UBO Identification for Middle Eastern & African Entities

For UK and European firms, some of the hardest beneficial ownership work involves clients and counter parties connected to the Middle East and Africa. Ownership is often opaque. Free zones, offshore vehicles and layered holding companies are common. Sanctions and geopolitical risk are high.

In this Aventine Lab webinar, Arsalan Abbasi was joined by James Redfern, Director at Diligencia, which has specialised in corporate information across the Middle East and Africa since 2008, and James Byrne, founder and CEO of the Open Source Centre, a UK non-profit that investigates illicit networks. Together they explained how UBO identification really works in the region, where it breaks down, and what regulated firms should do about it.

Why UBO identification matters beyond compliance

Identifying the ultimate beneficial owner is a regulatory requirement and a core defence against money laundering and sanctions evasion. James Redfern also pointed to practical benefits: a single view of the client, and better risk management across the firm.

What counts as an ultimate beneficial owner?

The definition itself shows where the difficulty lies. An ultimate beneficial owner should always be a natural person, and is identified through three tests applied in order:

Ownership: owns or controls more than 25% of the shares or voting rights. Thresholds vary, and some jurisdictions use 10%.
Control: has the power to appoint or dismiss the majority of the directors, even without owning the company.
Fallback: if no one meets the first two tests, the person responsible for senior management of the entity.

The registers capture legal ownership and voting rights. But beneficial owners can also be people whose influence over board members or shareholders is not written down anywhere. Having every registry filing does not guarantee you understand who owns or controls the company.

Why the Middle East and Africa are harder

Diligencia covers 73 countries across the Middle East and Africa through around 350 sources. James Redfern summarised the challenges:

Different filing requirements in every jurisdiction, and often several jurisdictions within one country.
Many languages: Arabic, Farsi, French, Portuguese and English.
Different company formation traditions. Francophone North and West Africa historically used the French société anonyme, which, as the name suggests, did not show owners. That has since changed. Elsewhere, English-style company law applies.
Fragmented data sources. One company’s records may be spread across several bodies.
Protectionist cultures. Information may exist, but cultural or business norms make people reluctant to publish it.

His most important message, though, is that things are opening up. The information is increasingly available. The work lies in finding it, translating it and interpreting it.

Registry access, country by country

United Arab Emirates

The UAE has seven emirates, each with its own Department of Economic Development acting as a registry, more than 50 free zones that allow up to 100% foreign ownership, and several offshore registries that publish no ownership information. Since the introduction of beneficial ownership rules, UAE companies must file BO information on a UBO register within 15 days of a significant change, using a 25% threshold. James put the penalties at roughly the equivalent of US$4,000 for a first failure, rising for repeat failures. That is not a large deterrent for big corporates.

Jordan and Egypt

Jordan used to be highly fragmented and has improved a lot. It now has a beneficial ownership register, although you may still need records from the Ministry of Industry, Trade and Supply, the Companies Control Department, the Securities Depository Center, six free zones and the Official Gazette. In Egypt, documents used to take days and days. A full corporate filing can now be assembled in around four to five days.

The wider GCC

Outside the UAE, GCC registry information is generally available, either free or for a fee, and is supported by official gazettes. It is mostly in Arabic and mostly in PDF. If you want to automate access, plan for Arabic translation, OCR and an understanding of local business culture.

Iraq, Libya and Iran

In federal Iraq (Baghdad), registries are transparent, with full director and ownership records available free, in Arabic. The Kurdistan Region (Erbil) charges fees and holds very little. In Libya, you need to know whether an entity is registered in Tripoli or Benghazi, because past internal conflict means the two hold different information.

Africa

In South Africa, there was for many years no legal requirement to state who the owners are when filing a company. Whatever access you have to the registry, that information is not there, and you have to find it another way. In parts of West Africa, documents are still paper-based and can take three to five days per request.

In-person access and court orders

Some registries require an in-person visit, local residency or a court order before they release records. You cannot always request them from abroad.

Why you cannot stop at the first layer

A registry filing usually shows a company’s immediate shareholders, not its ultimate owners. To reach a natural person you have to retrieve the parent’s records, then the grandparent’s, and keep going until you reach a human. When each set of documents takes three to five days from a paper-based source, building a full corporate picture can take weeks.

