A shareholder register can look perfectly clear and still tell only half the story.
Suppose a UAE company is owned by an overseas business. That business is owned by another holding company, which has four individual shareholders. One of those individuals also has the right to block major decisions.
Who really controls the UAE company?
Answering that question is part of identifying the ultimate beneficial owner, or UBO. But identifying the person is only the starting point. The company also needs to understand whether that ownership creates any legal, financial or reputational exposure.
This is where a UBO risk assessment becomes useful. It looks beyond names and percentages to consider where the owners are based, how they built their wealth, whether sanctions or political exposure are involved and whether the ownership structure makes commercial sense.
What Does UBO Risk Mean?
A UBO is the individual who ultimately owns or controls a business.
Under UAE beneficial ownership rules, a person may qualify if they directly or indirectly own or control 25% or more of a company. Ownership is not the only test. Someone may also qualify because they control voting, can appoint or remove most directors or have the power to influence important decisions.
UBO risk appears when the company cannot clearly answer basic questions about those individuals.
For example:
- Who ultimately receives the financial benefit?
- Does anyone exercise control without appearing as a shareholder?
- Are the ownership percentages supported by current documents?
- Is an owner connected to a sanctioned country or person?
- Does the declared ownership match the bank’s KYC records?
- Is there a sensible reason for each company in the ownership chain?
A complicated structure does not necessarily mean something is wrong. Large groups often use several legal entities for valid commercial reasons. The concern begins when the structure cannot be explained, supporting records are missing or the people in control appear to be deliberately hidden.
Why UBO Risks Belong in Your Business Risk Assessment
A business risk assessment looks at the events and relationships that could harm a company. Depending on the business, this may include financial crime, regulatory failure, fraud, sanctions breaches, poor governance or reputational damage.
Ownership affects all of these areas.
Imagine a UAE company whose immediate shareholder is a local holding company. On paper, the relationship may appear low risk. Further checks might reveal that the holding company is controlled by an individual living in a high-risk jurisdiction. That person may also have links to another business facing corruption allegations.
That information does not prove that the UAE company has done anything wrong. It does, however, change the level of attention the relationship requires.
If the UBO is missing from the assessment, the company may underestimate its actual exposure.
UBO Risks UAE Companies Should Look For
UBO risks often appear when ownership structures are complex, unclear, or designed to hide the person who ultimately controls the company. UAE businesses should watch for these warning signs during due diligence.
Ownership that is difficult to follow
One holding company is usually manageable. Five companies spread across several countries require more work.
The company should be able to trace each level, calculate the indirect ownership and show the documents used. If an ownership chart is the only available evidence, the review is incomplete. A chart helps people understand the structure, but it does not prove that the information is correct.
Connections to higher-risk countries
Where an owner lives, operates or earns money can affect the company’s exposure to money laundering, terrorist financing, corruption and sanctions.
Nationality alone is not a fair or useful way to judge risk. The assessment should consider the individual’s residence, business activities, financial history, source of wealth and commercial links.
A country’s connection is one factor. It should not become the entire conclusion.
A politically exposed owner
A politically exposed person, or PEP, is someone who holds or previously held a prominent public role. Certain family members and close associates may also require closer attention.
Having a PEP as a UBO is not automatically prohibited. It does raise questions that an ordinary ownership review may not answer. How did the person build their wealth? Are public contracts involved? Could they influence decisions for personal benefit?
The company may need additional checks, approval from senior management and more regular monitoring.
Possible sanctions exposure
Sanctions checks should not stop with the company name.
A business may not appear on a sanctions list, but one of its owners or controllers might. There may also be indirect links through a parent company or another business within the group.
Potential matches need to be reviewed carefully. Common names, incomplete birth dates and different spellings often produce false results. Dismissing a match too quickly is risky, but treating every match as confirmed is equally careless.
Nominee arrangements
Nominee shareholders and directors can be used for legitimate reasons. The problem is that they may hide who gives the instructions or receives the benefit.
A useful assessment asks who appointed the nominee, whose decisions they follow and whether a written declaration reflects what happens in practice.
If nobody can answer those questions properly, the company does not yet understand its ownership.
Sudden or unexplained ownership changes
A shareholder may leave for an ordinary commercial reason. A group may also restructure before receiving investment or entering a new market.
Still, the timing matters. A transfer made just before a large transaction, banking review or regulatory enquiry deserves closer attention.
The company should record why the change happened, who paid for the shares and whether the new owner changes the business’s risk profile.
