Skip to content
PDF Report | 25 Pages | UBO Due Diligence
Companion intelligence page for the Ethixbase360: UBO Due Diligence eBook 2026. This 25-page strategic guide is for compliance and risk professionals.
Executive Summary
Ultimate beneficial ownership has shifted from a peripheral compliance issue to a central corporate risk. Regulators are no longer focused on whether ownership data has been collected; they are focused on proof: whether organisations can demonstrate, defend, and continuously monitor who ultimately controls or benefits from a relationship. This shift has been driven by the convergence of sanctions enforcement, export controls, anti-money laundering regulation, and third-party risk governance into a single, integrated demand for ownership transparency.
Ethixbase360’s February 2026 guide, authored by Virna Di Palma, Natasha Martin, and James Swenson, establishes that UBO due diligence is no longer optional, reactive, or periodic. It must be continuous, defensible, and integrated with third-party approval, monitoring, and management across the full lifecycle of every supplier, partner, and intermediary relationship.
Multiple regulatory developments reinforce this shift. In the United States, the Corporate Transparency Act and FinCEN’s Beneficial Ownership Information regime have created new reporting obligations for privately held entities, though implementation has been fluid and enforcement posture continues to evolve. OFAC’s 50% Rule means that ownership stakes held by multiple sanctioned persons are aggregated, and indirect ownership through layered structures still counts, making name-based screening alone insufficient. The Bureau of Industry and Security’s updated affiliate and end-user controls extend ownership analysis directly into export compliance. In Europe, the EU Anti-Money Laundering Authority is advancing, but court rulings on privacy have created uneven registry access, making triangulation across multiple sources essential.
Geopolitically, the environment is more demanding than ever. Russia-related sanctions evasion networks, shadow fleets, layered ownership chains, and intermediary switching have demonstrated that enforcement agencies now trace value flows and beneficial control through corporate networks, not just named counterparties. China-related export controls have widened with greater attention to indirect exposure. Enforcement cases, including the $660 million Gunvor S.A. guilty plea and the $118 million Tigo Guatemala deferred prosecution agreement, illustrate how hidden ownership structures combined with weak third-party oversight produce material penalties.
Ethixbase360 argues that organisations that modernise their approach, moving from static, name-based screening to continuous, ownership-based intelligence, will reduce regulatory exposure, strengthen supply chain resilience, and make faster, safer decisions in a volatile global environment. The path forward is visibility, verifiability, and vigilance.
Key statistics & data points
In March 2024, Gunvor S.A. pleaded guilty to FCPA conspiracy and agreed to pay more than $660 million, the scheme relying on offshore structures, intermediaries, and cross-border payment routes across multiple jurisdictions to disguise bribery of Petroecuador officials.
Source: U.S. Department of Justice, as cited in Ethixbase360, UBO Due Diligence 2026, February 2026
In November 2025, Comunicaciones Celulares S.A. (Tigo Guatemala, subsidiary of Millicom International Cellular) agreed to pay approximately $118 million, a $60m fine plus $58.2m forfeiture, to resolve an FCPA investigation into bribery concealed through shell entities and fraudulent invoicing.
Source: U.S. Department of Justice, as cited in Ethixbase360, UBO Due Diligence 2026, February 2026
Across 2024, OFAC sanctioned hundreds of individuals and entities tied to Russia’s military industrial base and sanctions evasion networks spanning 17 jurisdictions, reinforcing that evasion depends on layered ownership chains and intermediaries that obscure ultimate control and benefit.
Source: OFAC, as cited in Ethixbase360, UBO Due Diligence 2026, February 2026
The most common beneficial ownership threshold is 25% direct or indirect ownership or control, but lower thresholds may apply in higher-risk contexts, and a person qualifies as a UBO without any equity stake if they exercise control through voting rights, director appointment powers, or contractual arrangements.
Source: FinCEN; FATF, as cited in Ethixbase360, UBO Due Diligence 2026, February 2026
Under OFAC’s 50% Rule, an entity is treated as blocked even if not named on the SDN List when one or more sanctioned persons collectively own 50% or more of it, ownership stakes of multiple blocked persons are added together and indirect ownership through layered structures counts toward the threshold.
