Talk to usTry the demo

Beneficial Ownership: What the FATF Standard Asks of Institutions and Countries

KYC, AML and digital identification

For: Compliance analyst or product owner who has to identify the people behind a legal-entity customer

The FATF definition of a beneficial owner, the cascade an institution follows for a company customer, what countries must hold in registers, and how EU, UK and UAE texts set thresholds and fallbacks.

For information; not legal advice.

A legal-entity customer is a structure, and an institution that onboards one must find out which natural persons stand behind it. This guide is for the compliance analyst or product owner who has to design that step, and it asks one question: what does the FATF standard mean by a beneficial owner, what does it require from the institution and from the country, and where do European Union, UK and UAE texts set their own thresholds and fallbacks? The article explains the concept as the primary texts state it. It does not describe how any company data is sourced or checked in a particular product.

The definition

The FATF Recommendations are the global anti-money laundering and counter-terrorist financing standard, and this guide uses the update of June 2026 as published by the Eurasian Group, a FATF-style regional body. The glossary of the Recommendations defines a beneficial owner for a legal person as the natural person who ultimately owns or controls the customer, or the natural person on whose behalf a transaction is being conducted. It also includes the natural persons who exercise ultimate effective control over a legal person. The glossary then states two consequences in one sentence.

Only a natural person can be an ultimate beneficial owner, and more than one natural person can be the ultimate beneficial owner of a given legal person.

The first half of that sentence rules out an answer that names another company. The second half tells the designer that the answer is a list and not a single field.

For legal arrangements such as express trusts, the glossary names a wider group: the settlor, the trustee, the protector if there is one, each beneficiary or the class of beneficiaries and objects of a power, and any other natural person exercising ultimate effective control over the arrangement. Where the trustee or another party to the arrangement is itself a legal person, the beneficial owner of that legal person has to be identified.

What the Recommendations ask of institutions

Recommendation 10 on customer due diligence lists, as its second measure, the identification of the beneficial owner.

Identifying the beneficial owner, and taking reasonable measures to verify the identity of the beneficial owner, such that the financial institution is satisfied that it knows who the beneficial owner is. For legal persons and arrangements this should include financial institutions understanding the ownership and control structure of the customer.

Three phrases in the quotation shape a design. "Reasonable measures" sets a standard that is less than absolute certainty and more than a declaration by the customer. "Satisfied that it knows" puts the judgement on the institution and not on the customer. "Understanding the ownership and control structure" means that the output is not only a list of names but also a picture of how those names relate to the customer.

The interpretive note to Recommendation 10 states what "reasonable" depends on. A footnote to the note says that in determining the reasonableness of the identity verification measures, regard should be had to the money laundering and terrorist financing risks posed by the customer and the business relationship. The extent of verification of a beneficial owner is therefore a risk decision, in the same way as the extent of verification of any customer.

Paragraph 5 of the note sets out what an institution should do for legal persons and legal arrangements. It begins with the customer. The institution should identify the customer and verify its identity, typically through name, legal form and proof of existence, the powers that regulate and bind the legal person together with the names of persons in senior management positions, and the address of the registered office and principal place of business. It then turns to the beneficial owners, and for legal persons it describes a sequence.

The first step is the identity of the natural persons, if any, who ultimately have a controlling ownership interest in the legal person. The note adds in brackets that there may be no such person, because ownership interests can be so diversified that no natural person, acting alone or together, exercises control through ownership. The second step applies to the extent that there is doubt about whether the persons with the controlling ownership interest are the beneficial owners, or where no natural person exerts control through ownership interests. In that case the institution identifies the natural persons, if any, who exercise control of the legal person or arrangement through other means. The third step applies where no natural person is identified under the first two. Then the institution should identify, and take reasonable measures to verify the identity of, the relevant natural person who holds the position of senior managing official.

A footnote to the note makes the logic explicit. It says that the three measures are not alternative options but cascading measures, each to be used where the previous measure has been applied and has not identified a beneficial owner. A system that lets an operator pick the senior manager first, because it is faster, departs from that logic.

