AMLR Solutions 
AMLR Consultation
EUDI Wallet
Onboarding
Ongoing Monitoring
FRAML
KYC
KYB
KYI
Age Assurance
Workforce IAM
Candidate Verification
Account Takeover
Bonus/ Promotion Abuse
Chargeback Fraud
Deepfake
Document Fraud
Fraud Networks
Impersonation Fraud
Money Mule Activity
Multi-Accounting
Party Fraud
Regulatory & Compliance Risks
Synthetic Identity Fraud
Adult Content
Banking
Crypto
Fintech
Forex
Compliance
Fraud prevention
Trust & safety
Global expansion
Compliance Officers
Developers
Fraud Analysts
Product Managers
Journey Builder 
Global Trust Platform
Customer Profiles
Vendor Comparison
IDV Case Management
AML Case Management
Regulatory Reporting
Agentic Rule Builder 
AI Compliance Co-Pilot 
Fraud Analytics
Fraud Hub 
OCR
Shufti AI
Bank Account Verification 
Biometric Duplication
Database Checks
Document Intelligence
Government ID
Mobile Driver's License
NFC
Selfie Liveness
Brand Personalisation
Deployment Options
Identity Methods
IDV Modes
Multi-tenancy
On-Premise IDV
Secure Capture
Shufti MCP
- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Cambodia
- Canada
- China
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- USA
- Vietnam
Scale Identity Verification and KYC Operations in United Arab Emirates
Verify nationals and expats through UAE PASS, Emirates ID NFC, and 10,000+ foreign ID types; run KYB on businesses and real owners, and monitor transactions and sanctions lists. One platform manages the full compliance lifecycle for CBUAE-, DFSA-, FSRA-, and VARA-supervised firms.
Operational Performance for UAE KYC
Our Numbers Speak Volumes
99.07%
Pass
Rates
<5 secs
IDV
Verification
90%
eIDV
Verification
UAE IDV/KYC Challenges
Diverse Customer Documents Complicate Onboarding
The UAE is home to 200+ nationalities, and expatriates outnumber Emirati citizens, so most customers onboard with foreign passports and IDs. Shufti's zero-shot document intelligence verifies documents from 240+ countries, including formats it has never seen before.
Keeping Customer Risk Current Requires Continuous Monitoring
Keeping CDD records current requires monitoring beyond onboarding. Shufti checks transactions against customer profiles, refreshes sanctions and PEP data every 15 minutes, and flags registry, director and ownership changes to track risk throughout the entire customer relationship.
Mainland, DIFC, ADGM and VARA Firms Follow Different Rulebooks
Mainland, DIFC, ADGM and VARA firms face different verification rules and retention minimums of five, six or eight years. Shufti’s AI Journey Builder configures checks by jurisdiction, product and risk tier, supporting requirements across your group’s licences.
Thin Case Files Weaken goAML Reports
Incomplete case files leave compliance teams reconstructing evidence for goAML reports. Shufti’s case management connects transaction history, related parties, supporting documents, analyst rationale and decisions, with direct UAE goAML integration for SAR and STR preparation and filing.
Documents and Languages
Individual Documents Shufti Verifies in the UAE
Shufti verifies 11+ UAE identity documents plus passports and ID cards from other countries. The cards below cover the core documents UAE onboarding relies on, with the full list on the supported documents page.
View All Supported DocumentsUAE PASS
The UAE's national digital identity, and one of the validation routes the CBUAE (Central Bank of UAE) names for Emirates ID checks. Shufti authenticates customers through UAE PASS natively, so identity is confirmed against a government source.
Emirates ID
Issued by the ICP to UAE nationals and residents under Federal Decree-Law No. 9 of 2006. Shufti reads the chip through NFC, runs nine forensic detection layers, matches the holder through biometric liveness and confirms identity via UAE PASS.
UAE Passport
Biometric ICAO-compliant passport issued to UAE nationals. Shufti reads the chip through NFC and runs nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.
Foreign Passports and National ID Cards
Shufti actively processes 10,000+ ID types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. Expat and non-resident customers, including GCC nationals, onboard with their home-country passport or ID in the same flow as Emirates ID.