Source: OFAC, as cited in Ethixbase360, UBO Due Diligence 2026, February 2026
In August 2025, OFAC designated Grinex, a cryptocurrency exchange, for facilitating billions of dollars in transfers intended to bypass sanctions, extending enforcement into digital finance and demonstrating that UBO monitoring must now cover digital asset intermediaries as well as conventional corporate structures.
Source: OFAC, as cited in Ethixbase360, UBO Due Diligence 2026, February 2026
Under the U.S. Corporate Transparency Act, the vast majority of in-scope reporting companies were required to file initial BOI reports by 21 March 2025, with updates due within 30 days of any ownership change, though a March 2025 interim FinCEN rule removed reporting requirements for U.S. companies, focusing obligations on foreign entities.
Source: FinCEN, as cited in Ethixbase360, UBO Due Diligence 2026, February 2026
Expert Quotes and Insights
"The question is no longer 'do we collect ownership information?' It is 'can we prove it, defend it, and monitor it continuously?'"
"In an environment where opacity is increasingly treated as risk in itself, transparency becomes a capability and a competitive advantage."
Chapter Breakdown
Chapter 1: Introduction — Why UBO Matters (p. 4)
Beneficial ownership has become a frontline issue in financial integrity, sanctions enforcement, and corporate resilience. Regulators are increasingly focused on hidden ownership structures enabling money laundering, sanctions evasion, and corruption. UBO due diligence must be continuous, defensible, and integrated with third-party approval, monitoring, and management.
Chapter 2: Foundations — What UBO Means in Practice (p. 5–7)
A beneficial owner is the natural person who ultimately owns, controls, or benefits from a legal entity. The most common threshold is 25% direct or indirect ownership, but control through voting rights, director appointment, or contractual arrangements also qualifies, with no equity required. Legal ownership tells you whose name is on the paperwork; beneficial ownership tells you who controls the entity and who profits. Any third-party due diligence that cannot establish beneficial ownership is incomplete.
Chapter 3: The New Risk Landscape — Why the Shift Happened (p. 8-9)
Geopolitical tensions and strategic rivalry have turned ownership structures into security and resilience issues. Russia-related sanctions have expanded alongside sophisticated evasion typologies including shadow fleets. China-related export controls have widened with greater attention to indirect exposure through affiliates. Enforcement is faster, broader, and more aggressive, sanctions exposure is increasingly found in corporate networks, not only in named counterparties. Ownership transparency is becoming a governance indicator.
Chapter 4: Why UBO Looks Different Today (p. 10)
Organisations face tighter rules, broader scope, more assertive enforcement, greater registry access complexity, and higher technology expectations. The question is no longer whether ownership information is collected but whether it can be proved, defended, and monitored continuously. UBO is now a determinative factor in whether a transaction is permissible, licensable, or must be declined altogether.
Chapter 5: Key Regulatory Updates — What to Track (p. 11-14)
Five regulatory environments are surveyed. In the US, the Corporate Transparency Act and FinCEN's BOI regime have staggered filing obligations with evolving scope. OFAC's 50% Rule requires aggregating ownership stakes of multiple blocked persons and tracing indirect ownership. BIS's affiliate approach extends export control compliance to ownership analysis. In Europe, AMLA is advancing but court rulings have restricted registry access. Globally, more rules combined with less registry visibility means multi-source triangulation is now essential.
Chapter 6: Why Programmes Fail (p. 15)
UBO programmes fail for three reasons: structural complexity (multi-layered chains, nominee arrangements, trusts, and hidden affiliates); data limitations (incomplete, self-reported, or privacy-restricted registry data); and operational constraints (manual processes, spreadsheets, screenshots, one-off registry searches, that cannot scale). The gap between policy and practice is where risk accumulates.
Chapter 7: What Good Looks Like in 2026 (p. 16)
Effective UBO due diligence in 2026 rests on five principles: ownership-based not name-based; risk-based and proportionate; continuous monitoring not one-time checks; evidence-led and audit-ready; and integrated across sanctions, export controls, and third-party risk management. Risk sits with the person who benefits or controls, not necessarily the person whose name appears on paper.
