UAE National KYC Digital Platform: Compliance Requirements, Data Protection and Penalties Explained

Know Your Customer (KYC) procedures are an important part of identifying customers, verifying information and managing financial crime risks. In the UAE, businesses and financial institutions may need to collect and verify customer information as part of their regulatory and operational responsibilities.

However, when different institutions repeatedly collect similar information from the same customer, the process can create duplication, additional administrative work and delays.

To address this issue, the UAE introduced a legal framework for a national digital platform designed to support the collection, management and exchange of Know Your Customer information.

The principal legislation is Federal Decree-Law No. 30 of 2024 Regarding the “Know Your Client” Digital Platform, issued on 1 October 2024. The framework was further developed through Cabinet Resolution No. 55 of 2026, which promulgates the Executive Regulations, and Cabinet Resolution No. 56 of 2026, which sets out administrative violations and sanctions.

Together, these instruments establish rules concerning the operation of the platform, the responsibilities of participating parties, the handling of customer information and the consequences of specified breaches.

For businesses, financial institutions and other entities falling within the relevant provisions, understanding these requirements is important for maintaining appropriate data governance and compliance procedures.

1. What Is the UAE National KYC Digital Platform?

The KYC Digital Platform is a centralised digital infrastructure established under Federal Decree-Law No. 30 of 2024.

The legislation provides for the collection, analysis, use and exchange of KYC information, as well as the issuance of KYC reports through the platform.

Its purpose is to support customer verification by allowing authorised users to obtain relevant information through a regulated process, subject to the applicable requirements.

The platform is intended to reduce unnecessary duplication in KYC procedures and improve the efficiency of customer verification. However, it should not be understood as removing every institution’s separate customer due diligence responsibilities.

The platform operates within a legal structure that addresses consent, data handling, confidentiality, security and the responsibilities of participating parties.

The legislation governing the platform

The principal instruments are:

• Federal Decree-Law No. 30 of 2024: Establishes the legal basis for the KYC Digital Platform.

• Cabinet Resolution No. 55 of 2026: Promulgates the Executive Regulations governing the platform.

• Cabinet Resolution No. 56 of 2026: Establishes the schedule of administrative violations and sanctions for breaches of the Decree-Law and its Executive Regulations.

The two Cabinet Resolutions were issued on 20 April 2026 and published in Official Gazette No. 822 on 30 April 2026.

These instruments should be read together to understand the platform’s operational requirements and enforcement provisions.

2. Who Is Involved in the KYC Digital Platform?

The legislation identifies different participants, each with responsibilities under the applicable provisions.

The platform management company

The Decree-Law provides for a company responsible for establishing and managing the platform and carrying out the functions assigned to it under the legislation.

Its responsibilities include managing KYC information and supporting the processes through which reports are generated and made available in accordance with the applicable requirements.

Data Providers

Data Providers supply relevant information to the platform under the legal and operational arrangements that apply to them.

The Decree-Law's definition covers certain government authorities and institutions, private-sector entities operating in the UAE or its free zones, financial institutions, insurance companies and insurance-related professions licensed by the Central Bank, as well as other potential providers identified in accordance with the legislation.

The precise status and obligations of an entity should be assessed against the Decree-Law and Executive Regulations rather than assumed from its business category alone.

Users

Users are entities authorised under the applicable legislation to obtain KYC reports.

Access to reports is subject to the statutory requirements, including the relevant customer approval and the prescribed process for requesting a report.

An entity should not assume that participation in the platform gives it unrestricted access to all customer information.

Customers

Customers are the individuals or legal persons whose KYC information is processed through the platform.

The legislation recognises customer approval as an important part of the process for obtaining a KYC report. The approval must satisfy the applicable requirements and relate to the purposes permitted under the legal framework.

The rights and responsibilities of each participant depend on the specific provisions applicable to their role.

3. What Customer Information May Be Included?

The Executive Regulations establish requirements relating to the KYC information maintained through the platform.

For natural persons, Article 3 of Cabinet Resolution No. 55 of 2026 addresses information including:

• Name in Arabic and English.

• Date and place of birth.

• Emirates ID and travel-document details.

• Residence or entry visa information, where applicable.

• Residential address information.

• Occupation and employer details.

• Telephone number and email address.

• Principal sources of income.

• Information relating to politically exposed person status, where applicable.

The regulations also address KYC information relating to legal persons and arrangements.

The exact information required will depend on the category of customer and the applicable provisions.

The inclusion of information within the regulatory requirements does not mean that every participating entity can collect, access or use all such information without restriction. Data handling remains subject to the legal requirements governing the platform, the participant's role and the permitted purpose.

4. What Are the Main Responsibilities of Data Providers?

Data Providers have an important role in ensuring that information supplied to the platform is reliable and suitable for its intended purpose.

Under the Executive Regulations, their responsibilities include providing KYC data in accordance with the relevant arrangements and ensuring that the information supplied meets the applicable requirements.

This places importance on the processes used to collect, verify, update and transmit information.

Accuracy and verification

Entities should review the accuracy and currency of the information they provide and maintain appropriate procedures for identifying errors or inconsistencies.

Where information is outdated or incorrect, the entity should follow the applicable process for correcting or updating it.

Data-sharing arrangements

Data Providers must consider the formal arrangements governing the supply and transmission of information to the platform.

Relevant procedures should address responsibilities, secure connectivity and the timely provision of information in accordance with the applicable rules.