UAE Driving License
Verify UAE driving licenses with document-authenticity checks, expiry checks, and facial matching to connect the license to its holder. For Dubai RTA-issued licenses, Shufti’s e-IDV lookup also checks license status, expiry, and permitted vehicle class, supporting more informed onboarding for car rental, ride-hailing, and delivery businesses.
Proof of Address
Utility bills, bank statements, registered tenancy contracts, and official address certificates. All are verified in one step alongside the customer's identity document.
Entity Identity
Trade License (Mainland or Free Zone)
Issued by the emirate's economic department or the relevant free zone authority. Shufti checks the licence for tampering and matches it against live registry data, confirming the company exists and what it is licensed to do.
Certificate of Incorporation and National Economic Register Extract
The National Economic Register extract shows a company's current license status across the UAE. Shufti runs a live registry call at every check, so changes made after incorporation surface before you onboard.
Memorandum and Articles of Association
Shufti's AI-OCR reads ownership, capital and signing authority from the MoA and its filed amendments. It also flags GAN-generated or edited pages before they reach your reviewers.
Business Address Proof
Ejari in Dubai, Tawtheeq in Abu Dhabi, plus tenancy contracts, utility bills and bank statements. Shufti cross-checks the address against the trade licence, so any mismatch surfaces at onboarding.
Tax Identity
VAT Registration Certificate
Issued by the Federal Tax Authority under Federal Decree-Law No. 8 of 2017. Shufti extracts the TRN and cross-checks it against the entity's other documents.
Corporate Tax Registration Certificate
Issued by the Federal Tax Authority under Federal Decree-Law No. 47 of 2022. It is verified in the same flow as the VAT certificate, so one case file holds the full tax identity.
Foreign Tax Registration and FATCA/CRS Self-Certification
Foreign-owned structures go through the same flow. Shufti collects home-country tax registrations and FATCA and CRS self-certifications where those obligations apply.
Ownership and Control
Real Beneficiary Register
Required under Cabinet Resolution No. 109 of 2023, which replaced No. 58 of 2020, with updates due within 15 days of any change. Shufti extracts the UBO tree to the 25% threshold and screens every beneficial owner.
Shareholder Register and Ownership Chart
Shufti maps ownership through every intermediate company until it reaches a real person. Each owner is screened against OFAC, EU, UK HMT, UN, PEP and adverse-media lists.
Directors, Managers and Authorized Signatories
Board resolutions and powers of attorney confirm who can act for the company. Shufti verifies each person's ID, screens every director and sends an alert when the board changes.
Languages We Cover
Arabic, English and Expat Document Parsing
UAE onboarding runs on bilingual Arabic and English documents, plus expat IDs written in dozens of other scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy. On Arabic, it scores 94%, where Google Vision scores 64%.
Arabic Name Matching
Phonetic and transliteration rules handle bin, bint, and Al- structures, so spelling variants of one name still match in sanctions and PEP screening.
Cross-Document Consistency Checks
Names and identifiers are reconciled across the Emirates ID, passport, trade license, and Real Beneficiary Register to catch mismatches.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Regulatory Update
Every Verification Route UAE Regulators Recognize, in One Platform
The CBUAE recognizes three national routes for digital customer due diligence: the Emirates ID checked through the ICP Validation Gateway, UAE PASS and Emirates Facial Recognition. Shufti supports all three, plus chip, database, document, and video routes for non-residents and customers without an Emirates ID.
ICP Validation Gateway
LiveCBUAE guidance expects Emirates IDs to be verified through the ICP Validation Gateway, with the evidence kept. Shufti validates Emirates IDs against the gateway directly and can also authenticate them through UAE PASS, storing every result in the case file.
Emirates Facial Recognition
LiveThe Ministry of Interior and ICP run a "face fingerprint" system for remote identity checks. Shufti supports it, so it confirms a customer's face against the national system rather than only a card photo.
