Skip to content
What is Ultimate Beneficial Ownership (UBO)?
Businesses do not always operate under the name of the person who controls them. Shell companies, layered ownership structures, and nominee arrangements can put significant distance between a legal entity and the individual who benefits from it. Ultimate beneficial ownership is how you close that gap.
What is ultimate beneficial ownership?
An ultimate beneficial owner (UBO) is the natural person who ultimately owns or controls a legal entity, or on whose behalf a transaction is conducted. That person may not appear on a company's official registration documents. They may hold their interest through a chain of companies, a trust, or nominee arrangements specifically designed to obscure their identity.
The Financial Action Task Force (FATF) defines a UBO as the natural person who ultimately owns or controls a customer and/or the natural person on whose behalf a transaction is being conducted, including those who exercise ultimate effective control over a legal person or arrangement.
Source: FATF, via Moody's ASIS InternationalWhat UBO means in practice
Most organisations understand UBO as a know-your-customer (KYC) or anti-money laundering (AML) obligation. That framing is too narrow. In a third-party risk context, UBO is the answer to a more fundamental question: do you know who you are doing business with?
A joint FATF and Egmont Group analysis of 106 case studies found that legal persons, principally shell companies, are a key feature in schemes designed to disguise beneficial ownership. (FATF / Egmont Group) Those structures are not always built with criminal intent. But they create the same problem for your due diligence programme regardless of intent: opacity. (SpyCloud)
Why are UBOs important?
Financial crime hides behind legal structures.
The UN Office on Drugs and Crime estimates that between 2% and 5% of global GDP is laundered each year, amounting to between $800 billion and $2 trillion annually. (UNODC) The vehicle of choice is the corporate structure. Shell companies, nominee directors, and layered holding arrangements create the distance criminals need between the crime and the money. UBO transparency is the mechanism that collapses that distance. (NAVEX)
Sanctions and regulatory exposure travel through ownership.
A vendor that looks clean at entity level may be controlled by a sanctioned individual, a PEP, or someone subject to asset freezes. If you process payments to that entity without identifying the UBO, you may be in breach of OFAC, OFSI, or EU sanctions regulations regardless of your intent. The legal entity is not on the sanctions list. The person behind it is. You need to know that person exists.
Ownership changes.
A third party you onboarded two years ago with a clean UBO profile may have changed hands since. Mergers, acquisitions, investments, and restructuring alter beneficial ownership regularly. Early data from operational beneficial ownership registries shows that approximately 18% of entities registered in 2024 required corrections to their beneficial ownership declarations. (EU BO Register data) Point-in-time UBO checks made at onboarding do not capture what happens afterward.
Regulators expect you to know.
The UK's own analysis found that 12% of disclosed beneficial owners could not be matched to reliable identity data, suggesting either weak internal processes or deliberate obfuscation. (TrustSphere AI, citing UK government analysis) That figure reflects the gap between what organisations report and what they can verify. Regulators are increasingly closing that gap through mandatory registry cross-referencing and enforcement.
Reputational risk is real.
Association with a vendor controlled by a corrupt individual, even through several layers of corporate structure, creates reputational and regulatory exposure. The layers do not constitute a defence. They are increasingly read as a signal that adequate due diligence was not conducted.
What legislation underpins UBO?
UBO requirements are not universal. The obligations you face depend on your jurisdiction, your sector, and where your third parties are incorporated. The direction of travel globally is toward greater transparency and stricter enforcement, but the current landscape remains fragmented.
EU Anti-Money Laundering Directives
The EU has progressively strengthened UBO requirements across successive AML Directives. Under the current framework, EU member states maintain centralised beneficial ownership registers for companies and trusts. The standard ownership threshold triggering disclosure is 25%, with a 15% threshold permitted for higher-risk entities under 6AMLD. Since the implementation of 6AMLD, member states must allow access to beneficial ownership registers to those with legitimate interest, with full public access frameworks expected by mid-2027. (ComplyAdvantage) Financial institutions and designated non-financial businesses and professions (DNFBPs) are required to conduct UBO identification as part of customer due diligence. (Verizon)
UK Persons of Significant Control (PSC) Register
In the UK, beneficial owners are referred to as Persons of Significant Control. The PSC register is held and published by Companies House in a fully public open data format, currently holding data on over 4 million companies. (World Bank, Beneficial Ownership Transparency) The UK Money Laundering Regulations (MLRs) require firms to identify all UBOs of new accounts. The Economic Crime and Corporate Transparency Act (ECCTA), introduced in 2023, expanded Companies House's powers to verify and challenge UBO information, with enhanced enforcement for overseas entities owning UK property. (Intelisys)
US Corporate Transparency Act (CTA) / FinCEN
The US CTA, implemented through FinCEN's Beneficial Ownership Information (BOI) reporting rule, was designed to require US-formed entities to disclose their beneficial owners to FinCEN. In March 2025, FinCEN issued an interim final rule that revised the definition of reporting company to cover only foreign entities registered to do business in the US, formally exempting domestic reporting companies from the CTA's BOI requirements. (FinCEN) The practical effect is that US-incorporated companies are no longer required to report to FinCEN, though financial institutions' own KYC obligations under the Bank Secrecy Act remain unchanged. (Sangfor Technologies)
FATF Recommendations 24 and 25
FATF Recommendations 24 and 25 set the global baseline for beneficial ownership transparency of legal persons and legal arrangements respectively. In March 2022, FATF agreed on tougher global beneficial ownership rules to stop criminals hiding illicit activities and dirty money behind secret corporate structures, closing loopholes that had allowed shell companies to be used as cover for criminal activity. (FATF) Countries' implementation of these standards is assessed through mutual evaluations, creating direct incentive for jurisdictions to strengthen their UBO regimes. (Verizon)
How can organisations build defensible UBO programmes?
