· Jurisdiction Briefing

UAE: identifying the customer and the beneficial owner under Cabinet Resolution No. (134) of 2025

Every customer file has to answer two questions before anything else. Who is the customer? And which natural person stands behind it? Cabinet Resolution No. (134) of 2025, the Executive Regulations of Federal Decree by Law No. (10) of 2025, answers both in a…

Illustration for “UAE: identifying the customer and the beneficial owner under Cabinet Resolution No. (134) of 2025”

Every customer file has to answer two questions before anything else. Who is the customer? And which natural person stands behind it? Cabinet Resolution No. (134) of 2025, the Executive Regulations of Federal Decree by Law No. (10) of 2025, answers both in a Division headed Customer Due Diligence and Beneficial Owner Identification Procedures.

The CBUAE Rulebook shows the Resolution effective from 14 December 2025, with the status In-Force. The articles read here are addressed to financial institutions, designated non-financial businesses and professions (DNFBPs) and virtual asset service providers (VASPs) alike.

This briefing covers when identity must be verified (Article (6)), what must be collected (Article (9)), how the beneficial owner is found (Article (10)), the listed-company exception (Article (11)) and existing customers (Article (13)). The money thresholds in Article (7) were covered on 23 September, and reliance on third parties and Article (14) on 14 October. Enhanced and simplified due diligence under Article (5), politically exposed persons and life insurance beneficiaries are not covered here, beyond one cross-reference.

When: before or during, with one narrow exception

Article (6) sets the timing. Firms must verify the identity of the Customer and the Beneficial Owner before or during the establishment of a Business Relationship or the opening of an account. For a customer with whom no such relationship exists, verification comes prior to carrying out a Transaction.

Clause (2) allows a deferral, but only in cases of low crime risk, and only on three conditions:

  • verification is completed as soon as possible after the relationship starts or the Transaction is executed;
  • the deferral is necessary so as not to disrupt the normal course of business;
  • appropriate and effective measures are applied to control the risks of the Crime.

Clause (3) adds a duty that applies whenever the timing slips: firms must take measures to manage risks in circumstances where the Customer is able to benefit from the Business Relationship prior to the completion of the verification process.

Note the wording of the deferral. Clause (2) speaks of completing verification of the Customer’s identity. Verifying the identity of the Customer and the Beneficial Owner after the relationship begins appears separately, in Article (5), as an example of a Simplified Due Diligence measure, which firms may apply where low risks are identified, in coordination with the Supervisory Authority. Our reading: a policy that defers beneficial owner verification should say which of the two routes it relies on.

Article (7) sets three triggers that apply to all three types of firm, as applicable, alongside the thresholds: the commencement of a Business Relationship, a suspicion of a Crime, and doubts as to the accuracy or adequacy of customer identification data previously obtained. The third is the one that reopens files that were complete when they were opened.

What: the customer, and anyone acting for it

Article (9) applies to every Customer, “whether permanent or occasional”. The firm must establish whether the Customer is a natural person, a Legal Person or a Legal Arrangement, and verify identity using original documents, data or information obtained from a reliable and independent source.

Natural persons. The firm obtains:

  • the name as stated in the identity card or travel document;
  • nationality, address, and date and place of birth;
  • where applicable, the name and address of the employer;
  • a true copy of a valid identity card or travel document.

Legal persons and legal arrangements. The Resolution calls these items basic information:

  • name, legal form, memorandum of association, the tax registration number of Legal Persons subject to corporate tax, and the unique reference number, if any;
  • the address of the registered office or principal place of business and, where the Person is foreign, the name and address of its legal representative in the State, if any, with supporting evidence;
  • articles of association or any other equivalent approved documents;
  • the names of relevant persons holding Senior Management positions.

Senior Management is a defined term. It means the person or persons with authority to take strategic and executive decisions materially affecting risk management, compliance policies and operational governance. Chief executive officers, general managers and board members are given as examples.

Three more duties sit in the same article. The firm must verify that any person acting on behalf of the Customer is duly authorised to do so, and identify that person in the same way as a customer. It must understand the purpose and the intended nature of the Business Relationship, and obtain information on it where necessary. And it must understand the nature of the Customer’s business and its ownership and control structure.

Who owns it: the beneficial owner

The Resolution defines the Beneficial Owner as the natural person who owns or exercises ultimate effective control over the Customer, or on whose behalf Transactions are conducted. That includes control exercised directly, through a chain of ownership or control, or by any other indirect means. There may be one or more.

Article (10) frames the duty. Firms take into account the risks of the Crime arising from the Customer and the Business Relationship, identify the Beneficial Owner of Legal Persons and Legal Arrangements, and take Reasonable Measures to verify that identity from a reliable and independent source. The standard is to be satisfied that the Beneficial Owner’s identity has been determined. Reasonable Measures are themselves defined: measures taken within customer due diligence and beneficial owner identification, proportionate to the risks of money laundering, terrorist financing or proliferation financing.

Legal persons: three steps, in order

  1. Ownership. Obtain the identity of the natural person who ultimately owns, individually or jointly with another person, an actual controlling ownership interest or shares in the Legal Person of 25% or more.
  2. Control. Identify the natural person who exercises legal or actual control over the Legal Person, or control through any other means, directly or indirectly, in three situations: where there is doubt about the person identified at step one; where there is doubt that the owner is the Beneficial Owner; or where no natural person exercises control through an ownership interest.
  3. Senior management. Where no natural person is identified under the first two steps, identify the relevant natural person holding a Senior Management position, whether one or more.

Two things follow from the text. The control step is triggered by doubt as well as by the absence of an owner who controls, so a name at 25% or more does not close the question if the firm doubts it. And the senior management step is a last resort, reached only when the first two produce no one.

The definitions close one shortcut. A Nominee Shareholder, who votes or receives dividends on a Nominator’s instructions, “shall not be deemed the Beneficial Owner” by virtue of holding shares in that capacity. A Nominee Director is likewise not deemed the Beneficial Owner.

Legal arrangements: everyone with a role

For a Legal Arrangement, Article (10) requires the firm to:

  • identify the Trustee, Settlor, Trust Protector, Beneficiaries or classes of Beneficiaries, and the powers and authorities granted to them where no Beneficiaries are identifiable when the Trust is established;
  • identify any other natural person exercising ultimate effective control, including through a chain of ownership or control over the trust;
  • obtain adequate information on the Beneficial Owner to identify them at the time of payment, or when they intend to exercise legally acquired rights;
  • identify the natural persons holding equivalent or similar positions in other Legal Arrangements;
  • identify the Beneficial Owner of any Legal Person that is a party to the arrangement, under the same article.

The listed-company exception

Article (11) is permissive. Where the Customer, or its controlling owner, is a company listed on a securities market subject to disclosure requirements that ensure sufficient transparency on the Beneficial Owner, or a subsidiary of such a company holding a controlling interest, the firm may choose not to identify or verify any shareholder or Beneficial Owner of those companies. Identity information may then come from publicly available registers, from the Customer, or from any other reliable sources.

The condition is in the market, not the listing. The exception rests on the disclosure requirements of the market concerned. Our reading: the file should show which market, and why its disclosure rules were judged sufficient.

The other side of the table

Chapter Three of the Resolution puts matching duties on the customer’s side.

  • Companies must cooperate with financial institutions, DNFBPs and VASPs in providing adequate, accurate and up-to-date Beneficial Owner information (Article (38)).
  • Nominees must notify the company of their capacity and disclose the identity of the person they represent or the Nominator (Article (39)).
  • Trustees, and persons in a similar or equivalent position, must disclose their status to financial institutions, DNFBPs and VASPs when establishing a Business Relationship or carrying out an Occasional Transaction above the prescribed threshold, and must provide beneficial owner information on the Legal Arrangement, and on the Funds held or managed under the relationship, upon request (Article (41)).

Article (43) then points the other way. The Concerned Authorities, in particular the Public Prosecution, Law Enforcement Authorities and the Unit, are to obtain the basic information in Article (9) and the beneficial owner information in Article (10), as held by competent authorities and by financial institutions, DNFBPs and VASPs, as swiftly and effectively as possible. What a firm collects under Articles (9) and (10) is therefore also what it may be asked to produce.

Keeping it current, and the back book

Identification is not a one-off. Under Article (8), ongoing monitoring includes ensuring that documents, data and information obtained under customer due diligence are up to date and relevant, through reviewing records, with particular emphasis on categories of High-Risk Customers. The definition of High-Risk Customers names, among others, customers with complex ownership structures and non-residents not holding a State-issued identity card.

For relationships that already existed, Article (13) requires firms to apply customer due diligence to the Customers and Business Relationships existing when the Resolution entered into force, at such times as they deem appropriate based on materiality and risk. Where due diligence was applied before that date, they must ensure the adequacy of the data previously obtained.

Our reading: “at such times as they deem appropriate” leaves the timetable to the firm, but not the decision. A remediation plan that ranks the back book by materiality and risk is the evidence that the decision was made.

What to do with this

  1. Map the form to the article. Check the natural-person and legal-person fields in the onboarding form against Article (9), item by item, including the tax registration number, the unique reference number, the foreign legal representative and the names of Senior Management.
  2. Write the three-step test into the procedure. Ownership at 25% or more, then control on doubt or where no one controls through ownership, then Senior Management as the last resort, with the reason for each step recorded.
  3. Name the deferral route. For any product that onboards before verification is complete, record whether it relies on Article (6) or on simplified due diligence under Article (5), and the risk controls that apply while the customer can already use the account.
  4. Evidence the listed-company exception. Record the market, the basis for judging its disclosure sufficient, and, for a subsidiary, the controlling interest.
  5. Date the back-book plan. Under Article (13), show how existing relationships were ranked by materiality and risk, and when each tier will be reviewed.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu