How to document a technology group across Spain, the United States and the UAE

When a technology business operates across several jurisdictions, a bank's first question is not whether the brand sounds convincing. It is far more concrete: who contracts, who invoices, who develops the software and who performs every function that touches money or data.

While preparing onboarding processes across Spain, the United States and the United Arab Emirates, I have learned that entity clarity matters more than marketing. A brand, a product website and a legal entity may share a name, but they are not interchangeable. Documenting them as if they were creates friction and, more importantly, avoidable uncertainty.

The smallest useful unit is a responsibility with a source

A useful map does not start with a decorative organisation chart. It starts by assigning each entity a jurisdiction, an activity, a responsibility and evidence. Original documentation — incorporation certificate, trade licence, ownership record, contract or current policy — always prevails over a public explanation.

The UAE Central Bank's customer due diligence guidance expects financial institutions to understand, among other elements, a customer's activity, business practices, source of income or wealth, source of funds and expected activity. FATF adds the need for adequate, accurate and up-to-date beneficial ownership information. A sales presentation cannot replace any of those layers.

A public responsibility map

In my case, the public summary current as of 23 August 2026 is set out below. Its purpose is to guide an initial review; it does not replace documents delivered through a secure channel.

This map prevents two common mistakes: assuming that every company with a similar brand performs the same activity and confusing a technology interface with the regulated provider that executes a particular function.

Brand, product and provider are not the same layer

Bennu develops software and an interface for a private platform. Where a flow depends on an external function — for example a fiat rail, on-ramp or regulated service — that function belongs to the provider identified for that flow, subject to its eligibility rules, jurisdiction and terms. A regulated provider's participation does not automatically transfer its licence to the software company.

Likewise, the word “Payments” inside a brand does not by itself turn a company into a payment institution. The applicable scope is the one recorded in the trade licence, contracts and current description of each company.

What the file should contain

To make the review traceable, the document pack should allow seven layers to be reconstructed without relying on assumptions:

1. Identity and ownership: individual, UBO, directors and organisation chart.
2. Legal existence: incorporation, registry status and applicable trade licence.
3. Activity: what each entity actually develops, sells or contracts.
4. Flow: who receives instructions, who executes and where every step is recorded.
5. Providers: exact function, contract, jurisdiction and operational dependency.
6. Funds and wealth: chronological explanation and supporting documents through a secure channel.
7. Controls: KYC/KYB, sanctions, reconciliation, privacy, incidents and update process.

Document numbers, accounts, confidential contracts and customer data do not need to be indexed. A public website can act as an evidence index; the full file should travel through the secure channel agreed with the institution.

Which changes require the map to be reviewed

Documentation loses value if it is presented as an eternal snapshot. A new company, jurisdiction, account, provider, product or contract can change the analysis. Every public summary should therefore have a cut-off date, an update owner and one clear rule: when a material responsibility changes, the company map, compliance file and public descriptions are reviewed together.

Scope note: this article describes a documentation method and the declared public map as of the date shown. It is not legal, regulatory, tax or financial advice; it does not evidence a licence or bank approval. Original documentation and each institution's independent verification prevail.

Sources

• CBUAE Rulebook — Customer Due Diligence, KYC and Record-Keeping — current expectations for UAE licensed financial institutions.
• FATF — Beneficial Ownership and Transparency — adequate, accurate and up-to-date ownership information.
• Alex Sicart Ramos's companies and public KYC/KYB file — declared scope and cut-off date.