Enhanced Due Diligence for High-Risk Countries in UAE: What Every Regulated Business Must Know in 2026
Enhanced due diligence for high-risk countries is one of the most operationally critical and most frequently misunderstood obligations under UAE AML law. With Iraq and Bosnia and Herzegovina added to the FATF grey list on 19 June 2026, and Kuwait added in February 2026, the question of when and how to apply enhanced due diligence high risk countries UAE has never been more urgent for financial institutions, DNFBPs, and VASPs across the country.
Yet despite its importance, enhanced due diligence for high-risk countries UAE is consistently one of the top compliance gaps identified during Ministry of Economy AML inspections. Businesses either apply it too broadly, blanket EDD for every client from a listed country, which FATF explicitly discourages, or they fail to apply it at all when the risk assessment clearly supports it. Both approaches are wrong. Both attract regulatory consequences.
This guide explains exactly what enhanced due diligence high risk countries UAE requires under Federal Decree-Law No. 10 of 2025, Cabinet Resolution 134 of 2025, and the CBUAE Rulebook Section 6.4.3 when EDD is triggered, what documents are required, how to apply it correctly for grey-list versus blacklist countries, and how to document EDD in a way that satisfies Ministry of Economy inspectors and CBUAE supervisory reviews. For UAE businesses that have just updated their risk frameworks following the June 2026 FATF grey list update, this is the practical implementation guide that follows.
For context on which countries are currently on the FATF grey list and what changed in the February and June 2026 updates, see our FATF Grey List Update UAE 2026 guide first.
What Is Enhanced Due Diligence for High-Risk Countries in UAE?
Enhanced due diligence for high-risk countries UAE is the additional layer of customer verification, documentation, monitoring, and reporting that regulated entities must apply when a business relationship or transaction involves a jurisdiction identified as high-risk under UAE AML regulations.
It is defined under Cabinet Resolution 134 of 2025 as a set of intensified CDD measures applied in circumstances where the standard customer due diligence process is insufficient to adequately manage the money laundering, terrorist financing, or proliferation financing risk presented by a specific client, relationship, or transaction. The CBUAE Rulebook Section 6.4.3 specifically governs EDD requirements for high-risk countries for licensed financial institutions, while the same principles apply to DNFBPs under Cabinet Resolution 134 of 2025.
Enhanced due diligence high risk countries UAE is not a separate process from standard CDD; it is an intensification of it. Where standard customer due diligence involves verifying identity and understanding the business relationship, enhanced due diligence for high-risk countries UAE requires going further: deeper verification, more documentation, senior management oversight, enhanced ongoing monitoring, and, in some cases, mandatory additional reporting to the Financial Intelligence Unit UAE.
Understanding the difference between enhanced due diligence UAE AML obligations for different categories of high-risk countries is essential. The obligations for FATF blacklist countries are fundamentally different from those for FATF grey list countries, and applying the wrong level of scrutiny in either direction creates compliance risk.
What Is the Difference Between CDD and EDD in UAE?
The difference between CDD and EDD in UAE defines the entire framework for how regulated entities manage customer risk. Understanding this distinction is the foundation of correct enhanced due diligence high risk countries UAE, implementation.
Simplified CDD UAE applies to customers assessed as lower risk where the probability of money laundering, terrorist financing, or proliferation financing is demonstrably low. It involves basic identity verification and a lighter level of ongoing monitoring.
Standard CDD UAE is the default level applied to most customers. It involves verifying the customer’s identity, understanding the nature and purpose of the business relationship, identifying the ultimate beneficial owner (UBO), and conducting ongoing monitoring of transactions and activity.
Enhanced due diligence UAE is the intensified level applied when a customer or transaction is assessed as higher risk. It involves all standard CDD measures plus additional information collection, deeper verification, source of funds and source of wealth documentation, senior management approval, and more frequent ongoing monitoring.
