When must KYC be completed?

The objection that “KYC is delaying the deal” combines two questions. Is customer due diligence (CDD) required at all? If it is, must every element be completed now and to the same depth? The first is largely fixed by the applicable rules. The second depends on risk, timing provisions and controlled exceptions.

FATF sets an international standard rather than a directly enforceable onboarding rule for every company. Countries implement it through legislation and regulatory requirements. Recommendation 10 addresses financial institutions; Recommendation 22 extends specified requirements to defined designated non-financial businesses and professions (DNFBPs). Whether an entity or activity falls within the UAE framework is therefore a separate question, considered in the note on the 2025 instruments and the insurance perimeter.

What is mandatory

FATF Recommendation 10 requires CDD when a business relationship is established, when specified occasional transactions are carried out, when money laundering or terrorist-financing suspicion arises, or when previously obtained identification data appears unreliable or inadequate. The risk-based approach does not decide whether CDD is required in those circumstances; it determines the extent of the measures applied.

CDD covers identifying and verifying the customer; identifying the beneficial owner and taking reasonable measures to verify that person; understanding the purpose and intended nature of the relationship; and ongoing scrutiny. Urgency cannot remove these elements. It also does not justify collecting every conceivable document: the nature and extent of verification must remain proportionate to risk.

When verification must be completed

Recommendation 10 sets the baseline: the identities of the customer and beneficial owner are verified before or while the relationship is established, or when an occasional transaction is conducted. A country may permit completion as soon as reasonably practicable afterwards only where the risks are effectively managed and postponement is essential to avoid interrupting normal business. Use of the relationship before completion must be controlled, for example through transaction limits and closer monitoring.

This is not permission to begin with an incomplete file and finish it whenever convenient. If applicable CDD cannot be completed, the institution must not open the account, begin the relationship or execute the transaction, or must terminate an existing relationship, and should consider a suspicious transaction report.

How the UAE implements the boundary

The enforceable federal framework is Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025. Article 7(1) requires financial institutions, DNFBPs and virtual asset service providers to apply CDD when establishing a business relationship, when there is suspicion of a Crime, or when doubts arise about the accuracy or adequacy of previously obtained customer identification data.

The occasional-transaction thresholds are category-specific. Under Article 7(2), a financial institution applies CDD to an occasional transaction of at least AED 55,000 and to a transfer of at least AED 3,500. Under Article 7(3), the AED 3,500 threshold applies to one or several related virtual-asset transactions by a virtual asset service provider. Article 7 does not set a general occasional-transaction threshold for DNFBPs. Their activity-specific triggers appear elsewhere: Article 3 includes AED 55,000 for dealers in precious metals and stones and AED 11,000 for gaming operators.

Article 6 requires verification of the customer and beneficial owner before or while a relationship is established. Article 6(2) permits completion of customer identity verification afterwards only in cases of low crime risk, provided verification is completed promptly, deferral is necessary to avoid disrupting normal business, and effective risk controls apply. The low-risk condition makes the UAE exception narrower than the FATF baseline. Article 21(1) additionally requires risk-management procedures for relationships used before verification is complete.

Article 5(3) treats later verification of both the customer and beneficial owner as a possible simplified measure. That permission is not unilateral: its conditions include coordination with the Supervisory Authority. Read with Article 6(2), it also shows a textual distinction between a simplified measure addressing both persons and the timing exception referring only to customer identity verification.

Article 13 requires customer due diligence measures to be applied to existing customers and business relationships, at such times as the institution considers appropriate based on materiality and risk, and requires the adequacy of data obtained before the Resolution took effect to be ensured. Article 14 prohibits establishing or continuing a relationship, or executing a transaction, when CDD cannot be applied. If a suspected Crime exists and applying CDD may alert the customer, Article 14(2) permits the institution to refrain and requires a suspicious transaction report (STR) stating the reasons.

For DIFC Relevant Persons, the federal regime operates with Articles 70(3) and 71(1) of the Regulatory Law and the DFSA AML Module. In ADGM, sections 15A–15B of the Financial Services and Markets Regulations and the FSRA AML Rulebook apply to Relevant Persons. Sector and supervisor must therefore be identified before any deferral is approved.

Depth is determined by risk

Recommendation 1 requires proportionate measures. Higher risk requires enhanced measures; lower risk may justify simplified measures where national rules allow and no suspicion or specified higher-risk scenario exists. INR.1 paragraph 16 expressly requires institutions to consider differentiating measures according to the type and level of risk.

A common core process is legitimate. What the risk-based approach rejects is mechanically identical depth: the same additional documents, approvals, update frequency and monitoring intensity regardless of identified risk. The discretion belongs to the institution through approved governance, not to an individual employee. Efficiency may come from parallel collection, removal of duplicative evidence and permitted third-party reliance under Recommendation 17, whose UAE conditions are considered in the note on another participant’s due diligence.

What the file must show

The record should identify the customer and beneficial owner, verification sources, relationship purpose, assessed risks and selected measures. A deferred step should have a recorded legal basis, approval, interim controls and completion date. FATF Recommendation 11 requires relevant records to be retained for at least five years. Article 25 supplies the UAE rule, calculating the period from the latest applicable event specified there.

A delay labelled “KYC” may therefore reflect a mandatory boundary, a proportionate risk decision or an inefficient process. The useful questions are specific: what triggered CDD, which element remains incomplete, what does national law require then, and which risk factor justifies the requested depth?

---

This note sets out general observations on the applicable regulatory framework and does not address the circumstances of any particular entity. It does not constitute legal advice and should not be relied upon as such. The description reflects the regulatory framework as at the date of the latest revision stated above. Any English translation of UAE federal legislation cited in this note should be read subject to the authoritative Arabic text, which prevails in the event of inconsistency.