SonarPulse is KYC, onboarding and identity verification software for firms in the UAE, ADGM and the DIFC. It onboards individuals and companies with document capture and biometric identity verification, maps beneficial owners through the shareholder hierarchy, screens every party against sanctions, PEP and adverse-media sources, rates the customer low, medium or high and keeps the file current with risk-based CDD renewal.
What the UAE asks of your customer due diligence
- Beneficial owners from 25%, under three sets of rules. Onshore, Cabinet Decision No. 109 of 2023 counts whoever holds 25% or more of capital or voting rights, and exempts the financial free zones. ADGM’s Beneficial Ownership and Control Regulations 2022 and the DIFC Authority’s company handbook each use 25%, with control and senior-management or director tests where no one crosses the line. Beneficial ownership across the six.
- CDD thresholds. Under Article (7) of Cabinet Resolution No. (134) of 2025, financial institutions apply CDD to occasional transactions at or above AED 55,000 and to occasional wire transfers at or above AED 3,500; virtual asset service providers at or above AED 3,500. Resolution 134/2025.
- A longer customer file in the DIFC. Since 2 March 2026, DFSA Rule 7.3.2 asks for date and place of birth and, where applicable, the employer for natural persons, and the legal form, tax registration number, unique reference number and UAE legal representative (if any) for bodies corporate. The DFSA’s March 2026 amendments.
- PEPs. Federally, senior management approval is required for foreign PEPs, and for domestic and international-organisation PEPs where the relationship is high risk (Article 16 of Resolution 134/2025). The DFSA requires approval for every PEP; ADGM sends any PEP into enhanced CDD. Who counts as a PEP.
- Reliance does not move the responsibility. Under Article (20) a firm may rely on a third party for CDD but remains responsible for it, and must obtain the identification data immediately. Third-party reliance and record keeping.
- Penalties. Under Article (17) of Federal Decree by Law No. (10) of 2025, a Supervisory Authority can impose a fine of AED 10,000 to AED 5,000,000 for each violation. Who can penalise, and for what.
How SonarPulse handles KYC
- Onboarding and KYB. Six entity types with purpose-built data models.
- Identity verification. Document capture and biometric identity verification at onboarding.
- Beneficial owners. UBO and shareholder hierarchy, with every owner in the chain screened, not just the customer.
- Sanctions, PEP and adverse media. 250+ global sanction, PEP and watchlist sources, your own lists as per-tenant blacklists, adverse media and legal and enforcement records.
- Risk rating and EDD triggers. A per-tenant rules engine with versioning and rollback, category weights per entity type and a transparent low, medium or high rating, with enhanced due diligence triggered by the rating.
- Perpetual monitoring. Daily re-screening with hit-diffing and consolidated alerts, plus a daily adverse-media watch.
- CDD renewal on autopilot. Periodic review scheduled by risk rating (high every year, standard every three, low every four), a secure OTP-gated portal for the customer, cross-validation of the updated data and per-field maker-checker review, with high-risk sign-off always dual-controlled.
- Vendor and counterparty checks. Vendor Verification applies the same discipline to counterparties that are not customers, for ADGM’s know-your-business-partner duty.
Questions about KYC in the UAE
What is the beneficial ownership threshold in the UAE?
25% of capital or voting rights, onshore under Cabinet Decision No. 109 of 2023, in ADGM under the Beneficial Ownership and Control Regulations 2022, and in the DIFC under the DIFC Authority’s handbook. The onshore decision exempts the financial free zones, which run their own rules.
How quickly must companies report a change of beneficial owner?
Under Article (38) of Cabinet Resolution No. (134) of 2025, within fifteen working days of the change. The DIFC Authority handbook gives thirty days.
Can we rely on a group company’s CDD?
Article (20) allows it if the group applies the Resolution’s CDD, PEP and record-keeping requirements, runs a group-wide programme and is supervised for it. The relying firm remains responsible for the accuracy of the measures.
Further reading
