KYC for Real Estate Brokers in the UAE: CDD, EDD and Source of Funds

This guide covers when the checks start, what to collect from individuals and companies, how to find the beneficial owner, how to check source of funds, when standard checks become enhanced due diligence (EDD), and when you may rely on someone else’s KYC.

The rules come from Cabinet Resolution No. 134 of 2025 (CR 134/2025), the Executive Regulations of the UAE AML law, and from the Ministry of Economy and Tourism’s Supplemental Guidance for Real Estate Agents & Brokers (2026). The wider picture is in our AML guide for real estate agents.

When a broker has to do KYC

You must verify the identity of the customer and the beneficial owner before or during the start of the business relationship, or before you carry out a transaction for a customer you have no relationship with (CR 134/2025, art. 6(1)). MoET’s guidance says that for a broker, the relationship starts as soon as any of these happens:

• you agree to act for a client on a property deal, even a single one;
• you receive instructions to carry out a transaction;
• you sign a brokerage contract, listing agreement, power of attorney or a similar document;
• you receive a fee or commission.

In practice, collect KYC when you take the instruction, not at transfer.

You also have to repeat or update the checks when you suspect a crime, or when you doubt the identification data you already hold (CR 134/2025, art. 7(1)).

Brokers have no minimum deal value. Some guides say customer checks start at AED 55,000. In CR 134/2025 that threshold applies to occasional transactions at financial institutions (art. 7(2)). A broker checks every sale and purchase customer.

Whose KYC do you collect?

Your customer: the buyer, the seller, or both, depending on whom you act for. MoET’s guidance also asks you to verify the beneficial owners and connected counterparties, and to screen everyone involved against the sanctions lists. If someone acts on the customer’s behalf, check that they are authorised and identify them too (CR 134/2025, art. 9(2)).

What to collect

Individuals (CR 134/2025, art. 9(1)(a)):

• full name as shown on the ID or passport;
• nationality;
• address;
• date and place of birth;
• employer’s name and address, where applicable;
• a true copy of a valid Emirates ID or passport.

Companies and other legal persons (art. 9(1)(b)):

• name, legal form and memorandum of association;
• tax registration number, if the company is subject to corporate tax;
• registered office or principal place of business, and for a foreign company the name and address of its legal representative in the UAE, if it has one;
• articles of association or an equivalent document;
• names of the people in senior management.

For every customer, also record the purpose and intended nature of the relationship: buying to live in, to rent out or to resell. For a company, understand the nature of its business and its ownership and control structure (art. 9(3) and (4)).

Verify all of this “using original documents, data, or information obtained from a reliable and independent source” (art. 9(1)). A photo of a passport sent on WhatsApp is not verification on its own. Compare it with the original or with a reliable source.

Beneficial owner: who is really buying

When the customer is a company, you must identify the natural person behind it (CR 134/2025, art. 10(1)):

1. anyone who owns, alone or jointly, 25% or more of the company;
2. if there is doubt, or nobody reaches 25%, whoever controls it by other means, directly or indirectly;
3. if you still can’t identify anyone, the person or persons in senior management.

For a trust, identify the trustee, settlor, protector and beneficiaries, and anyone else with ultimate control (art. 10(2)).

MoET’s guidance warns about intermediaries: family members, business partners or legal representatives who stand between you and the real buyer. Their presence can be legitimate, but it can also be an attempt to keep the beneficial owner out of sight, so find out why they are involved.

Source of funds and source of wealth

• Source of funds is where the money for this deal comes from.
• Source of wealth is how the customer built their overall wealth.

MoET’s guidance asks brokers to verify the source of funds behind the transaction and to check that the explanation is credible and backed by documents. Acceptable evidence includes:

• bank statements;
• mortgage or financing agreements;
• proof of savings or income;
• documents from an earlier property sale;
• for business owners, company financial statements.

Source of wealth may be needed for higher-risk customers and deals: foreign PEPs, customers from high-risk jurisdictions, and complex legal arrangements. Where the price, the ownership structure or the amount of money doesn’t fit what you know about the customer, ask more questions and move to enhanced checks.

