The Shared Assumption That Creates the Shared Risk
Across the UAE business community, organisations conducting due diligence, whether onboarding a counterparty, hiring a senior executive, closing a private equity transaction, managing a family office principal relationship, or sourcing physical gold, share a default assumption: run the databases, check the boxes, file the results.
The assumption is wrong, and the consequences when it fails are not abstract. They include regulatory fines exceeding AED 380 million imposed on UAE entities in the first eight months of 2025 alone for AML-related failures. They include executives in sensitive roles who have operated for years with fabricated credentials. They include investment transactions in which the individual sitting across the table was precisely who a database said he was, and precisely not who he claimed to be in every material commercial respect. They include commodities chains where the provenance documentation was complete and the provenance itself was false.
The argument this paper makes is structural, not operational. Commercial screening tools are not failing because they are operated badly. They are failing because the GCC information environment was not the environment they were designed for. Closing that gap requires intelligence-led investigation: directed human enquiry, discreet source interviews, and the kind of contextual verification that has no database equivalent.
The Information Architecture of the GCC Is Different
The failure mode of database-only screening is well understood in theory and systematically underestimated in practice. The reason is that most compliance frameworks were designed for jurisdictions with publicly searchable court records, consolidated corporate registries, dense investigative press, and the kind of regulatory enforcement transparency that generates the adverse media coverage on which databases depend.
The UAE is a different information environment. This is not a criticism of the jurisdiction; it is a structural observation that every practitioner operating here should have absorbed by now.
The UAE's beneficial ownership register, established under Cabinet Decision No. 109 of 2023, is confidential. It is held by the company and submitted to the relevant licensing authority. It is accessible to competent authorities upon official request; it is not accessible to a compliance officer running a KYC check, an investment manager conducting pre-deal diligence, or a family office conducting a partner assessment. The UAE has over 36 free zones as of December 2023. Each operates a separate registration system. There is no consolidated public registry linking corporate structures across emirate boundaries. A holding company in RAKEZ and an operating subsidiary in IFZA and a management entity in DMCC may share beneficial ownership with no publicly searchable connection between them.
Court records are not publicly accessible in the same form as common law jurisdictions. Defamation law and commercial confidentiality constrain investigative coverage. Regulatory enforcement announcements name institutions but do not routinely name the individuals whose decisions drove the violations. The UAE's 2024 National Risk Assessment, issued by the Ministry of Economy, identified misuse of legal persons and nominee structures as a primary ML typology affecting the DNFBP sector, and explicitly required DNFBPs to detect complex, opaque ownership structures in their due diligence frameworks. That requirement cannot be met through a screening database query, because nominee relationships do not appear in the documents those tools index.
Federal Decree-Law No. 10 of 2025 on Combating Money Laundering Crimes, the Financing of Terrorism, and the Financing of Arms Proliferation, which entered into force on 14 October 2025, raised the evidentiary standard further. Regulators now assess not whether a process was followed but whether it produced demonstrable outcomes. The CBUAE, ADGM FSRA, and DFSA are examining the substance of compliance programmes, not the existence of a screening subscription.
Where Each Category of Due Diligence Hits the Same Wall
Counterparty and AML Compliance Due Diligence
The onboarding compliance problem is the one most regulated entities have at least recognised. Enhanced customer due diligence under the CBUAE's 2026 guidance package requires institution-specific CDD programmes, risk-sensitive beneficial ownership verification, and documented proliferation financing institutional risk assessments. The ADGM FSRA published Consultation Paper No. 1 of 2026 in April 2026 proposing further enhancements to its AML Rulebook. The DFSA, in its October 2025 regulatory update, confirmed that EDD requirements apply continuously, not only at onboarding.
The enforcement record makes the stakes concrete. The CBUAE imposed fines exceeding AED 339 million on banks, exchange houses, and insurers between March and June 2025 for AML violations. Over AED 380 million in total had been issued across all regulated sectors within the first eight months of that year. The most common violations included inadequate customer due diligence, failure to identify beneficial owners, and the use of generic, static risk assessments.
A database check cannot verify beneficial ownership when the register is confidential. It cannot identify the nominee director's principal when that relationship exists only in a private agreement. It cannot surface the reputational intelligence about a counterparty that exists only within the networks of people who have dealt with that entity in this market. That intelligence must be gathered through direct enquiry: structured conversations with market participants, former associates, sector peers, and other individuals who hold first-hand knowledge of the subject. This is not supplementary activity. Under the current regulatory standard, it is the primary mechanism by which an enhanced due diligence requirement is genuinely satisfied.
