When a Saudi bank submits a corporate customer file to SAMA examiners during an AML inspection, the first question about beneficial ownership is rarely whether the file contains a company-registry extract. It is whether the institution can demonstrate that it verified who actually controls the entity. SAMA beneficial ownership verification under Article 2.3.1 of the AML/CTF framework requires institutions to identify natural persons who ultimately own or control the customer, and a commercial-registry printout alone does not answer that question in the majority of corporate structures.
The gap appears in files for holding companies, family businesses with nominee shareholders, entities owned through multiple tiers of corporate vehicles, and customers whose ownership has changed since incorporation. In each case, the registry extract shows legal title at a snapshot in time, but it does not reveal whether those registered shareholders are the ultimate beneficial owners, whether control is exercised through voting agreements, whether shares are held in trust, or whether ownership has been transferred informally within a family or business group.
This article explains why reliance on company-registry extracts creates a verification gap, describes the three-layer process that SAMA examiners expect, and outlines when compliance heads and KYC managers should reassess their corporate customer due diligence programs.
Why Company-Registry Extracts Are Necessary but Not Sufficient
A commercial-registry extract from the Ministry of Commerce is a foundational document. It confirms legal existence, registered activity, authorized signatories and the shareholders of record at the time of issuance. For many Saudi closed joint-stock companies and limited-liability companies, the extract lists shareholders by name and percentage.
The limitation is that the extract reflects only what has been formally filed. It does not capture:
- Beneficial ownership through intermediary entities. When a shareholder is itself a company, the extract stops at the corporate shareholder and does not identify the natural persons behind it.
- Control exercised without majority ownership. A shareholder holding 30 percent may control the entity through voting agreements, board representation or operational authority, yet the extract shows only the percentage.
- Informal transfers within families. Shares registered in the name of one family member may be beneficially owned by another under an undocumented arrangement, common in family-owned enterprises.
- Nominee arrangements. A registered shareholder may hold shares on behalf of another natural person, and the registry does not record this relationship.
- Changes since the extract date. Ownership may have shifted through private sale, inheritance or corporate reorganization after the document was issued.
SAMA Article 2.3.1 requires financial institutions to identify the natural person or persons who ultimately own or control the customer. The standard is ultimate control, not registered title, and that distinction is what examiners test during file reviews.
The Three-Layer Verification Process
A verification process that satisfies SAMA requirements moves beyond the registry extract to establish a complete and current picture of beneficial ownership. The process has three layers.
Layer One: Obtain the Company-Registry Extract
The commercial-registry extract remains the starting point. It provides the legal structure, confirms the entity's status, and lists the first tier of shareholders. For wholly Saudi-owned limited-liability companies with natural persons as direct shareholders, this layer may be sufficient if the ownership is straightforward and the extract is recent.
The KYC file should include an extract dated within a reasonable period before onboarding. If the customer relationship is periodic-review age, the institution should request a fresh extract to confirm that the registered structure has not changed.
Layer Two: Map the Ownership Chain to Natural Persons
When one or more shareholders are corporate entities, the institution must obtain equivalent documentation for each corporate shareholder and continue the chain until natural persons are identified. This produces an ownership chart that shows each tier.
For example, if the customer is a Saudi limited-liability company owned 60 percent by a holding company and 40 percent by two natural persons, the institution must obtain the commercial-registry extract or equivalent for the holding company, identify its shareholders, and repeat the process if any of those shareholders are also corporate. The chain continues until every line terminates in a natural person.
The ownership chart is not a decorative diagram. It is a working document that the institution prepares and updates, showing names, percentages and the source document for each tier. SAMA examiners will ask to see both the chart and the underlying registry extracts or shareholder registers that support it.
Layer Three: Confirm Actual Control Through Independent Means
The third layer addresses the gap between registered ownership and actual control. The institution must verify that the natural persons identified in the ownership chart are in fact the beneficial owners, and that no other natural person exercises control through means not visible in the corporate records.
Independent confirmation methods include:
- Signed beneficial-ownership declaration. The customer's authorized signatory completes a declaration identifying the natural persons who own or control the entity, including any arrangements not reflected in the registry. The declaration is signed, dated and retained in the file.
- Board resolutions or shareholder agreements. Documents that show voting arrangements, control rights or beneficial interests held by persons other than the registered shareholders.
- Certified ownership structure. For larger or more complex customers, a letter from the customer's external auditor or legal counsel certifying the beneficial-ownership structure and confirming that it reflects current and actual control.
