Video KYC & eKYC development · UAE
Video KYC and eKYC development for UAE banks, built to the CBUAE's digital ID guidance.
Appsarmy builds remote onboarding and eKYC systems for UAE licensed financial institutions. The CBUAE's guidance is technology neutral — it does not mandate a live video call — but it does require Emirates ID verification through a government channel and two documented assessments before you rely on any digital ID system. We build to that, with Arabic-first journeys and the passport branch handled properly. Part of our fintech app development practice. For India's very different rules, see V-CIP video KYC development in India.
What a UAE onboarding build is actually made of.
Because the CBUAE guidance is technology neutral, the hard parts are not the ones vendors demo. They are the government channel integration, the evidence you have to retain alongside the document, the branch for applicants without an Emirates ID, and the assessments that justify the whole design.
Emirates ID verification, through the channel
Integration with the ICP online validation gateway and UAE Pass so verification runs through a UAE Government channel rather than an image check — and retention of both the Emirates ID copy and its digital verification record, which is the part most builds forget.
The assessments behind itThe document-type branch
An Emirates ID holder can finish digitally. A passport-only applicant cannot — the guidance requires a copy taken physically from the original, under the signature of the employee performing CDD. We branch the journey at the start so those applicants are routed, not rejected at the final step.
Onboarding inside a banking appIdentity proofing & enrollment
Collecting, validating and verifying identity evidence: validation that the evidence is genuine, verification that the validated identity belongs to this individual — including through biometrics.
Authentication & lifecycle
The second stage of a digital ID system: authenticators, binding, step-up at the assurance level required, and re-proofing when a customer loses every authenticator of an MFA factor.
Arabic-first journeys
Arabic and English as equals with full RTL layout, not a translated afterthought — the same discipline we apply to multi-language delivery on OBDX.
Screening & ongoing CDD
Sanctions and PEP screening at onboarding, plus the monitoring, enhanced due diligence and periodic reassessment paths that digital identification does not replace.
Two assessments come before any technology choice.
The assurance level assessment is how you understand what assurance a digital ID system provides from its technology, architecture and governance, and judge its reliability and independence. The appropriateness assessment is the risk-based decision on whether it is reliable enough for customer due diligence given your business and risk profile. They run in that order — there is little point assessing appropriateness while assurance concerns are unresolved. One useful shortcut: where the UAE government has mandated a specific system, as with Emirates ID verification through the ICP validation gateway, institutions may rely on the government's own assessment of it. Choosing the government channel does not just satisfy the rule; it reduces the assessment you have to carry yourself.
Where UAE onboarding work lands.
The UAE market has a particular shape: a resident population that is largely expatriate, a mature national digital identity, and institutions licensed variously by the CBUAE, the DFSA and the FSRA. All three facts change the build.
Retail account opening, end to end
Digital account opening built on UAE Pass and the ICP gateway, with the document-type branch, digital signing, screening, and the write path into the core — delivered as one journey rather than a verification widget bolted to a form.
SME and corporate onboarding
The harder case: authorised signatories and beneficial owners each needing identification, trade licence and ownership evidence, and a review path that does not stall for weeks because one signatory is travelling.
Re-verification & periodic review
Periodic risk reassessment and refresh cycles that reuse the identity data already held, including re-proofing when a customer has lost every authenticator of a required factor.
Third-party reliance, built correctly
Reliance on a third party's onboarding is permitted if you immediately obtain the identification and verification information, including the assurance levels, and can satisfy yourself that copies will be made available. That is a data contract, so we build it as one.
Arabic and RTL throughout
Arabic as a first-class language across the journey, the documents and the officer tooling — layout mirrored properly, numerals and dates handled, and the signing flow working in both directions.
Onboarding on an Oracle core
Where the bank runs Oracle Banking Digital Experience over FLEXCUBE, onboarding has to land in that stack — which is the ground we cover on OBDX mobile development and in core banking integration.
Evidence first, because that is what gets reviewed.
Licence & scope framing
Which regulator you sit under — CBUAE, DFSA or FSRA — and what your risk profile and licence actually permit remotely. The answer changes the journey, so it comes before the journey.