Confidentiality and security

KYC information may contain personal and commercially sensitive details. Data Providers should therefore ensure that access, handling and transmission arrangements comply with the relevant confidentiality and security requirements.

The applicable rules should be reviewed alongside other laws governing personal data, cybersecurity and financial crime compliance, where relevant.

5. Customer Approval and Access to KYC Reports

Customer approval is a key feature of the KYC Digital Platform.

The Decree-Law defines customer approval as prior approval obtained through a legally acceptable means, including written or digital approval, for the purposes specified in the legislation and Executive Regulations.

The platform's report-access process must comply with the requirements applicable to the customer, the requesting User and the intended purpose.

Businesses should not treat the platform as a general database from which information can be obtained or used without following the prescribed procedure.

What should participating entities consider?

Entities involved in requesting or providing KYC information should establish procedures to verify that the required approval has been obtained and documented.

They should also ensure that requests are made by authorised persons, information is accessed only for permitted purposes and records are maintained in accordance with the applicable requirements.

The precise approval process and the circumstances in which information may be requested should be confirmed against the official legislation and applicable operational rules.

6. Confidentiality, Data Protection and Permitted Use

The use of a centralised KYC platform creates responsibilities concerning the security and appropriate handling of customer information.

The legal framework addresses the collection, storage, processing, transmission and use of KYC data, as well as the protection of reports against unauthorised access or disclosure.

Entities participating in the platform should ensure that their procedures reflect the restrictions applicable to their role.

Key areas for review

Access controls: Access to KYC information should be restricted to authorised persons acting within their permitted responsibilities.

Secure transmission and storage: Systems and procedures should be appropriate for protecting information against unauthorised access, loss or misuse.

Permitted purposes: KYC reports should be requested and used in accordance with the legal requirements governing the platform.

Confidentiality: Employees and service providers handling KYC information should understand the restrictions applicable to disclosure and use.

Record management: Relevant records should be maintained and handled according to the applicable retention and security requirements.

The Decree-Law also interacts with other relevant legislation, including the UAE's personal data protection and anti-money laundering laws. The precise obligations will depend on the entity's activities and regulatory status.

The platform should therefore be treated as a regulated information-sharing mechanism, not as a replacement for broader data protection and compliance responsibilities.

7. Administrative Violations and Sanctions Under Cabinet Resolution No. 56 of 2026

Cabinet Resolution No. 56 of 2026 establishes a schedule of administrative violations and sanctions relating to breaches of the KYC Digital Platform Decree-Law and its Executive Regulations.

The schedule should be consulted to identify the specific conduct covered, the party responsible and the applicable sanction.

It is important not to treat all violations as carrying the same fine. The consequences depend on the particular violation and the applicable entry in the official schedule.

The wider Decree-Law also contains provisions concerning specified prohibited conduct. Depending on the circumstances, a matter may raise issues beyond administrative non-compliance.

How should businesses approach the sanctions framework?

Entities should first identify the provisions that apply to their role as a Data Provider, User or other participant.

They should then map the applicable requirements against their internal procedures, particularly those concerning data accuracy, customer approval, confidentiality, access controls and permitted use.

Where a possible breach is identified, the entity should assess the facts, preserve relevant records and obtain appropriate legal or compliance advice.

Important: Specific fine amounts should be quoted only after checking the relevant violation and sanction in the official schedule to Cabinet Resolution No. 56 of 2026. A single general fine range should not be presented as applicable to every breach.

8. A Practical KYC Compliance Checklist for Businesses

Businesses that may fall within the platform's requirements should consider the following steps.

Confirm the entity's role

Determine whether the business qualifies as a Data Provider, User or another participant under the applicable provisions. Confirm the requirements that apply to that role.

Review data accuracy procedures

Establish how information is collected, verified, updated and corrected before it is provided or used.

Document customer approval

Ensure that required customer approval is obtained and recorded through the permitted process before a KYC report is requested.

Strengthen access controls

Limit access to KYC information to authorised personnel and review how requests and report access are approved.

Review confidentiality and security

Assess the systems and procedures used to store, transmit and handle KYC information.

Confirm contractual and operational arrangements

Review any agreements or operational arrangements required for participation in the platform and clarify the responsibilities of each party.

Train relevant employees

Ensure that employees responsible for customer onboarding, compliance, data management and reporting understand the procedures relevant to their work.

Verify the applicable sanctions

Review Cabinet Resolution No. 56 of 2026 and identify the specific violations and consequences relevant to the entity's role.

This checklist is a starting point. It does not replace a review of the complete legislation, official operational guidance or the requirements applicable to a particular business.

Conclusion

The UAE National KYC Digital Platform represents an important development in the country's approach to customer verification and the regulated sharing of KYC information.

Federal Decree-Law No. 30 of 2024 establishes the legal basis for the platform, while Cabinet Resolutions No. 55 and 56 of 2026 provide the Executive Regulations and administrative sanctions schedule.

For participating entities, the principal compliance considerations include identifying their role, maintaining accurate information, following the required approval process, protecting confidential data and ensuring that reports are accessed and used only as permitted.

The platform is intended to support more efficient customer verification, but it does not eliminate the need to understand and comply with separate regulatory obligations.

Businesses should review the official legislation and assess how the requirements apply to their operations before implementing or changing their KYC procedures.

Malhotra Legal Consultancy can assist businesses with reviewing relevant regulatory obligations, assessing compliance documentation and identifying legal considerations associated with customer verification and data-handling processes in the UAE.