October 14, 2026 · Jurisdiction Briefing

UAE: relying on a third party for customer due diligence, and the records you keep, under Cabinet Resolution No. (134) of 2025

Ask two questions of a customer file. Who actually did the due diligence? And can the firm produce it? Cabinet Resolution No. (134) of 2025, the Executive Regulations of Federal Decree by Law No. (10) of 2025, answers the first in Article (20), in a Division…

The CBUAE Rulebook shows the Resolution effective from 14 December 2025 with the status In-Force. Its Article (70) repeals Cabinet Resolution No. (10) of

Both articles are addressed to financial institutions, designated

non-financial businesses and professions (DNFBPs) and virtual asset service providers alike.

This briefing reads those two articles closely, with the provisions they point to. The Resolution as a whole was covered on 23 September.

Reliance is allowed. The responsibility stays where it was

Article (20) is permissive: a firm may rely on a third party to apply customer due diligence measures. The permission is given for stated purposes — identifying the Customer and the Beneficial Owner, and understanding the nature of the Customer’s business or the purposes of a Business Relationship. It comes with a proviso in the same sentence: the relying firm remains responsible for the accuracy of those measures.

The conditions that follow are things a firm can evidence or cannot.

The third party’s own status. The firm must ensure that the third party is regulated and supervised, and that it complies with customer due diligence and record-keeping requirements pursuant to the Resolution.
The data, now; the documents, on request. The firm must immediately obtain from the third party the necessary identification data and information collected during the due diligence measures. It must also take the necessary steps to ensure it is able to obtain copies of the necessary documents without delay upon request.

The article opens with a country-risk instruction as well. Reliance is to be decided taking into account the countries identified by the National Committee as high-risk, countries with deficiencies in their anti-money laundering, counter-terrorist financing and proliferation financing systems, and, to the maximum extent possible, the available information on country risks.

Read together, those lines describe a file that still has to exist at the relying firm. The identification data is to be obtained immediately. Only the underlying documents may stay with the third party, and then only if the firm has taken steps to be able to get copies without delay.

Relying on a group company has its own test

Clause (2) of Article (20) deals with a third party that forms part of the same Financial Group. The Resolution defines a Financial Group as a group of financial institutions consisting of a holding company or another legal person that exercises control over the rest of the group and coordinates functions for the purpose of applying supervision at group level.

A firm relying on such a group member must ensure:

that the Group applies due diligence requirements in respect of customers and politically exposed persons, maintains records and implements anti-crime programs in accordance with the Resolution’s Divisions on customer due diligence, politically exposed persons and record-keeping and with Article (32), and that the group is subject, in this regard, to supervision by the competent authority;
that any high risks related to countries are adequately mitigated through the Group’s anti-crime policies and controls.

Article (32) is the group-wide programme article. It requires Financial Groups to implement group-wide programs for combating Crime, applicable to all branches and subsidiaries in which the group holds a majority ownership, and it lists what those programs must include: policies and procedures for exchanging the information required for customer due diligence and crime risk management; the provision of customer, account and transaction information from branches and subsidiaries to compliance, audit and AML/CFT officers at group level where necessary; and adequate safeguards on confidentiality, non-tipping-off and the use of exchanged information.

Our reading: “the group onboarded this customer” is an answer only when the firm can show that the group programme meets that description and is supervised.

Outsourcing is carved out, on conditions

Clause (3) draws a line that matters for anyone using an agent, a managed service or an onboarding vendor. Reliance on a third party, it says, does not include the use of external sources, such as outsourcing or agency services, to perform customer due diligence measures on the firm’s behalf. The carve-out is tied to conditions in the same sentence:

the services are carried out in accordance with the firm’s own internal policies and procedures;
the external sources are subject to the firm’s supervision and control in the effective implementation of those policies and procedures;
the external sources apply fitness and propriety standards and effective audit procedures to their staff.

The distinction is practical. A third party relied on under Clause (1) applies due diligence measures that the relying firm then answers for. An outsourced provider within Clause (3) performs the firm’s measures, to the firm’s procedures, under the firm’s control. Our reading is that an arrangement which meets neither description is the one to worry about, and the contract is where that shows.

When the due diligence cannot be completed

Article (14) is the backstop for both models. A firm is prohibited from establishing or continuing a Business Relationship, or executing a Transaction, where it is unable to apply customer due diligence measures, and it shall consider submitting a Suspicious Transaction Report to the Unit whenever necessary. The article does not distinguish by who was meant to collect the information.

Article (25): what is kept, and for how long

Article (25) is written in numbered clauses. Each one is a separate test.

Transaction records. Firms must retain all records, documents, instruments and data relating to all domestic and international financial and cash Transactions and commercial dealings, for not less than five (5) years from the date of completion of the Transaction or the termination of the Business Relationship with the Customer.

Customer and monitoring records. The second clause is the long one. It covers all records and documents obtained through customer due diligence measures and ongoing monitoring, account files, business correspondence and copies of personal identification documents. It expressly includes Suspicious Transaction Reports, the results of any analysis conducted, closed-circuit television (CCTV) and the related automated teller machine (ATM) recordings, and any other recordings.

The period is again not less than five years, but the clause names several starting points:

the date of termination of the Business Relationship;
the date of account closure, for Customers holding accounts;
the completion of an occasional Transaction;
the date of completion of inspection by the Supervisory Authority;
the date of completion of an investigation;
the date of issuance of a final court judgment.

The closing words decide which one applies: the retention period is calculated “by reference to the most recent of such procedures”. A retention schedule that starts every clock at account closure therefore reads only part of the clause.

Organisation. Retained records, documents and instruments must be organised in a manner sufficient to permit the reconstruction of individual Transactions, data analysis and the tracing of financial transactions, so as to be capable, where necessary, of providing evidence for the prosecution of criminal activity.

Availability. All Customer information — including information relating to customer due diligence, ongoing monitoring and the results thereof, as well as records, files, documents, correspondence and related forms — must be made available to the concerned authorities promptly upon request. The first clause says the same of transaction records.

Where the duty comes from, and what a breach is

The Resolution’s record-keeping rules implement Article (19) of the Decree by Law. Clause (1) of that article requires firms to implement customer due diligence measures and continuous monitoring procedures “while retaining the information obtained from implementing such measures”, and to retain all records, documents and data relating to Transactions, whether domestic or international, ensuring their immediate availability to Competent Authorities upon request, pursuant to the provisions of the Executive Regulations.

Article (35) of the Decree by Law makes a violation of Clause (1) of Article (19) punishable by imprisonment and a fine of not less than AED 10,000, or by either of these two penalties. The Decree by Law’s penalty provisions were covered on 7 October.

What to do with this

Sort every arrangement into a clause. For each introducer, group entity, agent and vendor that touches onboarding, record whether it is reliance under Clause (1), group reliance under Clause (2) or outsourcing within Clause (3), and keep the evidence for the conditions of that clause.
Test the “without delay” promise. Ask a relied-on third party for copies of the documents behind a sample of files, and time the response.
Rebuild the retention schedule around the most recent event. Add inspection, investigation and final judgment as events from which the five-year period for a customer file can run.
Check that the list in Clause (2) of Article (25) is all in scope. Suspicious Transaction Reports, the results of analysis, and CCTV and related ATM recordings are named in it.
Run a reconstruction drill. Pick a closed relationship and rebuild one transaction end to end from what was retained, including any documents held by a third party.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates