Middle East Business Verification Shifts Beyond Onboarding

A trade licence, a list of named directors and a bundle of registration papers tells a bank very little about who is actually behind a company. For banks and payment providers in the Middle East, that paperwork is the opening move, not the finish line.

The questions that follow are the substance of know-your-business, or KYB. Who owns the entity? Who directs its decisions? Does the activity it runs match the activity its documents describe? Cross-border ownership structures and information scattered across multiple authorities make those questions considerably harder to answer.

KYB has moved from a filing exercise to an intelligence exercise, said Adeel Mirza, Head of the AML & KYC Unit at Al Masraf, speaking during a Sumsub webinar titled Business Verification in the Middle East: Staying Compliant While Scaling. Ultimate beneficial ownership (UBO) transparency now sits at the centre of that work, he said, because criminal networks have grown skilled at concealing themselves inside layered corporate structures that span several jurisdictions and include offshore vehicles.

Mirza appeared alongside Syed Hassan, Head of Compliance & MLRO at Tabby, and Arina Rumyantseva, Senior Legal Counsel at Sumsub. Mark Bain, Product GTM Lead – KYB at Sumsub, moderated.

Ownership data has a shelf life

Establishing who owns a company at onboarding is not a one-off task. Institutions face mounting pressure to keep owner records current and to act when new information contradicts what they hold.

Rumyantseva cited Europe as an example. The EU's Anti-Money Laundering Regulation (AMLR) obliges institutions to report discrepancies between their own due diligence findings and what central registers show. She said the regulatory picture is becoming more interesting, and that it remains unclear how different regulators will handle cases where beneficial owners are still not properly verified.

In the UAE, licensing authorities have made ownership details easier to obtain by including UBO information within the trade licence itself, Mirza said, which allows banks and financial institutions to identify beneficial owners directly. He described the region's alignment with international standards as strong, particularly following the Financial Action Task Force evaluation and the UAE's period on the FATF grey list, which it has since left.

Supervisors have changed their line of questioning, Mirza added. Rather than asking whether a framework exists, examiners want evidence that it works — the methods used, the results produced, and how targets were met.

Scaling across borders

Middle Eastern firms begin with a demanding baseline at home. Hassan said the Central Bank of the UAE expects institutions to understand a customer's geographies, counterparties, products, channels and the purpose of its transactions. Payment companies, fintechs, exchanges and remittance providers in the region often transact along high-growth corridors, he noted, which can carry elevated sanctions, trade-based money-laundering and terrorist financing risk.

Few companies in the region are purely domestic, Mirza said, with the UAE and Oman among the Middle East's largest trade hubs. Even mid-sized businesses sit inside global supply chains. A company may be incorporated in one country, bank in a second, hold shareholders in a third and trade with counterparties across several more. Meeting the governance rules of a single jurisdiction no longer suffices, and the data behind those checks is often fragmented.

Hassan pointed to the e-KYC platform the CBUAE announced in April with Norbloc AB as technology partner. As he understands it, the platform uses distributed ledger technology so financial institutions can reuse due diligence data, cutting compliance cost and effort while improving customer experience. No rollout timeline has been published. Hassan expects the benefit to be limited to customer due diligence collection, with ongoing monitoring and risk profile checks still required.

Automation keeps the accountability

Automation is how firms scale KYB without diluting it, Mirza said, but it does not transfer responsibility. Machines remove inefficiency so people can handle judgement-based decisions. Regulators still expect an institution to explain and defend its choices, which means explainability and human oversight must survive even in highly automated systems.

He recalled asking an AI transaction monitoring vendor what defence a bank would offer regulators if the system failed to flag an alert. The vendor had no answer.

A customer that clears onboarding today may look nothing like itself a year from now. Owners change, counterparties move, and businesses enter new markets. The burden falls on institutions to notice when an entity drifts from its original profile and to show supervisors a clean audit trail when asked.