A KYC onboarding workflow for a Dubai brokerage: collect, verify, store, and prove it

What a Dubai brokerage has to be able to prove about every client

The question an inspector asks is simple: for this deal, who was the client, who really owns or controls them, where did the money come from, was there screening, who approved, and where is the proof? The Ministry of Economy and Tourism's guidance for real estate agents and brokers (2026) describes the answer as a structured, consistent onboarding framework, so that information, checks and documents are collected, verified and stored the same way across the organisation.

That is a process problem before it is a software problem. The tool simply makes the process hard to skip. This article walks the process. For the tool decision see AML and KYC software for UAE brokers.

Why the flow starts at the listing agreement, not at the offer

The guidance treats a business relationship in real estate as established when you agree to provide a service, receive instructions, sign a listing agreement, engagement letter or power of attorney, or receive fees. Customer due diligence (CDD) must be completed before or at that point, and before any transaction.

The consequence most checklists miss: the seller needs onboarding too. Signing Contract A (the listing agreement between seller and brokerage, one of the standard smart contracts issued by the Dubai Land Department, DLD, the emirate's property registry) starts the relationship. A checklist built only for buyers leaves half your clients uncovered. Tenants and landlords on rental deals are a separate question: ask the Ministry or a lawyer how your policy should treat them, and write the answer into your procedures.

Step 1: send one secure onboarding link instead of asking on WhatsApp

Passport photos in agents' chats are the commonest failure. The Ministry's guidance names reliance on informal communication channels and manual record-keeping as record-keeping gaps. A secure link fixes both: the client uploads straight into the brokerage's file, not an agent's phone, and the CRM (the system where you keep clients and deals) records that it happened.

It also takes less agent time. Sending a pre-filled link from the CRM when a listing is agreed is faster than chasing documents across chats, and that is what gets agents to use it. If the flow is slower than the WhatsApp habit, agents will keep using WhatsApp.

Step 2: collect the right documents for each client type

The Ministry of Economy's Circular 5/2022 names the minimum identification: for individuals, a valid Emirates ID or passport copy; for companies, the trade licence, articles of association, register of beneficial owners, and Emirates ID or passport copies of all beneficial owners and all shareholders or partners. The DNFBP Guidelines add the details for individuals: full name, nationality, date and place of birth, ID or passport number, issue and expiry details and proof of residential address.

Client type	Named in official text	Good practice to add
Resident individual	Emirates ID or passport copy; name, nationality, date and place of birth, ID number, issue and expiry	Proof of address (utility bill, government document, lease or regulated-bank statement are listed examples); occupation or employer
Non-resident individual	Passport copy and the same personal details	Residence visa if any; extra care on source of funds
Company or SPV	Trade licence, articles, register of beneficial owners, IDs of owners and shareholders or partners	Board resolution and authorised signatory proof
Trust or foundation	Treat as a complex structure: owners and controllers identified	Constitutional documents; ask your compliance officer or lawyer
Representative or power of attorney	Identity of the client and of the representative	The power of attorney itself, and why the representative is acting
Third-party payer	Treat as a red flag until explained	Payer's identity and the reason for payment

Treat the last column as my suggestion unless you confirm it. Dated proof of address (such as "within three months") is a vendor convention, not Ministry text.

Step 3: identify the beneficial owner and ask for source of funds

A beneficial owner is a real person (not a company) who owns or controls 25 percent or more of the customer. The guidance also says to consider control that is exercised another way, and common control even where individual stakes are below 25 percent. For a layered company, keep asking "who owns the owner" until you reach people.

Source of funds evidence listed in the sector guidance includes bank statements, loan or financing agreements, proof of savings, income records and documents of prior property sales. Source of wealth is expected for higher-risk clients such as foreign PEPs and complex structures. One caution: the AED 55,000 figure in the cash-reporting circular is not a standalone "source of funds threshold". Do not present it as one. See REAR tracking for what it actually triggers.

Step 4: screen sanctions and PEP lists and save the dated result

A PEP is a politically exposed person: someone with a prominent public role, plus close family and associates, who carries higher corruption risk. Sanctions screening must happen before you establish the relationship or execute a transaction, and should continue through an ongoing relationship. Adverse media (negative news) and PEP background checks are expected.

What matters for the file is the evidence: the names checked, the lists or tool used, the date and time, the result, and who cleared any matches. A tick box saying "screened" proves very little.

Step 5: rate the client and decide who approves

Ministry Circular 6 of 2025, addressed to real estate brokers, asks you to apply enhanced due diligence (EDD) to high-risk customers, standard CDD to medium-risk and simplified due diligence (SDD) to low-risk ones, in each case only where there is no suspicion of money laundering or terrorist financing. You must document why you applied SDD or EDD.

A non-specialist can run a simple points table. This is an illustrative owner-designed model, not a regulatory one, and your compliance officer should set the actual weights and document the reasoning:

Factor	Example points
Non-resident client	1
Company or layered structure	2
Intends to pay in cash	3
Payer is not the buyer	3
PEP or close associate	Automatic EDD
High-risk jurisdiction	Automatic EDD
Unusual urgency or price far from market	2

Approval: for PEPs, the guidance requires senior management approval before starting or continuing the relationship, along with source of wealth and funds backed by reliable records. For other high-risk clients, senior approval is good practice, but I could verify the official requirement only for PEPs.