Docless Database (eIDV)
LiveLow-risk customers can verify without uploading a document. Shufti confirms identity through a UAE PASS login or a check against permitted UAE data sources and returns a decision in seconds.
NFC Chip Verification
LiveShufti reads the secure chip in the Emirates ID, the UAE ePassport and most foreign biometric passports. This is the high-assurance route for residents who don't use UAE PASS.
Document and Face Biometric
LiveEmirates IDs, UAE passports and foreign IDs are authenticated and paired with iBeta Level 3 liveness to confirm a real, present person. This is the route most non-residents take.
Fraud Prevention Across the UAE Customer Journey
Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help UAE businesses act on risk while keeping legitimate customers moving.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Capture guidance built for the Emirates ID and bilingual documents cuts retakes, so genuine customers don't drop out at the camera step.
Cleaner Audit Trails
Shufti’s case management records sources, results, timestamps, evidence, analyst notes, and decision history, with direct UAE goAML integration for SAR and STR filing.
One Workflow, One Back Office
Unify KYC, KYB, AML screening and transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, director, and transaction behavior changes, managing the full compliance lifecycle.
UAE PASS and Emirates ID-First Flow Design
Residents authenticate through UAE PASS or an Emirates ID chip read first. Non-residents move to passport verification in the same flow.
Shufti's IDV/KYC Solutions for the United Arab Emirates
KYC Solutions
UAE customers arrive as nationals on UAE PASS, residents with an Emirates ID or expats on foreign documents. One Shufti flow routes each by risk, so nobody faces checks they don't need.
Explore More
Face Verification
A genuine Emirates ID proves nothing if a deepfake is holding it. Shufti's iBeta Level 3 liveness matches the live face to the ID photo, while 99.5% of genuine users pass on the first try.
.
Age Verification
UAE age-restricted platforms must stop minors without losing adults at sign-up. Shufti estimates age from a selfie in under five seconds, falls back to the Emirates ID, and blocks 99.8% of underage attempts.
.
Bank Account Verification
A verified customer can still withdraw to someone else's account. Shufti validates the UAE IBAN and matches the holder's name against bank records in real time, so payouts reach only the person you verified.
.
Address Verification
UAE proof of address comes as Ejari, Tawtheeq, utility bills or bank statements in two scripts. Shufti extracts the address from any of them, tolerating spelling differences, at a 99.3% pass rate.
.
Document Verification
Emirates IDs, UAE passports and foreign IDs each carry different security features. Shufti runs nine forensic layers on every one, from MRZ checksums to GenAI detection, and decides in under 15 seconds.
.
Identity Verification
Serving nationals, residents and expats often means stitching tools together. Shufti runs UAE PASS, Emirates ID NFC, document checks and liveness in one API session, so every customer clears a single journey.
.KYB Solutions
UAE companies sit across mainland and free zone registers, often behind layered ownership. Shufti runs live registry calls at every check and traces ownership to the real beneficiaries Cabinet Resolution No. 109 of 2023 requires.
Explore More
Business Verification
Onboarding a UAE company means confirming its trade licence, TRN, signatories and everyone who owns or controls 25% or more. Shufti's live registry call pulls that picture together in one check, putting corporate onboarding under two minutes.
.
Enhanced Due Diligence
PEPs, layered free zone structures and high-risk sectors need more than standard checks. Shufti's branching questionnaires collect source of wealth and UBO verification in one session, scored against your own risk appetite.
.AML Screening
A customer who is clean at onboarding can land on a list next week. Shufti’s perpetual KYC screens against 4,000+ watchlists, including the UAE domestic sanctions list and UN lists, refreshed every 15 minutes, with every alert kept in one case file.
Explore More
Business AML Screening
Sanctions exposure in a UAE company often sits with a director or owner, not the entity itself. Shufti’s perpetual KYB screens all three against the UAE Local Terrorist List, UN sanctions, PEPs and adverse media, rescreening as lists change.
.
Transaction Monitoring
Spot suspicious activity with Shufti’s library of 500+ pre-built rules covering structuring, smurfing, and mule activity. Check alerts against customer identity and transaction history for 60% fewer false positives, then move investigations into case management with direct UAE goAML integration for SAR and STR filing.
.
Travel Rule
UAE virtual asset firms must exchange sender and recipient details on qualifying transfers. Shufti reaches every major Travel Rule network through one IVMS101-compatible integration and verifies ownership of unhosted wallets where there is no counterparty.
.
AI Compliance Co-Pilot
One common name can return 140+ screening hits. Shufti's Co-Pilot reviews each hit first, classifying risk with a confidence score and written reason, so analysts start with real matches and the MLRO keeps the final call.
.Built To Fit the United Arab Emirates' Compliance Landscape
Federal AML law and federal bodies apply in every emirate, including the free zones, while the CBUAE, DFSA, FSRA, VARA and sector supervisors each add rules for their own jurisdiction. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each license your group holds.
Federal AML Law (Decree-Law No. 10 of 2025)
In force since 14 October 2025, replacing Decree-Law No. 20 of 2018. Its implementing rules in Cabinet Resolution No. 134 of 2025 require firms to identify anyone owning 25% or more (Article 10), monitor relationships continuously (Article 8) and keep records at least five years (Article 25).
Central Bank of the UAE (CBUAE)
Supervises mainland banks, exchange houses, finance companies, payment firms and insurers. Emirates IDs should be verified through the ICP Validation Gateway, UAE PASS or Emirates Facial Recognition, and an April 2026 guidance update expects risk to be reassessed throughout the relationship. Banks keep their master system of record in the UAE.
UAE Financial Intelligence Unit (FIU)
Receives suspicious transaction reports through goAML, where reporting entities and DNFBPs must register before filing. Article 18 of Federal Decree-Law No. 10 of 2025 requires them to notify the FIU without delay and directly, with a detailed report on the suspicious transaction or activity behind it.
Dubai Financial Services Authority (DFSA)
Runs its own AML Module inside the DIFC, requiring reliable independent verification, a documented risk rating for every customer, an MLRO, and records kept for at least six years under AML 14.4.1. The DIFC sits outside Cabinet Resolution No. 109 of 2023 and applies its own beneficial ownership rules.
Financial Services Regulatory Authority (FSRA)
Requires ADGM firms to verify customers and beneficial owners, apply enhanced checks to PEPs, and keep records for at least six years under Rule 4.5.1. Under Rule 9.3, outsourcing eKYC or screening leaves full responsibility with the firm, which must vet its provider before appointment and oversee it afterward.
Virtual Assets Regulatory Authority (VARA)
Licenses virtual asset firms across Dubai, outside the DIFC. Its Compliance and Risk Management Rulebook requires Travel Rule data on transfers above AED 3,500, controls on self-hosted wallet risk, transaction monitoring against each customer's profile, and records kept for at least eight years, indefinitely where national security applies.
Capital Market Authority (CMA)
Replaced the Securities and Commodities Authority under Federal Decree-Laws No. 32 and 33 of 2025, supervising securities markets outside the financial free zones. Its licensees remain bound by Federal Decree-Law No. 10 of 2025 and the CDD, monitoring and retention duties in Cabinet Resolution No. 134 of 2025.
Ministry of Economy and Tourism (MoET)
Supervises most mainland DNFBPs, from real estate brokers to precious metals dealers and corporate service providers. It enforces Cabinet Resolution No. 109 of 2023, which requires companies to update their Real Beneficiary Register within 15 days of any change, with penalties set under Cabinet Resolution No. 132 of 2023.
General Commercial Gaming Regulatory Authority (GCGRA)
Holds exclusive federal jurisdiction over commercial gaming, from lottery and internet gaming to sports wagering. Licensees must show controls for player due diligence, transaction monitoring and suspicious transaction reporting, and its 2025 Commercial Gaming Policy Paper with the NAMLCFTC recommends enhanced due diligence for higher-risk relationships.
Federal Authority for Identity, Citizenship, Customs & Port Security (ICP)
Issues the Emirates ID under Federal Law No. 2 of 2004 and Federal Decree-Law No. 9 of 2006. It maintains the Validation Gateway that the CBUAE directs licensed firms to use for Emirates ID checks, with evidence of each digital verification kept on file under their record-keeping policies.