Records that tell different stories
The trade licence, UBO declaration, shareholder register, corporate documents and bank KYC file should broadly agree.
Small differences may come from old addresses, replaced passports or spelling variations. Other differences are more serious. If one record shows 20% ownership and another shows 40%, the company needs to find out which is correct.
Leaving inconsistencies unresolved can delay banking, investment and due-diligence reviews.
How to Carry Out a UBO Risk Assessment in the UAE?
Start by drawing the full ownership chain. Include each company, the percentage held and the individuals at the end. Where a person owns shares indirectly, show the calculation rather than recording only the final figure.
Next, check how control works in practice. Read shareholder agreements, voting arrangements, nominee declarations and director-appointment clauses. A person with less than 25% ownership may still have substantial control.
Identity details should then be verified using current documents. Names, dates of birth, addresses and nationalities should match the company’s UBO declaration and other KYC records.
The review should also consider source of wealth and source of funds. These terms are related, but they are not interchangeable. Source of wealth explains how someone accumulated their overall wealth. Source of funds explains where the money for a particular investment or transaction came from.
Finally, screen each relevant individual for sanctions, PEP status and credible adverse information.
The result should be a risk rating with a clear explanation. Writing “high risk” without explaining why is not useful. The assessment should identify the exact concerns, the evidence reviewed and the action the company plans to take.
What Should the Company Do With the Findings?
A risk assessment should lead to decisions, not sit untouched in a folder.
If the review finds gaps, the company may need to:
- Request missing ownership documents
- Confirm the source of investment funds
- Correct its UBO or KYC records
- Obtain approval from senior management
- Review transactions more closely
- Increase sanctions and adverse-media screening
- Ask for legal or compliance advice
- Set a date for another review
Every action needs an owner and a deadline. Otherwise, the same problem will still be there during the next bank or regulatory review.
Problems with UBO records can also point to weaknesses elsewhere. An AML/CFT Gap Assessment can help a company check whether similar issues affect its customer checks, sanctions controls, monitoring or recordkeeping.
When Should You Review UBO Risk Again?
Do not wait for trade-licence renewal.
A new review may be needed after a share transfer, group restructuring, change in voting rights or appointment of a new controlling person. A UBO moving to another country may also affect the company’s risk profile.
Other triggers include new sanctions, negative media, unexplained transactions or information that no longer matches the company’s records.
Even when nothing obvious has changed, a periodic review makes sense. Old information can be just as misleading as missing information.
Mistakes That Weaken UBO Risk Assessments
The most basic mistake is assuming that identifying the UBO completes the assessment. It does not. A name and ownership percentage tell you who the person is within the structure, not what risk the relationship creates.
Companies also run into trouble when they:
- Check direct shareholders but ignore indirect owners
- Focus on percentages and overlook control rights
- Treat every complex structure as suspicious
- Accept an ownership chart without verifying it
- Give a risk rating without recording the reasons
- Identify problems but assign no corrective action
- Fail to review the assessment after ownership changes
A copied template will not solve these problems. The assessment needs to reflect the company’s actual owners, markets, transactions and exposure.
How Vertex Compliance Can Help
Ownership risk rarely exists in isolation. It can affect a company’s banking relationships, investment plans, regulatory position and reputation.
Vertex Compliance provides business risk assessment services that examine UBO exposure alongside AML/CFT, sanctions, governance and operational risks.
The aim is not to label every complicated arrangement as suspicious. It is to establish what the company can prove, where genuine uncertainty remains and what should be fixed first.
Frequently Asked Questions
Is identifying the UBO enough?
No. Identification tells you who owns or controls the company. A UBO risk assessment looks at the risks connected to that person and the wider ownership structure.
Is a complicated ownership structure always risky?
Not necessarily. There may be a valid commercial reason for it. The company should still be able to explain the structure and support every level with reliable documents.
Can a politically exposed person own a UAE company?
PEP status does not automatically prevent ownership. However, the relationship may require additional checks, senior approval and closer monitoring.
Should an indirect owner be assessed?
Yes. Looking only at direct shareholders can hide the individuals who ultimately own, benefit from or control the company.
What if the UBO records and bank records are different?
Do not ignore the difference. Check the source documents, identify which information is outdated and correct the relevant records.
How often should UBO risk be reassessed?
Review it periodically and whenever ownership, control, location or relevant risk information changes. Waiting for licence renewal may leave the company relying on outdated information.