Chapter 8: The Maturity Model (p. 17)
Five stages of UBO capability: Stage 1 Ad hoc (reactive, high exposure); Stage 2 Basic (static onboarding snapshots); Stage 3 Standardised (defined policy, largely manual); Stage 4 Automated and intelligence-enabled (ownership mapping with automation and monitoring); Stage 5 Integrated ecosystem (UBO embedded across sanctions, export controls, ESG, and enterprise risk with board-level assurance). The goal is deliberate progression, not overnight transformation.
Chapter 9: Enforcement 2026 — What the Cases Show (p. 18-20)
Three case studies: Tigo Guatemala's $118 million FCPA penalty (2025) showing how majority ownership without operational control creates compliance blind spots. Gunvor S.A.'s $660 million guilty plea (2024) demonstrating corruption exposure in third-party payment channels. Russia-related OFAC enforcement across 17 jurisdictions, including the Grinex cryptocurrency exchange designation, showing authorities looking beyond named entities to how value flows through corporate structures.
Chapter 10: TPRM and Technology — From Screening to Ownership Intelligence (p. 21)
AI-enabled ownership mapping assembles structures across jurisdictions, identifies indirect control and hidden affiliates, and supports defensible decisions even with incomplete information. Continuous monitoring tracks sanctions updates alongside ownership changes. Technology must also connect UBO to supply chain transparency laws including the CSDDD, where ownership visibility is a core input into human rights risk assessment and supplier governance.
Chapter 11: The Path Forward — Building a Defensible UBO Programme (p. 22)
A modern UBO programme has six components: governance and accountability; multi-source verification (no single source is sufficient); ownership mapping and resolution workflows; real-time monitoring and event-driven triggers; technology-enabled scale (AI-enabled mapping and automated workflows are no longer optional); and audit-ready evidence with documented sources, rationale, and decision trails.
Chapter 12: Conclusion — Visibility, Verifiability, and Vigilance (p. 23)
Beneficial ownership sits at the centre of sanctions enforcement, export controls, supply chain integrity, and corporate governance. Organisations that move from static manual checks to continuous, evidence-led, ownership-based due diligence will operate with greater confidence. The path forward is visibility, verifiability, and vigilance.
Definitions and Entities
UBO (Ultimate Beneficial Owner)
The natural person who ultimately owns, controls, or materially benefits from a legal entity, whether directly or through intermediaries. A person may qualify as a UBO without any equity stake if they exercise control through voting rights, director appointment powers, financing covenants, or contractual arrangements. The global trend is toward broader definitions of control and greater scrutiny of indirect ownership, particularly where sanctions, export controls, and enforcement risk apply.
OFAC 50% Rule
A rule by which OFAC treats an entity as blocked, even if not named on the SDN List, if sanctioned persons own 50% or more of it in the aggregate, directly or indirectly. Ownership stakes of multiple blocked persons are added together; indirect ownership through layered structures counts. Organisations must understand and document the full ownership chain, not just screen the named entity.
Corporate Transparency Act (CTA)
A U.S. federal law requiring many privately held entities to file Beneficial Ownership Information reports with FinCEN identifying each beneficial owner. An interim FinCEN rule announced March 2025 removed requirements for U.S. companies and persons, focusing obligations on foreign entities. CTA reporting supports ownership analysis but should not replace independent, risk-based due diligence.
FinCEN (Financial Crimes Enforcement Network)
The U.S. Treasury bureau administering the Beneficial Ownership Information reporting regime under the Corporate Transparency Act, maintaining the BOI database for authorised access, and issuing AML compliance and beneficial ownership guidance.
BIS (Bureau of Industry and Security)
The U.S. Department of Commerce bureau administering Export Administration Regulations for dual-use goods and advanced technologies. Under its updated 50%/affiliates approach, BIS expects ownership analysis of counterparties, parents, subsidiaries, joint ventures, and related parties, making UBO a direct input into export control compliance and licensing decisions.