On thresholds, the same note is careful. A controlling ownership interest depends on the ownership structure of the company and may be based on a threshold, and the example given is any person owning more than a certain percentage, such as 25%. The note to Recommendation 24 adds that a threshold should be determined from the jurisdiction's assessment of risk, with a maximum of 25%.

There is one exemption. Where the customer, or the owner of the controlling interest, is a company listed on a stock exchange and subject to disclosure requirements that ensure adequate transparency of beneficial ownership, or is a majority-owned subsidiary of such a company, it is not necessary to identify and verify the identity of any shareholder or beneficial owner of that company.

Where the information may come from

The note says that the relevant identification data may be obtained from a public register, from the customer or from other reliable sources. That sentence is permissive, and it must be read next to the verification duty in Recommendation 10. A register entry or a customer declaration is a source of data. The institution still has to take reasonable measures to verify the identity of the persons named.

For trusts the note lists the settlor, the trustees, the protector if any, the beneficiaries or class of beneficiaries, and any other natural person exercising ultimate effective control over the trust, including through a chain of control or ownership. For other types of arrangements the institution identifies persons in equivalent or similar positions. A footnote adds that for beneficiaries designated by characteristics or by class, the institution needs enough information to be able to establish the identity of the beneficiary at the time of payout or when the beneficiary intends to exercise vested rights.

What the Recommendations ask of countries

Recommendations 24 and 25 put the duty of transparency on countries, for legal persons and for legal arrangements. Recommendation 24 asks countries to ensure that there is adequate, accurate and up-to-date information on the beneficial ownership and control of legal persons that competent authorities can obtain or access rapidly and efficiently, through a register of beneficial ownership or an alternative mechanism. It also asks countries not to permit new bearer shares or bearer share warrants, to take effective measures against the misuse of nominee shareholders and directors, and to consider facilitating access to the information by financial institutions and other obliged businesses carrying out customer due diligence.

Three words that are defined

The interpretive note to Recommendation 24 defines the three adjectives that appear in the phrase. Adequate information is information sufficient to identify the natural persons who are the beneficial owners and the means and mechanisms through which they exercise ownership or control. Accurate information is information that has been verified, by verifying the identity and status of the beneficial owner using reliable, independently sourced documents, data or information, and the note adds that the extent of verification may vary with the level of risk. Up-to-date information is information that is as current as possible and updated within a reasonable period, and the note gives within one month following any change as an example.

The definition of accurate is the bridge to this article's subject. The standard asks the register to hold verified data, and it asks the institution to verify the beneficial owners it identifies. Two systems are supposed to meet in the middle.

A multi-pronged approach

The note asks countries to follow a multi-pronged approach to ensure that beneficial ownership can be determined in a timely manner. Countries should require companies to hold information on their own beneficial ownership and to cooperate with authorities and with institutions. They should require the information to be held by a public authority or body, or use an alternative mechanism that gives authorities efficient access. And they should use supplementary measures, which the note says may include information obtained by financial institutions in accordance with Recommendations 10 and 22. The last point matters for design. The standard counts the institution's own customer due diligence as one of the sources that make up the national picture, and a register is not meant to be the only line of defence.

For bearer shares it asks for a prohibition on new issuance, and for existing instruments to be converted into registered form or immobilised with a regulated intermediary, with holders notifying the company in the meantime so that it records their identity before any rights are exercised. For nominees it asks for one or more of three mechanisms: disclosure of nominee status and nominator, licensing, or a prohibition. A footnote to the nominee paragraph states the consequence for institutions: identifying the beneficial owner where a nominee holds a controlling interest requires establishing the identity of the natural person on whose behalf the nominee is ultimately acting.

The European Union

The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027, with a later date for some categories of obliged entities. It contains both sides of the picture, the definition of who is a beneficial owner and the duties of the institution that must find out.

