How KYC Drives Egypt’s Financial Future

Egyptian regulators do not ask for an ID scan. They ask for a customer file that explains who the person is, why they want the service, and what normal activity looks like. VOVE ID builds identity verification flows for regulated teams, so this guide stays on what the Egyptian rules require of that file.

This guide covers KYC requirements in Egypt. For a full breakdown of the KYC framework, see our KYC Requirements Explained 2026.

Direct answer: Before providing a covered service in Egypt, an institution must identify the customer and any representative, verify identity with valid official documents and reliable independent data, and record the purpose of the relationship and expected activity. If due diligence cannot be completed, it must not open the account, start the relationship, or execute the transaction, and it should consider an immediate report to the EMLCU. PEPs require senior-management approval and source-of-wealth checks, sanctions lists are screened daily and after every update, and records are kept for at least five years.

The rules that govern the file

The core instrument is AML Law No. 80 of 2002 and its Executive Regulations, enforced with the Egyptian Money Laundering and Terrorist Financing Combating Unit (EMLCU). Customer due diligence sits mainly in articles 22 bis A and 22 bis C of the Executive Regulations, with article 33 on anonymous accounts and article 32 bis on PEPs (CBE overview). The binding text is the Arabic consolidated version (Law; Executive Regulations). The exact data set you collect also depends on the EMLCU's current customer due diligence procedure and your sector rules, for example those of the CBE or, for non-bank financial activity, FRA Decision No. 161 of 2024. Which rules apply depends on the regulated activity, not on the fintech label.

For supervisors, reporting channels, and the full sanctions regime, see our AML compliance guide for Egypt.

What to collect from an individual

Anonymous accounts and accounts in false or fictitious names are prohibited (Law article 8; Executive Regulations article 33). For each natural person, collect the full legal name, official identification details, date and place of birth, nationality, address, occupation or business, and contact details, plus anything the applicable EMLCU or sector procedure adds. Then record the nature and purpose of the relationship, the products the customer expects to use, expected volumes, counterparties and geographies, and the source of funds needed to understand what normal looks like. The expected-activity profile is what makes later monitoring meaningful, so it belongs in the file from day one.

Verify before the relationship starts

Verification happens before the relationship or occasional transaction, using valid official documents and reliable independent data or information. The file should record the authenticity checks, the expiry date, and, where the customer is not physically present, the liveness or non-face-to-face controls that were applied (article 22 bis A). Anyone acting for the customer, such as an agent, is identified and verified in turn, with proof of their authority kept in the file.

If due diligence cannot be completed, do not open the account, start or continue the relationship, or execute the transaction. Document whether the reasons require an immediate suspicious-transaction report to the EMLCU (article 22 bis C(1)).

PEPs

A PEP is someone who holds, or has held, a prominent domestic, foreign, or international-organization function. The assessment extends to family members, close associates, persons acting on their behalf, and legal persons or arrangements they control. For covered PEP relationships, obtain senior-management approval before establishing or continuing the relationship, take reasonable measures to establish source of wealth and source of funds, and apply enhanced continuous monitoring (article 32 bis). Keep the approval, the source analysis, and the monitoring plan together.

Sanctions screening at onboarding

Monitor the UN Security Council terrorism, terrorist-financing, and proliferation-financing lists daily, and apply Egypt's domestic terrorist lists separately under Law No. 8 of 2015. Screen customers, beneficial owners, representatives, and transaction parties before onboarding, before transactions, and immediately after every list update. A confirmed UN designation means freezing the full asset perimeter without delay or prior notice, and notifying the EMLCU and the competent supervisor immediately of every freeze, attempted transaction, and other implementation action (FIU Decision No. 1 of 2024).

Keep the customer file alive

Monitor activity against what the file says: identity, business, risk, expected activity, and source of funds. Refresh the file on a schedule and whenever ownership, management, product use, geography, behavior, or sanctions status changes (article 22 bis C). The file should let monitoring and case teams retrieve the onboarding purpose, expected activity, risk rating, screening history, and prior reviews in one place, so KYC is not treated as a one-time form.

If you automate KYC, screening, or monitoring, document the data coverage, rule or model logic, alert handling, access, change control, testing, and human oversight. Relying on a third party does not move accountability away from your institution.

Reporting, tipping off, and records

The AML/CFT manager must notify the EMLCU immediately once suspicion exists, regardless of transaction value and including attempted transactions. Internal review must not be used to delay the report (article 36(3)). Use the current EMLCU form and secure channel assigned to your institution. The CBE's circular of 16 April 2026 specifically requires foreign-exchange companies to implement goAML, so confirm your own supervisor's instruction instead of assuming the same applies to you.

Never disclose to the customer or any unauthorized person that a report, examination, or investigation exists (Law article 11). Keep transaction, customer, representative, and beneficial-owner records for at least five years from account closure or completion of an occasional transaction, and longer if the EMLCU or an investigating authority asks (Law article 9; Executive Regulations article 34).

Personal data and the PDPL deadline

Customer files hold identity documents and, with remote onboarding, biometric data. The Personal Data Protection Law No. 151 of 2020 has a transition that ends on 1 November 2026 (PDPC). Map each processing purpose to a lawful basis, using legal-obligation processing for AML compliance rather than relying on blanket consent. Check which PDPC licenses or permits your processing needs, and register a qualified data protection officer if you are a legal-person controller or processor. Before any cross-border transfer, determine whether a statutory exception applies. A personal-data breach must be reported to the PDPC within 72 hours of becoming aware of it. Where AML law overrides an erasure or ordinary retention request, preserve the AML records (PDPC consent guidelines).

How VOVE ID fits

VOVE ID supports the verification steps above with document capture and OCR, including Arabic documents, biometric liveness, face matching, and AML and sanctions screening, with each result logged for audit. Before you rely on it for Egypt, confirm with the VOVE ID team that the Egyptian documents you accept are covered in your configuration, and define which results can clear automatically and which go to manual review.

For the full source-linked version, with 7 control areas and 45 implementation checks, see VOVE ID's Egypt KYC, KYB, and AML compliance checklist.

FAQ

Is a liveness check mandatory in Egypt?

The Executive Regulations require verification with valid official documents and reliable independent data, and the file should record the controls used where the customer is not physically present. Check the EMLCU procedure and your sector rule for any specific method requirement.

Is Egypt on the FATF grey list?

No. Egypt was not named in FATF's jurisdictions under increased monitoring or call-for-action statements as of 19 June 2026 (FATF). That does not remove the expectation of a documented, risk-based approach.

How long must KYC records be kept in Egypt?

At least five years from account closure or completion of an occasional transaction, and longer if the EMLCU or an investigating authority requires it.

Sources

• AML Law No. 80 of 2002, current Arabic text (FRA)
• Executive Regulations of the AML Law, current Arabic text (FRA)
• FIU Decision No. 1 of 2024 on targeted financial sanctions
• Central Bank of Egypt, the Egyptian AML/CFT system
• Central Bank of Egypt, circulars
• Personal Data Protection Center, Data Subject Consent Guidelines
• FATF, Jurisdictions under Increased Monitoring, June 2026

Conclusion

An Egyptian KYC file is judged on its reasoning. A record that shows how identity was verified, why the customer was rated as they were, and what was done when a check failed will stand up with the EMLCU and the sector supervisor. A record that holds only a scanned document will not.

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.