KYB Verification: Why Corporate Onboarding Breaks

Files stall when the UBO chain stops at a company, the extract is six months old, the licence says consultancy while the site sells something else, or a PEP or sanctions hit sits in the case with no memo.

If you onboard corporate clients, you design the checklist so those gaps never enter the queue. If you are the founder in that queue, you build the pack the analyst can finish. KYC, KYB and onboarding work is the file, the scoring model, and the approval logic.

‍

What does a reviewer check in KYB verification?

KYC is the natural person: passport or Emirates ID, address, selfie or branch visit, screening of that one name. KYB is the legal person plus every human the law treats as part of that person. Cabinet Resolution 134/2025 Article 9 tells financial institutions, DNFBPs and VASPs to identify the customer as a natural person, a legal person or a legal arrangement, and to verify identity from original documents or from a reliable independent source. For a company that means legal name and form, registration number, registered address, directors, and the powers of anyone who signs.

Article 6 requires identity and beneficial-owner verification before or during account opening. Low-risk files may finish verification after the relationship starts, under tight conditions. High-risk files do not. Article 14 closes the gate: if the institution cannot apply CDD, it must not open the relationship or run the transaction, and it must consider a suspicious transaction report. CBUAE’s November 2025 guidance repeats the stop: do not onboard; exit if a relationship already exists; keep the records.

The reviewer works a short list. Registry extract against the application name. Licence against the activity you described. Chart of owners down to natural persons at the 25 percent ownership test, then control, then senior management. IDs for those people. Proof that a nominee is a nominee, with the nominator named. Screening of the company, directors, signatories and UBOs against the UN list, the UAE local list, PEP databases and internal exit lists. A purpose-of-account note a later monitoring rule can use. Source of funds for the first credit, and source of wealth where the rating is high.

FATF Recommendation 24, in the March 2023 guidance on beneficial ownership of legal persons, allows a threshold only if it does not exceed 25 percent. UAE law uses that ceiling as the ownership test. Wolfsberg’s Correspondent Banking Due Diligence Questionnaire still asks private companies for shareholders or ultimate owners at 10 percent or more, and asks each institution what lowest threshold it applies. A UAE bank that completes Wolfsberg packs may collect a 10 percent layer even where Cabinet 134/2025’s ownership test starts at 25 percent. Article 10’s control test still reaches people below 25 percent.

‍

Policy, file, and monitoring sit in different folders

The AML/CFT policy states how the firm rates customers, when it applies enhanced due diligence, how it screens names, and who signs a rejection. The KYB file is the evidence for one applicant: extracts, IDs, chart, SoF pack, screening printouts, and the memo that closes each exception. Ongoing monitoring is the later work: periodic refresh by risk rating, event-driven review when ownership or activity changes, and transaction rules set against the purpose you wrote at onboarding. This article stays with the file. Policy contents and wallet screening belong elsewhere.

‍

Why UBO chains and nested companies stall the file

The reviewer does not stop at the company that filled in the portal. Cabinet Resolution 134/2025 Article 10 requires identification of the natural person who owns 25 percent or more, then the person who exercises control by other means, then senior management if ownership and control still do not land on a person. CBUAE’s 6 November 2025 CDD guidance is blunt: a legal person cannot sit as the UBO, no matter the percentage on the share certificate. You walk the chain until you name people. A BVI holdco over a UAE operating company, plus a founder who claims control in chat but not on the register, leaves the analyst with PDFs and no person to screen.

Walking the chain to a natural person

Start with the customer entity. Pull a current extract from the registrar that issued the licence. Match company number, status, registered address, and directors to the application. Draw every shareholder. If a shareholder is a company, repeat. Stop when each line ends on a named human, or on a listed company that Article 11 of Cabinet 134/2025 lets you treat through public registers.

Cabinet Resolution 109/2023 Article 5 replaced Cabinet Resolution 58/2020 for mainland and commercial free zones from 16 November 2023. It uses the same 25 percent of capital or voting rights, including the right to appoint or remove a majority of the board. Financial free zones keep their own UBO rules. CBUAE’s November 2025 guidance still lists Decision 58 among its sources; the desk instruction is to keep tracing until every individual who owns or controls at least 25 percent is named. Joint holdings count. Two siblings at 15 percent each who vote together are in the test.

