UAE Pass and the ICP Validation Gateway, operated by the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP), let regulated entities verify an Emirates ID electronically against official government records. The Central Bank of the UAE (CBUAE) recognises both as compliant pathways for Customer Due Diligence, helping banks, insurers, and other licensed institutions move away from manual document checks.
This guide covers what each tool does, how they support digital identity verification, and what CBUAE-regulated entities need to know for Customer Due Diligence (CDD).
Why the UAE Eliminated SMS OTPs Entirely
Most regulators tighten OTP rules. The UAE Central Bank retired them completely.
- CBUAE mandated a full phase-out of SMS and email one-time passwords as an authentication method for financial transactions, starting July 2025 — a rare global first
- Banks must now confirm transactions through biometric authentication instead: fingerprint, facial recognition, or secure in-app verification
- Liability shifted with the mandate: if fraud is confirmed to have happened through SMS-only OTP misuse after the phase-out, the bank bears responsibility
- CBUAE also stood up a national Anti-Fraud Operations Centre in 2025 for real-time, sector-wide fraud monitoring
What This Means for Emirates ID Verification
OTPs are being retired because they’re too easy to intercept — a code sent by text can be phished, SIM-swapped, or socially engineered out of someone in seconds. A verification method tied to the Emirates ID itself doesn’t have that weakness.
That’s the real argument for UAE Pass and the ICP Validation Gateway: they don’t rely on a password or a code a customer might unknowingly hand over. They confirm identity against the same government record CBUAE already trusts — which is precisely the kind of control the Central Bank’s broader shift toward biometric, government-backed authentication is pushing every institution toward.
The Emirates ID as the Foundation of UAE Identity Verification
The Emirates ID is issued by the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP). It’s held by citizens and residents alike, and it underpins most identity checks in the UAE.
- It’s a government-issued credential linked to a central population register
- Financial institutions and other regulated entities are expected to verify it electronically
- A visual check of the physical card alone is not considered sufficient
What Is the ICP Validation Gateway?
The ICP Validation Gateway is an online service from the Federal Authority for Identity, Citizenship, Customs and Port Security. It lets approved organisations check Emirates ID details directly against the authority’s own records.
- The regulated entity submits the details on a customer’s Emirates ID
- The gateway confirms whether those details are valid and match the government record
- This gives independent verification, rather than relying on the document alone
What Is UAE Pass?
UAE Pass is the country’s national digital identity app. It lets residents authenticate themselves and access government and private-sector services using their Emirates ID credentials.
- During onboarding, a customer can confirm their identity directly through the app
- This removes the need to photograph or submit physical identity documents
- CBUAE guidance identifies Emirates ID validation through UAE Pass as a compliant digital identification pathway
How CBUAE-Regulated Entities Use These Tools
The CBUAE rulebook requires licensed financial institutions to verify an Emirates ID either physically or through digital and electronic KYC (e-KYC) solutions.
Where digital verification is used, the rulebook specifies that institutions must use the ICP’s online validation gateway, the UAE Pass application, or other UAE government-supported solutions, and retain a copy of the Emirates ID along with its digital verification record.
In practice, this typically looks like the following sequence:
Where Digital Identity Fits Into Broader CDD Obligations
Digital Emirates ID verification covers the identification and verification step of Customer Due Diligence. It doesn’t remove the need for a risk-based approach more broadly.
- CBUAE guidance still expects enhanced due diligence for higher-risk customers
- Records must be retained for the required period
- Customer risk must be reassessed periodically, not only at onboarding
Frequently Asked Questions
What is the difference between UAE Pass and the ICP Validation Gateway?
UAE Pass is the national digital identity app that individuals use to authenticate themselves. The ICP Validation Gateway is the backend service institutions use to check Emirates ID details against government records. Both are recognised pathways for digital identity verification.
Is digital Emirates ID verification mandatory for CBUAE-regulated entities?
The CBUAE rulebook requires licensed institutions to verify Emirates ID details either physically or digitally, using the ICP Validation Gateway, UAE Pass, or another government-supported solution, and to retain the verification record.
Can non-residents be verified through UAE Pass?
UAE Pass is built around the Emirates ID, so it primarily supports verification of citizens and residents. Non-residents are typically verified using a passport and other supporting documents.
How long must institutions retain digital verification records?
Retention requirements are set out in CBUAE guidance and rulebooks; institutions should confirm current retention periods directly with the CBUAE AML/CFT framework rather than relying on general assumptions.
Does using UAE Pass remove the need for ongoing due diligence?
No. Digital verification satisfies the identification step at onboarding, but CBUAE-regulated entities must still apply risk-based ongoing monitoring and periodic reassessment throughout the customer relationship.
Ready to Strengthen Your Identity Verification Approach?
If your institution is reviewing its UAE onboarding journey, check whether your current process makes full use of the ICP Validation Gateway and UAE Pass to meet CBUAE’s digital identification expectations. Keep your broader CDD and record-keeping obligations in view. Speak with our team about aligning your onboarding workflow with the latest CBUAE guidance.
0 Comments