Where should a Dubai brokerage keep client documents? Secure storage, access and agent offboarding

Why passports and contracts end up in WhatsApp and personal drives

Because it is the easiest thing an agent can do on a Tuesday night. The client sends a photo of a passport to the agent's phone. The agent forwards it to the developer's sales team, saves it to their own cloud drive and moves on. Nobody decided that. It simply happened, deal after deal, until a hundred passport images live on devices you do not control.

The fix is not a lecture. It is a path that is quicker than the habit: a client upload link, a folder per deal, and access that fits each person's job.

What you must keep, and what you should stop keeping

Two pressures pull in opposite directions.

Keeping. Under the UAE anti-money-laundering (AML) rules, brokers must keep customer due diligence and transaction records, including business correspondence and customer communications, for at least five years, counted from the latest of the end of the client relationship, the completed transaction, an inspection, an investigation or a final court judgment. The Ministry of Economy's 2022 circular and news release add Emirates ID or passport copies of the parties, receipts, contracts and sale agreements, and for company parties the licence, statutes, register of beneficial owners and shareholder IDs. The source is the federal AML framework (Cabinet Resolution 134 of 2025, Art. 25, and the Ministry of Economy and Tourism's guidelines for DNFBPs, the designated non-financial businesses and professions that include brokers, March 2026, section 11). It is not a chat rule set by the Dubai Land Department (DLD) or its regulator RERA, and the law does not name WhatsApp. Client messages tied to a customer or a deal are likely to count as business correspondence, which is an interpretation. Confirm with the relevant authority or a lawyer. For the identity-checking side of AML, see AML and KYC software for UAE brokers.

Not keeping. The UAE personal data protection law (Federal Decree-Law 45 of 2021) says personal data should be kept secure and only as long as the purpose needs. Its implementing details are unconfirmed, see the data protection article. I found no DLD or RERA rule prescribing how brokers store documents, or retention for non-AML files, so do not invent one.

The way through: keep the AML and transaction file in one controlled place for the required period, and delete the casual copies: the passport photo in a chat, the file in an agent's downloads folder, the listing-stage copy for a client who never signed. Decide each category and write it down.

A safe baseline: the shared drive done properly

A shared drive means a cloud folder space such as Google Drive (Google's file storage) or Microsoft SharePoint (Microsoft's equivalent for business teams) that the company owns. For a small brokerage this can be enough, but only if configured:

• The company account owns the files, not individual agents' personal accounts.
• Two-step login switched on for everyone.
• Access by group (agents, managers, compliance, admin), not by person.
• Link sharing set to "specific people", never "anyone with the link".
• Downloads and external sharing restricted where the tool allows it.
• The activity log turned on and reviewed.
• Backups, and a restore you have actually tested.

My rule of thumb, which is advice and not a regulation: this works up to roughly five agents if someone owns the settings. Past that, the weak point is people, not the drive.

When a transaction or document tool earns its cost

A transaction management or document tool adds checklists per deal, required documents, an audit trail and reminders. Consider one when you need to prove who saw or changed what, when agents keep missing documents, or when you open enough files that an admin cannot check each one. Ask the vendor the security questions at the end of this article. Check price per user, because per-agent fees add up in a growing team.

When a custom document portal makes sense

A portal is a private website where clients log in or use a link to upload documents and see what is still missing. It makes sense when client uploads, Dubai paperwork (the Contract A, B and F stages in the deal file checklist) and your CRM need to link together. It is the most work to set up and gives the most control. If you are weighing it, what a client portal is and how a 10-agent brokerage shares one set of documents are good starting points. Be honest with yourself first: a configured drive covers many brokerages.

Access rules by role

Role	Should see	Should not
Owner	Everything, including the access log	Nothing hidden from you
Compliance officer	All onboarding, screening and AML files	Editing commercial terms
Manager	Their team's deals	Other teams' client IDs by default
Agent	Their own deals' folders	Other agents' clients, or bulk download
Admin	Upload and organise; limited view	Full ID images unless the task needs them

This is least privilege: each person gets only what the job needs. For a related setup, letting an admin send documents without seeing everything covers one part of it.