For each natural person, run KYC: valid passport or Emirates ID, date and place of birth, nationality, residential address, and a true copy. Residents: CBUAE tells licensed financial institutions to use ICP’s Validation Gateway on the Emirates ID and to keep that evidence with the card copy. Non-residents: the travel document plus an address the bank can test. A WhatsApp screenshot of a passport is not that copy.

Nested companies, SPVs, and registers that lag the story

Nested structures fail for mechanical reasons. The BVI extract names a registered agent; the share register that names the UAE founder sits in a different, unsigned PDF. The UAE operating company filed a UBO declaration with the zone in the spring and issued new shares to a holding company in June. Cabinet 134/2025 Article 38 gives the company fifteen working days to update beneficial-owner information after a change. The bank’s copy is the spring filing.

Reviewers treat a certificate of good standing, a certificate of incumbency, and a share register as time-bound. Many desks want those papers dated inside 30 to 90 days. An extract that still lists a director who resigned in March will not match the board resolution you uploaded in July.

CBUAE lists an unusual or unnecessary ownership structure among higher-risk examples. The fix is a one-page chart with percentages, jurisdiction of each node, and a footnote for every control right that is not a share. Then the extract for every node. Then the ID for every human at the end of a line. Trusts and foundations follow Article 10(2): settlor, trustee, protector, beneficiaries or classes of beneficiaries, and any other natural person with ultimate effective control. Label a trust as a legal-arrangement file on page one.

‍

Nominees, stale extracts, and papers that do not match the licence

Nominee shareholders and nominee directors are lawful in many places. They are also a named risk in UAE law. Cabinet 134/2025 Article 39 requires a nominee director or nominee shareholder to tell the company of that capacity, to disclose the nominator, and to notify any change within fifteen working days. Article 38 requires the company to keep that nominee information up to date. A bank that cannot see the nominator has not identified the beneficial owner. The file needs the nominee agreement or a notarised declaration that names the nominator, plus KYC on that nominator, plus screening of both names.

Bearer shares are a hard stop. Article 38(4) forbids companies established in the State from issuing bearer shares or bearer share warrants. A foreign parent that still has bearer paper will draw questions even if the UAE subsidiary is clean. Convert and document, or expect a refusal.

Licence mismatch kills files that look complete. The onboarding form says “payments, cross-border, merchants in Europe and the GCC”. The free-zone licence lists management consultancy and IT consultancy. UAE company formation and licensing is where those activity codes get chosen. A bank will not rewrite your licence. Match the activity list to the product, amend the licence before you submit, or write a scope note that shows which licensed activity covers which flow. A VARA category, a CBUAE stored-value approval, or an ADGM FSRA permission that is “in progress” is not a licence. Put the application receipt in the file if you must show timeline. Do not label it as granted.

The trade name on the website is a brand; the licence is a different legal name; the invoice template uses a third string. Pick the legal name as the spine. Put the brand on a covering note as a trading name, with the extract that records it if the zone allows trading names. Otherwise change the site before you upload. Proof of address for the company is the registered office on the extract, a utility bill or tenancy, or the zone’s allocation letter for a flexi-desk. A founder’s villa ejari is not the company’s address unless the licence says so.

‍

Activity mismatch, the website, and source of funds

The onboarding form asks for nature of business in a free-text box. The reviewer opens the trade licence, the website, and the invoices you uploaded. Cabinet Resolution 134/2025 requires the institution to understand the purpose of the relationship. CBUAE’s 6 November 2025 guidance tells licensed financial institutions to build an expected-activity profile and test later flows against it. Consultancy on the licence, OTC crypto on the site, gaming invoices in the PDF: the analyst cannot close. Source of funds is the same test. The first credit has to match a named origin the bank can reconstruct from paper the founder already holds.

When the licence, website, and invoice trail disagree

Ksenia Babochkina, Commercial Director at Medici Expert, puts the crypto version in one line: “Crypto companies don't get rejected by banks for being crypto companies. They get rejected for not being able to explain themselves clearly.” The same sentence applies to payments and FX. The reviewer needs a narrative a correspondent can read.

