Terms of use

• Client: the organisation that subscribes to the services.
• User: an individual the client authorises to use the platform.
• Client Data: any data, including personal data, that a client or its users enter, upload or send through the services.
• Outputs: screening results, match scores, risk ratings, reports and other results the services produce.
• Order: a signed order form, accepted proposal or client agreement that sets out the services, fees and term.

RiskLens360 is compliance software that helps regulated businesses carry out customer onboarding and due diligence, risk assessment, sanctions and watch list screening, transaction monitoring, case management, record keeping and regulatory reporting. The features available to a client depend on its Order.

The services are tools that support a client's own anti-money laundering and sanctions compliance programme. They do not replace that programme, the client's compliance officer, or professional advice.

We may improve, change or retire features over time. We will not materially reduce the core functionality a client has paid for during its current term without reasonable notice.

• The client is responsible for who it authorises as users, for setting their permissions, and for removing access when a user leaves or changes role.
• Login details are personal. Users must keep them confidential and must not share accounts.
• The client is responsible for all activity carried out under its users' accounts, and must tell us promptly if it suspects unauthorised access.
• Registration details must be accurate and kept up to date. We may verify a client's identity and licence before giving access.

Where a client uses the services to deliver compliance work for its own customers, the client:

• confirms it has the contractual authority and any consent or instructions needed from each of its customers to process their data through the services;
• remains responsible to its customers for the work it delivers, and for any advice or decisions it gives them;
• is responsible for keeping each of its customers' information separate and confidential within its own use of the services; and
• may not resell or give its customers direct access to the services unless its Order allows it.

Packages and pricing for AML service providers are set out in their Order.

• Where an Order includes API access, we grant the client a right to use the API to connect its own systems, such as an ERP, CRM or core system, to the services during the term.
• API keys are confidential credentials. The client must store them securely, must not embed them in public code, and must tell us immediately if a key may have been exposed so it can be revoked.
• API use must stay within the documentation, the usage limits in the Order and fair use. We may throttle or suspend requests that threaten the stability or security of the services.
• The client is responsible for its own systems and integrations, including how it stores and uses data received through the API.
• We may update the API. Where a change will break an existing integration, we will give reasonable advance notice where practical, except where the change is needed urgently for security or legal reasons.

The services may connect to third party products chosen by a client, such as its ERP, CRM, identity verification, messaging or storage providers. The client is responsible for its choice of those providers, for its agreements with them, and for data it sends to or receives from them. We are not responsible for third party products, their availability, or their handling of data once it leaves the services.

The client remains solely responsible for meeting its legal and regulatory obligations, including:

• its risk assessment, policies and controls, and the decision to accept, keep or exit any customer;
• reviewing potential matches and deciding whether a match is genuine;
• applying freezing measures and other targeted financial sanctions obligations within the legal deadlines;
• deciding whether to file suspicious transaction reports and other reports, and filing them, including through goAML, within the legal deadlines;
• keeping records for the periods the law requires;
• the accuracy, completeness and lawfulness of Client Data, and having a lawful basis and any notices or consents needed to process it;
• keeping its own systems compatible with the services and giving us the cooperation reasonably needed to provide them; and
• not warning any person, or disclosing that a transaction is under review as suspicious, that a report has been or may be made, or that authorities are investigating, which is a criminal offence under Article 29 of Federal Decree Law No. 10 of 2025. The services never notify screened individuals, and clients must not use the services, or any message or export from them, to do so.

Information about UAE laws on our website or in the services is general information only and is not legal advice.

Outputs depend on the sanctions and watch lists and other data sources available at the time of a check, on the settings the client chooses, and on the quality of the information entered. Lists are published by third parties and may change, contain errors or be updated with a delay.

As a result, outputs may include potential matches that do not relate to the person or entity checked, and may not identify every relevant risk. Outputs must be reviewed by trained staff before any decision is made, and must not be treated as a final determination about any person.

Outputs and list data may be used only for the client's own compliance purposes, and not for marketing, credit, employment or tenancy decisions, or any purpose unrelated to compliance.

You must not, and must not allow anyone else to:

• use the services for any unlawful purpose, or to screen people without a legitimate compliance reason;
• access, or try to access, accounts, data or systems that are not yours;
• probe, scan or test the vulnerability of the services, or bypass security or usage limits, without our written permission;
• copy, modify, reverse engineer or create derivative works of the services, except as the law expressly allows;
• scrape, extract or resell the services, outputs or list data, white label them, or use them to build a competing product, unless an Order expressly allows it;
• upload malicious code, or content you do not have the right to upload; or
• use the services in a way that could damage, overload or impair them or other clients' use of them.

