How should a bank app handle ID expiry and KYC refresh on a legacy core?

The UAE central bank’s consumer standard names one consequence for a customer who ignores written requests to update an expired ID. After a notice period of 90 calendar days, or another period the central bank prescribes, the bank temporarily blocks debit and credit cards, while other account operations stay available through a branch. The notices banks publish go further. They list digital banking, cheque books and, in some cases, closing the account. The customer meets the distance between those two texts as a frozen app and a branch queue. Part of that distance is a design problem.

Humbleteam, a digital product design agency, publishes this guide. Rules and bank practices are described as of October 29, 2026. The guide is general information, not legal advice, and your compliance team decides which rules apply to your product. It covers the UAE first, with notes on the EU and the UK, and it marks what we found and what we could not find.

What do the rules require, and what do they leave open?

FATF Recommendation 10 asks banks to do ongoing due diligence on every relationship. Its interpretive note adds that documents, data and information collected under due diligence must be kept up to date and relevant through reviews of existing records, particularly for higher-risk customers.

The CBUAE guidance on customer due diligence and record-keeping, in force from November 7, 2025, describes two kinds of review. Periodic reviews follow the customer’s risk rating. Event-driven reviews follow a trigger, and the listed triggers include changes in employment (considered by customer risk) and a bank employee learning that customer information is outdated. The text says identity documents should be valid, unaltered and unexpired. At the hard end, a bank should not keep a relationship with a customer who is unable or unwilling to provide required information. That clause is written for refusal, not for a customer whose card lapsed last week.

Two more texts shape the screen. CBUAE’s digital identification guidance says banks verifying an Emirates ID should use the ICP validation gateway, UAE Pass or another government-supported solution, and keep a copy of the card and its digital verification record. The consumer standard’s clause 5.1.2.3 says that when a bank blocks account privileges, it must send a written notice within 24 hours with the details, the action the customer must take and a contact.

The EU is moving toward risk-based handling. AMLA’s draft guidelines, still a draft after a consultation that closed on September 3, 2026, say an expired ID need not be re-collected by default. When a bank does re-collect, it may do so at once, at the next scheduled review, or when the customer next asks for a service. We did not verify the JMLSG text for the UK. The FCA’s Consumer Duty does reach the wording: communications must be likely to be understood and sent in good time for decisions.

The sources leave real gaps. We found no CBUAE or ICP text that sets a time limit for a bank’s review of a submitted update, a grace period after expiry, or how to treat a customer who holds a renewal receipt but no new card. Those are questions for your compliance team, and the screen should not guess.

What do UAE banks say publicly when an Emirates ID expires?

Each of the following is one bank’s practice, not a market rule. RAKBANK’s KYC portal says the notification shows how many days are left. After the deadline it “may restrict” debit and credit cards, cheque book requests and digital banking access, and in some cases the account could be closed. It reinstates services “within 2 working days” of a submission in order. Emirates NBD and Emirates Islamic say in portal FAQs that outdated records may lead to restricted access and possible termination of services. A DIB page from a 2019 campaign lists the restricted products, says branches still worked, and promises restoration within 3 to 4 hours of an e-form submission. Its final reminder went out 5 days before restrictions began.

Public facts about the ID affect the wording. Residents can renew from six months before expiry, and renewal can need a visit to an ICP centre for fingerprints and a signature. The ICP grace period is 30 days, but it covers ICP’s late fee, not a bank’s restrictions. An ID can also end when a residency permit is cancelled, so the copy should not assume the customer forgot.

How should reminders run before the ID expires?

This sequence is our suggestion, and compliance owns the dates.

• Open with an in-app notice when the renewal window opens. Ask the customer to renew with ICP first, since the new card does not exist yet.
• Add SMS and email as expiry nears, with the exact date any restriction would start.
• Send a final notice naming what would stop, what would keep working, and how to update. After expiry, send the written notice the standard expects, with the notice period stated.

Treat reminder links as an attack surface. RAKBANK’s page names its sender address and says it will never ask for a password or PIN. An in-app message needs no link, so let SMS point back to the app.

What should the in-app update journey contain?

Offer three routes. The first is an NFC read of the card chip. Habib Bank AG Zurich’s UAE app shows the pattern: hold the card against the phone, review the captured details, submit or discard, then get an SMS confirmation. The page warns that a card held a few centimeters away may fail to read, so the screen needs a positioning hint. We did not verify which current phones can read the card chip, so test on the devices your customers use.

The second route is UAE Pass. Its button guide includes a flow for an existing customer updating KYC documents at the provider’s request. Its account levels matter, because a basic account has no verified Emirates ID. We could not verify which banks read renewed card data through UAE Pass, so test it with your provider. The third route is scan or upload, and it stays as the fallback.

Whatever the route, three details save the most effort:

• Read the expiry date before the upload completes. Uploading the old card is the likeliest mistake, and the CBUAE guidance wants unexpired documents.
• Pre-fill what the bank already holds and ask “still correct?” for address and employer. WCAG 2.2 success criterion 3.3.7 asks that information already entered in a process be auto-populated or selectable. Ask for new proof of address only when the address changed.
• Show what the bank holds before the customer starts. Emirates NBD’s help page offers “View your Emirates ID on record with us,” and its portal marks outdated records in red.

Say upfront what the app cannot change. RAKBANK says contact details need a branch visit.

How should restrictions work instead of a full freeze?

The central bank’s own text is graduated: a card block, a notice period, no charge, and branch operations still permitted. The map below splits the journey into states. The screen text and the “what still works” column are our suggestions, and each row needs compliance approval.

The bank notices above restrict digital banking too, which may be the bank’s own choice or its reading of a rule. Ask compliance which restrictions are required. One design consequence follows: if the app is restricted, the update route must still work. RAKBANK’s portal starts from a code sent to the customer’s email, and DIB’s 2019 e-form arrived as an SMS link. Neither depends on the restricted channel.

What happens after the customer submits?

Three states follow: in review, needs another document, and done. Public timing comes from single banks. RAKBANK says 2 working days for reinstatement. DIB said 3 to 4 hours in 2019. Emirates Islamic and Habib Bank confirm success by SMS or email. No rule we found sets a review time, so the screen should state only what your own queue data supports.

Use “received” on submit, “being checked” in review and “updated” only when the new ID is on file. Keep “services restored” for the moment the restriction is gone. Our guide to pending states and cut-off times on a legacy core shows how to display a wait with an end time. When a document is rejected, show the reason and keep every earlier entry. A customer who must start over may give up and walk into a branch.

What does a legacy core limit, and what can the screen promise?

In some cores, a restriction is a status set by a batch job. Oracle’s documentation for one of its banking products describes an account status batch that updates statuses where an automatic-change flag is on. That is one vendor’s example. The pattern to check in yours is a status that changes on a schedule, not on the customer’s tap, with an override that may exist only in a branch.

Map three things for your core: which system sets the restriction, when it can be cleared (online, batch, branch), and who can clear it. The channel layer can keep its own “update under review” marker, so the app shows the true state while the core flag is still on. The screen can promise receipt, review and a notification, but not a restoration time the batch schedule cannot support. A daily list of customers whose update was approved but whose restriction remains gives branch staff a queue they can clear in order.

How do accessibility and Arabic and English change the design?

The consumer standard’s disclosure rules require information in Arabic and English, in a format suitable for People of Determination, in plain language (2.1.1.2, 2.1.1.4, 2.1.1.5). Whether a KYC notice counts as disclosure information is for compliance to confirm.

Our suggestions for testing in both languages: ID numbers and dates inside Arabic sentences; a screen reader announcing “Submitted” without moving focus (WCAG 4.1.3); a code timer the customer can extend (Emirates Islamic’s OTP lasts 3 minutes, and WCAG 2.2.1 asks for a way to extend limits); and a phone route for people who cannot use NFC or a camera. A branch-only step is a barrier for some customers, so name the alternative.

Illustrative worked example: Bank A (invented)

Bank A, its rules and its numbers are invented. Its core sets restrictions in a nightly batch, and branch staff can override. Its app reaches the core through a channel layer. Its compliance team starts the card block 90 days after the first written notice.

• Sam’s Emirates ID is six months from expiry. A banner says to renew with ICP. Sam renews late, and after expiry the banner shows the date the card block would start.
• Sam opens the update, holds the card to the phone, and the app reads it. Address shows as “still correct?” and Sam taps yes. Employer has changed, so Sam edits one field.
• The screen says “We received your update at 11:40. We’ll tell you here and by SMS.” Bank A’s review is manual, so it makes no time promise.
• Variant: Sam uploaded the old card by mistake. The app catches the expiry date before submission and says so.
• Variant: Sam never updates. On day 90 the cards are blocked and a written notice follows within 24 hours. The update journey still opens.
• When the review passes, the channel layer shows “Updated.” The nightly batch lifts the flag, and only then does the app say the cards work again.

Where do these defaults stop working?

The sources are central bank texts, one FATF document, a draft EU guideline and public pages from a few banks. Those pages describe single institutions, and the DIB page dates from 2019. We found no UAE Pass bank flow to confirm and read one vendor’s batch documentation. The UK rules were not checked beyond the Consumer Duty. Several clauses say “should,” and your compliance team decides how binding each is for your bank.

What can you produce now?

Before anyone draws a screen, fill the state map for your own bank, map where each restriction is set and cleared, and write one reminder sequence compliance has approved. Then measure how many customers reach each state and how many finish in the app rather than a branch. If you are choosing a design team, ask each candidate to design one row of the map. Our comparison of design agencies used to bank compliance and legacy systems is a place to start.