Collecting KYC documents on WhatsApp in the UAE
Customers will photograph an Emirates ID and send it in ten seconds. They will not log into a portal to upload it. That gap is why KYC over WhatsApp works — and why getting the storage architecture right matters more than the messaging.
Short answer. Ask with a utility template, collect inside the free 24-hour window, and download every inbound file to your own storage immediately. Media IDs from webhooks expire after 7 days. If your only copy is in the chat, you will lose it.
The retention windows, because they decide your architecture
| Thing | Lifetime |
|---|---|
| Media ID received in a webhook | 7 days |
| Media ID returned by the API on upload | 30 days |
| The media file itself on Meta's servers | ~30 days, encrypted |
| The temporary download URL | Minutes — treat as single-use |
Downloading inbound media is two steps, and this is where most first builds break:
- Call the Media API with the media ID to get a download URL.
- Fetch that URL with your bearer token in the header.
The URL looks like an ordinary CDN link, but it still requires the auth header. A browser cannot load it in an
<img> tag, and you cannot email it to your compliance team. Fetch it server-side, store it, serve it from
your own system.
Practical consequence. Do the download inside your webhook handler, or in a job it enqueues within seconds. Anything that defers this to a nightly batch will eventually run past a window and lose a customer's document after they have already sent it — which is the worst possible time to ask again.
The collection flow
- Utility template listing exactly what is needed, one item per line. A document request tied to an application the customer already started is utility — about AED 0.058, no marketing opt-in.
- They reply, which opens the free 24-hour service window. Everything after this is free-form and free.
- Acknowledge each file individually as it lands: "Emirates ID front received." Silence after someone sends an identity document reads as failure and generates a phone call.
- Reject fast and specifically. "The expiry date is cut off — can you re-shoot with all four corners visible?" beats "unclear image". Because you are inside the window, this costs nothing.
- Confirm completion with what happens next and when.
The 24-hour window is why WhatsApp beats email for this job. On email, every round trip is another day. Here, a three-round-trip correction happens in four minutes and costs one template.
Handle it like the sensitive data it is
An Emirates ID photograph is identity data. A few things follow, and they are not optional:
- Store it in your own controlled system with access control and a retention policy. Chat history on a staff phone is not that.
- Do not let staff use their personal WhatsApp for this. On the free Business app, documents land on a device someone takes home. On the API, they land in your system.
- Restrict who can view the collected documents inside your team inbox. Most people who need to run the conversation do not need to open the passport scan.
- Have a deletion path. If you cannot answer "where are all copies of this customer's Emirates ID and how do I delete them", you do not have a KYC process, you have a folder.
- UAE-regulated activities carry statutory obligations. Real estate brokers, dealers in precious metals and stones, corporate service providers, auditors and financial institutions are subject to UAE AML/CFT requirements. Check what applies to you — this page is about the messaging mechanics, not legal advice.
Who runs this in the UAE
Real estate agencies collecting Emirates ID and passport for a tenancy, banks and exchange houses, corporate service providers doing company formation, insurance brokers, car dealerships arranging finance, schools at admission, and telecoms at activation. Different regulators, same mechanics: a request template, a free window, and immediate download to your own storage.
What this does not fix
WhatsApp gets you the document faster. It does not verify it. Whatever check you run — expiry date, name match, face match, sanction screening — still runs after the file lands. What changes is that it lands in minutes instead of after three chase emails.
Adjoltz builds these flows for UAE brands on Meta's official Cloud API — correct template categories, the buttons, and the inbox behind them. Messages at Meta's rate with zero markup, from $149/month.
Frequently asked questions
Can I collect Emirates ID and passport copies over WhatsApp?
Yes, and customers respond to it far faster than to a portal upload. Ask with a utility template, collect inside the free 24-hour service window that their reply opens, and download every file to your own controlled storage immediately. Treat the images as identity data with access control, a retention policy and a deletion path.
How long does WhatsApp keep media files?
Media IDs received in webhooks expire after 7 days, media IDs returned by the API expire after 30 days, and the files themselves persist for around 30 days encrypted. The temporary download URL is much shorter lived and should be treated as single use, so download inbound documents in your webhook handler rather than in a nightly batch.
Why can I not open a WhatsApp media URL in my browser?
Because the download URL still requires your bearer token in the request header even though it looks like an ordinary CDN link. A browser image tag cannot send that header. Resolve the media ID to a URL and fetch it server-side, then serve the file from your own system.
Is a document request a marketing or utility message?
Utility, when it relates to an application or account the customer already started. That means no marketing opt-in, around AED 0.058 rather than roughly AED 0.183, and no exposure to the marketing frequency cap.
Related: do I need the WhatsApp API, or is the free app enough?