Guide
RegTech, KYC and AML Platform in the UAE: Outsourcing Rules
The short answer
A RegTech, KYC or AML platform is not usually licensed as such in its own right. The company registers the ordinary way, through the Dubai Department of Economy and Tourism (DET), a free zone, or a financial free zone authority. The customer changes the picture. Once a licensed financial institution relies on the platform for its AML/CFT checks, that institution's own regulator treats the arrangement as outsourcing and holds the institution, not the vendor, to account for it. That regulator may be the Central Bank of the UAE (CBUAE), the Dubai Financial Services Authority (DFSA, DIFC), the Financial Services Regulatory Authority (FSRA, ADGM), the Capital Market Authority (CMA, formerly the Securities and Commodities Authority) or the Virtual Assets Regulatory Authority (VARA, Dubai). The question that decides the route is whether the platform only supplies software, or also makes the call: closing an alert, clearing a case, filing a report.
Who decides, and on what the perimeter turns
No single UAE regulator issues a "RegTech licence". The commercial activity sits with DET or a free zone. The regulatory weight sits with whichever authority supervises the buyer: a bank or exchange house answers to the CBUAE, a DIFC firm to the DFSA, an ADGM firm to the FSRA, a capital markets firm to the CMA, a virtual asset service provider to VARA. Each expects its licensed entity to run due diligence on any outsourced function and keep audit rights over the provider. The platform is rarely the regulated party; the contract that makes the customer accountable for it is what these regulators will eventually ask to see.
Separately, and regardless of which financial regulator applies, the federal Personal Data Protection Law covers processing personal data "whether in full or part through electronic systems, inside or outside the country." It prohibits processing without the owner's consent, subject to limited exceptions, and gives individuals a right to correct or restrict processing of their data. A platform handling passports, selfies or transaction histories is processing personal data under this law however it is licensed.
What a buyer's compliance team will actually check
Procurement diligence, not incorporation, is where RegTech sales stall. A regulated buyer wants to see:
- Where the underlying data comes from and whether the platform has durable rights to use it
- Whether a person reviews disputed cases, or the model decides alone
- Where data is hosted and where support staff sit
- How false positives and model changes are measured and logged
- What happens to a case file when the buyer's own regulator asks for it
The UAE Cyber Security Council runs a five-year National Cybersecurity Strategy, approved in 2025, and a National Cyber Security Accreditation Program, a certification route for standardising cybersecurity practice. Neither is a mandatory gate for every vendor, but a buyer's security review increasingly asks where a platform sits against that programme, particularly for anything touching biometric data.
How money and liability move through the product
A RegTech company's own bank account is usually the first banking question, and the most straightforward one: the business needs an operating account like any software company, and the file a bank wants looks the same (ownership, source of the founders' funds, and a clear description of what the product does with customer data). Working through bank account readiness early avoids the account becoming the last thing settled before launch.
That changes the moment the product stops being pure software. The same questions that decide who receives or controls money in a fintech apply here: a tool that holds client money, initiates a payment, or extends credit is a different regulated activity, and no amount of bank account readiness turns a commercial licence into permission to do that. Keep the two questions separate: can this company bank, and does it, rather than its customer, ever touch customer money. The second, where it arises, needs its own authorisation or sponsor.
Ownership, substance and the roles a buyer checks
Group structure can put the technology, the intellectual property and any licensed function in separate entities, provided each has a genuine role. A buyer's legal team will ask who owns the model and the data pipeline, who is named on the contract, and who is liable if a screening result is wrong. Where ownership sits across more than one jurisdiction, work through it as regulated and complex ownership before a diligence team tests it. The written case belongs in the supporting business plan, not assembled after the question is asked.
What commonly goes wrong
- Scraping or buying data without a durable right to use it for screening
- Describing the tool as something that makes a customer "compliant", rather than something that supports a decision the customer still owns
- Using biometric data without having worked through the data protection law's consent and purpose requirements first
- Keeping an offshore review team or subprocessor out of the contract and out of the buyer's diligence file
Comparing incorporation fees is the most common early mistake. The cost that matters is the full route: the entity, any data licensing and security assurance a buyer requires, and what it costs to add a managed-review layer later if software-only turns out not to be enough. Velarozone prices that full stack rather than a formation headline, and sets out its own fee the way how Velarozone works describes.