Ongoing monitoring UAE runs across all customer categories but the frequency, depth, and triggers for escalation differ based on risk category. For customers subject to enhanced due diligence in high-risk countries UAE, monitoring must be more frequent and more sensitive to changes in activity patterns.
The key principle underlying this entire framework is the risk-based approach to EDD UAE; the level of due diligence must be proportionate to the risk, not applied uniformly to all customers regardless of their individual risk profile.
When Is Enhanced Due Diligence Required for High-Risk Countries in UAE?
Enhanced due diligence for high-risk countries UAE is required in specific circumstances defined by Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025. The trigger is not a customer’s nationality or country of residence alone; it is the risk assessment outcome based on the full picture of the customer’s profile, activity, and connections to higher-risk jurisdictions.
Under Cabinet Resolution 134 of 2025 and the CBUAE Rulebook Section 6.4.3, enhanced due diligence high risk countries UAE must be applied when:
A customer has material connections to a FATF blacklist country
For customers with material connections to Iran, North Korea, or Myanmar the three countries on the FATF blacklist as of June 2026 enhanced due diligence high risk countries UAE is mandatory. This is not a risk-based discretion. EDD is required for all business relationships and transactions involving blacklist jurisdictions. FIs, DNFBPs, and VASPs are also prohibited from relying on third parties located in blacklist jurisdictions to perform their due diligence procedures.
A customer’s risk assessment rates them as higher risk due to FATF grey list country connections
For customers with material connections to FATF grey list countries including Iraq and Bosnia and Herzegovina (added June 2026), Kuwait and Papua New Guinea (added February 2026), and all other current 22 grey-listed jurisdictions enhanced due diligence for high-risk countries UAE is not automatic. It is triggered when the firm’s own risk-based assessment, informed by but not solely determined by the grey-list status, rates the specific client relationship as higher risk.
A customer is identified as a Politically Exposed Person (PEP)
PEP enhanced due diligence UAE is a standalone EDD trigger regardless of country connections. Clients holding prominent public positions, their family members, and close associates require enhanced due diligence as a mandatory obligation under Cabinet Resolution 134 of 2025.
A transaction is complex, unusually large, or has no apparent legitimate purpose
Even where a customer has passed standard CDD, a specific transaction that is complex, unusually large, conducted in an unusual pattern, or has no apparent economic rationale triggers enhanced due diligence requirements UAE.
Correspondent banking relationships
Enhanced due diligence correspondent banking UAE is a mandatory obligation under the CBUAE’s April 2026 guidance for all correspondent banking relationships, regardless of the respondent institution’s country risk rating.
There are doubts about the accuracy of previously obtained CDD information
Where a regulated entity has reason to doubt the accuracy, completeness, or current validity of CDD information already held, EDD must be applied to verify and update the information before proceeding.
AML red flags are identified
EDD must be applied when there are red-flag indicators of potentially unusual or suspicious transactions or activities, not just based on country of origin or nationality alone. AML red flags high risk countries UAE include structuring behaviour, rapid deposit-withdrawal patterns, unusual transaction volumes relative to stated business activity, and source-of-funds inconsistencies.
High-Risk Countries Under UAE AML Law: Grey List vs Blacklist
Understanding the difference between EDD for grey list and blacklist countries in UAE is essential for applying proportionate, compliant enhanced due diligence high risk countries UAE procedures.