Step 6: lock the CRM stage until onboarding is approved

This is the control that makes the process stick. In your CRM, set the pipeline so a deal cannot move to "Contract B created" or "Contract F created" until the onboarding record shows "approved" with the approver's name and date. Contract B is the buyer-and-broker agreement, Contract F the sale agreement between seller and buyer. Agents will complain once. Then they will learn the link is quicker.

Step 7: store, refresh and keep the file for the required period

Under the UAE anti-money-laundering rules, brokers must keep customer due diligence and transaction records, including business correspondence and customer communications, for at least five years, counted from the latest of the end of the client relationship, the completed transaction, an inspection, an investigation or a final court judgment. The source is the federal AML framework (Cabinet Resolution 134 of 2025, Art. 25, and MoET's DNFBP Guidelines, section 11). It is not a DLD or RERA (Dubai's Real Estate Regulatory Agency) chat rule, and the law does not name WhatsApp. Client messages tied to a customer or deal are likely to count as business correspondence, which is an interpretation. Records the guidance lists include ID documents, due diligence forms, beneficial ownership information, source of funds evidence, call logs and meeting records, risk classification, approval or rejection decisions and screening outcomes.

Passport copies also fall under the UAE data protection law (Federal Decree-Law 45 of 2021). Keep them for the AML period, then delete or archive under your data policy. I could not find ID-specific retention rules, so ask a lawyer. See UAE data protection for brokerages.

Review cycles are not fixed in the official text, which says only that reviews should match the risk. Yearly for high risk and longer for lower risk is a common pattern, not a rule. A yearly rhythm is laid out in the annual AML review and compliance calendar.

Where software and AI help with KYC onboarding, and where a person must decide

Concrete tasks:

• Form and checklist by client type. The link asks different questions for an individual, a company or a representative, so agents never have to remember.
• Document reading. AI can extract name, number and expiry from a passport, Emirates ID or trade licence into CRM fields, flag an expired ID and flag a name that differs from the draft contract. Where digital identity checks are used, the guidance says they must meet reliability and security standards, and that validating the machine-readable zone or chip is accepted for higher-risk foreign IDs.
• Automatic flags. Cash intended, third-party payer, company buyer or PEP hit raises the points and routes the file to the compliance officer.
• Stage gates and reminders when documents are missing.

What stays human: checking documents against the originals, deciding the risk rating, approving high-risk clients and deciding whether something is suspicious. Software also cannot make the client willing to explain their money. I build onboarding flows like this for brokerages as custom work, but a good form and a CRM stage gate get you most of the way.

Try it yourself with Claude (an AI assistant). Paste in your own onboarding checklist (no real client data) and ask: "Turn this into a form with one question set for individuals, one for companies and one for representatives. Mark which fields are mandatory, and list the documents to upload for each." Review the result against the Ministry texts listed under Sources before you use it.

Red flags that stop the file and go to the compliance officer

The Ministry's guidance lists red flags in this sector. The ones that matter most at onboarding:

• The client will not explain the source of funds.
• Payments are deliberately split into smaller amounts at short intervals.
• Payments come from accounts that are not in the buyer's name, or an escrow is funded by an unrelated third party.
• Third-party cheques, or nominee shareholders.
• The client withdraws after you ask for enhanced due diligence.
• A request to backdate a contract.
• A price far from market value.

Rule for agents: do not tell the client you are suspicious and do not investigate yourself. Stop, note the facts and escalate. The compliance officer decides whether a report is needed. Failures the Ministry has fined in the past include no KYC before establishing a relationship, no PEP due diligence, no EDD in high-risk situations and no continuous monitoring.

The cost of poor records is covered in the published schedule under Cabinet Resolution 71 of 2024, which lists fines of AED 50,000 to 200,000 for failing to keep records or make them available, AED 50,000 to 200,000 for failing to register on goAML (the online reporting system of the UAE Financial Intelligence Unit, FIU), and AED 100,000 to 500,000 for failing to report suspicious transactions promptly or give the Unit information it requests, with a possible doubling on repeat. Newer instruments replaced the laws that resolution cites and I could not confirm whether the schedule still operates unchanged, so confirm the current schedule with the Ministry of Economy.

A one-page client onboarding checklist you can copy

1. Client type chosen: individual, non-resident, company, trust, representative.
2. Onboarding link sent from the CRM; date sent: ______
3. ID or passport received and checked against the original. Expiry date: ______
4. Personal details recorded: name, nationality, date and place of birth, ID number, address proof.
5. For companies: licence, articles, register of beneficial owners, owner and shareholder IDs, signatory proof.
6. Beneficial owner(s) of 25 percent or more identified.
7. Source of funds documents received; source of wealth if higher risk.
8. Sanctions, PEP and adverse media screening done; date, tool and result saved.
9. Risk rating and reasoning recorded; SDD, CDD or EDD applied.
10. Approver and date recorded; senior approval if a PEP.
11. CRM stage unlocked for Contracts A, B and F.
12. Records stored in the shared file, with a review date and a keep-until date.

How I'd approach this

Build the checklist first, on paper, and agree it with whoever acts as your compliance officer. Then put it in one form, one upload link and one CRM gate. Run ten real files through it and see where agents get stuck, because that is where it will leak. Resist adding software before you can describe the flow in seven lines. Check the Ministry texts under Sources for the current wording.