Who is a beneficial owner

Article 51 says that the beneficial owners of legal entities are the natural persons who have a direct or indirect ownership interest in the corporate entity, or who control, directly or indirectly, the corporate or other legal entity, through ownership interest or by other means. It adds that control by other means shall be identified independently of and in parallel to the existence of an ownership interest. The two limbs are parallel and not sequential, which is a difference from the cascade in the FATF note.

Article 52 gives the ownership limb its threshold. An ownership interest means direct or indirect ownership of 25 % or more of the shares, voting rights or other ownership interest in the corporate entity, including rights to a share of profits, other internal resources or a liquidation balance. Indirect ownership is calculated by multiplying the shares or voting rights held by the intermediate entities along the chain and adding together the results of the various chains, and all shareholdings at every level are taken into account. As an illustration of the rule, a person who holds sixty percent of an intermediate company that holds half of the customer has an indirect interest of thirty percent, which is above the threshold of twenty-five percent.

The Regulation allows the threshold to fall in some cases. Where Member States identify categories of corporate entities exposed to higher risk, the Commission may adopt delegated acts that set a lower threshold for those categories, and the lower threshold shall be set at a maximum of 15 % of ownership interest unless the Commission concludes, on the basis of risk, that a higher threshold, in any case below 25 %, would be more proportionate.

Article 53 defines control. Control of a legal entity means the possibility to exercise, directly or indirectly, significant influence and impose relevant decisions within it. Control through ownership interest means ownership of 50 % plus one of the shares or voting rights. Control by other means includes in any case the majority of the voting rights, the right to appoint or remove a majority of the board, relevant veto or decision rights, and decisions regarding the distribution of profit or a shift in assets. Article 54 deals with multi-layered structures in which ownership and control coexist in different layers of a chain.

What the institution does

Article 20 lists identification of the beneficial owners and reasonable measures to verify their identity, so that the obliged entity is satisfied that it knows who the beneficial owner is and understands the ownership and control structure of the customer. Article 22(2) tells obliged entities to collect, for the beneficial owner of a legal entity, the information referred to in Article 62(1), second subparagraph, point (a). That information is all names and surnames, place and full date of birth, residential address, country of residence, nationality or nationalities, the number of an identity document such as a passport or national identity document, and a unique personal identification number where one exists. Article 62 separately lists the nature and extent of the beneficial interest and the date as of which it is held.

The fallback for the case in which nobody can be found is stated closely. Where, after exhausting all possible means of identification, no natural person is identified as a beneficial owner, or where there are doubts that the persons identified are the beneficial owners, obliged entities shall record that no beneficial owner was identified and identify all the natural persons holding the positions of senior managing officials in the legal entity and verify their identity. There is an exception to the verification step. Where verifying the identity of the senior managing officials may tip off the customer that the obliged entity has doubts about the beneficial ownership of the legal entity, the obliged entity shall abstain from that verification and shall instead record the steps taken to ascertain the identity of the beneficial owners and senior managing officials. Obliged entities also keep records of the actions taken and of the difficulties encountered during the identification process that led to resorting to a senior managing official. The wording matters: the senior managing officials are a last resort, and the fact that no beneficial owner was found is itself recorded.

Verifying the beneficial owner

Article 22(7) is the verification rule. Obliged entities verify the identity of the beneficial owner either in accordance with the rules that apply to the customer, which are the identity document route and the electronic identification route together with relevant qualified trust services, or by taking reasonable measures to obtain the necessary information, documents and data from the customer or other reliable sources, including public registers other than the central registers. The extent of the information consulted is determined having regard to the risks posed by the occasional transaction or the business relationship and the beneficial owner, including risks relating to the ownership structure. In addition, obliged entities shall verify the information on beneficial owners by consulting the central registers.

Two further duties tie the institution to the register. When entering into a new relationship with a legal entity that is subject to registration, the institution collects valid proof of registration or a recently issued excerpt of the register confirming validity of registration. And Article 24 requires obliged entities to report to the central registers any discrepancies they find between the register and the information they collect, without undue delay and in any case within 14 calendar days of detection. The Article then gives a derogation with conditions. An obliged entity may refrain from reporting and may instead request additional information from the customer where the discrepancies are limited to typographical errors, different ways of transliteration or minor inaccuracies that do not affect the identification of the beneficial owners or their position, or result from outdated data while the beneficial owners are known to the obliged entity from another reliable source and there are no grounds for suspicion of an intention to conceal information. In that case the entity invites the customer to submit the correct information to the central register without undue delay and in any case within 14 calendar days, and if the customer has not done so within that deadline the entity reports the discrepancy to the register. The derogation does not apply to cases of higher risk, to which the Regulation's enhanced due diligence measures apply. The Article as a whole does not apply to notaries, lawyers, other independent legal professionals, auditors, external accountants and tax advisors for information they receive while ascertaining a client's legal position or defending or representing the client in judicial proceedings, except where they provide legal advice in the situations the Regulation names.

What the entity itself must hold

The Regulation puts duties on the customer too. Article 62 requires legal entities to ensure that the beneficial ownership information they hold, provide to obliged entities or submit to central registers is adequate, accurate and up to date. The entity obtains that information within 28 calendar days of its creation, updates it promptly and in any case within 28 calendar days of any change, and updates it annually. Article 63 adds that legal entities shall provide information on their beneficial owners to obliged entities when the obliged entities apply customer due diligence. For the case where no beneficial owner can be determined, the entity states that fact with a justification and provides the details of its senior managing officials.

The United Kingdom

The UK Money Laundering Regulations define the beneficial owner of a body corporate in regulation 5. For a body corporate whose securities are not listed on a regulated market, the beneficial owner is any individual who exercises ultimate control over the management, any individual who ultimately owns or controls, directly or indirectly and including through bearer shareholdings, more than 25% of the shares or voting rights, or an individual who controls the body corporate. The UK threshold is stated as more than 25%. That differs from the EU wording of 25 % or more.

Regulation 28 sets the duties. Where the customer is beneficially owned by another person, the relevant person must identify the beneficial owner, take reasonable measures to verify the identity so that it is satisfied that it knows who the beneficial owner is, and, if the beneficial owner is a legal person or arrangement, take reasonable measures to understand its ownership and control structure. The senior person responsible for managing the body corporate may be treated as its beneficial owner only if the relevant person has exhausted all possible means of identifying the beneficial owner and has either not succeeded or is not satisfied that the individual identified is the beneficial owner. In that case the relevant person must keep written records of all the actions taken and take reasonable measures to verify the identity of the senior person.

One paragraph speaks directly to the question of registers. Relevant persons do not satisfy their requirements under the beneficial owner rule by relying solely on information delivered to the registrar under any enactment that requires information on registrable persons or beneficial owners to be delivered to the registrar. The text is explicit that the register is an input and not a substitute for the institution's own measures.

The United Arab Emirates

Article (10) of Cabinet Resolution No. (134) of 2025 addresses the beneficial owner of legal persons and legal arrangements. That Resolution is the executive regulation of Federal Decree by Law No. (10) of 2025 on anti-money laundering, and the Rulebook of the Central Bank of the UAE shows it as effective from 14/12/2025 and in force. Its Article (70) repeals Cabinet Resolution No. (10) of 2019, so a text that quotes the beneficial owner article of that earlier resolution describes a repealed provision. Financial institutions, designated non-financial businesses and professions, and virtual asset service providers shall take into account the risks of the crime arising from the customer and the business relationship, identify the beneficial owner of legal persons and legal arrangements, and take reasonable measures to verify that identity using documents, data or information from a reliable and independent source, so as to be satisfied that the beneficial owner's identity has been determined. For a customer that is a legal person, the first step is to obtain the identity of the natural person who ultimately owns, individually or jointly with another person, an actual controlling ownership interest or shares of 25% or more. The second step applies where there is doubt about that identification, or doubt that the natural person holding the ownership interest is the beneficial owner, or where no natural person exercises control through an ownership interest, and it identifies the natural person who exercises legal or actual control over the legal person, directly or indirectly or through any other means. The third step applies where no natural person is identified under the first two, and it identifies the relevant natural person or persons holding a senior management position. For a customer that is a legal arrangement, the article requires identifying the trustee, settlor, trust protector, beneficiaries or classes of beneficiaries, and any other natural person exercising ultimate effective control, including through a chain of ownership or control. It also requires adequate information on the beneficial owner to allow identification at the time of payment or when the beneficial owner intends to exercise legally acquired rights. Article (11) contains an exception: where the customer, or its controlling owner, is a company listed on a securities market subject to disclosure requirements that ensure sufficient transparency about the beneficial owner, or a subsidiary of such a company holding a controlling interest, it is permissible not to identify or verify any shareholder or beneficial owner of that company, and identity information may be obtained from public registers, from the customer or from other reliable sources.