Registries have their own limits as well. Even Companies House is not always up to date. James Redfern was once a director of a company and resigned, yet it took a year for his name to come off the record.

Six ways ownership is obscured in the region

James Redfern walked through the structures that most often make UBO identification difficult. Some are perfectly legitimate and some are deliberate concealment.

Multi-layer cross-border holdings. A UAE LLC owned by a Bahraini holding company owned by a BVI entity. None of this is illegal, but the natural person disappears behind different disclosure rules.
Nominee shareholders. Until the 2020–21 reforms to UAE company law, mainland companies needed 51% Emirati ownership. Foreign founders held 49% and used side agreements to control 100%. Many of those companies still exist, so the register does not reflect who controls them.
State and quasi-government ownership. An operating company owned by a regional investment authority owned by a sovereign wealth fund. Identifying the natural persons behind it is close to impossible.
Limited-transparency registers. Offshore jurisdictions with no public ownership data, and registries that require in-person access, residency or a court order.
Mainland, free zone and offshore chains. A mainland company owned by a free zone company owned by an offshore SPV, all inside the same country.
Bearer shares. Whoever holds the certificate owns the company. They are now rare, but where they still exist the owner cannot be traced.

Circular ownership also appears, where company A owns B, B owns C, and C buys shares in A. It is not always criminal and sometimes has cultural roots. Arsalan described how in Iran it was once common to put a child or a cousin’s child down as owner, to protect the business from creditors or from the state seizing it. Concealment is not always money laundering, but you still need to understand why the structure exists.

Ownership is not control: lessons from investigations

James Byrne’s work starts from the assumption that someone does not want you to know. That is not true of most business, but it is the case in the networks he investigates. His examples are worth keeping in mind:

Names taken from strangers. In North Korea-linked networks, the chain often ends with someone from a remote village in China. When journalists found them, they had no idea they were on the documents. Sailors’ names taken from ships’ records have appeared too.
Historical ownership matters. Diligencia investigated an Emirati company that looked clean. Its historical records showed a Belarusian owner, who disappeared from the structure when the war in Ukraine began.
The Russian shadow fleet. As sanctions restricted Russia’s oil revenue, it built extensive networks to own and manage vessels and launder the proceeds. A large part of that network has operated out of the UAE, much of it through free zone companies.
Economy-wide laundering. The Open Source Centre’s report on A7, a Russian company set up by a fugitive Moldovan oligarch, describes a settlement system for Russian importers. It runs through front companies in Kyrgyzstan, the UAE and elsewhere. No Russians appear on those companies’ documents, but the A7 network controls them.
De facto versus de jure. Banks have told James Byrne they have no North Korean exposure because no North Koreans appear in their screening. Of course they do not. North Korea’s foreign bank accounts were held in the names of companies in China, Germany and elsewhere.

James Byrne explained why networks gravitate to particular hubs: permissive jurisdictions combined with market fundamentals such as liquidity and talent. That explains why so much activity runs through the UAE rather than, say, the Isle of Man.

If you get to the UBO, it doesn’t necessarily mean that whoever you’ve identified controls or owns the business.
James Redfern, Diligencia

Names, transliteration and entity resolution

Arsalan asked about one of the most practical problems: names. Arabic naming conventions string together a person’s own name, their father’s, their grandfather’s and the family name, so relatives often share long sequences of the same names. Transliteration into English produces many spellings: Muhammad can be romanised in a dozen ways.

This is entity resolution: proving that the person on one document is the same person on another. James Redfern called it vital. Start from the original Arabic documents where you can, and make sure you begin with the correct legal name, because a wrong name sends you down a rabbit hole. Marriage and bloodlines add further complexity. Diligencia keeps a database of GCC ruling family members partly for this reason.

James Byrne described North Korean operatives who translated Korean names into Chinese characters (Kim becomes Jin, for example) and then romanised the Chinese. The result is a romanised Chinese name that started as a Korean one. They hide in that linguistic nuance, and only native speakers of each language spot the pattern. There is no silver bullet for entity resolution.