Open your own site the way a junior analyst does. Legal name in the footer. Licence number. Jurisdiction. Product pages that match the objects on the licence. If you describe brokerage, custody, exchange, or token issuance, the permission that covers that activity has to exist, or the copy has to come down before the file goes in.

Three recent invoices, a master services agreement, and a payment-flow diagram beat a marketing deck. CBUAE asks for anticipated products, geographies, volumes and values. Write inbound and outbound monthly ranges, corridors, and counterparties by type. “High turnover, global” is not a profile.

Source of funds the reviewer can reconstruct

CBUAE splits two questions. Source of funds is the origin of the money that will credit this account: a named bank’s closing statement, a share-subscription agreement with the incoming wire, a property sale with land-department papers, retained earnings with audited accounts. Source of wealth is how the humans who own the company built the stock of assets. Higher-risk ratings, foreign PEPs, and complex structures pull both. Article 16 of Cabinet 134/2025 requires reasonable measures on source of funds and wealth for foreign PEPs, and the same measures for domestic PEPs and international-organisation PEPs when the relationship is high risk.

SoF is a named-bank statement, a sale contract, or audited retained earnings. A CEX screenshot and a wallet-balance PDF fail that test. If the seed capital sat in digital assets, the pack is the original fiat origin, the venue that converted it, the transaction IDs as support, and the accounting trail that ties those assets to the shareholder who is wiring in. Accounting and tax for fintech structures is where that trail is built so a bank or auditor can read it. Group funding needs parent board minutes, an intercompany loan or dividend resolution, and the parent’s bank statement showing the debit.

‍

Translation, attestation, and video KYC versus sitting in a branch

A passport scan that looks readable on your laptop can still fail the file. Reviewers need a certified translation where the original is not in Arabic or English, and a chain of legalisation for foreign corporate papers that will sit in a UAE file. The UAE is not a party to the 1961 Hague Apostille Convention. The HCCH status table, last updated 30 June 2026, lists 130 contracting parties; the UAE is not among them. An apostille from a foreign registry does not replace UAE embassy attestation plus MOFAIC. CBUAE treats remote onboarding as higher risk when there is no video contact, and it still expects Emirates ID validation through ICP’s gateway for residents.

Certified translation and the consular chain

Translate the extract, the memorandum, the UBO register, the board resolution, and the power of attorney. Use a translator the receiving bank lists, or a UAE-certified legal translator, and attach the translator’s stamp. One romanisation of the founder’s name on the passport, the chart, the bank form, and the Arabic licence.

Foreign corporate documents for use in the UAE run a consular chain: notary or issuing registry in the home country, that country’s foreign ministry, the UAE embassy or consulate in that country, then the Ministry of Foreign Affairs in the UAE. MOFAIC’s attestation service states that fees depend on the number of documents and whether the document is personal or commercial. Confirm the live tariff in the portal. Combined digital legalisation at some UAE missions can collapse the last two stamps.

Start the chain on a new extract. A 2023 memorandum attested in 2026 is still old if the directors changed in 2025. Re-issue, then attest. The POA must name the company, the attorney, the acts, and an expiry. The board resolution that authorised it must match.

Video KYC, Emirates ID, and when someone still has to appear

CBUAE’s November 2025 guidance treats identification as technology-neutral. Cabinet 134/2025 Article 9 requires documents, data or information from a reliable and independent source; it does not lock identity evidence to paper. Digital identification is allowed on that same test. Emirates ID, UAE Pass, and the Ministry of Interior / ICP facial-recognition programme are the national tools the guidance names. Licensed financial institutions should validate Emirates ID through ICP’s gateway and keep that evidence.

Non-face-to-face relationships still carry higher ML/TF/PF risk where instructions travel over the internet with no personal contact via video teleconference. Video KYC reduces remote-onboarding risk. Liveness, a clear capture of the photo page, and a match to the extract’s director list still have to land. A high-risk VASP, a nested structure, or a foreign PEP UBO may still end in a branch appointment. Sending a local PRO to “do KYC” for a UBO in another country does not identify that UBO.