FATF Blacklist Countries Mandatory EDD and Countermeasures
For FATF blacklist countries Iran, North Korea (DPRK), and Myanmar, as of June 2026, enhanced due diligence high risk countries UAE is mandatory across all business relationships and transactions. The NAMLCFTC requires all FIs, DNFBPs, and VASPs in the UAE to:
- Apply enhanced due diligence measures to all business relationships and transactions involving blacklist jurisdiction nationals, entities, and those acting on their behalf
- Prohibit the establishment of any branches or representative offices within blacklist jurisdictions
- Prohibit reliance on third parties in blacklist jurisdictions to perform due diligence
- Apply countermeasures specified by UAE supervisory authorities to protect the financial system
- File a High-Risk Country Transaction Report (HRC) or High-Risk Country Activity Report (HRCA) to the Financial Intelligence Unit UAE through the goAML portal for transactions and activities involving blacklist countries. This is a mandatory additional reporting obligation on top of standard STR/SAR requirements
The HRC and HRCA filing obligation is one of the least understood and most frequently missed compliance requirements in the UAE. Many businesses understand their STR filing obligation but are unaware that blacklist country transactions require a separate, dedicated report through the goAML portal. Failure to file HRC/HRCA reports is a standalone compliance violation.
FATF Grey List Countries Risk-Based EDD
For FATF grey list countries, the current 22 jurisdictions under increased monitoring, including Iraq, Kuwait, Bosnia and Herzegovina, and Papua New Guinea, enhanced due diligence for high-risk countries UAE is not automatic. The NAMLCFTC is explicit that due diligence measures must in all cases be proportionate to the risks posed by business relationships and transactions with natural or legal persons from such jurisdictions.
FATF explicitly discourages indiscriminate de-risking UAE AML refusing all business or applying blanket EDD to every client from a grey-listed country without a supporting risk-based assessment is not compliant behaviour. Grey-list status is an input into the risk assessment, not an automatic EDD trigger.
What grey-list status requires is a structured risk-based response: update your country risk model, review affected customer risk ratings, and apply enhanced due diligence for high-risk countries UAE where the individual client risk assessment supports it.
FATF Blacklist (Iran, North Korea, Myanmar) | FATF Grey List (22 jurisdictions) | |
EDD required? | Yes, mandatory for all | Risk-based not automatic |
HRC/HRCA reporting? | Yes mandatory | No STR/SAR if suspicious |
Third-party reliance? | Prohibited | Permitted with appropriate oversight |
Countermeasures? | Yes | No |
De-risking permitted? | Countermeasures may apply | No indiscriminate de-risking is discouraged |
What Documents Are Required for EDD in UAE?
What documents are required for EDD in UAE depends on the specific risk factors driving the enhanced due diligence requirement. The documentation standard for a grey-list country client differs from that for a blacklist country client or a PEP. The CBUAE Rulebook Section 6.4.3 and Cabinet Resolution 134 of 2025 together define the enhanced due diligence high risk countries UAE documentation requirements.
As a minimum, enhanced due diligence for high-risk countries UAE requires:
Identity Verification Documents
Enhanced identity verification going beyond standard CDD for corporate clients, which means verifying the full ownership chain through to the natural persons who are the ultimate beneficial owners, not just the immediate shareholder layer.
Source of Funds Documentation
Documentation evidencing the origin of the funds used in the specific transaction or business relationship, such as bank statements, business accounts, transaction records, or other evidence establishing that the funds come from a legitimate source.
Source of Wealth Verification UAE
For higher-risk clients and particularly for PEPs and high-value transactions, source of wealth documentation establishing how the client accumulated their overall wealth, not just the specific transaction funds. This may include business records, employment history, inheritance documentation, or investment records.
Nature and Purpose of Business Relationship
Enhanced documentation of why the client wants to use your services, the expected nature of transactions, and how this aligns with their business or personal profile.
Senior Management Approval
Under Cabinet Resolution 134 of 2025, establishing or continuing a business relationship that requires enhanced due diligence in high-risk countries UAE requires senior management approval UAE sign-off from a senior person within your organisation above the level of the front-line relationship manager. This must be documented.
Enhanced Ongoing Monitoring Records
Records of more frequent and more detailed ongoing monitoring activity, including what was reviewed, when, what was found, and what action was taken or not taken with documented rationale.
Additional Information Where Doubts Exist
Where doubts exist about the accuracy of CDD information, additional verification documents addressing the specific doubt must be obtained and documented.