• Fees, billing frequency and any usage based charges are set out in the Order, or on our pricing page for packs bought online.
• Packs bought online are sold by our reseller, Paddle.com, which is the merchant of record and handles payment and receipts.
• Unless the Order says otherwise, invoices are payable within 30 days.
• We may suspend the services if an undisputed invoice remains unpaid after we have given written notice and a reasonable period to pay.
• Refunds follow our refund policy, unless the law or the Order requires otherwise.
• Where an Order includes a number of searches, checks or credits for a period, unused amounts expire at the end of that period and do not carry over, unless the Order says otherwise.

As between us and the client, the client owns Client Data. The client grants us the rights needed to host, process and transmit Client Data to provide, secure and support the services.

For personal data in Client Data, the client is the controller and we act as its processor (or sub-processor, where the client acts for its own customers). We will process it only on the client's documented instructions, keep it confidential, apply appropriate security measures, help the client respond to requests from individuals and authorities, and notify the client without undue delay of a personal data breach affecting it. Our privacy policy and any data processing terms in the Order also apply.

We may use aggregated and anonymised information that does not identify any client or person to operate, secure and improve the services.

Each party will keep the other's confidential information confidential, use it only to perform the agreement, and protect it with at least reasonable care. This does not apply to information that is or becomes public without breach, was already lawfully known, is independently developed, or must be disclosed by law or by a competent authority, in which case the disclosing party will give notice where the law allows.

We and our licensors own the services, the website, the software, the API, documentation, designs and the RiskLens360 name and logo. The client receives a limited, non-exclusive, non-transferable right to use the services for its internal business purposes during the term. No other rights are granted.

If you give us suggestions or feedback, we may use them freely without any obligation to you.

We work to keep the services available, secure and performing well, and we provide support through the channels in the Order. The services may be unavailable from time to time for planned maintenance, which we try to schedule outside UAE business hours, or for reasons outside our control. Any specific availability or response commitments are set out in the Order.

We may suspend access, in whole or in part, where reasonably necessary to protect the security or integrity of the services, to comply with the law or a request from a competent authority, or where a client or user materially breaches these terms. Where practical, we will give notice first and restore access once the reason has been resolved.

The agreement runs for the term in the Order and renews as the Order sets out. Either party may terminate if the other materially breaches the agreement and does not fix the breach within 30 days of written notice, or if the other becomes insolvent.

When the agreement ends, access to the services stops. For 30 days afterwards, the client may request an export of its Client Data. After that period we delete Client Data from our active systems, and from backups as they are overwritten, except where the law requires us to keep it. Clients remain responsible for keeping their own copies of records for the periods required by anti-money laundering law.

Sections that by their nature should continue after termination, such as confidentiality, liability and fees owed, continue to apply.

Except as expressly stated in these terms or the Order, and to the extent the law allows, the services and outputs are provided "as is" and "as available". We do not warrant that the services will be uninterrupted or error free, that lists or third party data are complete or current, or that use of the services will ensure a client's compliance with any law or prevent any penalty.

To the extent the law allows:

• neither party is liable for indirect or consequential loss, or for loss of profit, revenue, business or goodwill;
• we are not liable for fines, penalties or sanctions imposed on a client, or for losses arising from a client's compliance decisions, its failure to review outputs, or its failure to meet reporting or freezing deadlines; and
• our total liability arising out of or in connection with the agreement in any 12 month period is limited to the fees the client paid for the services in the 12 months before the event giving rise to the claim.

Nothing in these terms limits liability that cannot be limited or excluded under UAE law, including liability for fraud or gross negligence.

The client will defend and compensate us for claims, losses and costs arising from Client Data it did not have the right to process, its use of the services in breach of these terms or the law, or claims by its own customers relating to work it delivered to them.

Neither party is liable for delay or failure caused by events outside its reasonable control, such as natural disasters, war, acts of government, failures of the internet, public utilities or third party hosting providers, or cyber attacks despite reasonable precautions. Payment obligations are not excused.

We may update these terms from time to time. The date at the top shows when they last changed. For clients with an active Order, material changes take effect at the next renewal unless the client agrees earlier or the change is required by law.

These terms and any dispute arising from them are governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai. The parties will first try in good faith to resolve any dispute through discussion between senior representatives. If it is not resolved within 30 days, the courts of Dubai have exclusive jurisdiction.

• A client may not assign or transfer the agreement without our written consent. We may assign it to an affiliate or a successor to our business.
• If any provision is found invalid or unenforceable, the rest of the terms remain in effect.
• A failure or delay in enforcing a right is not a waiver of it.
• The agreement is the entire agreement between the parties about its subject and replaces earlier discussions.
• Notices to us must be sent to the email address below. Notices to a client are sent to the contact in its Order.
• These terms are written in English. If they are translated, the English version prevails to the extent the law allows.

Questions about these terms: info@risklens360.com, or +971 52 634 3446.