Know Your Customer (KYC)
Know Your Customer (KYC) refers to the regulatory requirement for financial institutions and virtual asset service providers to identify, verify, and understand their customers before establishing a business relationship and on an ongoing basis throughout the relationship. KYC is a core component of anti-money laundering (AML) compliance and is mandated across all UAE virtual asset regulatory jurisdictions.
Components of KYC
KYC encompasses three levels of customer due diligence (CDD):
Standard CDD: Applied to all customers at onboarding. Includes collecting identification data (name, date of birth, address, national ID), verifying identity against reliable independent sources (government-issued ID, electronic verification through platforms like Sumsub), understanding the purpose of the business relationship, and assessing the source of funds.
Simplified CDD: Available for lower-risk customers meeting defined criteria under the applicable regulator’s rules. Reduced verification requirements but not exemption from verification.
Enhanced Due Diligence (EDD): Applied to higher-risk customers including politically exposed persons (PEPs), customers from FATF high-risk jurisdictions, and customers presenting elevated ML/TF risk indicators. EDD involves additional verification, source of wealth documentation, senior management approval, and enhanced ongoing monitoring. See our EDD guide.
KYC in the UAE Virtual Asset Context
Virtual asset firms face unique KYC challenges including remote customer onboarding (requiring robust electronic verification), cross-border customer bases, cryptocurrency source-of-funds tracing (requiring blockchain analytics from providers like Chainalysis and Elliptic), and unhosted wallet ownership verification.
UAE regulators across VARA, ADGM, and DFSA require KYC procedures calibrated to these virtual asset-specific challenges.
Beneficial Ownership Identification
For corporate customers, KYC extends beyond identifying the entity itself to identifying the natural persons who ultimately own or control the entity — the beneficial owners. UAE AML law requires VASPs to identify all beneficial owners holding a specified percentage of ownership (typically 25% or more) and verify their identities using the same standards applied to individual customers.
Beneficial ownership identification is particularly challenging for virtual asset firms because:
- Corporate structures in the crypto industry often span multiple jurisdictions
- Token-based governance structures may obscure traditional ownership relationships
- Nominee and trust structures may be used to conceal beneficial ownership
- Some jurisdictions have limited beneficial ownership transparency
VASPs must apply a risk-based approach to beneficial ownership verification, with enhanced due diligence for complex or opaque ownership structures.
Ongoing KYC Obligations
KYC is not a one-time onboarding exercise. Ongoing obligations include periodic KYC refresh (frequency based on customer risk rating), transaction monitoring against customer profiles, continuous sanctions and PEP screening, and event-driven review when suspicious activity or material changes are identified.
The frequency of KYC refresh is determined by the customer’s risk rating:
- High-risk customers: Annual refresh including updated source of funds/wealth documentation and senior management re-approval
- Medium-risk customers: Refresh every two to three years with updated identification documents and profile review
- Low-risk customers: Refresh every three to five years with confirmation that customer circumstances remain unchanged
Event-driven reviews are triggered by changes in customer circumstances (new nationality, change of address, change in business activity), unusual transaction patterns flagged by monitoring systems, adverse media coverage, changes in sanctions or PEP status, or regulatory notifications.
For detailed KYC procedures, see our KYC/CDD procedures guide. For the broader AML program framework, see our AML program design guide.
Technology Infrastructure
Effective KYC implementation requires technology platforms capable of automating verification processes at scale. Sumsub and similar platforms provide document verification, liveness detection, sanctions/PEP screening, and ongoing monitoring capabilities. For UAE VASPs, the KYC platform must support Emirates ID verification for UAE resident customers and global passport verification for international customers.
Blockchain analytics platforms (Chainalysis, Elliptic, Crystal Blockchain) complement KYC platforms by providing on-chain identity verification — confirming that customer wallet addresses do not have exposure to sanctioned entities, illicit services, or high-risk counterparties.
KYC for Corporate and Institutional Clients
Corporate KYC presents additional complexity beyond individual verification. UAE VASPs must conduct enhanced verification for corporate clients including obtaining certified copies of constitutional documents (articles of association, memorandum of association), verifying the identity of all directors and authorized signatories, identifying and verifying all beneficial owners holding 25% or more of ownership or control, obtaining a board resolution authorizing the business relationship, and understanding the corporate client’s business activities and expected transaction patterns.
For institutional clients such as regulated financial institutions, VASPs may apply simplified due diligence where the institution is itself subject to equivalent AML/CFT supervision. However, this simplified approach does not apply to institutions from FATF high-risk jurisdictions, where enhanced due diligence remains mandatory regardless of the institution’s regulated status.
Enforcement Context
KYC failures constitute AML programme control failures under VARA’s framework. The Morpheus Software (Fuze) case cited failures in AML programme controls that encompass KYC deficiencies. Inadequate KYC infrastructure can result in cease-and-desist orders, financial penalties, and skilled person appointments. For the full enforcement landscape, see the enforcement action dashboard.
Related Terms
For regulatory context, visit UAE Tokenization Regulations and Dubai Tokenisation.