The UAE Central Bank has issued a new guidance on the use of digital IDs by financial institutions for the purpose of their customer due diligence obligations.
The guidance discusses identity proofing, enrollment and authentication mechanisms in relation to the use of digital ID systems by licenced financial institutions (LFIs). The institutions are also required to utilise technology best practices, adequate governance and well-defined policies and procedures.
The guidance is part of the regulator’s overarching guidance on anti-money laundering and combatting the financing of terrorism (AML/CFT) for licenced financial institutions including banks, finance companies, exchange houses and insurance companies, agents and brokers.
The guidance, which comes into effect immediately, will assist the institutions’ understanding of risks and effective implementation of their statutory AML/CFT obligations, and takes Financial Action Task Force (FATF) standards into account.
LFIs have been advised to leverage data generated by authentication (IP addresses, for example) for ongoing customer due diligence and transaction monitoring in order to detect suspicious customer behavior and/or transactions in, to or from sanctioned and high-risk jurisdictions.
Financial institutions are permitted to rely on customer identification and verification undertaken by a third party at onboarding provided the LFIs obtain all relevant information from the third party, take steps to ensure that the third party will provide copies of customer documents and information used for due diligence, and take steps to ensure that the third party complies with the due diligence and record-keeping requirements in the country.
LFIs should take adequate measures to address the inherent technology and security challenges presented by digital ID systems. LFIs should implement and enforce necessary safeguards to reduce identity proofing and enrollment risks, including cyber attacks, security breaches and use of stolen, falsified or synthetic ID details, given the increasing complexity and severity of cyber breaches.
LFIs are expected to conduct adequate assurance level and appropriateness assessments on the digital ID systems they choose. They are also expected to implement and enforce adequate assurance protocols regarding the accuracy of digital ID systems and may perform the assurance reviews directly or obtain audit or assurance certification details from an expert body.
Khaled Mohamed Balama, Governor of the CBUAE, said: “The Central Bank is working closely with the Licensed Financial Institutions to ensure their full compliance and understanding of the guidances that we issue regularly. This guidance on the use of digital ID for Customer Due Diligence obligations, will enhance the anti-money laundering and combatting the financing of terrorism framework, and will mitigate the potential risks in order to safeguard the UAE’s financial system.”