Do your EDD files meet the documentation standard for UAE AML inspections?
AMLUAE’s AML/CFT Health Check assesses your EDD documentation against the requirements of Cabinet Resolution 134 of 2025 and the CBUAE Rulebook, identifying every gap before a regulator does
How to Apply Enhanced Due Diligence for High-Risk Countries in UAE: A Step-by-Step Guide
Here is the complete AML EDD process UAE businesses must follow when enhanced due diligence for high-risk countries UAE is triggered, whether by FATF blacklist status, grey-list-informed risk assessment, PEP status, or other EDD triggers.
Step 1: Identify the EDD trigger
Determine exactly why EDD is required. Is it because the client has material connections to a FATF blacklist country (mandatory EDD)? Is it because the client’s individual risk assessment is elevated by grey-list country connections (risk-based EDD)? Is it because of PEP status, transaction complexity, or other risk indicators? Document the trigger clearly inspectors will ask.
Step 2: Conduct enhanced identity verification
Go beyond standard identity documents. For individuals, this may mean additional government-issued documents, biometric verification, or independent confirmation of identity from a reliable source. For corporate clients, map the complete ownership structure through to the ultimate beneficial owners not just the immediate shareholder layer.
Step 3: Obtain source of funds documentation
Request and verify documentation establishing the origin of the funds involved in the specific transaction or business relationship. Bank statements, business accounts, or transaction records are typically required. For high-value transactions, source of wealth verification UAE documentation of overall wealth accumulation is also required.
Step 4: Obtain senior management approval
Before establishing or continuing any business relationship that triggers enhanced due diligence high risk countries UAE, obtain and document formal senior management approval UAE. Record who approved, at what level, on what date, and what information was reviewed before approval was given.
Step 5: Document the nature and purpose of the relationship
Record in detail why the client needs your services, what transactions are expected, what volumes and frequencies are anticipated, and how all of this aligns with their stated business or personal profile. Any misalignment between expected and actual activity is itself a red flag requiring escalation.
Step 6: Conduct enhanced ongoing monitoring
Set enhanced monitoring parameters for the relationship more frequent review cycles, lower alert thresholds, and more detailed investigation of flagged activity. Customer risk profiling UAE must be updated as new information is obtained or as the client’s activity changes.
Step 7: Apply HRC/HRCA reporting for blacklist country transactions
For transactions involving FATF blacklist countries (Iran, North Korea, Myanmar), file a High-Risk Country Transaction Report (HRC) or High-Risk Country Activity Report (HRCA) through the goAML portal. This is mandatory regardless of whether the transaction is suspicious it is a separate reporting obligation from the STR/SAR process.
Step 8: File STR/SAR where suspicious activity is identified
If monitoring identifies suspicious activity even in the context of an EDD relationship where HRC/HRCA is already being filed, a Suspicious Transaction Report (STR) or Suspicious Activity Report (SAR) must also be filed through the goAML portal. These are separate obligations that can coexist.
Step 9: Review and reassess regularly
Enhanced due diligence for high-risk countries UAE is not a one-time exercise. The EDD relationship must be reviewed at regular intervals and whenever material changes occur in the client’s activity, business, ownership, or the risk status of their connected jurisdictions. The June 2026 FATF grey list update is itself a trigger for reviewing all EDD relationships involving affected jurisdictions.
Step 10: Organise and retain all EDD documentation
Under Article 25 of Cabinet Resolution 134 of 2025, all EDD documentation must be retained for a minimum of five years. Given the removal of the statute of limitations for AML crimes under Federal Decree-Law No. 10 of 2025, businesses should consider retaining higher-risk EDD files well beyond the minimum period. All documentation must be organised for rapid retrieval during regulatory inspections.