Executive Office for Control and Non-Proliferation (EOCN)
Publishes the UAE Local Terrorist List under Cabinet Resolution No. 74 of 2020, which also implements UN Security Council sanctions on terrorism and proliferation financing. Regulated firms in the UAE screen customers, owners, and directors against both sets of lists to meet their targeted financial sanctions duties.
National AML/CFT Committee (NAMLCFTC)
Chaired by the CBUAE Governor, the committee has set national AML/CFT policy since replacing the Executive Office for AML/CTF in September 2024. Its National Risk Assessment identifies the sectors, threats, and vulnerabilities that firms across the UAE are expected to factor into their own business-wide risk assessments.
UAE Data Residency and Deployment
Shufti offers UAE data residency and on-premises deployment, giving your firm control over where verification data is stored and processed. Hosting locations and transfer arrangements are defined in your agreement, so deployment can be selected around your applicable residency and outsourcing requirements.
UAE Personal Data Protection Law (PDPL)
For verification workflows subject to the UAE PDPL, Shufti provides encryption, role-based access controls and configurable retention. These controls help your firm protect identity and biometric data, restrict access and apply its documented retention policy throughout the verification lifecycle.
DIFC and ADGM Data Protection
DIFC and ADGM have separate data protection regimes. Shufti supports your implementation with configurable retention, access controls, audit logs and a data processing agreement, helping your firm document how verification data is handled under its applicable framework.
Retention Controls
Shufti makes retention configurable by client and jurisdiction, helping your firm apply the record-keeping period relevant to its license and activities. Statutory minimums are not automatic deletion dates: the retention schedule must also account for legal holds and any continuing lawful requirement to preserve records.
Encryption and Security
Shufti encrypts verification data in transit and at rest, with role-based access and audit logging to control and trace its use. ISO 27001:2022 certification and SOC 2 Type 2 assurance provide supporting evidence for your firm’s vendor security assessment.
Automated Decisions and Biometric Data
Shufti provides verification results and supporting details through its API and back office, helping your customer support team investigate queries about document, facial verification, and liveness checks. Teams can use this information to explain outcomes and escalate disputed results to the appropriate decision-maker.
Scope of Our Role
Shufti processes verification data on your firm’s instructions when acting as its service provider. Your firm determines the purpose of those checks and retains responsibility for customer decisions and compliance. Shufti’s privacy notice separately identifies activities where it acts as an independent controller.
Data Residency and Privacy Controls in the UAE
UAE AML Sources That Strengthen Decisions
National Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation Financing Committee
UAE Financial Intelligence Unit
Central Bank of the UAE
Ministry of Economy and Tourism AML Department
Ministry of Justice AML/CFT Department
UAE Capital Market Authority
Dubai Financial Services Authority
ADGM Financial Services Regulatory Authority
Dubai Virtual Assets Regulatory Authority
Executive Office for Control and Non-Proliferation
FATF
Middle East and North Africa Financial Action Task Force
Egmont Group of Financial Intelligence Units
UN Security Council Consolidated List
Terrorist Financing Targeting Center
Turn UAE Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
PROVEN WORKFLOWS
Identity Verification Built Around Your Industry in the UAE
Know The Seller Behind The Storefront
For UAE marketplaces onboarding local and overseas sellers, a trading name alone provides limited assurance. Shufti’s KYB and identity checks help establish the business and the people operating it. Device intelligence and linked-account detection help identify repeat abusive sellers, while authentication protects sensitive changes to seller accounts and payout details.
Frequently Asked Questions
Does Shufti support UAE PASS, and what happens when customers cannot use it?
Shufti supports UAE PASS alongside document, biometric and NFC verification. Customers unable to complete UAE PASS can follow alternatives configured for your onboarding requirements. UAE PASS supports citizens, residents and visitors; available verified attributes depend on account type and assurance level.
Is scanning an Emirates ID enough, or should verification include its chip?