Pre-Employment and Executive Screening
The pre-employment problem in the GCC is structurally similar and commercially underestimated. The UAE's labour market is heavily expatriate. For most senior hires, the employing entity has no direct knowledge of the candidate's career history, professional conduct, or reputation in their markets of prior service. The candidate's CV is the primary source of information, and it has no independent verifier other than the documents the candidate chooses to provide.
The credential fraud risk is documented and legally serious. Federal Law No. 9 of 2021 on the Prohibition of the Use of Academic Degrees Issued by Non-Licensed Entities explicitly prohibits using degrees from non-licensed entities for employment purposes within the UAE. Under Article 6 of that law, intentional submission of forged degrees carries imprisonment of up to one year and fines of up to AED 500,000. Employers who knowingly accept forged credentials face their own penalties. Under Article 252 of Federal Law by Decree No. 31 of 2021 on the UAE Crimes and Penalties Law, forgery of an official document carries imprisonment of up to ten years. Employers who fail to verify credentials carry legal exposure, not merely operational inconvenience.
But the credential gap is the narrow version of the problem. A database check will confirm that a candidate's name does not appear on a sanctions list. It will not confirm whether a candidate whose employment history shows a series of senior roles at reputable institutions actually performed as described, or whether their departure from each position was voluntary and clean. It will not reveal that a candidate who presents impeccably on paper spent three years in a prior role managing relationships that later generated regulatory scrutiny. Reference conversations, conducted properly, with former supervisors who held direct oversight of the candidate's work, are the only instrument that establishes that kind of ground truth. Standard reference provision, in which the candidate nominates referees who then provide supportive commentary, is not intelligence gathering. It is performance theatre.
For UHNW household and estate staff, the stakes are different but the analytical gap is the same. Family offices placing staff in positions of access to principals, children, assets, or sensitive information cannot rely on database checks and attestation reviews. The prior service record that matters is not the one that appears in an employment letter; it is the one that exists in the memory of the people who worked alongside or above the candidate in previous roles. That record requires human enquiry to surface.
Investment, M&A, and Private Equity Due Diligence
A 2025 analysis cited by UAE-based advisors found that rushed or inadequate due diligence contributed to 30% of deal failures in the UAE. Middle East M&A total disclosed deal value increased to USD 5.8 billion in H2 2025. The frequency and scale of transactions means the due diligence gap creates systemic risk across the investment community, not only case-by-case failures.
In an M&A or private equity context, database screening addresses the identifiable compliance surface: sanctions, PEP flags, adverse media entries. What it does not address is the set of questions that determine whether a transaction produces the outcome the investor modelled. Who are the individuals who actually control the target, and what is their commercial track record in this market? Are the revenue figures presented in the information memorandum consistent with what the target's suppliers, customers, and banking counterparties have experienced? Does the management team's stated track record hold when tested against the people who were present during the events it describes?
These questions are answered through a combination of targeted OSINT investigation and discreet source enquiry: conversations conducted within the target's industry ecosystem by experienced investigators with established networks in this market. In data-scarce environments, where public records are thin and court filings are not accessible, discreet interviews with informed human sources are not supplementary; they are the primary evidence base. The intelligence product that results from properly conducted HUMINT enquiry provides the contextual layer without which financial and legal due diligence produces a technically clean file on a commercially unclear subject.
Family Office and UHNW Principal Relationships
Family offices managing significant pools of capital in the UAE are particularly exposed to the gap between database compliance and genuine intelligence. The principals they are considering as co-investors, business partners, or relationship counterparties frequently operate through structures specifically designed to minimise public information: holding companies, trust arrangements, multi-jurisdiction corporate layers. A screening database query returns what is publicly recorded. For a UHNW individual who has deliberately structured their affairs for privacy, that may be very little.
The commercial risks are not theoretical. A co-investor relationship that proceeds on the basis of a clean database check and a compelling personal presentation, without independent verification of the individual's track record, source of wealth, and reputation in the markets where they operate, creates direct exposure to regulatory, legal, reputational, and financial consequence. Family offices operating within ADGM and DIFC are subject to the same enhanced due diligence requirements as regulated financial institutions for high-risk relationships. The ADGM FSRA's Notice No. FSRA/FCCP/28/2025, issued in March 2025, required all FIs, DNFBPs, VASPs, and NPOs to apply enhanced due diligence to all relationships with high-risk jurisdiction exposure.