Remote onboarding and the beneficial owner

The European Banking Authority guideline on remote customer onboarding addresses legal entities. It asks institutions to define in their policies which categories of legal entities they will onboard remotely, taking into account the level of money laundering risk associated with each category and the level of human intervention needed to validate the identification information. It asks that the remote solution have features to collect the relevant data to identify and verify the legal person, the data to verify that the natural person acting on its behalf is entitled to act, and the information on beneficial owners. For the natural person acting on behalf of the legal person, the identification process described for natural persons applies.

Read with the other texts, this gives a practical picture. The legal entity is identified from registry documents and registry data. The people involved are separate natural persons, each of whom is an individual identity to be established: the person who acts for the entity, and each beneficial owner whose identity must be verified to the extent that risk requires. A flow for legal entities therefore has a part that is about documents and registers, and a part that is the individual identity verification that any natural-person flow performs.

What good data looks like

Open Ownership publishes nine principles for effective beneficial ownership disclosure. They are grouped by what they improve: definition, coverage and detail enable disclosure and collection; central register, access and structured data facilitate storage and auditability; and verification, up-to-date and historical records, and sanctions and enforcement improve quality and reliability.

The verification principle is the closest to the institution's own work. It asks for verification of information about the corporate vehicle, the beneficial owners, their status as beneficial owners, meaning the means through which ownership or control is held, and the individuals making the declaration. It lists mechanisms for the point of submission: ensuring values conform to known and expected patterns, ensuring values are real by cross-checking against existing authoritative systems and other government registers, and checking supporting evidence against original documents.

Differences to watch

The texts agree on the idea and differ in detail. The following points are the ones most likely to matter in a rule configuration.

  • The EU treats ownership and control as parallel limbs, while the FATF note and the UAE article describe a cascade in which control by other means applies where ownership does not identify a person.
  • The EU and UAE thresholds are stated as a quarter or more, the UK as more than a quarter, and the FATF note speaks of a maximum of a quarter when a country sets a threshold on the basis of risk.
  • All the texts treat the senior managing official as the last step, and the EU and UK require the fact that no owner was found to be recorded.
  • The EU requires institutions to consult central registers and to report discrepancies, while the UK states that reliance solely on registrar data does not satisfy the rule.

Questions to put to your own design

  • Does the flow end at a natural person for every ownership chain, or can it stop at another company?
  • Which threshold does your jurisdiction use, and is it stored as configuration with its legal source?
  • Does the logic apply ownership and control as the text of your jurisdiction requires, in parallel or in sequence?
  • What does the flow record when no beneficial owner can be found, and who approves the senior-official fallback?
  • Which sources besides the customer's declaration are consulted, and how are conflicts recorded?
  • How is the identity of each identified owner verified, and how does the extent of that verification follow risk?
  • What happens when the register and your findings disagree?
  • Is the structure chart, and not only the list of names, kept as part of the record?

Where this sits in a verification flow

Once the natural persons behind a legal-entity customer are named, each of them may need a verified identity. A verification flow built on NeuroVision KYC places the identity part of that step in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The document step detects, classifies and reads IDs, and document anti-fraud checks are included in every package. The liveness step is active: the person moves the face closer through two ovals. One-time links and QR hand-off let the person start the session on a phone. To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us