AMLA (EU Anti-Money Laundering Authority)
The EU body created under the 2024 AML package to harmonise AML rules, strengthen beneficial ownership transparency, and improve oversight consistency across member states, operating alongside reduced public registry access following the CJEU’s 2022 privacy ruling.
Shadow Fleet
A network of shipping vessels, trading entities, and financial intermediaries used to transport sanctioned goods, particularly Russian oil, by obscuring cargo nature and destination through layered ownership chains, flag switching, and offshore payment channels. OFAC, EU, and UK NCA have designated shadow fleet operators across multiple jurisdictions.
PEP (Politically Exposed Person)
A person holding or having held a prominent public function, including heads of state, senior officials, military leaders, state enterprise executives, and their close associates, representing elevated bribery and corruption risk. UBO analysis must identify whether a beneficial owner qualifies as a PEP, which affects the permissibility and required oversight level of a relationship.
BOI (Beneficial Ownership Information)
The structured data about beneficial owners required by the U.S. Corporate Transparency Act to be filed with FinCEN for in-scope entities. Must be updated within 30 days of any change in ownership or reported details. Access to the BOI database is restricted to authorised users, including law enforcement and financial institutions.
Ownership Intelligence
The evolved standard for UBO due diligence described by Ethixbase360, moving from name-based screening and static registry searches toward continuous, AI-enabled mapping of ownership structures across jurisdictions, identification of indirect control and hidden affiliates, and real-time monitoring integrated across sanctions, export controls, ESG, procurement, and enterprise risk.
Frequently Asked Questions
What is a UBO and why does it matter for compliance?
What is a UBO and why does it matter for compliance?
A UBO, or Ultimate Beneficial Owner, is the natural person who ultimately owns, controls, or materially benefits from a legal entity, whether directly or through intermediaries. Without visibility into beneficial ownership, organisations cannot be certain who they are doing business with, who benefits from a transaction, or where risk lies. A relationship that appears legitimate on paper can become a compliance and reputational liability if the true owner is sanctioned, politically exposed, or linked to illicit networks. Any third-party due diligence that cannot establish beneficial ownership is incomplete.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026.
What is OFAC's 50% Rule and how does it affect third-party due diligence
What is OFAC's 50% Rule and how does it affect third-party due diligence
OFAC’s 50% Rule holds that an entity is treated as blocked even if not named on the SDN List, if sanctioned persons own 50% or more of it in the aggregate, directly or indirectly. Ownership stakes of multiple blocked persons are added together, and indirect ownership through layered structures counts. Organisations must understand the full ownership chain and document how they reached their conclusion; name-based screening alone is insufficient.
Source: OFAC; Ethixbase360, UBO Due Diligence 2026, February 2026.
How do export controls relate to beneficial ownership?
How do export controls relate to beneficial ownership?
Under BIS’s updated 50%/affiliates approach, export control compliance requires looking beyond the named counterparty to understand who owns the entity and which parties it is linked to. Restricted parties use front companies, joint ventures, and layered ownership chains to access controlled technologies indirectly. UBO is therefore a determinative factor in whether a transaction is permissible, licensable, or must be declined.
Source: BIS; Ethixbase360, UBO Due Diligence 2026, February 2026.
What is the Corporate Transparency Act and what does it require?
What is the Corporate Transparency Act and what does it require?
The U.S. Corporate Transparency Act requires many privately held entities to file Beneficial Ownership Information reports with FinCEN, identifying each beneficial owner. A March 2025 interim rule removed requirements for U.S. companies and persons, focusing on foreign entities. For in-scope entities, updates are required within 30 days of ownership changes. CTA reporting supports but should not replace independent, risk-based due diligence.
Source: FinCEN; Ethixbase360, UBO Due Diligence 2026, February 2026.
Why is name-based screening alone insufficient for UBO compliance?
Why is name-based screening alone insufficient for UBO compliance?
