Nafath beneficial ownership verification SAMA requirements present a persistent challenge for digital-onboarding teams at Saudi fintechs and digital banks. Nafath authenticates the identity of the individual opening an account, confirming that the person is who they claim to be. But when that individual is acting on behalf of a corporate customer—a limited liability company, a holding structure, or a foreign entity with a Kingdom presence—Nafath does not tell you who ultimately owns or controls that entity. This gap is exactly what SAMA AML examiners look for when they review customer due diligence files, and it is the reason many institutions discover during an examination that their eKYC onboarding flow satisfies identity verification but falls short of the beneficial-ownership transparency required under FATF Recommendation 24.
This article describes the three specific verification steps that are missing from most Nafath-based corporate onboarding journeys, explains why each matters under the SAMA AML/CTF framework, and shows how two Riyadh-based fintechs adapted their digital workflows to capture beneficial-ownership data without reverting to manual processes.
Why Nafath Authentication Is Not Beneficial-Ownership Verification
Nafath is an identity-authentication service. When a user completes Nafath authentication during account opening, the institution receives confirmation that the person holds a valid national identity or residency credential and that they have successfully authenticated using the National Single Sign-On platform. This is a strong control for individual customer due diligence. It answers the question: Is this person who they say they are?
But when the account is opened for a corporate customer, the question changes. The individual authenticated by Nafath may be an authorized signatory, a director, or an employee acting under a power of attorney. The institution must still determine who ultimately owns or controls the legal entity on whose behalf the account is being opened. FATF Recommendation 24 requires financial institutions to identify the beneficial owner of a corporate customer and to take reasonable measures to verify that identity. SAMA AML/CTF rules incorporate this requirement, and examiners consistently cite gaps in beneficial-ownership verification during on-site inspections.
The problem is not that institutions are ignoring beneficial ownership. Most have a policy that defines beneficial owners as natural persons who directly or indirectly hold more than a specified percentage of ownership or control. The problem is that the eKYC workflow often stops after Nafath authentication, leaving no structured process to collect, verify, and document beneficial-ownership information for the corporate customer.
The Three Missing Verification Steps
SAMA examiners identify three recurring gaps in corporate eKYC onboarding flows. Each gap represents a missing verification step that institutions must address to satisfy FATF Recommendation 24 and SAMA AML/CTF requirements.
Gap One: No Cross-Reference to Ministry of Commerce Beneficial-Ownership Registers
The Ministry of Commerce maintains beneficial-ownership registers for companies incorporated in the Kingdom. These registers are the authoritative source for ownership structures of Saudi legal entities. Yet many eKYC workflows rely entirely on self-declarations provided by the customer during onboarding, with no automated or manual cross-reference to the Ministry of Commerce data.
When an examiner reviews a corporate customer file and finds only a self-declaration form, the first question is whether the institution verified that declaration against an independent source. If the answer is no, the file is flagged as deficient. The institution has collected information but has not verified it, and verification is the requirement.
Two Riyadh fintechs addressed this gap by integrating a Ministry of Commerce beneficial-ownership lookup into their eKYC workflow. After the authorized signatory completes Nafath authentication and provides the commercial registration number, the system queries the Ministry of Commerce register and retrieves the registered beneficial owners. The workflow then presents this data to the customer for confirmation. If the customer indicates that the ownership structure has changed since the last filing, the system prompts for supporting documentation and flags the file for manual review. This approach satisfies the verification requirement without adding a manual step for every onboarding.
Gap Two: No Structured Collection of Self-Declarations for Complex Ownership Structures
Not all beneficial owners appear in the Ministry of Commerce register. When a Saudi company is owned by another legal entity—a holding company, a trust, or a foreign parent—the register shows the immediate shareholder but not the natural persons who ultimately control that shareholder. In these cases, the institution must collect a self-declaration from the customer that identifies the natural persons who meet the beneficial-ownership threshold.
Many eKYC workflows include a generic upload field for "additional documents" but do not present a structured form that guides the customer through the disclosure of beneficial owners in multi-tier structures. The result is incomplete or ambiguous information. A customer may upload a shareholder list that shows corporate shareholders without disclosing the natural persons behind those entities. When the examiner reviews the file, the institution cannot demonstrate that it took reasonable measures to identify beneficial owners.
The two fintechs solved this by adding a conditional step in the eKYC workflow. When the Ministry of Commerce lookup returns a corporate shareholder, the workflow presents a structured form that asks the customer to identify each natural person who directly or indirectly holds more than the threshold percentage. The form includes fields for name, nationality, date of birth, and identification number, and it requires the customer to upload supporting documentation such as a corporate registry extract or a notarized beneficial-ownership declaration. The workflow does not allow the customer to proceed until the form is complete. This ensures that the institution collects the information in a format that can be verified and documented.
