UBO Verification in the UAE: A Guide for Licensed Financial Institutions

Current Landscape for KYB and UBO Verification in UAE

UBO verification requirements across the UAE have changed substantially. The anti-money laundering framework was replaced in late 2025.

• The new framework. Business verification obligations sit in Federal Decree-Law No. 10 of 2025, in force from 14 October 2025, and Cabinet Resolution No. 134 of 2025, in force from 14 December 2025.
• The three-tier sequence. Beneficial ownership sits at Article 10 of the Resolution, which requires institutions to identify the natural person who ultimately owns 25% or more or otherwise holds a controlling ownership interest, then consider control through other means, and use senior management only as the final fallback where no individual can be identified through the first two routes.
• Screening gaps found by the CBUAE. The May 2026 thematic review of Stored Value Facilities, Retail Payment Service Providers and Payment Token Service Providers identified gaps in the sanctions screening of corporate customers’ ultimate beneficial owners, directors and authorised agents, alongside weaknesses in the periodic testing and validation of screening systems.
• Onboarding alone is not enough. Every identified beneficial owner sits inside AML controls covering sanctions, PEP and adverse media screening. Those controls are maintained and tested throughout the relationship.

This guide sets out what the framework calls for, where verification becomes difficult, and what a buyer should test before choosing a provider.

Where UAE UBO Verification Becomes Difficult

UBO verification is one of the hardest parts of customer due diligence.

• Cross-border chains. Ownership structures span multiple jurisdictions. Beneficial owners and directors are often non-residents, and foreign registries do not always release reliable ownership information.
• A continuous obligation. Compliance officers identify, verify and screen every relevant individual. The file holds evidence that reasonable measures were taken to identify the true beneficial owner.
• Where the process breaks. Ownership passes through foreign companies, trusts or multiple corporate layers. Registry information is incomplete. Nominees obscure the person giving instructions. Control rests on voting rights, appointment powers or contractual influence rather than shareholding alone.

A declared beneficial owner may not always be a verified one.

UAE-regulated institutions must establish which natural person ultimately owns or controls a business, support that conclusion with reliable evidence, resolve conflicting information and keep the record current.

A workflow that only collects a UBO declaration speeds up onboarding. It does not resolve the verification challenge.

What the New Rules Ask of Licensed Financial Institutions

Four regulatory layers govern KYB and UBO verification in the UAE. They set the legal obligations, implementing regulations, supervisory expectations and practical guidance for Licensed Financial Institutions.

How to Verify UBO across UAE

Licensed Financial Institutions apply a sequential, risk-based approach. Ownership comes first at 25% or more, then control through voting rights or contractual arrangements, and the senior managing official only after both have been assessed.

The Process of UBO Verification and Risk Assessment Across UAE

Step One: Ownership and Control

Article 9(4) covers the nature of the customer’s business and its ownership and control structure. Article 10 then identifies the beneficial owner within it. Two routes evidence it. Institutions may use either or both on a risk-sensitive basis.

From documents

A certificate of incorporation bearing an official government seal, a corporate registry extract, or a government-issued corporate ID. A non-resident company with a complex structure carries notarised first-layer ownership documents. Remaining layers carry complete incorporation documents including beneficial owner information.

From data

The guidance permits independent verification of the customer’s registration, beneficial ownership and current active status via public or private databases, corporate registries or a credit bureau.

Step Two: Identity of the Persons Named

• Reasonable Measures. Each identified owner is verified with documents, data or information from a reliable and independent source.
• The same natural-person identification requirements. These apply to identified beneficial owners and persons acting on behalf of the customer. Directors may also fall within these verification requirements where they are beneficial owners, authorised representatives or otherwise subject to applicable identification obligations.
• From documents. Government-issued photo identification confirms identity, nationality and national identity number. A birth certificate, passport or national identity card confirms date and place of birth.

Document Types for a Cross-Border Ownership Chain

CBUAE guidance gives several examples of documentary evidence that an LFI may use to confirm a natural person’s residential address, including a recent utility bill, UAE government correspondence, tenancy contract, tax statement, property deed or mortgage statement.

A workflow that supports only a narrow set of address documents may create unnecessary friction where beneficial owners or directors are based outside the UAE and present other reliable forms of evidence.

