KYC and Beneficial Ownership in the UAE: An Onboarding Checklist
Rajesh Kumar
Good KYC means identifying each customer, verifying that identity from reliable independent sources, understanding why they want the relationship, working out who ultimately owns and controls any company, rating the risk and keeping the file current. For companies, the key step is to follow ownership through every layer until you reach the real people behind it, and to verify them rather than simply accept what the customer tells you.
Key takeaways
- Customer due diligence is a process, not a form: identify, verify, understand purpose, assess risk and keep reviewing.
- For a company, trace ownership and control to the natural persons, however many layers sit in between.
- Verify beneficial owners from independent evidence. A signed declaration on its own is not verification.
- Higher-risk customers need more: source of funds and wealth, senior approval and closer monitoring.
- If you cannot complete due diligence, do not onboard, and consider whether the situation should be reported.
What KYC and customer due diligence cover
Know your customer, usually shortened to KYC, is the everyday name for customer due diligence. In substance it has five parts. You identify the customer. You verify that identity using reliable, independent documents or data. You understand the purpose and intended nature of the relationship. For a legal entity, you establish who ultimately owns and controls it. And you keep the information current and monitor activity against what you know.
Rules differ between sectors and supervisors in their details, including what must be collected, when, and in which circumstances simplified or enhanced measures apply. Treat this article as a practical structure and check the specifics against the guidance that applies to your licence.
Onboarding an individual
The aim is simple: be confident that the person is who they say they are and understand why they are dealing with you. A sound file for an individual usually holds the following.
- A valid identity document, checked for authenticity, expiry and that the photograph matches the person. For remote onboarding, use a method that gives you real assurance, such as liveness checks, rather than a photo sent by message.
- Full name, date of birth, nationality, country of residence and contact details, matching the document.
- Address evidence where your procedure or the risk requires it.
- Occupation or business activity, and the purpose of the relationship in the customer's own words.
- Source of funds, and source of wealth where the risk calls for it.
- Results of screening against sanctions and politically exposed person lists, with the date and outcome recorded.
Write down anything that does not fit, together with how you resolved it. A file that shows a question was asked and answered is stronger than a spotless-looking file that tells nobody anything.
Onboarding a company
Companies add complexity because there is a legal entity and, behind it, people. You need to understand both. A typical company file covers the following.
- Registration documents and trade licence, checked as current and consistent with the name and activities the customer gives you.
- Constitutional documents showing how the company is governed and who may bind it.
- A list of directors and authorised signatories, each identified and verified to the standard you apply to individuals.
- A structure chart showing every shareholder layer up to the natural persons who own or control the company.
- A clear description of what the company does, who its customers and suppliers are, and where it operates.
- Evidence of why it wants to deal with you and what activity to expect.
- Screening of the company, its owners, directors and signatories.
Beneficial ownership: following the chain to real people
A beneficial owner is a natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. The relevant rules set the ownership level at which someone counts as an owner and also recognise control through other means, such as voting rights, the power to appoint directors or influence exercised informally. Check the current threshold and definitions that apply to you.
Where the customer is owned by other companies, you keep going until you reach people. Where no individual can be identified through ownership, the rules generally look next at who exercises control and, as a last resort, at senior management, but you must be able to show that you tried properly first and why the fallback applies. The table sets out common situations and a sensible response.
| Situation | What to do |
|---|---|
| Owned directly by one or more individuals | Identify and verify each owner above the threshold. Check that the shareholder register supports what the customer says. |
| A company owns the customer | Obtain the same ownership information for that company and continue upward until you reach the natural persons. Keep the chart. |
| A trust or foundation is involved | Identify the settlor or founder, trustees or council, protector and beneficiaries or classes of beneficiary, plus any person with effective control. Obtain the trust or foundation documents. |
| Nominee shareholders or directors | Establish who the nominator is. Nominees are not the beneficial owners. Treat the arrangement as a risk factor and ask why it exists. |
| A publicly listed or regulated company | Simplified measures may be available where the rules allow. Record why they apply and keep the evidence. |
| Ownership cannot be established | Do not proceed on assumption. Escalate, consider refusing or ending the relationship and think about whether a report is warranted. |
Verify, do not just ask
Collecting a signed declaration of ownership is a good start and a poor finish. Verification means testing what you were told against independent evidence: the shareholder register, official registry extracts where available, certified identity documents for the owners and, for higher-risk customers, additional corroboration. If the paperwork a customer gives you contradicts itself, or the customer is reluctant to explain, treat that as information in its own right.