Gap Three: No Enhanced Due Diligence When Ownership Chains Pass Through High-Risk Jurisdictions
FATF Recommendation 24 requires institutions to understand the ownership and control structure of a corporate customer. When that structure includes entities or individuals in jurisdictions that present higher money-laundering or terrorist-financing risk, the institution must apply enhanced due diligence. This means additional verification steps, more frequent periodic reviews, and heightened scrutiny of transactions.
Most eKYC workflows assign a risk rating to the corporate customer based on factors such as business activity, transaction volume, and geographic location. But the risk-rating logic often does not consider the jurisdictions in the beneficial-ownership chain. A Saudi company with a beneficial owner resident in a high-risk jurisdiction may receive a standard risk rating and standard due diligence, even though SAMA AML/CTF rules require enhanced measures.
The two fintechs addressed this by updating their customer risk-rating models. The model now evaluates the nationality and country of residence of each beneficial owner disclosed during onboarding. If any beneficial owner is a national or resident of a jurisdiction on the FATF list of high-risk or non-cooperative jurisdictions, or a jurisdiction the institution has identified as higher-risk in its own risk assessment, the system automatically elevates the customer risk rating and triggers enhanced due diligence requirements. Enhanced due diligence includes additional source-of-wealth documentation, senior management approval before account opening, and more frequent periodic reviews. The workflow documents the rationale for the elevated rating in the customer file, so examiners can see that the institution applied a risk-based approach.
What a Good Outcome Looks Like
A well-designed beneficial-ownership verification process produces three outcomes that examiners look for during a SAMA AML/CTF inspection.
Complete documentation. Every corporate customer file contains verified beneficial-ownership information. For Saudi legal entities, the file includes a Ministry of Commerce register extract or a screenshot of the lookup result. For complex structures, the file includes a completed beneficial-ownership declaration form and supporting documents. For customers with beneficial owners in high-risk jurisdictions, the file includes additional source-of-wealth documentation and evidence of senior management approval.
Defensible verification. The institution can demonstrate that it took reasonable measures to verify the beneficial-ownership information. This means cross-referencing self-declarations against independent sources where available, requesting supporting documentation for complex structures, and applying enhanced due diligence when risk factors are present. The file documents what verification steps were taken and why.
Consistent application. The beneficial-ownership verification process is embedded in the eKYC workflow, so it is applied consistently to every corporate customer. There are no gaps caused by manual handoffs, and there is no reliance on relationship managers to remember to collect the information. The workflow enforces the policy, and the system documents compliance.
When to Review Your KYC Program
Three signs indicate that it is time to review your KYC and eKYC program for beneficial-ownership gaps.
First, you are preparing for a SAMA AML/CTF examination and you want to identify and remediate gaps before examiners arrive. A proactive review allows you to fix deficiencies in your workflow and remediate customer files in a controlled manner, rather than responding to findings under time pressure.
Second, you have recently implemented or upgraded your eKYC onboarding platform and you want to confirm that beneficial-ownership verification controls are correctly configured. Many institutions discover after go-live that the platform supports beneficial-ownership data collection but that the workflow does not enforce it, or that the risk-rating model does not consider beneficial-ownership risk factors.
Third, you are onboarding corporate customers at scale and you want assurance that your due diligence process will withstand examiner scrutiny. As your corporate customer base grows, the cost of remediating deficient files increases. A review now prevents a larger remediation effort later.
How the Firm Reviews KYC and eKYC Programs
The firm conducts a KYC, CDD and eKYC Program Review that covers customer due diligence, enhanced due diligence, beneficial ownership, PEP handling and digital onboarding through Nafath against SAMA requirements. The review follows a four-step process: review of policies, risk rating and onboarding journeys; testing of a sample of customer files across segments; assessment of gaps in CDD, EDD, ownership and PEP controls; and preparation of a program fixes and file remediation plan.
The review produces three deliverables: a KYC program assessment report, risk-rating model recommendations, and a remediation plan for customer files. The assessment takes four to six weeks and covers customer risk-rating methodology, CDD and EDD file testing, beneficial ownership and PEP controls, and periodic review cycles. The review is conducted against SAMA AML/CTF and FATF frameworks.
The firm addresses corporate customers, including beneficial ownership and complex structures, and can design and run a file remediation program after the review if needed.
Closing
If you are preparing for a SAMA examination, implementing a new eKYC platform, or scaling corporate customer onboarding, a review of your beneficial-ownership verification controls will identify gaps before examiners do. The firm's KYC, CDD and eKYC Program Review provides an independent assessment of your due diligence processes, risk-rating model, and customer files, with a clear remediation plan that closes the gaps examiners cite most often.
