Short answer: Money transfer in the UAE is regulated by different authorities depending on where you operate. On the mainland, the Central Bank of the UAE (CBUAE) licenses and supervises exchange houses and other remittance providers. In the Dubai International Financial Centre (DIFC) the regulator is the Dubai Financial Services Authority (DFSA), and in Abu Dhabi Global Market (ADGM) it is the Financial Services Regulatory Authority (FSRA). Whichever applies, the licensed business owns the obligations, and the platform has to make each one easy to carry out and easy to prove.
RemitSo is white-label remittance software for licensed money transfer operators. We are a technology company, not a remitter or exchange house, and nothing here is legal advice.
Three regulators, one set of questions
The rulebooks differ, but each regulator asks a remittance business similar questions about its systems.
- Mainland (CBUAE). The CBUAE Rulebook sets out the Exchange Business Regulation, which covers remittances alongside currency exchange, and the standards for licensing and monitoring exchange business. Retail payment services sit under a separate regulation.
- DIFC (DFSA). The DFSA Rulebook treats money transmission as part of Providing Money Services, a regulated financial service in or from the DIFC.
- ADGM (FSRA). The FSRA also regulates Providing Money Services, under its own regulations and rules.
Licence categories, capital and the conditions attached to them are on those pages and are questions for your adviser. For the platform, three things carry across all three regimes:
- You must know your customer and show how you knew.
- You must screen, monitor and report, with the evidence kept.
- You must control your outsourcing, including the technology and the payout partners your service relies on.
Know where every record lives
Expect to be asked who your technology provider is, where customer records are held, who can reach them, and how you would get them back.
What that means for your platform:
- Your own environment. On RemitSo, each operator runs its own instance in its own AWS account, in the AWS region it chooses. AWS bills the operator directly, and nothing is shared with another operator.
- Separate entities, kept apart. If your group runs a mainland business and a free-zone business, keep each licensed entity's customers, rules and records separate, so each regulator sees only what belongs to it.
- Evidence for the outsourcing file. RemitSo is ISO 27001:2022 certified, and the admin panel lists every deployed software component with its version and licence, downloadable in a format security reviewers read.
Customer due diligence: one record per customer, with the evidence
Each regulator expects you to identify and verify customers, scale checks to risk, and keep what you collected. The CBUAE's AML/CFT guidance is on its website, and the DFSA and FSRA publish their own AML rulebooks.
On RemitSo:
- Identity checks with the evidence attached. e-KYC through a connected identity provider checks the ID document, a selfie and a live face, and matches the name to the profile. Alternatively, customers upload documents for manual review, or you use both. Evidence is kept with every result.
- A person can overrule, and the reason stays. A reviewer can overrule an identity check or a risk flag, and the reason is kept with the record.
- Documents that scale with risk. You set "up to" limits per transaction and over a day, week, month, 90 days or a year, per currency and corridor, such as AED. Each tier names the documents the customer must provide, and above the top tier an officer has to raise the limit.
Screening: built for names that look alike
UAE remitters serve customers from dozens of countries, and many senders and recipients share a small set of common names. That makes sanctions screening a volume problem as much as a compliance one. The UAE's Executive Office for Control and Non-Proliferation publishes the UAE's sanctions lists and guidance.
On RemitSo:
- Eight sanctions lists, kept up to date. Every sender, recipient and staff member is screened, and everyone is re-screened when the lists change.
- A match holds; a person decides. A possible match holds the transfer until an officer on your team rules on it. Nothing is blocked by the match alone.
- Built for common names. Matching is tuned to keep possible matches on short and common names to a number your officers can genuinely review.
Which lists your regulator expects you to screen against is a question for your compliance officer. Tell us, and we'll confirm how they are covered.
Monitoring and reporting suspicion
Suspicious transactions are reported to the UAE Financial Intelligence Unit through its reporting platform. The decision to report, and the report itself, belong to your compliance officer. The platform's job is to surface what needs a person and keep the trail.
- Rules you can explain. You build rules from 47 ready-made risk indicators, combined to match your own risk assessment. Clean transfers flow on, and the rest are held for a person.
