UBO requirements in the UAE: identifying and screening beneficial owners

Article 10 of Cabinet Resolution No. 134 of 2025 requires financial institutions, DNFBPs and virtual asset service providers to identify the beneficial owner of a company customer in this order:

• Ownership: the natural person who ultimately owns, alone or jointly, a controlling ownership interest or shares of 25% or more.
• Control: where there is doubt about the owner, or no natural person controls through ownership, the natural person who exercises legal or actual control over the company, directly or indirectly, by any other means.
• Senior management: where no one is identified under the first two steps, the natural person or persons holding a senior management position.

The identity must be verified using documents, data or information from a reliable and independent source, to the point where you are satisfied you know who the beneficial owner is.

For a trust or similar arrangement, Article 10 requires you to identify:

• the trustee, settlor, protector, and the beneficiaries or classes of beneficiaries;
• any other natural person with ultimate effective control, including through a chain of ownership or control;
• people in equivalent positions in other types of legal arrangement; and
• the beneficial owner of any company that is a party to the arrangement.

Under Article 11, where the customer or its controlling owner is a company listed on a securities market with disclosure rules that make its beneficial ownership transparent, or a majority owned subsidiary of one, you do not have to identify and verify its shareholders or beneficial owners. The information can come from public registers, the customer, or other reliable sources.

Article 6 requires the identity of the customer and the beneficial owner to be verified before or during the start of the business relationship, or before carrying out a transaction for someone you have no relationship with. Deferring verification is allowed only where risk is low, it is needed to avoid disrupting normal business, and it is completed as soon as possible.

Article 9 also requires you to understand the nature of the customer's business and its ownership and control structure, and to verify that anyone acting on the customer's behalf is authorised to do so.

If you cannot complete due diligence, Article 14 prohibits starting or continuing the relationship or carrying out the transaction, and you should consider filing a suspicious transaction report.

The duty also runs the other way. Under Article 38, UAE companies must hold their own beneficial owner information and shareholder register, update it within 15 working days of any change, and cooperate with the businesses that ask for it. Bearer shares are prohibited.

In practice, a company that cannot or will not give you its beneficial ownership is a red flag, not just an inconvenience.

The EOCN guidance lists ultimate beneficial owners, both individuals and legal persons, among the parties that must be screened against the UAE Local Terrorist List and the UN Consolidated List. Directors and anyone holding a power of attorney for the customer are on that list too.

The 25% threshold decides whom you must identify, but it is not the sanctions test. Freezing follows its own rules: majority ownership above 50%, evidence of control, or acting on behalf of a designated person. A designated shareholder below 25% can still matter, for example if their dividends must be frozen. See owned or controlled: when to freeze a company linked to a designated person.

The guidance also requires screening again when there is a material change in a customer's nature or ownership, so an updated shareholder register should trigger a new screen.

• Record the full ownership chain with percentages, down to natural persons.
• Record control arrangements, such as voting agreements and powers of attorney, alongside ownership.
• Screen each beneficial owner, director and attorney, not only the company name.
• Collect key identifiers (date of birth, nationality, passport number) so hits can be resolved.
• Rescreen when ownership changes and whenever the sanctions lists are updated.

RiskLens360 includes UBO and link analysis, so beneficial owners and related parties are captured with the customer and screened with it. See how this applies to company service providers.