant's due diligence

Where several intermediaries are involved, Article 20 permits an in-scope entity to rely on specified customer due diligence measures performed by a third party, subject to stated conditions, while retaining responsibility for their accuracy.

First published
21 August 2026
Last revised
8 October 2026

In a placement involving several intermediaries, more than one in-scope participant may seek customer due diligence information concerning the same customer. Earlier collection of that information does not by itself establish that Article 20 permits another participant to rely on it.

Article 20 of Cabinet Resolution No. 134 of 2025, the executive regulations of Federal Decree-Law No. 10 of 2025, permits a Financial Institution, a Designated Non-Financial Business or Profession, or a Virtual Asset Service Provider within its scope to rely on specified customer due diligence measures performed by a third party, subject to stated conditions. The relying entity remains responsible for the accuracy of those measures.

What the provision permits

Article 20 permits reliance for the customer due diligence purposes it specifies: identifying the customer and beneficial owner, understanding the nature of the customer’s business, or for the purposes of a business relationship. The permission is limited to the measures identified in the provision.

Two conditions are attached. The first concerns the third party: the relying entity must ensure that the third party is regulated and supervised and complies with the customer due diligence and record-keeping requirements of the Resolution.

The second concerns information. The relying entity must immediately obtain the necessary identification data and information collected during the third party’s customer due diligence, and must take the necessary steps to ensure that copies of the necessary documents can be obtained without delay on request.

Immediate receipt of the necessary identification data and information is distinct from the requirement to be able to obtain copies of the necessary documents without delay on request. The two are stated separately in the provision, and satisfaction of one does not by itself establish satisfaction of the other.

Reliance and the external performance of due diligence

Clause 3 of Article 20 states that reliance on a third party does not include the use of external sources, such as outsourcing or agency services, to perform customer due diligence measures on the entity’s behalf, where those services are carried out in accordance with the entity’s internal policies and procedures, where the external sources are subject to its supervision and control in the effective implementation of those policies and procedures, and where they apply fitness and propriety standards and effective audit procedures to their staff.

The characterisation of a given arrangement therefore turns on the features stated in Clause 3, not on the label used in correspondence. Where a broker collects identification documents using an insurer’s forms, that fact does not by itself determine the characterisation. The analysis must also address whether the work is performed on the insurer’s behalf under its internal policies and procedures, whether the external source is subject to its supervision and control, and whether the specified fitness, propriety and audit arrangements apply to that source’s staff.

Supervisory expectations

The Central Bank’s Guidance for Licensed Financial Institutions on Customer Due Diligence/Know Your Customer and Record-Keeping, in force from 7 November 2025, adds expectations at Section 3.10. It refers to the submission of a non-objection certificate or letter of the third party to the Central Bank for approval, states that third-party reliance does not apply to outsourcing, service provider, vendor or agency relationships, and treats reliance as acceptable only in relation to other financial institutions or designated non-financial businesses and professions. Section 3.10 cites the corresponding provision of the former executive regulations; the operative provision is Article 20.

Where the third party forms part of the same group

Where the third party forms part of the same Financial Group, Article 20(2) specifies group-level matters that the relying entity must ensure. These concern the application by the group of the due diligence, politically exposed person, record-keeping and anti-crime programme requirements identified in Divisions Three, Four and Eleven of Part One of the Chapter and in Article 32, supervision of the group in that respect by the competent authority, and the adequate mitigation of high country-related risks through the group’s anti-crime policies and controls.

The group relationship does not by itself establish that the requirements for reliance have been met.

The country-risk layer

Article 20 requires the countries identified by the National Committee as high-risk, countries with deficiencies in their anti-money laundering, terrorist financing and proliferation financing systems, and the available information on country risks, to be taken into account. It does not prescribe an exhaustive list of geographical connections relevant to that assessment.

Article 23 separately addresses enhanced due diligence and countermeasures concerning high-risk countries and countries with deficiencies in their systems.

The underlying obligation, and Article 42

Reliance is a question that arises only where the framework applies to the entity in question. Whether it applies must be assessed separately for each participant and the relevant activity; the perimeter question is addressed in the note on the 2025 instruments and the insurance perimeter. The structure of a placement chain, and the difference between the flow of information and contractual privity, is set out in the note on beneficial ownership through the placement chain.

Article 42 provides that banking secrecy, professional secrecy or contractual liability may not be invoked to prevent the application of the framework where information is exchanged between Financial Institutions in connection with reliance under Article 20. The provision does not extend that rule to every category of third party, and it does not remove every other legal or practical restriction on the exchange of information.

What the record can evidence

Article 20 does not prescribe a particular file format. A record intended to evidence the application of its conditions could identify the following matters:

  • which third party is relied upon, and on what basis it was established that the third party is regulated and supervised and complies with the customer due diligence and record-keeping requirements of the Resolution;
  • that the necessary identification data and information were obtained immediately, and by what route copies of the necessary documents can be obtained without delay on request;
  • the features listed in Clause 3 as they apply to the arrangement: whose internal policies and procedures govern the work, on whose behalf it is performed, what supervision and control applies, and what fitness, propriety and audit arrangements apply to the staff concerned; and
  • how country risk was taken into account.

Article 20 permits reliance only on its stated conditions and leaves the relying entity responsible for the accuracy of the measures.

This note sets out general observations on the applicable regulatory framework and does not address the circumstances of any particular entity. It does not constitute legal advice and should not be relied upon as such. The description reflects the regulatory framework as at the date of the latest revision stated above. Any English translation of UAE federal legislation cited in this note should be read subject to the authoritative Arabic text, which prevails in the event of inconsistency.