Name-based screening identifies whether a named entity appears on a sanctions or adverse database, but does not reveal who ultimately controls it through intermediaries or whether it is linked to a restricted network through affiliates. Under OFAC’s 50% Rule, entities controlled by sanctioned persons are blocked even under different names. Under BIS’s affiliate approach, export control risk exists in the network around a counterparty. UBO analysis closes this gap by tracing ownership to the natural persons who ultimately benefit or control.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026.
What makes a UBO due diligence programme defensible in 2026?
What makes a UBO due diligence programme defensible in 2026?
A defensible programme rests on five principles: ownership-based, not name-based (looking through layers to detect hidden affiliates and control signals); risk-based and proportionate (effort allocated by sector, jurisdiction, and ownership complexity); continuous monitoring, not one-time checks; evidence-led and audit-ready (conclusions explainable with sources, methodology, timestamps, and decision trails); and integrated across sanctions, export controls, and TPRM.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026.
Why do UBO programmes fail?
Why do UBO programmes fail?
UBO programmes fail for three reasons: structural complexity (multi-layered chains, nominee arrangements, trusts, and hidden affiliates designed to obscure ownership); data limitations (incomplete, self-reported, or privacy-restricted registry data); and operational constraints (manual processes, questionnaires, spreadsheets, static screenshots that are slow, inconsistent, and cannot scale). The gap between policy and practice is where risk accumulates.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026.
What do the Gunvor and Tigo Guatemala enforcement cases teach compliance teams?
What do the Gunvor and Tigo Guatemala enforcement cases teach compliance teams?
Gunvor S.A. paid more than $660 million after a 2024 FCPA guilty plea for bribery concealed through offshore structures and intermediaries, demonstrating that corruption exposure sits in third-party payment channels where oversight is weakest. Tigo Guatemala’s $118 million 2025 penalty showed how majority ownership without operational control creates blind spots that bad actors exploit. Both cases reinforce that ownership is not the same as control, and limited information access is a red flag requiring escalation.
Source: DOJ; Ethixbase360, UBO Due Diligence 2026, February 2026.
How has Russia-related sanctions enforcement shaped UBO expectations?
How has Russia-related sanctions enforcement shaped UBO expectations?
TOFAC sanctioned hundreds of individuals and entities in Russia’s military industrial base across evasion networks spanning 17 jurisdictions in 2024. Russia’s shadow fleet uses layered ownership chains and offshore payment channels to evade restrictions. OFAC’s August 2025 designation of Grinex cryptocurrency exchange extended enforcement into digital finance. These actions demonstrate that sanctions compliance requires ownership and related-party visibility, not just list-based screening.
Source: OFAC; Ethixbase360, UBO Due Diligence 2026, February 2026.
How is technology changing UBO due diligence?
How is technology changing UBO due diligence?
AI-enabled ownership mapping assembles structures across jurisdictions, identifies indirect control and nominee patterns without relying on single registry searches. Continuous monitoring tracks sanctions updates alongside ownership changes so organisations respond when risk shifts rather than months later. Technology connects UBO diligence to CSDDD and modern slavery obligations, making ownership visibility a core input into human rights risk assessment. Ownership-based due diligence focusing on who benefits and who controls is now central to regulator expectations.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026.
What are the five stages of UBO programme maturity?
What are the five stages of UBO programme maturity?
Ethixbase360’s maturity model has five stages: Stage 1 Ad hoc (reactive, poorly documented, high exposure); Stage 2 Basic (collected at onboarding with limited verification); Stage 3 Standardised (defined policy and templates but largely manual); Stage 4 Automated and intelligence-enabled (ownership mapping with automation and monitoring); Stage 5 Integrated ecosystem (UBO embedded across sanctions, export controls, ESG, and enterprise risk with board-level assurance). The goal is deliberate progression, not overnight transformation.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026.
What are the six components of a defensible UBO programme?
What are the six components of a defensible UBO programme?
Ethixbase360 identifies six components: (1) governance and accountability, thresholds, escalation rules, clear ownership; (2) multi-source verification, no single source is sufficient; (3) ownership mapping and resolution workflows; (4) real-time monitoring and event-driven triggers; (5) technology-enabled scale, AI-enabled mapping and workflows are now baseline expectations, not optional; (6) audit-ready evidence, documented sources, rationale, and decision trails reconstructable months or years later.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026.