PDPL Federal Decree-Law No. 45 of 2021 sits on the copy you keep. Passports, Emirates IDs, facial templates and liveness videos are personal data. Store them for CDD and the statutory AML hold. Cabinet 134/2025 Article 25 requires retention of CDD records and copies of identification documents for at least five years from the end of the relationship or the transaction, whichever later trigger applies. Write the PDPL deletion rule and that five-year clock as one schedule.

‍

PEP and sanctions hits that nobody dispositions

Screening is not a green tick in a vendor portal. Cabinet 134/2025 Article 16 requires systems that can tell whether the customer or the beneficial owner is a foreign PEP, and adequate measures for domestic PEPs and persons with a prominent function in an international organisation. Foreign PEPs need senior-management approval before the relationship starts or continues, reasonable measures on source of funds and wealth, and enhanced ongoing monitoring. Domestic PEPs and international-organisation PEPs get those extra measures where the relationship is high risk.

CBUAE tells licensed financial institutions to screen, before onboarding, the customer, the UBOs, persons acting on behalf of the customer, and senior managers of legal persons. Lists include negative media, PEP databases, the institution’s own exit list, the UN Security Council lists, and the UAE local list.

A hit that sits unworked is a failed file. Same name, different date of birth: write the comparison, the nationality, and the false-positive decision with the analyst’s name and date. Same person, PEP by a sibling’s ministerial post: write the family link, the SoW pack, the senior-manager approval, and the monitoring code. True match to a UN or UAE local-list name: freeze without delay, no tip-off, notify the Executive Office for Control and Non-Proliferation within five business days, and do not onboard. The sanctions programme itself is a separate piece of work. The KYB file needs the disposition of the hits this applicant generated. Adverse media without a list match still needs a note. Leaving a first-page search hit blank guarantees a second round of questions.

‍

Failure modes: what the reviewer sees, and the document that fixes it

Desk map against Cabinet 134/2025 Articles 6, 9–11, 14, 16, 25, 38–39; Cabinet 109/2023 Article 5 for mainland and commercial free-zone UBO registers; CBUAE CDD/KYC guidance of 6 November 2025. Freshness windows below are desk convention as of August 2026, not a statute.

‍

UBO line stops at a company

The share register names “ABC Holdings Ltd 100%” and no human appears. Close it with a chart to natural persons, an extract for each node, and a KYC pack for each human at ≥25% or with control.

Joint holdings ignored

Four people at 20% each, and the file says “no UBO.” Add a combined-ownership note plus IDs and screening for people who vote or act together.

Nested SPV with a missing layer

A Cayman or BVI certificate with no incumbency. Produce a current incumbency or register of members, and embassy plus MOFAIC if the paper must be used in the UAE.

Nominee not declared

The director matches a corporate-services staff list and the nominator is absent. File a nominee declaration naming the nominator (Art. 39), then KYC and screening on nominator and nominee.

Stale extract

Good standing or a share register older than the desk window (often 30–90 days). Replace it with a new extract, incumbency, or good standing dated inside the bank’s printed window.

Licence vs product

The licence says consultancy. The site and form say OTC, exchange, or PSP. File an amended licence with matching activity codes, or a scope note plus a filed amendment receipt.

Legal name vs brand

Website, invoices, and the IBAN letter use three different strings. Use the extract as the spine. Add a trading-name addendum if the zone records one.

SoF is a screenshot

A CEX or wallet PDF, or a personal-account promise. Replace it with an originating-bank statement, a sale contract, audited retained earnings, or parent board paper plus the parent debit.

Translation

An Arabic or third-language extract with no certified English. Supply a certified translation and one romanisation of each name across passport, chart, and forms.

Apostille only

A Hague sticker, no UAE embassy, no MOFAIC. Run the consular chain (notary/registry, home MFA, UAE mission, MOFAIC). Confirm fees on the MOFAIC portal.

Video KYC incomplete

Blurry passport, no liveness, UBO sent a PRO. Retake with liveness. Add the ICP gateway result for Emirates ID. Book a branch slot if the rating requires presence.

