Author: Leas Bachatene
Trying to identify the Ultimate Beneficial Owner (or UBO) of a third party can be challenging. Of course, knowing the identity of “The natural person(s) who ultimately owns or controls a customer and/or the natural person on whose behalf a transaction is being conducted”, should be the ultimate goal for any organisation. Not only is it, increasingly, a legal requirement, it can also help to mitigate reputational risk to the business by ensuring that, for example, the entity is not owned by or associated with a Politically Exposed Person or an individual subject to sanctions or engaged in illegal or corrupt activity.
But sometimes, despite an organisation’s most thorough efforts, the UBO remains elusive. However, that should not have to spell the end of a business relationship before it has even begun.
The problem with UBOs
One of the things that makes it hard to identify UBOs is the fact that their true identity can often be obscured by corporate layers or structures. It is not illegal to set up or operate a corporate structure per se, but they can be used as a vehicle for organised crime. Indeed, according to the OECD “almost every economic crime involves the misuse of corporate entities”. We saw this all too clearly with the Panama Papers wrongdoing of April 2016. Reported as the largest data leak in history, the Panama Papers exposed how some business owners have used hard-to-trace off-shore companies and tax havens for years to conceal their identity, their wealth, and their questionable business deals. The Paradise Papers leak just one year later was more of the same – more big names and brands using corporate structures to shield their identities and their wealth from higher taxes.
Such crime comes at a cost to the economy, with the UN Office on Drugs and Crime estimating that the amount of money laundered globally in one year is 2 – 5% of global GDP, while Tax Justice Network figures indicate that governments are losing upwards of $189bn a year via hidden offshore wealth.
Global drive for transparency
It is no wonder then, in light of the Panama and Paradise revelations, governments around the world have reformed regulations to help crack down on organised crime. These usher in new requirements on the identification of UBOs, aimed at improving transparency on the real owners of companies and other entities.
The European Union has been something of a driving force. It introduced new UBO reporting requirements in June 2021 as part of the 6th Anti-Money Laundering Directive Under the regulations, which are frequently updated, discrepancies relating to beneficial owner information found in the course of conducting due diligence need to be reported. There is some recognition that it may not always be possible to identify a UBO – in which case organisations are required to keep records to show the steps they have taken to find it.
Hong Kong has also tightened its UBO requirements. After the Panama Papers, it was identified as the “most active center in the world” for the creation of shell companies. The country’s Financial Services and Treasury Bureau responded by introducing the Significant Controllers Register, which is available to enforcement agencies on demand. Again, the requirement is to take “reasonable steps” to ascertain if there is a significant controller of the company and to identify them.
In the United States, The Customer Due Diligence Requirements for Financial Institutions Rule (the CDD Rule) defines a beneficial owner as an individual who owns 25% or more, directly or indirectly, of a business, and requires covered financial institutions to establish and maintain written policies and procedures that are “reasonably designed” to verify their identity.
Clearly, UBO requirements vary from one jurisdiction to the next, but in general, the onus is on organisations to do what they “reasonably” can to identify and verify who ultimately owns the company they’re doing business with.
The UBO challenge
This sounds perfectly reasonable but the reality of finding out exactly who is behind a legal entity can be fraught with difficulty – not just because of the different requirements from one jurisdiction to the next but also because definitions vary so much. Depending on where you are in the world, UBOs are defined as persons with a 25% or greater equity interest or voting rights, those who control a legal entity and/or those who benefit from a legal entity.
Ownership structures can be multi-layered and opaque. Sometimes there can be four, five or six entities to wade through before you can even start to get close to a ‘natural person’. Organisation A is owned by organisations B and C, which in turn are owned by organisations D and E, and on it goes. Adding to the complexity, information on UBOs is often inconsistent, fragmented and hard to find or access, with central or company-held registers in some jurisdictions, like in the UK, but none in others, such as in the US. Discovering that the ultimate beneficial owner is in a jurisdiction where shareholding information is simply not available is not only frustrating, it can seriously hinder or even halt progress. The result is that organisations often waste time and money doing all they can to try to find out who the UBO is, never to find the answers they need.
Time for a new approach
The good news is that there is another way. Rather than getting caught up in long-drawn-out and costly searches, organisations should put the onus on the third party to identify and verify their UBO. Asking third parties to provide details of their ultimate beneficial owner along with the relevant documentation as part of the due diligence questionnaire (DDQ) can significantly speed up the process. It means that organisations are able to run the appropriate checks on the individual or individuals registered as the ultimate beneficial owners much sooner than if they were having to do all the legwork themselves.
This approach also avoids unnecessary investigations. For example, if the third party reveals that their UBO is a British Virgin Islands or offshore institution, accessing individual names will be virtually impossible so there is no point even trying.
The fact that the UBO is an offshore structure does not necessarily mean that a deal is off the cards – walking away from a business relationship solely because it is owned by an offshore entity makes little business sense. The real issue is a lack of enforcement in the transparency behind the offshore structure, but all is not lost. Organisations can adequately assess the risk of doing business with an unknown UBO by weighing a multitude of different factors.
- Is this the first time they are working with this third party?
- Is the third party in a high-risk jurisdiction?
- Is the third party a listed organisation?
- Is the deal significant enough that it could drive bad practices for the third party to make it happen?
The answers to questions like these will help organisations decide on the best course of action for their business.
Knowing the UBO is the holy grail of managing third-party risk. It is the key to ensuring the integrity of any business deal, protecting an organisation’s reputation and complying with regulatory requirements. However, not knowing the UBO’s identity does not have to be a deal breaker. It may turn out that not doing business is more detrimental than moving forward with an unidentified UBO. The key is to assess the risk horizontally and holistically, and not simply against the UBO vertical.