Key Takeaways and Actions
Move from name-based screening to ownership-based intelligence.
Risk sits with the person who benefits or controls, not the person whose name appears on paper. Build processes that look through layers, detect hidden affiliates, and apply the OFAC 50% Rule aggregation correctly.
Treat UBO as a continuous discipline, not a one-time onboarding task.
Ownership structures change and risk often emerges after onboarding. Establish refresh cycles and event-driven triggers so ownership data does not become a static snapshot that creates blind spots.
Integrate UBO across sanctions, export controls, and TPRM.
UBO analysis informs sanctions compliance, export control assessments, procurement, ESG due diligence, and supply chain governance. Strong programmes share ownership intelligence across functions and embed it into business decisions.
Apply the OFAC 50% Rule to all counterparty screening.
Trace ownership chains to aggregate stakes held by multiple sanctioned persons and identify indirect ownership through layered structures. Document the methodology and conclusions in a form that can withstand regulatory scrutiny.
Do not rely on a single data source for UBO verification.
Registry data can be incomplete, out of date, or privacy-restricted. Triangulate across registries, commercial databases, sanctions and PEP sources, adverse media, and questionnaires. Document what was checked and what could not be verified.
Build structured escalation paths for when ownership cannot be confirmed.
When ownership is unclear, the workflow should not default to approval. Risk teams need structured escalation, clear exception handling, and documented evidence trails that demonstrate what was assessed and what residual risk remains.
Invest in technology-enabled scale.
Manual UBO processes cannot keep pace with dynamic ownership risk. AI-enabled ownership mapping, automated resolution workflows, and real-time monitoring are now the baseline expectation, not an advanced capability.
Ensure audit-ready documentation at every stage.
Regulators and prosecutors expect firms to explain how conclusions were reached — with sources, methodology, timestamps, and decision trails. Maintain records that can be reconstructed months or years after the fact.
Assess ownership complexity in export control decisions.
Under BIS’s updated affiliate approach, the same relationship can trigger parallel sanctions and export control obligations. Identify front companies, joint venture structures, and layered ownership chains in sectors involving controlled technologies and dual-use goods.
Citation-Ready Snippets
↗Cite this Finding
Gunvor S.A. agreed to pay more than $660 million following a March 2024 FCPA guilty plea, with the scheme relying on offshore structures and intermediaries across multiple jurisdictions, demonstrating that corruption exposure sits in third-party payment channels where oversight is weakest, according to the U.S. Department of Justice as cited in Ethixbase360’s 2026 UBO guide.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026
https://ethixbase360.com/intelligence-hub-ubo-due-diligence-ebook-2026/
↗Cite this Finding
Under OFAC’s 50% Rule, an entity is treated as blocked even if not named on the SDN List when sanctioned persons collectively own 50% or more of it, with ownership stakes of multiple blocked persons aggregated and indirect ownership through layered structures counting toward the threshold, making name-based screening alone insufficient for sanctions compliance.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026
https://ethixbase360.com/intelligence-hub-ubo-due-diligence-ebook-2026/
↗Cite this Finding
UBO due diligence is no longer optional, reactive, or periodic; it must be continuous, defensible, and integrated with third-party approval, monitoring, and management across the full relationship lifecycle, according to Ethixbase360’s February 2026 guide on beneficial ownership.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026
https://ethixbase360.com/intelligence-hub-ubo-due-diligence-ebook-2026/
↗Cite this Finding
In an environment where opacity is increasingly treated as risk in itself, structured and technology-enabled UBO oversight, integrated with enhanced due diligence, is a strategic control for sanctions resilience, export-control defensibility, supply-chain integrity, and sustained market access, according to Ethixbase360’s 2026 guide.
Source: Ethixbase360, UBO Due Diligence 2026, February 2026
https://ethixbase360.com/intelligence-hub-ubo-due-diligence-ebook-2026/
Download the full guide
UBO Due Diligence eBook 2026 | Guide | 25 Pages | February 26