Counterfeit documents are widely used, so an institution may need more than a single document. The guidance names non-resident onboarding as its example. Institutions should know which documents are legally valid in that jurisdiction. For an unfamiliar foreign type, they may ask for a notarised, apostilled or embassy-certified copy.

Video Verification as an Equivalent to Face-to-Face Onboarding

Where personal contact between an LFI representative and the customer takes place through video teleconference, the relationship is not treated as non-face-to-face for the purposes of the CBUAE guidance.

• Two conditions support this treatment. The interaction must involve personal contact with a representative of the institution and take place through live video teleconference. Where those conditions are met, the relationship is not classified as non-face-to-face solely because the interaction occurred remotely. Other customer, geographic, ownership or transaction risk factors may still require enhanced measures.
• Where a relationship stays non-face-to-face. Additional checks apply, including independently verifiable telephone contact, address confirmation, certified documents from lawyers or notaries, biometric methods using reliable and independent digital identification systems, and multi-mode authentication. These apply at establishment and during ongoing monitoring, at least as stringently as for face-to-face contact.

When Enhanced Measures Apply

• When it applies. Enhanced measures apply where the risk assessment identifies higher crime risk, where high-risk-country requirements apply, or where the applicable PEP requirements are triggered. Article 1 also places two groups inside the defined term High-Risk Customers: customers with complex ownership structures, and non-residents without a UAE-issued identity card.
• Two measures bear on verification workflow. Article 5(2)(c) calls for additional information on the beneficial owner, including public databases and open sources. It also calls for more regular updates to due diligence information on the customer and the beneficial owner. Websites and proprietary databases may also be used for reputation.
• Non-documentary sources. The guidance names three high-risk scenarios: unfamiliarity with a document presented, an account opened remotely or online without the customer or its authorised representatives physically present, or red flags identified during onboarding.

Characteristics that may push a file towards enhanced measures:

Watchlist Screening for the Verified UBO

The screening obligation is separate from identification and verification. It reaches more people than most onboarding processes cover.

• Before onboarding. Institutions screen against money laundering, terrorist financing and proliferation financing (ML/TF/PF) sources. These include negative media databases, PEP databases and internal watchlists.
• Throughout the relationship. The same parties are screened against applicable sanctions lists before onboarding and for the life of the relationship. Results are documented. Sanctions screening covers the UN Security Council Consolidated List and the UAE Cabinet Local Terrorist List at a minimum.
• The legal basis. Section 3.8 of the CBUAE Guidance on Customer Due Diligence, Know Your Customer and Record-Keeping, supported by Article 19 of Federal Decree-Law No. 10 of 2025, Articles 21, 22 and 23 of Cabinet Resolution No. 134 of 2025, Articles 44 to 48 of Cabinet Decision No. 74 of 2020, CB Notice No. 4368/2021 and Section 21.2 of CB Notice No. 3090/2021, as amended by CB Notice No. 3599/2023.

Who Must Be Screened

PEP and Sanctions Screening for Ultimate Beneficial Owners

Article 16 requires institutions to determine whether the customer or any identified beneficial owner is a Politically Exposed Person. The enhanced measures that follow depend on the category of PEP and the risk presented by the relationship.

• Senior management approval. Required for foreign PEP relationships and, where the relationship presents higher risk, for domestic PEPs and persons entrusted with prominent functions by international organisations, in accordance with the applicable requirements.
• Source of funds and source of wealth. Take reasonable measures to establish the source of wealth and source of funds of the customer and beneficial owner where the applicable PEP requirements are triggered.
• Enhanced ongoing monitoring. Apply enhanced monitoring throughout the relationship where the relevant PEP requirements apply.

Ongoing Review When Corporate Ownership Changes

Article 1 defines Up-to-Date Information as information as current as possible, updated within a reasonable timeframe after any change. It attaches to beneficial ownership records. A change in the ownership structure is not merely an administrative update. It is also a review event requiring reassessment of the customer’s beneficial ownership information and related due diligence.

• Review triggers. A change in ownership of a business entity, a change of legal name through merger or acquisition, a change of domicile, and a true match against a sanctions, PEP or negative news list. A review that finds no business justification for a complex ownership structure escalates.
• What the refresh covers. Identification information for the customer, the beneficial owners and any person acting on their behalf, a review of any enhanced due diligence, and re-screening of the full step three population together with other related parties.