A scan captures visible details; NFC reads compatible chips, validates issuer signatures, compares chip and document data, and matches the chip portrait to a live selfie. Emirates ID workflows require confirmed chip compatibility, access permissions and government-supported validation applicable to your business.
Can Shufti verify foreign documents or identity formats it has not encountered before?
Yes. Shufti’s zero-shot document intelligence handles previously unseen formats, supporting onboarding across 240+ countries and territories. UAE businesses can accommodate unfamiliar foreign passports and national IDs as formats evolve, combining document analysis, data extraction and authenticity checks to deliver usable verification results.
How does Shufti OCR compare with Google OCR for Arabic identity documents?
Shufti’s internal benchmark reports 92.17% Arabic OCR accuracy versus Google Vision’s 90.24% on identical document sets under standardized conditions. Its OCR extracts structured identity fields, including names, birthdates and document numbers; forensics assesses authenticity. These vendor-reported results do not guarantee accuracy across UAE documents.
How does Shufti verify ownership when a UAE company has several corporate layers?
Shufti combines live registry checks, ownership-tree extraction and corporate document analysis to trace individuals behind businesses. It verifies and screens directors and ultimate beneficial owners, linking results to company records. Incorporation documents and shareholder registers supplement incomplete registry information when investigating ownership chains.
Does Shufti’s ongoing monitoring cover more than sanctions screening?
Yes. Shufti combines sanctions and PEP re-screening, adverse-media monitoring, registry and director-change alerts, transaction analysis and triggered identity re-verification. These track customer identity, business ownership and transactional behavior, supporting Article 8’s ongoing-monitoring requirements for keeping CDD information current and scrutinizing transactions.
How does Shufti keep screening current and handle Arabic name variations?
Shufti refreshes sanctions, PEP and adverse-media data every 15 minutes. Matching accounts for transliteration, phonetic differences and name order, using birthdates and nationality to assess matches. UAE configurations should explicitly include the UAE Local Terrorist List, UN Consolidated List and other applicable sources.
Can we choose UAE hosting or run verification inside our own infrastructure?
Yes. Shufti offers UAE hosting under contractually specified regional arrangements and on-premise deployment within your infrastructure. Air-gapped deployments are also supported, with model and watchlist updates delivered through approved transfer mechanisms, giving organisations with strict network controls flexibility in how verification is deployed.
What controls help us protect identity and biometric data?
Shufti uses TLS encryption in transit, AES-256 at rest, role-based access and audit logging. Teams can restrict access, trace record use and configure retention. Data processing terms document the service arrangement, supporting implementation of the privacy framework applicable to your UAE entity.
Can we configure different retention periods for different UAE licenses?
Yes. Shufti supports retention configuration by client and jurisdiction. AML minimums generally span five years federally, six under DFSA and ADGM, and eight under VARA. Account for record type, retention start events, and legal holds; reaching minimum periods does not automatically authorize deletion.
What does Shufti provide when our compliance team needs to prepare a goAML report?
Shufti’s case management integrates directly with UAE goAML for SAR and STR filing. It brings together transaction chronology, customer and connected-party details, risk indicators, supporting documents, analyst notes, and decision history, helping your compliance team prepare and submit reports within a connected workflow.
Can we add verification checks without rebuilding our onboarding journey?
Yes. Shufti supports KYC, KYB, and AML through a shared API, with modules enabled as requirements expand. Journey Builder lets you visually configure verification steps, while web and mobile SDKs support document capture and customer-facing flows, helping you introduce checks within your existing integration.
How does Shufti make verification queries easier for our customer support team?
Shufti provides verification outcomes and supporting details through its API and back office. Authorized support staff can investigate queries, explain appropriate next steps and escalate disputed outcomes with relevant evidence, giving support and compliance teams a shared factual basis for resolving customer issues.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
13 July, 2026
Identity Verification in the Middle East: GCC eKYC Guide
A practitioner's guide to KYC in the Middle East, covering eKYC rules, national digital IDs, data residency and how docless eIDV works across the GCC markets today.
Product Guide
