UBO Discovery: Mapping Ownership Through Corporate Layers

Onboarding a company is rarely as simple as verifying one director. Behind a single legal entity can sit holding companies, nominee shareholders, trusts, and cross-border vehicles designed to obscure who actually controls the money. Identifying the ultimate beneficial owner (UBO) — the natural person who owns or controls the entity — is where most KYB (Know Your Business) programs succeed or fail. This is general information, not legal advice, but the mechanics are consistent across most frameworks.

What Counts as a Beneficial Owner

Most regimes define a UBO using two tests: ownership and control. The EU's fifth and sixth Anti-Money Laundering Directives and the US FinCEN Beneficial Ownership rule both commonly use a 25% ownership threshold, though many higher-risk firms lower it to 10%. Control is broader and often missed: someone can hold zero shares but still direct the entity through voting rights, board appointment powers, or a nominee arrangement.

• Direct ownership: a person holding shares in the customer entity itself.
• Indirect ownership: shares held through one or more intermediate companies, where you multiply percentages down the chain.
• Control without ownership: golden shares, veto rights, or documented influence over management.

When no individual meets the threshold, most frameworks require you to record a senior managing official as a fallback — and to document why no true UBO was identifiable.

Tracing the Ownership Chain

Layered structures require you to walk each branch until you reach a natural person or hit a dead end. For a customer owned 60% by a holding company that is itself owned 50% by an individual, that person's indirect stake is 30% — above threshold. The work is arithmetic plus source verification at every node.

• Pull the corporate registry extract for each entity in the chain and record the registration number, jurisdiction, and date retrieved.
• Cross-check shareholder registers against articles of association, since registries can lag actual ownership.
• Flag opaque links: bearer shares, nominee directors, or entities in secrecy jurisdictions warrant enhanced due diligence.
• Screen every identified UBO against sanctions and PEP lists, not just the primary entity.

Trusts add a separate dimension. You typically need to capture the settlor, trustees, protector, beneficiaries, and any other person exercising ultimate control — each treated as a distinct verification subject.

Verifying the People You Find

Discovering a name is not verification. Once you have identified the natural persons, each one still needs identity confirmation to the same standard as a retail customer: a genuine document check, and where risk warrants, a liveness-bound selfie. The friction here is real — UBOs are often busy executives in different countries who never signed up to complete a verification flow.

This is where a chat-based verification step helps. Instead of routing an unfamiliar UBO through a web portal, you can send a scoped request over Telegram or WhatsApp that collects exactly the fields required — name, date of birth, document, proof of control — and nothing more. Data minimization matters especially for UBOs, because you are handling personal data of people who are not your direct customer and who have their own privacy expectations.

Documenting and Refreshing the Structure

Regulators expect you to show your reasoning, not just your conclusion. Store the full ownership diagram, the percentage math, the registry sources with retrieval dates, and the rationale for any fallback to a senior managing official. A snapshot decays: ownership changes through share transfers, restructures, and inheritance.

• Set an event-driven trigger when a registry filing or corporate action is detected.
• Apply configurable retention so UBO records persist for the statutory period, then expire automatically rather than accumulating indefinitely.
• Version each refresh so the audit trail shows what you knew, and when.

Done well, UBO discovery turns an opaque corporate wrapper into a defensible, verifiable map of the humans behind it — collected precisely, and kept only as long as the law requires.