How Enhanced Due Diligence for High-Risk Countries UAE Applies by Sector
Banks and Financial Institutions
For UAE banks, enhanced due diligence high risk countries UAE applies across retail banking, trade finance, correspondent banking, and private banking operations. The CBUAE Rulebook Section 6.4.3 is the primary reference requiring additional information, senior management approval, and enhanced ongoing monitoring for all high-risk country relationships. Following the June 2026 FATF grey list update, banks must reassess all Iraq-linked and Kuwait-linked client relationships and update their transaction monitoring alert rules for these jurisdictions.
Real Estate Agents and Brokers
Enhanced due diligence for real estate agents UAE is triggered when a buyer, seller, or beneficial owner has material connections to high-risk jurisdictions. Given that Kuwait and Iraq are significant sources of UAE real estate investment, the February and June 2026 FATF grey list additions have direct practical implications for Dubai and Abu Dhabi property transactions. Real estate agents must obtain source of funds documentation for all high-risk country-connected transactions, not just apply standard CDD, and document the risk-based rationale for their due diligence decisions.
Gold Traders and Dealers in Precious Metals
Enhanced due diligence for gold traders UAE involving high-risk country counterparties, particularly Iraqi suppliers and buyers, given the June 2026 grey-listing, requires deeper counterparty verification, source of funds documentation, and enhanced transaction monitoring. For cash-based transactions involving clients or counterparties from blacklist jurisdictions, HRC reporting to the goAML portal is mandatory.
Corporate Service Providers
For corporate service providers (CSPs) and company formation agents, enhanced due diligence high risk countries UAE is frequently triggered by UBO connections to grey-listed or blacklist jurisdictions. A Kuwaiti beneficial owner of a UAE holding structure, for example, now requires an EDD review following the February 2026 grey-listing of Kuwait. CSPs must document the complete UBO chain, verify the source of wealth, and obtain senior management approval for all such structures.
Exchange Houses
Exchange houses face EDD requirements for cross-border transfers to and from high-risk jurisdictions particularly Iraq, following the June 2026 grey-listing. Enhanced due diligence for high-risk countries UAE, for remittance operations involves verifying the purpose and destination of funds, applying enhanced monitoring to Iraq-linked transfer patterns, and escalating structuring behaviour or unusual frequency to the MLRO for STR consideration.
DNFBPs Generally
All DNFBPs must implement enhanced due diligence high risk countries UAE procedures as part of their AML/CFT compliance framework under Cabinet Resolution 134 of 2025. EDD requirements UAE DNFBPs 2026 include the same core elements as for financial institutions: enhanced identity verification, source of funds, senior management approval, enhanced monitoring, and documentation, though the practical implementation varies by sector and transaction type.
How to Document EDD for a UAE AML Inspection
How to document EDD for a UAE AML inspection is one of the most practically important questions for compliance officers because having done EDD correctly but documented it poorly is treated by inspectors almost the same as not having done it at all.
During an AML inspection, Ministry of Economy inspectors or CBUAE supervisors assessing your enhanced due diligence high risk countries UAE compliance will look for:
An EDD trigger document
a written record identifying exactly why EDD was applied to this client or transaction. This must reference the specific risk factor (blacklist country connection, grey-list informed risk assessment, PEP status, transaction complexity) and the date the trigger was identified.
Enhanced verification documents
the additional identity, source of funds, source of wealth, and ownership documents obtained beyond standard CDD. These must be present in the client file, clearly labelled, and dated.
Senior management approval record
documentary evidence that a senior person above front-line level reviewed and approved the relationship before it was established or continued. An email, sign-off on a risk form, or board/committee minute will all serve this purpose.
Risk assessment rationale
a written explanation of why the risk assessment reached the conclusion it did why EDD was required, what risk factors drove the rating, and how the additional information obtained addressed those risks.
Ongoing monitoring records
evidence of enhanced monitoring activity over the life of the relationship monitoring reports, alert investigations, and any escalations or decisions made.
