Do UAE accountants need to re-apply customer due diligence to clients onboarded before the 2025 AML framework?
Yes. Customer due diligence measures must be applied to existing customers and business relationships that were already in place when the executive regulations came into force. The framework does not grandfather legacy clients. What it does allow is for the timing to be driven by risk rather than by a single deadline for the whole book.
In practice this means an accounting or audit firm should run a remediation exercise across its client base, ranking clients by risk and refreshing the highest risk files first. Triggers for prioritising a file include a change in ownership or control, unexplained changes in the pattern of instructions, clients connected to high risk jurisdictions, politically exposed persons, and files where beneficial ownership was never properly evidenced. Low risk, long-standing local clients can be refreshed on a longer cycle, provided the cycle is documented and actually followed.
Firms should keep evidence of the methodology used to rank clients and the schedule for refresh, because supervisors tend to test whether the risk-based approach was genuinely applied or simply asserted.
Legal Reference (UAE):
· Cabinet Resolution No. 134 of 2025, Article 13 — CDD must be applied to existing customers and relationships at appropriate times based on materiality and risk
· Cabinet Resolution No. 134 of 2025, Article 5 — risk identification, assessment and ongoing updating using a risk-based approach
For more details, consult the full text of Cabinet Resolution No. 134 of 2025 or seek guidance from your AML compliance officer.
AML compliance requirements for auditors and accountants in the UAE