Assurance assessment
The technology, architecture and governance of each candidate digital ID component, written up as the assurance level it provides, with its reliability and independence stated rather than assumed.
Appropriateness assessment
The risk-based determination for your business, documented. Where the government channel is mandated, the government's own assessment is relied on and the document says so explicitly.
Journey & branch design
Emirates ID holders digital, passport-only applicants routed to a physical touchpoint, corporates through the signatory and beneficial-owner path — with Arabic and English designed together, not sequentially.
Build & integrate
Short cycles against the ICP gateway and UAE Pass, with screening and the core write path in scope from the first sprint and a working journey each sprint.
Ongoing CDD handover
Monitoring, enhanced due diligence and periodic reassessment wired to the same identity data, so the system you launch is the whole lifecycle and not just the first day of it.
The UAE onboarding stack.
We already work on Gulf banking stacks.
Production experience in the GCC
We took an OBDX-based retail banking app to production for a GCC retail bank, delivered in phases against a live rollout. Onboarding lands in the same stack, with the same audit bar and the same Arabic requirement.
Integration, not a product licence
We are not an identity provider and we do not resell one. We integrate the government channels and the components you choose, and we build the journey, the branch logic and the evidence trail around them.
Arabic and RTL as a norm
Multi-language delivery including Arabic and RTL is routine in our Gulf banking work rather than a change request late in the project — which is usually when it surfaces otherwise.
We say which rules we read
This page is built on the CBUAE's guidance for licensed financial institutions on digital identification for customer due diligence. We will tell you where it is silent and where your supervisor's expectation, not the text, is what decides.
Work with us the way that fits.
Onboarding design sprint
A fixed engagement that returns the journey design, the document-type branch, the channel integration plan, and the shape of both assessments.
Fixed-scope onboarding build
A defined system against the ICP gateway and UAE Pass — journey, console, screening, core integration — with written scope and a clear price.
Hire banking engineers
Senior engineers who know Gulf banking stacks, Arabic delivery and core integration, embedded with your team or your implementation partner.
UAE eKYC and onboarding questions.
Does the CBUAE require a live video call?
Not in the way India's RBI does. The guidance is technology neutral — it sets out what a digital ID system must achieve and how reliable it must be, rather than mandating an officer-led video session. That is real design freedom, and it is the main structural difference from an Indian V-CIP build.
How must Emirates ID be verified?
Through a government channel: the online validation gateway of the Federal Authority for Identity, Citizenship, Customs and Port Security, the UAE Pass application, or another UAE Government-supported solution — keeping a copy of the Emirates ID and its digital verification record. Storing the document without the proof of validation is the common gap.
Can a passport-only applicant onboard remotely?
No. Where passports rather than Emirates IDs are used, a copy should be physically obtained from the original, under the signature of the employee carrying out CDD, and retained. So the journey must branch on document type at the start and route those applicants to a physical touchpoint rather than failing them at the last step.
What are the two assessments?
An assurance level assessment — what assurance the system provides given its technology, architecture and governance, and whether it is reliable and independent — and an appropriateness assessment, the risk-based decision on whether it fits your business. They are sequential. Where the government mandated the system, you may rely on the government's assessment.
What is UAE Pass's role?
It is the UAE's national digital identity and signature solution, letting users identify themselves to government service providers across all emirates by smartphone and sign documents digitally, using biometric facial recognition to verify and register users. In a build it does two jobs: a named verification channel, and digital signing for account-opening documents.
Does digital ID replace the rest of CDD?
No. It covers identification and verification. Ongoing due diligence, enhanced due diligence for higher-risk customers and periodic risk reassessment all still apply, and the guidance is explicit that a digital ID system does not remove the need for a risk-based approach. An onboarding project that stops at account opening has built half a system.
Is this the same build as a video KYC system for India?
The components overlap; the architecture does not. India's RBI requires the V-CIP session hosted in the entity's own premises and connected from its own network domain, all data stored in India, and a concurrent audit before accounts go live. The CBUAE instead requires government-channel Emirates ID verification and two documented assessments, leaving the technology open. One is a hosting and residency mandate, the other an assurance and evidence mandate. We build both and do not pretend one deployment satisfies the other.
Let's build your UAE onboarding.
business days