- The decision trail. The platform should show which rule held each transfer, who reviewed it and what they decided.
- The rule we design to: the platform flags, and your compliance team decides.
Payout partners: your contracts, your evidence
UAE operators typically pay out through banks, mobile wallets and cash pickup networks abroad. Your regulator will want to know who those partners are and how you oversee them.
On RemitSo:
- Three ways to pay out. Bank deposit, mobile wallet and cash pickup are supported.
- Your contracts. You hold the contract with each payout partner, so the commercial terms are yours. We connect and test them.
- Corridors as settings, not projects. Payout channels, banks and onboarding fields are set up by configuration, so a partner's required fields can be set per corridor.
- Locked payouts. Once a payout is approved, nobody can change it, so nobody can redirect it.
Rates, fees and the books
UAE remittance is competitive, and rates move quickly. On RemitSo, you can change every rate in one sitting, give larger transfers a better rate tier by tier, and set fees per corridor with a review reminder. An optional live rate feed applies your margin to market rates, and a rate beyond the guardrail you set is never applied. Every rate change records who made it, when, and what it was before.
Behind it, a double-entry ledger records every payment, payout, refund, fee and FX movement. Partner fees and bank fees sit in their own accounts, so you see real margin by corridor.
Records and audit evidence
Whichever regulator supervises you, expect to show who did what, when and why. On RemitSo:
- Audit trails in plain language. Each entry shows what changed, from what and to what, and who changed it.
- User access logs, roles and two-step sign-in. Roles cover every page and action, and every user signs in with two steps.
- Exportable compliance reports, so evidence leaves the system as a usable file rather than as screenshots.
How long you keep records is set by your regulator's rules. Check the period with your adviser.
What we've learned on Gulf-style corridors
Two lessons worth applying before launch:
- Common names can flood a screening queue. Where many customers share a few common names, untuned matching can return hundreds of possible matches for a single name, and officers face lists they can never review properly. Test screening with a sample of your real customer names before launch. A screening queue nobody can clear is not a control.
- Ask each partner what it needs before go-live. Some payout partners require extra recipient details for particular countries, such as an identity document type and number. Agree the list with each partner and set those fields per corridor before launch, so valid payouts aren't refused on day one.
Checklist: what the platform should evidence
| Area | What the platform should be able to evidence |
|---|---|
| Licensing and outsourcing | Your technology provider, partners, corridors and data location (your own AWS account and region) |
| Customer due diligence | Documents collected, verification results, reviewer decisions and reasons |
| Sanctions | Lists screened, when they were loaded, who was screened, and each ruling |
| Monitoring | The rule that held each transfer, the reviewer and the outcome |
| Suspicion reporting | A review trail your officer can rely on; the report itself stays with them |
| Payout partners | Partner contracts, required fields per corridor, and approved payouts that cannot change |
| Pricing | Who changed each rate and fee, when, and from what |
| Records | Audit trails, user access logs and exportable compliance reports |
Frequently asked questions
Does RemitSo hold a UAE licence or apply for one for us?
No. RemitSo is a technology company. Your licence, your AML programme and your reports to regulators stay with your business.
Does it matter whether we're on the mainland, in DIFC or in ADGM?
For the platform, much less than for your licence. The controls are the same; the rules, reports and records you configure follow your regulator. Your adviser confirms which regime applies.
Who decides on a sanctions match?
A person on your team. A possible match holds the transfer, and an officer rules on it. Every ruling is kept with its reason.
Can we pay out to bank accounts, mobile wallets and cash pickup?
Yes. All three are supported, through payout partners you contract with directly. We connect and test them.
Where is our customer data held?
In your own instance, in your own AWS account, in the AWS region you choose. AWS bills you directly, and nothing is shared with another operator.
For more, see our KYC, AML and sanctions tools, the admin panel features, how to choose and run payout partners and Starting a Licensed Money Transfer Business: The Platform and Operations Checklist. Book a demo to see a transfer screened, priced and paid out with your own corridors.
Rules change, and the CBUAE, DFSA and FSRA pages are the authority. Treat this as a guide to what your platform should evidence, not as legal advice. Check with your compliance adviser.