How we approach anti-money-laundering rules.

Why a small top-up agent has an AML notice at all

Anti-money-laundering and know-your-customer rules apply to all payment-handling services in the United Arab Emirates, including small ones. Even though every individual transaction on this site is capped at five hundred AED — well below typical reporting thresholds — we are required to publish how we handle the few obligations that do apply to a service of this size.

What information we collect

For a successful top-up the system records: the transit card number, the amount in AED, the time of the request, the optional email address you provide for the receipt, and a masked record of the card-of-card returned by the payment processor (typically the first six and last four digits, the brand and the country of issue). We do not record the full Visa or Mastercard PAN, the CVV, the expiry date or the cardholder name; those live with the processor.

Retention

Order metadata is kept for the period required by UAE accounting and tax law for service-fee invoices, which today is five years. After that period we delete the records, except where a specific request from a competent authority obliges us to keep them longer for an ongoing investigation.

Source of funds

Because every transaction must complete a Visa or Mastercard approval, the source of funds is by definition a card issued by a regulated bank. We do not accept cash, cryptocurrency, peer-to-peer transfers, prepaid wallet codes, or any instrument that bypasses the issuer chain.

Politically exposed persons and sanctioned entities

The processor we use runs the standard sanctions and PEP screening at the point of approval. We do not maintain a separate watchlist and we do not perform our own enhanced due diligence — that is the issuer’s and processor’s role on a per-transaction basis.

Suspicious-activity reporting

If a usage pattern looks unusual — for example, repeated declined approvals from different cards against the same transit-card number, or attempts to submit values that exceed the per-transaction limit — we pause the affected transit-card number for a short cool-down and forward the relevant metadata to the processor. Where a formal report is warranted, we file it with the competent UAE authority through the channels available to a service of our size.

Your rights

You can request a copy of the metadata we hold for a specific order by writing to care@dubaicardrefill.org with the order ID and proof that you are the owner of the email address that received the receipt. We answer within the time the privacy page sets out.