The intelligence that matters for a UHNW principal relationship is specifically the intelligence that databases do not hold: the reputation of the individual within their sector and family network, the history of prior partnerships and how they ended, any pattern of conduct that market participants have observed but that has never generated a press report or regulatory finding. This intelligence exists in conversations. It requires a structured approach to human source enquiry, using networks built over years of operating in this market, to access it reliably and confidentially.
Commodities and Physical Supply Chain Due Diligence
The commodities sector presents the clearest case for intelligence-led investigation, because the regulatory framework explicitly requires verification that goes beyond documentation.
The UAE Ministry of Economy's Due Diligence Regulations for Responsible Sourcing of Gold, aligned with the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (Fifth Edition), require refiners and traders to implement the OECD's five-step framework, including identification and assessment of supply chain risk and third-party review. The DMCC Responsible Gold Guidance requires its members to implement responsible sourcing standards aligned with the OECD framework, and in 2025 the Ministry of Economy revoked the licences of multiple precious metals dealers for AML and supply chain compliance failures.
Document-based compliance in the gold supply chain creates a category of risk that is precisely defined: provenance documentation can be accurate in every formal respect while the underlying provenance is false. A certificate of origin, a chain of custody record, a refinery compliance report: each of these documents reflects what was declared, not necessarily what was extracted, processed, or transported. In conflict-affected and high-risk areas, the gap between documentation and reality is often the product of deliberate, sophisticated fraud by actors who understand the documentation requirements precisely.
Closing this gap requires source-level verification: enquiry conducted at or near the point of extraction, processing, or initial purchase, through local networks that can assess whether declared supply chains reflect operational reality. This is HUMINT in the most literal sense. It is the application of in-country human source intelligence to a specific commercial verification problem. No database query reaches the artisanal mining area in West Africa or the trading corridor in the eastern DRC. A well-sourced investigator with established country networks can.
Practitioner Implications
The common thread across all five categories is the same: databases produce alerts against known, indexed information. Investigation produces intelligence about reality. The two are not interchangeable, and in the GCC information environment, the gap between them is structurally wider than it is in most Western jurisdictions. The practical response is to treat each category of due diligence as requiring a specific intelligence methodology:
• Counterparty and AML due diligence: treat database screening as the first filter, not the completed product. Where beneficial ownership cannot be confirmed from public sources, conduct direct documentary verification and structured reference enquiry with market participants. Document the steps taken and the residual gaps, as well as the positive findings. A compliance file that records only confirmations does not evidence that a genuine investigation occurred.
• Pre-employment and executive screening: do not accept candidate-nominated references as the sole source of character and performance intelligence. Conduct targeted discreet enquiries with former supervisors and professional peers who were not nominated by the candidate, using networks appropriate to the jurisdiction and sector where the candidate's prior service occurred. For senior and sensitive roles, verify credentials through primary source contact with issuing institutions, not document attestation review alone.
• Investment and M&A due diligence: build human source enquiry into the standard due diligence scope before exclusivity or significant capital commitment. The questions that determine commercial risk, including management track record, revenue quality, and prior partnership history, require human intelligence, not document review. In data-scarce GCC environments, discreet interviews with industry ecosystem participants are the primary evidence base for these assessments.
• Family office and principal relationships: for high-value relationships with UHNW individuals operating through opaque structures, conduct independent, discreet reputational enquiry drawing on established networks within the relevant sector and regional market. Supplement database checks with structured source development. Apply the same scrutiny to staff and household appointments where access to the principal or their assets is material.
• Commodities supply chains: for physical gold and precious metals, treat documentation review as necessary but insufficient. Where supply chains originate in or transit through conflict-affected or high-risk areas as defined by the OECD Guidance, supplement desk-based review with source-level verification through in-country networks capable of assessing declared provenance against operational reality.
The Standard Has Moved; the Tool Has Not
The regulatory standard now operative in the UAE, across CBUAE, ADGM FSRA, DFSA, and VARA, demands demonstrable investigative outcomes, not process completion. The enforcement record of 2025 demonstrates that examiners are testing substance, not format. The question an examiner asks is not "did you run a database check?" but "what do you know about this counterparty, candidate, or investment target, and how do you know it?"
A screening tool answers the first question. Intelligence-led investigation answers the second. The organisations in this market that understand the difference are the ones whose due diligence files will withstand examination. The ones that do not understand it are generating the enforcement statistics that make the argument for them.