A defensible UBO programme is not just about collecting ownership data. It is about being able to demonstrate to regulators, auditors, and counterparties that you took reasonable steps to identify who you are actually doing business with, kept that information current, and acted on what you found.
Define your scope and thresholds clearly.
Decide which relationships require UBO identification and at what ownership threshold. The standard starting point is 25%, but higher-risk relationships, sectors, or geographies may warrant a lower threshold. Define this in writing before you begin, so your approach is consistent and defensible.
Go beyond registry checks.
Public registers are a starting point, not a conclusion. Sumsub's 2024 analysis of pre-registration filings under the US Corporate Transparency Act found that 22% of disclosed beneficial owners had incomplete or inconsistent information when cross-referenced against government identity databases. (Sumsub 2024) Registry data should be cross-referenced against adverse media, sanctions lists, PEP databases, and independent identity verification. Do not treat a registry entry as confirmation of accuracy.
Trace ownership to a natural person, not a legal entity.
Your UBO programme should not stop at the first layer of corporate ownership. Every layer of holding companies, trusts, and nominee arrangements should be traced until you reach the natural person or persons who ultimately own or control the entity. Document each step of that trace.
Capture indirect control, not just ownership.
Some individuals exercise control over a legal entity without holding shares. Directors with sole signing authority, individuals who appoint or remove directors, and those who direct the business by other means are all potential UBOs under most regulatory frameworks, even if their ownership stake falls below the threshold.
Build ownership changes into your monitoring cycle.
UBO identification at onboarding is necessary but not sufficient. Mergers, acquisitions, restructurings, and investment activity alter beneficial ownership regularly and sometimes with no public announcement. Your ongoing monitoring programme should include triggers for re-screening: adverse media alerts, ownership change notifications, and periodic review cycles calibrated to the risk tier of the relationship.
Document your process and findings.
A defensible UBO programme requires evidence. Document the sources you consulted, the steps you took to trace ownership, the findings you made, and the decisions taken as a result. If a UBO was identified as a PEP or sanctions risk, document how you handled that finding. Regulators do not expect zero errors. They expect a process that is systematic, documented, and proportionate.
Apply risk-based escalation.
Not every UBO finding requires the same response. A PEP with no adverse information may be acceptable with enhanced monitoring. A UBO subject to active sanctions is not. Build clear escalation paths and approval processes so findings are acted on consistently rather than handled ad hoc.
Keep records audit-ready.
UBO records should be retained in a format that allows them to be produced on request. Regulatory examinations, law enforcement requests, and internal audits all require the ability to demonstrate what was known, when it was known, and what was done about it.
Frequently asked questions
What is a UBO?
A UBO, or ultimate beneficial owner, is the natural person who ultimately owns or controls a legal entity, regardless of what the entity's official registration documents show. That person may hold their interest through multiple layers of corporate structure, trusts, or nominee arrangements. The key word is "ultimate": you need to trace through every layer until you reach a human being.
Why is UBO identification important for third-party risk?
Because the risk profile of a legal entity is only as reliable as your knowledge of the person behind it. Sanctions, corruption investigations, PEP status, and reputational risk all attach to individuals, not companies. A third party with a clean entity-level profile can carry serious exposure if its ultimate beneficial owner is a sanctioned individual or subject to enforcement action.
What is the standard ownership threshold for UBO?
Most jurisdictions use 25% as the threshold at which a natural person is considered a beneficial owner. FATF recommends this as the maximum. The EU's 6AMLD allows member states to apply a 15% threshold for higher-risk companies. Some institutions apply lower thresholds for high-risk relationships regardless of regulatory requirements.
How often should UBO information be updated?
At minimum, UBO information should be reviewed when a relationship is renewed or extended, when adverse media or screening alerts fire, and when you become aware of ownership or structural changes. For high-risk relationships, periodic proactive review is best practice. Ownership changes are one of the most common ways a previously clean relationship becomes a risk exposure.
Do public beneficial ownership registers tell you everything you need to know?
No. Registers contain what companies have disclosed, not what is necessarily accurate. Registry checks should always be combined with adverse media screening, sanctions and PEP database checks, and independent identity verification for any relationship that warrants it.
What is the difference between UBO and KYC?
Know your customer (KYC) is the broader due diligence process used by financial institutions to verify the identity, nature, and risk profile of a customer before and during a relationship. UBO identification is a specific component of KYC, focused on identifying and verifying the natural persons who ultimately own or control the customer entity. You cannot complete KYC without completing UBO identification for non-individual customers.
Can a company have more than one UBO?
Yes. Any natural person who meets the ownership or control threshold is a UBO. A company with three shareholders each holding 35% has three UBOs. A company with a complex trust structure may have multiple individuals exercising different forms of control. All of them should be identified, verified, and screened.