Practical advice: if a meaningful share of your intake comes from the region, have a native-language speaker who understands local naming conventions in your team, or use a specialist provider. James Redfern finds it strange how many large European financial services firms onboard Middle Eastern high net worth individuals without Arabic speakers.

Registry data vs self-reported documents

Many firms rely on documents supplied by the client. James Redfern’s guidance:

Self-reported documents are a good starting point, especially if they are audited, but they are not free of bias.
Compare them with official registry records. A discrepancy between what the client gave you and what the registry holds is itself worth investigating.
Know your audit trail. Diligencia obtains documents directly from registries in response to its own requests, so provenance can be traced. Documents a customer provides are used to decide where to look, not as evidence in their own right.
Watch for forgery. James Byrne noted that the A7 network built an automated pipeline for forging documents to pass bank checks. Forged documents used to register companies in other people’s names will become more common as AI improves.

In a financial crime investigation you cannot ask the subject for documents at all, which is why independent registry access matters.

Go down the whole tree, not just to 25%

A common failure is treating UBO identification as a box-ticking exercise and not investigating enough layers. James Redfern called the 25% threshold arbitrary. Aggregated fractional holdings can add up to control, and some jurisdictions use 10%. Go as far down the tree as you can.

The consequences can be serious. A Middle Eastern company owned by a Saudi company owned by an Egyptian company may end in a sanctioned Belarusian shareholder. Arsalan shared a real estate case where a client that looked like a straightforward trust company buying a modest property in Canterbury turned out to be fronting for a Libyan official with problematic source of funds. The deal did not proceed. Source of funds and source of wealth checks are essential alongside the ownership map.

When to escalate to enhanced due diligence

Registry data has limits. When the trail ends in a proxy, an offshore vehicle or a name that does not add up, escalate to enhanced due diligence or corporate intelligence: source enquiries, on-the-ground investigation, social media, web infrastructure, journalistic sources and leaks. James Byrne’s team builds intelligence pictures from all of these in “informationally denied environments”. James Redfern stressed that there is no single method, and that colour and context around a structure matter as much as the filing.

On AI, both speakers were cautious. Much of the region’s data is in PDFs, held in protectionist or offline registries, and is not easily accessible to large language models. In hard-to-reach places, humans still have to go and get the data.

A practical checklist for regulated firms

Identify the immediate shareholders, then keep drilling through every layer until you reach natural persons.
Check which registry each layer sits in (mainland, free zone or offshore) and what that registry can and cannot tell you.
Look at historical ownership, not just the current snapshot.
Compare client-supplied documents against official registry records and investigate any differences.
Resolve names using original-language documents and native-speaker review.
Screen every individual and entity in the chain for sanctions, PEP status and adverse media.
Treat nominee, state-owned, bearer share or circular structures as triggers for enhanced due diligence.
Verify source of funds and source of wealth as well as ownership.
Escalate to specialist investigation when official sources run out.

Frequently asked questions

Is there a UBO register in the UAE?

Yes. UAE companies must keep beneficial ownership information and file it with the relevant registrar, updating it within 15 days of a change, using a 25% threshold. Offshore registries still do not make ownership information public.

Why is UBO identification harder in the Middle East?

Records are fragmented across many registries, free zones and offshore jurisdictions, are often in Arabic and in PDF, and may need in-person or paid access. Layered, nominee and state-linked structures also separate legal ownership from real control.

Can I rely on documents the client gives me?

Use them as a starting point, but verify them against official registry sources and investigate any differences. Self-reported documents are not free from bias and may be forged.

Is 25% the right threshold for UBO identification?

It is the common regulatory threshold, but our panel considered it arbitrary. Some jurisdictions use 10%, aggregated smaller holdings can add up to control, and control can exist without any shareholding.

Key takeaways

Ownership on paper does not always mean control. Look for side agreements, nominees and influence that is not written down.
Information across the Middle East and Africa is opening up, but it is fragmented, multilingual and slow to collect.
Go through every layer, look at history, and do not stop at the 25% line.
Entity resolution of names is the most underestimated challenge. Native-language expertise matters.
When official sources run out, escalate. Some answers only come from human investigation.

Table of Contents

UBO Identification for Middle Eastern Entities