PEP hit, no memo

An alert in the case and an empty comment field. Write the disposition: a false-positive comparison, or an Article 16 pack (SoF/SoW, senior-management approval, monitoring code).

Sanctions true match

The name sits on a UN or UAE local list. Do not onboard. Freeze and give EOCN notice per CBUAE. This is a stop, not a document chase.

IDs in a shared drive

Passports in an unnamed folder, no retention rule. Move them to an access-controlled CDD store. Keep the five-year AML clock (Art. 25) next to the PDPL deletion rule.

‍

How to build a file a bank or PSP will finish

Assemble the pack in the order the analyst opens it. Covering note: legal name, licence number, jurisdiction, product in two sentences, expected corridors and monthly ranges, and a table of UBOs with percentages and control rights. Then the customer entity: extract, licence, memorandum, lease or desk allocation, signatory list, board resolution to open the account. Then the chain: chart, parent extracts, nominee papers, trust deed if any. Then people: IDs, addresses, ICP validation where relevant, video or branch evidence. Then money: SoF for the first credit, SoW where the rating will be high. Then screening printouts and a memo for every name that will hit.

Pre-screen the names you already know. A founder who is a domestic PEP should arrive with the SoW pack and a request that the bank’s senior manager see the file at intake. A prior decline belongs in the covering note with the reason you were given.

Match the licence to the story before the sales call. If you need a payments activity, a VASP category, or a brokerage object, file the amendment first. For how a crypto business has to describe itself to counterparties in 2026, see crypto compliance in 2026.

Name a single coordinator, with WhatsApp and email, who can produce a missing extract without a board meeting.

CBUAE ties periodic review to the risk rating (high often annual; low often every three years in the examples the guidance uses) and event-driven review to a change in name, ownership, or activity. Fifteen working days is the statutory update window for company UBO data under Article 38.

Article 14 still lets the institution refuse when CDD cannot be completed. A complete file is the difference between a reasoned no and a six-week silence that ends in a portal status of “closed”.

‍

FAQ

What is the difference between KYC and KYB?

KYC verifies a natural person: identity document, address, liveness or branch visit, and screening of that name. KYB verifies a legal person: existence, licence, ownership chain to natural persons, signatories, purpose of the account, and screening of the company plus those people. In UAE law the statutory term is customer due diligence. KYB is the industry label for the legal-person slice of that duty.

What UBO threshold does UAE KYB use?

Cabinet Resolution 134/2025 Article 10 and Cabinet Resolution 109/2023 Article 5 both use 25 percent of ownership or voting rights as the ownership test, then control by other means, then senior management. FATF Recommendation 24 caps any threshold at 25 percent. Some banks also collect a 10 percent layer because Wolfsberg questionnaires ask for it. Control below 25 percent still counts.

Which documents does a UAE bank or PSP ask for on a company?

A current registrar extract, the trade licence, the memorandum, a board resolution to open the account, a signatory list, a UBO chart to natural persons with parent extracts, IDs for directors, signatories and UBOs, proof of the company’s address, and a source-of-funds pack for the first credit. Foreign papers for use in the UAE need the consular chain.

Can the company finish KYB on video, or must someone attend in person?

CBUAE allows digital identification from a reliable independent source and names Emirates ID validation, UAE Pass, and video contact as tools that reduce remote-onboarding risk. Many files complete on video. High-risk models, nested structures, and PEP UBOs still get a branch appointment.

Why do PEP or sanctions alerts stop the file for weeks?

An alert without a written disposition is an open CDD point. Cabinet 134/2025 Article 14 says the institution must not open the relationship if it cannot complete CDD. A false positive needs a dated comparison of dates of birth and nationality. A real PEP needs Article 16 measures and senior-management approval.

How long should the institution keep KYB records, including copies of IDs?

Cabinet 134/2025 Article 25 and CBUAE’s November 2025 guidance require at least five years from the later of the transaction, the end of the relationship, and certain inspection or court triggers. PDPL Federal Decree-Law 45/2021 still requires a purpose, access control, and deletion when the legal hold ends.