Activity log and audit trail: what to log, who reviews

Log who opened, downloaded, shared, edited and deleted a document, and when. The log is only useful if someone reads it. Put a monthly review in the compliance calendar, see the annual AML review calendar, and look for bulk downloads, access at odd hours and files opened by people outside the deal.

Client uploads without WhatsApp

Send a secure upload link from the CRM when a listing or buyer file opens. The client uploads straight into the deal folder, the agent gets a notification, and the link expires after a set time. Agents get access to their own deals only. Tell clients plainly why: it is safer for their passport than a chat. Where a client still sends something on WhatsApp, the agent moves it into the deal folder the same day and deletes the chat copy. Delete only after confirming the file is in the record and your policy allows it.

When an agent leaves: the offboarding runbook

1. Revoke access before the exit conversation, not after. Disable the account, end sessions and remove from groups and portals.
2. Move files to a brokerage-owned space. Anything on personal drives or phones must be transferred and then deleted, with the agent confirming in writing.
3. Reassign live deals and tell affected clients who is now their contact.
4. Remove from the CRM, WhatsApp groups, listing portal logins and shared passwords. Change any shared password the agent knew.
5. Collect devices and company SIM cards, and check the company WhatsApp Business account is not tied to their personal number.
6. Remind them of confidentiality in their contract.
7. Log it in the compliance file with dates and who did what.

Who owns client files as between the agent and the brokerage is a matter of contract, not something I could verify as law. Put it in the agent agreement, see making sure agents use the latest agreement. Other failure modes to design out: shared logins, "anyone with the link" sharing, an exit with the client list, and no tested backup.

How software and AI help with document storage and access, and what stays human

Concrete tasks:

• Auto-filing and naming. A document arrives and gets a standard name and the right deal folder, which also keeps retention manageable.
• Missing-document checks. The CRM compares what is in the folder with what the deal type requires.
• Expiry reminders. AI or a simple rule reads ID expiry dates and reminds the agent to refresh the document.
• Access reviews. A monthly report of who has access to what, and who has left but still has an account.
• Redaction. Masking ID numbers or account numbers in a copy that goes to someone who does not need them.

What stays human: deciding retention periods, approving access, deciding what is a breach, and anything legal. I build document portals and intake flows for brokerages, but treat that as one option, not the default.

Try it yourself with Claude (an AI assistant). Describe your current setup in plain words, with no client data, for example: "12 agents, documents in personal Google Drives and WhatsApp, a shared Drive nobody maintains." Ask: "Write a 30-day plan to move to a company-owned shared drive with group access, link sharing off and an exit checklist. List what each person does each week." Then check the plan against your own contracts. Do not upload real passports to an AI tool without reading this guide on private options.

Vendor security questions to ask before you buy

• Is data encrypted when stored and when sent?
• Can I export the full audit log and all documents, and in what format?
• Where is the data stored, and which country's law applies?
• How quickly will you tell me about a breach?
• Can I switch off sharing by link and set expiry on links?
• What happens to my data if I cancel?
• Do you use my documents to train AI?

A 30-day rollout plan

• Week 1. List where documents live today. Create the company-owned space and groups. Turn on two-step login.
• Week 2. Build the deal folder template and upload links. Brief agents on why.
• Week 3. Move live deals in. Delete personal copies, with written confirmation.
• Week 4. Run the first access review and a restore test. Write the offboarding runbook into agent contracts.

How I'd approach this

Start with the cheapest control that closes the biggest hole: documents move out of chats and personal drives into company space, and one person owns the settings. Test an agent exit on paper before it happens. Only buy a document tool or build a portal if, after a month, the drive still cannot give you the checklists and audit trail you need. If a breach or a data question arises, ask a lawyer.