KYC and KYB answer different questions
- KYC asks: who is this individual, and is the identity real?
- KYB asks: does this company exist, who controls it, and does its profile make sense for the activity you are seeing?
Onboarding a company means doing both — verifying the entity, then verifying the people behind it.
Individuals: what you should be able to evidence
- Full legal name, and any other names the person uses.
- Date of birth and nationality.
- Residential address, supported by a document.
- A government-issued ID, checked for authenticity, with the ID number recorded.
- The purpose and intended nature of the relationship.
- Whether the person is a politically exposed person — and whether a close family member or known associate is.
Companies: identify the entity, then find the humans
- Trade licence or certificate of incorporation, plus the register extract where one exists.
- Memorandum or articles of association, and the list of directors.
- Ultimate beneficial owners — the natural persons who ultimately own or control the entity, with identification documents for each.
- The person instructing you, and evidence of their authority to act.
- The group structure, including intermediate holding companies, and a note of why it exists.
UAE companies are generally required to hold ultimate beneficial owner records, and free zones apply their own requirements. A structure with several layers and no commercial rationale is a reason to ask questions — not a reason to stop at the first company in the chain.
Nominees and 'just sign here'
Nominee shareholders and directors are lawful, and they are also a common way to hide ownership. If the person signing cannot explain the ownership chain, or will not provide beneficial-owner documents, treat that as a risk factor and escalate it.
Risk factors that should change how much you dig
- A politically exposed person, their family, or a close associate.
- Cash-intensive activity, or a business model where cash is the main flow.
- Ownership spread across jurisdictions with no evident business reason.
- Reluctance to provide beneficial-owner documents, or documents that arrive late and incomplete.
- Urgency that outpaces your checks, or a customer who asks you to skip steps.
- Activity that does not fit the profile the customer described.
Escalate before you proceed
Escalation is a normal, documented step. The reviewer decides whether the relationship can continue, on what conditions, and what evidence supports that decision.
If the concern crosses into suspicion of money laundering or terrorism financing, the route is a report to the UAE Financial Intelligence Unit through goAML — not a quiet decision to proceed. Telling the customer about a contemplated report can itself be an offence.
Keep onboarding records usable
- Store the documents you actually relied on, not just a tick box.
- Record the date of verification and who verified.
- Version the record, so you can show what you knew at the time.
- Set a refresh cycle by risk band, and follow it.
Frequently asked questions
Can we accept a certified copy instead of seeing the original?
Certified copies can form part of a process, but what matters is that you can evidence how the identity was verified and by whom. Where verification is remote, document the method and its limitations.
How much ownership information is enough?
Go until you reach the natural persons who ultimately own or control the entity. Stopping at a holding company leaves the actual owner unidentified.
Does a PEP have to be refused?
PEP status is a risk factor, not a prohibition. It calls for senior approval, a clearer understanding of source of funds and wealth, and closer ongoing monitoring.
How often should we refresh customer information?
By risk band — higher-risk customers more often, and any customer when something changes, such as new owners, new activity, or a new adverse-media or sanctions record.
This guide is general information about compliance expectations in the UAE, written by our team. It is not legal advice and does not replace the guidance of your supervisory body. Where an obligation depends on your licence, activity or free zone, confirm it with your supervisor or a qualified adviser.