Risk rating and when to go further
Give each customer a risk rating at onboarding and write down the reasons. Your rating method should follow from your business risk assessment. Some features commonly justify enhanced due diligence.
- The customer or an owner is a politically exposed person, or closely connected to one.
- Links to higher-risk jurisdictions, or to sanctions exposure.
- Complex or opaque structures with no clear commercial reason.
- Cash-intensive businesses or sectors with a history of misuse.
- Wealth or activity that does not fit what you know about the customer.
- Adverse media or other negative information.
- Non-face-to-face onboarding without strong verification, or heavy reliance on introducers.
Enhanced due diligence typically adds several layers: a deeper look at the source of funds and the source of wealth, approval from a more senior person before you proceed, more frequent reviews and closer monitoring. Source of funds is where the money for this relationship comes from. Source of wealth is how the customer built their overall wealth. A property developer who is investing, for example, should be able to explain both the origin of this particular payment and the way their business generated its capital.
Keeping files current
A file that was perfect on the day of onboarding goes stale. Set review periods by risk, with higher-risk customers reviewed more often, and make sure the reviews actually happen. Add event-driven reviews as well. A change of ownership, a new jurisdiction, a significant change in activity, a screening hit or adverse media should each prompt a fresh look, whatever the calendar says.
At each review, refresh expired documents, confirm the ownership structure has not changed, check the activity against the original purpose and re-screen. Record the outcome, even when nothing has changed. A signed and dated review that says nothing has changed is evidence you looked.
When you cannot complete due diligence
If a customer cannot or will not provide what you need, do not open the relationship or carry out the transaction, and consider ending an existing one. Do not let commercial pressure, a promise that the documents will follow, or a long-standing relationship talk you out of this. Think also about whether the circumstances create a suspicion that should be escalated to your compliance officer, and handle that without alerting the customer.
Mistakes that reviews keep finding
- Stopping at the first corporate shareholder instead of following ownership to the people.
- Accepting a declaration with no supporting evidence.
- Expired identity documents that were never refreshed.
- A risk rating with no reasons, or one that never changes.
- Skipping enhanced measures for politically exposed persons or complex structures.
- Relying on an introducer without checking what the introducer actually did.
- Periodic reviews that are scheduled but not carried out.
- No record of how a discrepancy was resolved.
A simple onboarding sequence
- Collect the application and ask the customer to explain the purpose and expected activity.
- Identify and verify the customer and, for companies, every director and signatory.
- Build the ownership chart to the natural persons and verify them.
- Screen the customer, owners and connected parties, and record the results.
- Rate the risk and write down the reasons.
- For higher risk, obtain source of funds and wealth evidence and senior approval.
- Approve, decline or escalate, and record who decided and why.
- Set the review date and any special monitoring conditions.
Where Adventant fits
Adventant supports customer due diligence through our operational outsourcing service, covering onboarding checks, screening, customer risk assessment and ongoing monitoring, including remediating older customer files. We also write onboarding policies and procedures that go to the real owners. Use the form below to tell us what you need. This article is general information, not legal advice.
Frequently asked questions
What is a beneficial owner?
A natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. The rules set the ownership level that counts and also recognise control by other means. Check the current definition that applies to your sector.
Is a signed declaration enough to verify beneficial ownership?
No. A declaration is a starting point. Verify it against independent evidence such as the shareholder register, official registry extracts where available and identity documents for the owners.
What if I cannot identify any beneficial owner?
Do not proceed on assumption. The rules generally look next to who exercises control and, as a last resort, to senior management, but you must show that you tried properly first. Escalate and consider refusing or ending the relationship.
What is the difference between source of funds and source of wealth?
Source of funds is where the money for this particular relationship or transaction comes from. Source of wealth is how the customer built their overall wealth. Enhanced due diligence often asks for both.
How often should I review customer files?
Set the frequency by risk, with higher-risk customers reviewed more often, and add reviews triggered by events such as a change of ownership, a screening hit or a shift in activity. Make sure the reviews actually happen and are recorded.