HRC/HRCA filing confirmation
for blacklist country transactions, confirmation that the mandatory High-Risk Country Transaction Report or High-Risk Country Activity Report was filed through the goAML portal.
Review dates
records showing when the EDD relationship was last reviewed, what triggered the review, what was found, and what action was taken.
Inspectors assess not just whether EDD files exist but whether they are complete, current, consistent with your AML policy, and organised for rapid retrieval. Disorganised, incomplete, or undated EDD files are treated as evidence of an ineffective compliance culture.
How AMLUAE Helps UAE Businesses Implement Enhanced Due Diligence for High-Risk Countries
Enhanced due diligence for high-risk countries UAE is not a compliance box to tick it is an operational framework that must be built, documented, practised, and evidenced. At AMLUAE, we help UAE financial institutions, DNFBPs, and VASPs build EDD frameworks that are not only technically compliant with Federal Decree-Law No. 10 of 2025 and Cabinet Resolution 134 of 2025 but also inspection-ready and operationally effective.
Our services covering enhanced due diligence high risk countries UAE include:
AML/CFT Health Check: Assesses your current EDD procedures against Cabinet Resolution 134 of 2025 and CBUAE Rulebook Section 6.4.3, identifying gaps in your high-risk country EDD framework, senior management approval processes, HRC/HRCA reporting, and documentation standards.
AML/CFT Policy & Documentation: Produces fully customised EDD policy and procedures covering high-risk country triggers, grey list vs blacklist treatment, PEP EDD requirements, source of funds standards, senior management approval workflows, and HRC/HRCA filing procedures.
AML/CFT Risk Assessment Report: Updated for the June and February 2026 FATF grey list changes, incorporating Iraq, Kuwait, Bosnia and Herzegovina, and all 22 current grey-list jurisdictions into your business-wide risk assessment and country risk model.
In-House AML Compliance Setup: Builds your complete CDD and EDD framework from the ground up, including high-risk country procedures, customer risk profiling, senior management approval workflows, and goAML HRC/HRCA filing processes.
Regulatory Reporting Services: Manages all STR, SAR, HRC, and HRCA filings through the goAML portal, ensuring that mandatory High-Risk Country Transaction Reports are filed accurately and on time for blacklist country transactions.
AML Training Program: Role-based AML training UAE covering enhanced due diligence high risk countries UAE including the difference between grey list and blacklist obligations, EDD triggers, documentation standards, and HRC/HRCA reporting requirements.
AML Software: Automated sanctions screening UAE and country risk scoring tools that integrate FATF grey list and blacklist updates in real time, supporting enhanced due diligence for high-risk countries UAE, with technology-enabled risk alerts and monitoring.
We serve financial institutions, DNFBPs, VASPs, and NPOs across Dubai, Abu Dhabi, Sharjah, Ras Al Khaimah, Fujairah, and all UAE free zones including DIFC, ADGM, JAFZA, DMCC, and Meydan.
Whether you are building your enhanced due diligence high-risk countries UAE framework from scratch, updating it for the latest FATF grey list changes, or preparing for a Ministry of Economy or CBUAE inspection that will scrutinise your EDD documentation AMLUAE has the service that fits exactly where you are.
Frequently Asked Questions About Enhanced Due Diligence High-Risk Countries UAE
What is enhanced due diligence in UAE AML?
When is EDD required for high-risk countries in UAE?
What is the difference between CDD and EDD in UAE?
Do I need EDD for all clients from FATF grey list countries?
What documents are required for EDD in UAE?
What is a High-Risk Country Transaction Report in UAE?
Is senior management approval required for EDD in UAE?
Yes senior management approval is required for EDD in UAE before establishing or continuing any business relationship that triggers enhanced due diligence for high-risk countries. Under Cabinet Resolution 134 of 2025, approval must come from a senior person above the front-line relationship manager. The approval must be documented, recording who approved it, at what level, on what date, and what information was reviewed before the decision was made.