- Cross-reference with PEP and sanctions screening. The institution screens the identified beneficial owners against PEP databases and sanctions lists. A match that contradicts the declared ownership—such as a PEP appearing in a structure the customer claimed was family-owned—triggers further inquiry.
The third layer also includes a reasonableness test. If the declared beneficial ownership is inconsistent with the customer's business activity, transaction profile or the relationship manager's knowledge of the customer, the institution escalates for enhanced due diligence.
When the Verification Gap Becomes an Examination Finding
SAMA examiners sample customer files across retail, SME and corporate segments. In corporate files, they test whether the institution has identified and verified beneficial owners in accordance with Article 2.3.1. A finding is raised when:
- The file contains only a company-registry extract, with no ownership chart and no documentation of beneficial owners for corporate shareholders.
- The ownership chart is incomplete, stopping at a corporate shareholder without identifying the natural persons behind it.
- The beneficial-ownership declaration is missing, unsigned, undated or generic.
- The file shows no evidence that the institution verified the declared ownership through independent means.
- The ownership information is outdated, and the institution has not refreshed it during periodic review.
The finding is not that the institution failed to collect a document. It is that the institution cannot demonstrate that it knows who controls the customer, and therefore cannot assess the money-laundering or terrorist-financing risk that the relationship presents.
Signs It Is Time to Review Your Corporate KYC Program
Compliance heads and KYC managers should consider a program review when:
- SAMA or an external auditor has raised findings related to beneficial-ownership verification in corporate files.
- The institution onboards a significant volume of corporate customers—family businesses, holding companies, investment vehicles—and the KYC process relies primarily on commercial-registry extracts.
- The beneficial-ownership declaration template is a single-sentence attestation with no detail, and relationship managers report difficulty obtaining meaningful responses.
- Periodic review of corporate files does not include a refresh of the ownership chart or re-verification of beneficial owners.
- The institution has implemented or is implementing eKYC through Nafath for individuals, but corporate due diligence has not been updated to reflect the same verification rigor.
- There is no clear escalation path when a customer's declared ownership structure appears inconsistent with the business profile or transaction activity.
What a Good Outcome Looks Like
A corporate KYC program that satisfies SAMA beneficial-ownership requirements produces files in which an examiner can see, within minutes, who controls the customer and how the institution verified that conclusion. The file contains:
- A current commercial-registry extract for the customer.
- Registry extracts or equivalent documents for each corporate shareholder, continuing through all tiers.
- An ownership chart that maps the complete chain from customer to natural persons, with percentages and document references.
- A signed and dated beneficial-ownership declaration from the customer, identifying ultimate owners and any control arrangements not visible in the registry.
- Independent confirmation—board resolution, auditor letter, legal-counsel certification or cross-referenced PEP/sanctions screening—that supports the declared ownership.
- Evidence that the ownership information was reviewed and refreshed during the most recent periodic review.
The program itself includes clear procedures for each layer of verification, templates for ownership charts and declarations, guidance on when to escalate for enhanced due diligence, and a defined refresh cycle tied to customer risk rating.
How the KYC, CDD and eKYC Program Review Works
The review examines whether the institution's customer due diligence program—across individual and corporate segments—meets SAMA AML/CTF and FATF requirements, with particular attention to beneficial ownership, PEP handling and digital onboarding controls.
The process includes four steps: review of policies, risk-rating methodology and onboarding journeys; testing of a sample of customer files across segments; assessment of gaps in CDD, EDD, ownership and PEP controls; and preparation of a program-fixes and file-remediation plan.
Deliverables are a KYC program assessment report, risk-rating model recommendations, and a remediation plan for customer files.
The review covers customer risk-rating methodology, CDD and EDD file testing, beneficial ownership and PEP controls, and periodic review cycles. It addresses both individual and corporate customers, including beneficial ownership verification and complex structures. The assessment takes four to six weeks.
Institutions that identify gaps in existing files can design and run a file-remediation program following the review, bringing the portfolio into line with current requirements before the next examination cycle.
Closing
SAMA beneficial ownership verification is not a registry-extract exercise. It is a three-layer process that moves from legal title to actual control, and examiners test whether your files reflect that distinction. If your corporate KYC program relies on commercial-registry extracts without ownership charts, beneficial-ownership declarations or independent confirmation, the gap will appear in the next examination sample.
A KYC, CDD and eKYC program review identifies where the verification process falls short, tests a sample of files to measure the extent of the gap, and delivers a remediation plan that brings policies, procedures and existing customer files into line with SAMA Article 2.3.1. The result is a corporate due diligence program that examiners can verify and that your institution can defend.