Screening: sanctions and PEPs

Before the deal, screen the customer, the beneficial owners and the other parties involved.

• Sanctions. At a minimum, check the UN Security Council Consolidated List and the UAE Local Terrorist List. MoET Circular No. 3 of 2025 says every customer is screened, whatever the value or the payment method, and Cabinet Decision No. 74 of 2020 requires screening again whenever the lists change (art. 21(2)). The full process is in our sanctions screening guide.
• PEPs (politically exposed persons). You need a system to find out whether the customer or the beneficial owner is a PEP (CR 134/2025, art. 16). For a foreign PEP, and for a domestic PEP where the relationship is high risk, you also need senior management approval, reasonable measures to establish source of funds and source of wealth, and closer monitoring.
• Adverse media. MoET’s guidance asks for open-source reviews for adverse media, criminal associations and PEP links.

CDD, EDD or SDD: how deep to go

Rate each customer’s risk and match the depth of the checks to it (CR 134/2025, art. 5):

Enhanced due diligence can include (art. 5(2)(c)):

• more information on the customer, their occupation and the beneficial owner, including public databases and open sources;
• more information on the purpose of the deal;
• updating the customer’s information more often;
• establishing source of funds and source of wealth;
• closer monitoring of the relationship;
• the first payment through an account in the customer’s own name at a bank with equivalent due diligence standards;
• senior management approval to start or continue the relationship.

For customers from countries the National Committee lists as high-risk, enhanced due diligence in proportion to the risk is mandatory, together with any countermeasures MoET requires (art. 23).

Write down why you chose SDD, CDD or EDD. MoET’s guidance says the rationale must be clearly documented.

Your developer’s or bank’s KYC doesn’t cover you

Brokers often assume that the developer’s or the bank’s checks on the same buyer are enough. The obligation is yours, and you may rely on a third party’s checks only if (CR 134/2025, art. 20(1)):

• the third party is regulated and supervised and applies the same due diligence and record-keeping rules;
• you immediately obtain the identification data it collected, and can get copies of the documents without delay on request;
• you take into account the risk of the countries involved.

Even then, you remain responsible for the accuracy of the checks. A developer’s KYC you have never seen doesn’t count. Relying on a third party is also different from outsourcing: a provider that works under your own policies and procedures, under your supervision, does not count as reliance at all (art. 20(3)).

If the customer won’t give you KYC

You must not start or continue the relationship or carry out the deal, and you should consider filing a suspicious transaction report (CR 134/2025, art. 14(1)). If you suspect a crime and further questions would alert the customer, you may stop the checks and file an STR that explains why (art. 14(2)). See our guide to goAML reports for brokers.

Keep checking, and keep the file

Keep checking throughout the deal that payments, parties and timing still match what you know about the customer (CR 134/2025, art. 8). Watch especially for:

• a new third-party payer;
• a change in the payment method;
• a quick resale;
• a new name on the contract.

Keep every KYC document, screening result and risk decision for at least five years after the deal or the end of the relationship, organised so that each deal can be reconstructed (art. 25). MoET’s guidance names scattered records and informal channels such as messaging apps among the sector’s most frequent gaps.

Fines for KYC failures

These lines of the Cabinet Resolution No. 71 of 2024 list apply to KYC (amounts per violation, in AED):

Each violation is fined separately. More in our guide to AML fines in the UAE.

What we can do for you

Our AML subscription for brokers leaves the decisions with your Compliance Officer and takes over the preparation:

• screening of up to 100 clients against the sanctions and PEP lists, with a risk rating;
• KYC onboarding forms for individuals and companies, part of the AML documentation set;
• deal checks before closing and ongoing monitoring of client files;
• up to 10 FIU reports a year prepared in goAML, ready for your Compliance Officer to review and submit.

See what’s included and the price →

This guide is general information, not legal advice.

What this means for you

KYC for a broker comes down to three things: