· Jurisdiction Briefing

ADGM: ‘Know your business partner’ is where vendor due diligence already sits

"Know Your Vendor" is a process label, not an instrument. That is why a search for it in a rulebook comes back empty, and why firms sometimes conclude the duty is a matter of good practice rather than law.

Illustration for “ADGM: 'Know your business partner' is where vendor due diligence already sits”

“Know Your Vendor” is a process label, not an instrument. That is why a search for it in a rulebook comes back empty, and why firms sometimes conclude the duty is a matter of good practice rather than law.

In ADGM it is law, and it carries the regulator’s own heading: Know your business partner, Section 9.2 of the FSRA’s Anti-Money Laundering and Sanctions Rulebook. It sits in the current rulebook, AML VER11.210526, and it sat under a slightly different name in the version before it. This briefing sets out where the duty lives, who it binds, and the two points where a vendor relationship draws in more than a name check.

Where it sits, and what binds

Chapter 9 of the AML Rulebook is headed Third party CDD, business partner due diligence and outsourcing elements of CDD. Three limbs, three different problems:

  • 9.1 — Reliance on a third party’s CDD. Someone else has done CDD on your customer and you are leaning on it.
  • 9.2 — Know your business partner. The counterparty itself, where that counterparty is not your customer.
  • 9.3 — Outsourcing elements of CDD. You have handed part of your own customer CDD to a service provider.

Only 9.2 is squarely about a counterparty who is not your customer. Treating the three as one topic is the fastest way to a vendor policy that reads well and covers nothing.

Rule 9.2.1 is the operative sentence:

> “Prior to establishing the business relationship, a Relevant Person must > establish and verify the identity of its business partners by obtaining > sufficient and satisfactory evidence of the identity of any business partner > it relies upon in carrying on its Regulated Activities.”

Two Rules follow it. Rule 9.2.2 requires the firm to maintain accurate and up-to-date information and to conduct ongoing due diligence on its business partners throughout the course of the business relationship. Rule 9.2.3 is the remediation trigger: if the firm becomes aware at any time that it lacks sufficient information or documentation concerning a business partner’s identification, or develops a concern about the accuracy of what it holds, it must promptly obtain appropriate material to verify that partner’s identity.

The Rulebook itself treats this as a separate exercise from customer CDD. The record-keeping Rule, 4.5.1(a), requires a copy of all documents and information obtained in undertaking initial and ongoing CDD or due diligence on business partners — two named things in one line.

This is a restructure, not a new obligation

Be careful how you write this up internally, because the substance did not change on 21 May 2026.

The previous rulebook, AML VER10.020125, which the FSRA’s version table shows as effective from 2 January 2025 to 20 May 2026, already carried the duty at 9.2, under the heading Business partner identification, and its 9.2.1(1) opens with the same words as today’s Rule 9.2.1. What VER11 did was split that single Rule into three standalone Rules, 9.2.1 to 9.2.3, move the definition of “business partner” into Guidance, and lift the correspondent-banking obligations that used to sit inside 9.2 out into Chapter 10.

The FSRA said as much on the way through. Consultation Paper No. 1 of 2026 records that “Requirements in AML 9.2 for business partner due diligence have been streamlined”, with correspondent-banking requirements consolidated into Chapter 10. When it finalised the package on 21 May 2026, the FSRA said the amendments reflect developments in federal laws and international best practice, and that “the enhancements will have minimal impact on existing compliance requirements”.

So the finding for your gap analysis is not “a new vendor rule has landed”. It is “the duty we have had since at least January 2025 now has three numbered Rules, and our policy cites the wrong paragraph numbers.”

Rule, Guidance, and who counts as a business partner

The binding text does not tell you who your business partners are. That definition sits in Guidance under 9.2, and it is permissive: a business partner may include the persons a firm may rely on under Rule 9.1.1(1), a service provider performing elements of CDD under Rule 9.3.1, and other service providers. The Guidance then draws the line most policies need. Service providers include agents that directly facilitate a firm’s activities in servicing its clients, as distinct from service providers that provide purely ancillary services — software or facilities management are the Rulebook’s own examples — where the money laundering risks of the relationship to the firm are low.

Two consequences follow, and they point in opposite directions.

It is Guidance, so it is not a safe harbour. You cannot answer a supervisor’s question about a category of vendor by reciting a “may include” list, and you cannot read that list as closed.

But it is also less prescriptive than it used to be. In VER10 the same definition sat inside the Rule and said a business partner “includes” four named categories. The scoping decision is now more visibly yours to make and to justify, and the Guidance says how: take a risk-based approach, and let the money laundering risk assessment of the partner set the level of detail in the identification and verification process.

Who this binds

Not “all ADGM firms”. Rule 1.2.1(2) divides the Rulebook by type of Relevant Person. Authorised Persons other than Credit Rating Agencies, and Recognised Bodies, get Chapters 1 to 14. DNFBPs get Chapters 1 to 9 and 11 to 15. Representative Offices get Chapters 1 to 6 and 11 to 14. NPOs get Chapter 16 alone.

Chapter 9 therefore binds Authorised Persons, Recognised Bodies and DNFBPs. It does not reach Representative Offices — the Guidance explains that Chapters 7 to 9 deal with customers, and a Representative Office does not have any — and it does not reach NPOs. If you are drafting for a group with a representative office in ADGM, that office is outside this chapter.

CDD, eKYC and screening providers carry a harder set of conditions

There is a category of vendor that cannot be filed under “purely ancillary software”. Guidance under 9.3 states that outsourcing elements of CDD includes using digital identity verification services, screening services and using a service provider’s eKYC System. Where you use such a provider for your customer CDD, Section 9.3 applies on top of the business-partner duty, and it is prescriptive.

Before you appoint: evaluate the suitability of the provider, establish that the services are reliable, assess whether the service will keep you compliant with applicable legislation including anti-money laundering legislation, and clearly document the services to be provided in a binding agreement (9.3.3). After you engage: undertake periodic assurance assessments that the services comply with the agreement and allow you to remain compliant (9.3.4). There is one outright prohibition — you must not outsource any element of CDD to a service provider incorporated in or operating from a Jurisdiction Subject to a Call to Action (9.3.2). And the liability does not travel: under 9.3.1 a firm that outsources any element of its CDD, including to a member of its own Group, remains responsible for compliance and liable for any failure to meet anti-money laundering legislation.

Guidance adds a useful point for eKYC procurement. Where an eKYC system has been authorised or approved by a competent authority of the UAE, or by one in a jurisdiction with equivalent AML/TFS laws, a firm may take that into account in assessing suitability — but should still undertake its own review.

The one place sanctions screening reaches past the customer file

Chapter 11 carries the bridge. Rule 11.1.1(1) requires effective systems and controls to stay informed of, and take reasonable measures to comply with, relevant resolutions and Sanctions. Rule 11.1.1(2) then requires those systems and controls to enable the firm to comply with the requirements in Article 21 of Cabinet Resolution No. (74) of 2020.

Open Article 21, and the screening obligation is drawn wider than the customer file. Regular screening of databases and transactions against the UN Security Council, Sanctions Committee and Local Lists must include searching customer databases, searching the names of parties to any transactions, searching the names of potential customers, searching the names of beneficial owners, and:

> “Search for names of persons and organizations with which they have a direct > or indirect relationship.”

The notification duties in the same article point the same way: the firm must notify the Supervisory Authority if it suspects that one of its current or former customers, or a person it has a business relationship with, is listed or has a direct or indirect relationship with a Listed Person.

Read that as a statement of scope, not as a named supplier-screening rule. Article 21 is drafted in the language of relationships, and the words “supplier” and “vendor” are not the ones it uses. Note the status carefully too, and say it the way the records say it: the CBUAE Rulebook page for Article 21 is headed “CAB DEC 74/2020 Effective from 27/10/2020 Status: In-Force”, and the FSRA’s May 2026 rulebook still cross-refers to the same instrument at 11.1.1(2).

Two limits worth stating plainly

Beneficial ownership is anchored to the customer. The Rulebook’s defined term says so in its own first words: Beneficial Owners means, in relation to a customer, a natural person who ultimately owns or controls the customer, or a natural person on whose behalf a transaction is conducted or a business relationship established. The identify-and-verify machinery for beneficial owners in Chapter 8 runs to customers, and Rules 9.2.1 to 9.2.3 ask for the identity of the business partner, not for its ownership chain. If your house standard is to unwind a vendor’s ownership to a natural person, treat that as a risk-appetite decision and record it as one, rather than citing a business-partner rule that does not ask for it.

The trigger is regulated activity, not procurement. Rule 9.2.1 turns on reliance “in carrying on its Regulated Activities” — not on contract value, spend band or a place on a supplier register. Scope the population from your Regulated Activities, not from your accounts payable ledger.

One cross-reference to check by hand

If your outsourcing policy travels from the General Rulebook into the AML Rulebook, check the paragraph number. GEN VER15.160926 still carries Guidance under Rule 3.3.32 stating that “AML 9.2 contains additional requirements that apply to an Authorised Person that outsources one or more elements of its Client Due Diligence to a service provider”. Since VER11, the outsourcing requirements are in AML 9.3; AML 9.2 is business-partner due diligence. Follow the pointer blindly and you will end up testing the wrong control.

Four things worth doing

  1. Split the register. One list of parties you rely on under 9.1, one list of business partners under 9.2, one list of CDD service providers under 9.3. A single “third party register” will not answer any of the three.
  2. Write down your ancillary line. Decide, in writing and by reference to money laundering risk, which providers you treat as purely ancillary, and why. The Guidance gives you the concept; it does not give you the answer.
  3. Re-paper the CDD vendors. 9.3.3(4) wants the services documented in a binding agreement and 9.3.4 wants periodic assurance assessments. Check that your identity-verification, eKYC and screening contracts actually say what the service is, and that someone owns the assurance cycle.
  4. Test your screening scope against Article 21. Customer databases, parties to transactions, potential customers, beneficial owners, and persons and organisations with which you have a direct or indirect relationship. If your screening covers only the first and fourth of those, you have a gap that Rule 11.1.1(2) makes visible.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu