Introducing complead. One AI-native platform for financial crime compliance. Read the story
New Ready Integrations available Check the new integrations

The Hidden UBO Problem: When Beneficial Ownership Cannot Be Clearly Established

In short

As of October 2026, when no beneficial owner can be identified after every possible means is exhausted, FATF, EU and UK rules fall back on the senior managing official. FATF guidance and the EU AML Regulation say that official is not the beneficial owner. The US CDD Rule always names one control person. EU and UK files must also record each step taken and each difficulty met.

Why can the 25 percent test leave no beneficial owner?

I work on KYB files at payment and electronic money institutions. This piece is about the files where no one passes the ownership test.

A common shortcut calls the senior managing official the beneficial owner of last resort when nobody passes the ownership test. FATF reads its standard differently. Its March 2023 guidance on beneficial ownership of legal persons says recording the official "does not amend or supersede the definition of who the beneficial owner is" and only sets out how due diligence continues when no owner can be identified (paragraph 33). The EU AML Regulation, which applies from 10 July 2027 for most obliged entities, puts it in one line: "the senior managing officials are not the beneficial owners" (recital 125).

The test was never built to guarantee a name. FATF's interpretive note to Recommendation 10 asks for the people with a controlling ownership interest "if any", because ownership can be spread so widely that no one, alone or together, controls through it. A footnote to its note on Recommendation 24 lets each country set the threshold "with a maximum of 25%". The current EU directive treats 25 percent plus one share as "an indication" of ownership and lets member states set a lower figure. That changes in 2027. From 10 July 2027 the AMLR draws the line at "25 % or more" (Art 52(1)), so a holder at exactly 25 percent meets it.

A file with no one above 25 percent is an ordinary result, and the work starts there.

Which structures leave no one above the threshold?

Split stakes: who owns a company when five holders have 20 percent each?

Picture an illustrative trading company with five unrelated shareholders at 20 percent each. None passes. The US needs "25 percent or more", the EU directive 25 percent plus one share and the UK "more than 25%". Now suppose three of them vote together under a shareholders' agreement. Between them they hold 60 percent of the votes, and the AMLR counts a majority of voting rights "whether or not shared by persons acting in concert" as control (Art 53(3)(a)). The three can be beneficial owners through control.

For a UK partnership other than an LLP, MLR reg 5(3) names anyone entitled to or controlling "more than 25%" of the capital, the profits or the votes, so ten limited partners at 10 percent each pass no ownership limb. The regulation then asks who "otherwise exercises ultimate control over the management" of the partnership, which can lead to the general partner and on to whoever owns it.

Layered chains: why multiplying to the last layer can mislead

The AMLR multiplies through each chain and adds the chains together (Art 52), unless its rule for chains that mix ownership and control applies (Art 54).

In an illustrative chain, A holds 60 percent of HoldCo, which holds 40 percent of the customer. Multiplied, A has 24 percent. But A controls HoldCo, and three texts look through that control. The current directive treats a holding above 25 percent by a corporate entity under a person's control as "an indication of indirect ownership" (Art 3(6)(a)(i)). The AMLR names whoever controls a legal entity with a direct ownership interest in the customer (Art 54(a)). The UK counts shares held through a "majority stake" (Companies Act 2006, Sch 1A paras 9 and 18). On each, A is a beneficial owner.

In a second chain, B holds 40 percent of HoldCo2, which holds 70 percent of the customer. Multiplied, B has 28 percent, above the AMLR's "25 % or more"; and because HoldCo2 controls the customer, Art 54(b) names B as well. The PSC test follows majority stakes only, so B is not a PSC through HoldCo2. MLR reg 5 counts indirect holdings without setting a method, so UK due diligence may name an owner the PSC register leaves out. That reading is not settled guidance; confirm it with your own legal review. Sanctions use a separate count, set out in OFAC's 50 percent rule on indirect ownership.

Trusts: who is the beneficial owner of a trust?

FATF's 2024 guidance on legal arrangements says firms "shall identify and verify all parties" listed in its glossary definition (paragraph 162). The UK names them: settlor, trustees, beneficiaries, the class of beneficiaries where the individuals have not yet been determined, and any individual with control over the trust (MLR reg 6(1)). When a trust owns 25 percent or more of a US legal entity customer, the ownership prong records the trustee (31 CFR 1010.230(d)(3)). One trust can give one name in a US file and five roles in a UK one. A politically exposed person can sit in any of those roles.

Nominees and bearer shares: how do they hide the owner?

A nominee holds shares or a board seat on someone else's instructions, so the register shows a real person who is not the owner. The AMLR lists "formal or informal nominee arrangements" among the other means of control (Art 53(4)(c)), which makes the nominator the person to find. Bearer shares hide the holder. The UK counts ownership "including through bearer share holdings" (MLR reg 5(1)(b)). Picture a director on 200 boards at one service address: the file has to show who gives the instructions.

The FATF and Egmont Group report Concealment of Beneficial Ownership (July 2018) analyzed 106 case studies and typologies submitted by 34 jurisdictions. Legal persons, "principally shell companies", were a key feature of the schemes; front companies and bearer shares were "less frequently exploited". FATF calls the sample "relatively small" and weighted toward a few jurisdictions that sent more cases.

Closed, missing or wrong registers: what then?

On 22 November 2022 the EU Court of Justice held invalid the directive provision that made beneficial ownership information accessible "in all cases to any member of the general public" (press release 188/22). Under AMLD6, which member states apply by 10 July 2027, firms see a company's statement that it has no beneficial owner, or that its owners could not be determined, only if they report a discrepancy or "provide proof of the steps they have taken" (Art 10(5)). In the US, FinCEN's BOI page says that its final rule became effective on 14 August 2026 and that US companies are exempt from BOI reporting. The same page's March 2025 alert limited reporting to entities formed under foreign law and registered to do business in a US state or tribal jurisdiction, which do not report US persons as beneficial owners. The August 2026 alert does not restate that foreign entity scope. BOI reporting is a separate regime from the CDD Rule. A UK firm does not meet its duty to identify the owner by "relying solely" on information delivered to the registrar (MLR reg 28(9)). Each layer needs its own check.

Know when the ownership behind a customer changes.

complead, formerly Sanction Scanner, records each change to a company's owners, directors and status as it occurs and compares it with the verified baseline, so the next review starts from what changed. Sandbox keys immediately, no integration fees, and it runs beside your current tool.

800+companies use complead
80+countries served

How does each regime handle the fallback?

Table 1. The senior managing official fallback by regime (sources as listed, read 21 October 2026)

Regime Who is named when no owner is found Condition Verify Record Source
FATF standard The person who holds the position of senior managing official, recorded as holding that position Ownership step, then control step, found no one ("cascading measures") Reasonable measures, by risk That the person holds the position INR.10 para 5(b)(i) and fn 37; 2023 guidance para 33
EU directive, now (as each member state transposed it) Senior managing official(s), listed inside the beneficial owner definition "after having exhausted all possible means and provided there are no grounds for suspicion", or doubt about the person found "the necessary reasonable measures" Actions taken and "any difficulties encountered" in verifying Directive 2015/849 Arts 3(6)(a)(ii), 13(1)(b)
EU AMLR, from 10 July 2027 (10 July 2029 for two categories of obliged entity) "all" senior managing officials, after recording "that no beneficial owner was identified" All possible means exhausted, or doubts about the person found Each official, unless that "may tip off the customer"; then the steps taken are recorded instead Actions taken and difficulties encountered Regulation 2024/1624 Art 22(2), recital 125
UK MLR 2017 (England and Wales, Scotland, Northern Ireland) "the senior person in that body corporate responsible for managing it", whom the firm "may treat" as the beneficial owner "exhausted all possible means" and found no one, or is not satisfied with the person found Reasonable measures Written records of all actions, and of difficulties in verifying regs 28(6) to (8)
UK register of overseas entities (ECTE Act 2022, UK wide) Managing officers, filed by the entity itself Statement of "no reasonable cause to believe" it has registrable owners, or that owners or their details are missing As the Act's section 16 regulations require The statement, the officers' details and what owner details it has s 4
US CDD Rule Always "a single individual" with significant responsibility to control, manage or direct; no separate fallback None: the ownership prong names each individual, "if any", with "25 percent or more" Risk based procedures, "to the extent reasonable and practicable" Identifying data, documents relied on and "the resolution of each substantive discrepancy"; five years from account closure (identity data) or from the record (verification) 31 CFR 1010.230(b), (d), (i)

Status is the first split. FATF and the AMLR record the official without making them the owner, while the current directive places the official inside its definition and the MLR let a firm treat the senior person as the beneficial owner.

Only the directive adds "provided there are no grounds for suspicion". The directive, the AMLR and the MLR all apply the fallback to doubt about the person found as well as to finding no one.

Head count differs as well: the AMLR asks for all senior managing officials; the US asks for one control person in every file, owner or not.

What changed in 2026

Three dated items bear on a file with no owner, as of October 2026:

  • 4 March 2026, UK. The statutory guidance on significant influence or control was published on gov.uk; its founder example is used in the section on the senior managing official below.
  • 14 August 2026, US. FinCEN's final rule on BOI reporting became effective, and US companies are exempt from BOI reporting (FinCEN's BOI page). BOI reporting is a separate regime from the CDD Rule.
  • 10 July 2027, EU, next. The AML Regulation applies for most obliged entities, with "25 % or more" as the ownership line and register discrepancy reports within 14 calendar days of detection. Member states apply AMLD6 by the same date.

Is the senior managing official the beneficial owner?

Not under FATF or the AMLR. FATF's guidance calls recording the official a due diligence step, and the AMLR says the officials are not the beneficial owners even though they are reported in their place. The current directive and the MLR word it differently: the directive lists the official inside its beneficial owner definition (Art 3(6)(a)(ii)), and MLR reg 28(6) lets a UK firm treat the senior person as the beneficial owner. In the US the control person is a beneficial owner under the rule itself (1010.230(d)(2)). Whichever text applies, the file should say that no owner was found, so a later reviewer does not read a manager as the owner.

Who counts differs too: the AMLR means the executive members of the management body and the people with executive functions who answer to it for daily management (Art 63(4)), so a board member without executive functions may fall outside it. The MLR say the senior person responsible for managing the body corporate. The US rule gives examples such as a chief executive officer, a chief financial officer, a managing member or a general partner.

First, test control by other means. FATF's guidance treats people with ultimate control as beneficial owners "regardless of whether they own shares above any specified minimum ownership threshold" (para 35). The UK statutory guidance on significant influence or control (4 March 2026) describes a founder who no longer has a significant shareholding but whose voting recommendations are "always or almost always followed" by the majority shareholders (para 3.3). Such a founder would exercise significant influence or control, a PSC condition, and the file may have an owner after all. Advice given in a professional capacity, by a lawyer or an accountant for example, does not on its own count (para 4.2). Screen the official too.

What should the file record before you name an official?

An auditor reading the file asks two things: did the firm look properly, and does the record show it. The AMLR asks for records of "the actions taken as well as of the difficulties encountered" (Art 22(2)), the MLR ask for written records of every action (reg 28(8)), and the US rule asks for "the resolution of each substantive discrepancy" (1010.230(i)). Table 2 turns that into seven steps; its last column is one possible split, and your own policy sets it.

Write each difficulty so that someone else could repeat the check. "Complex structure" tells an auditor nothing. "Register in country B returned no shareholder data for HoldCo2; shareholder register requested from the customer twice, no reply after 10 days" says what was tried, where it failed and what is still open, which is the detail the AMLR's "difficulties encountered" wording points to.

Table 2. The record before naming a senior managing official, step by step

Step Evidence What the file records Who decides (illustrative)
1. Register checked Extract from each register in the chain, dated Where the register disagrees with what you found, and whether a discrepancy report was filed Analyst
2. Declaration and structure chart The customer's signed declaration (in the US, the certification form); a chart to the last layer Each layer with its source and date Analyst
3. Independent sources Filings, accounts, shareholder agreements, trust deed Which sources were used and which conflict Analyst
4. Control tested Voting agreements, rights to appoint the board, nominee agreements, family links The result of each control test Analyst, then a second reviewer
5. Reasons for doubt Gaps and conflicts from steps 1 to 4 Written reasons and the difficulties met Analyst
6. Official identified and verified Identity evidence for each official The verification, or (AMLR) why verifying would tip off the customer and which steps were taken instead Analyst; MLRO where tipping off is the reason
7. Sign off Risk rating, enhanced due diligence decision, next review date Who decided, when and on what MLRO or a delegated approver

Two steps reach beyond the file. The current directive already requires obliged entities to report register discrepancies (Art 30(4)). From 10 July 2027 the report goes to the central register "without undue delay" and within 14 calendar days of detection (AMLR Art 24(1)). A firm may instead ask the customer for more information when the gap is a typing or transliteration error or a minor inaccuracy that does not change who the owners are, or outdated data where it knows the owners from another reliable source and has no grounds for suspicion (Art 24(2)). The UK has its own discrepancy duty (MLR reg 30A). And once AMLD6 applies, the steps record is what lets a firm see a company's own "no beneficial owner" statement and its justification (Art 10(5)).

The analyst who wrote the record may be gone by the time an auditor reads it, so the trail has to include the layers that never resolved: complead's KYB and UBO verification reports them as unresolved instead of dropping them.

Lead on compliance.

Join 800+ companies that trust complead to detect risk, prevent fraud and stay compliant.

One Platformall compliance, risk & fraud requirements in a platform

When is a missing UBO a reason to stop?

Picture an illustrative applicant owned by a company in a second country, which a foundation in a third country owns, with a director who signs for 40 other entities and nobody willing to send the foundation's charter. That file has not exhausted every possible means; the customer has refused the one document that would settle the question.

The current directive allows the fallback only "provided there are no grounds for suspicion". AMLR recital 126, written about the entities' own reporting, adds that "difficulties in obtaining the information should not be a valid reason to avoid the identification effort". FATF lists an ownership structure that "appears unusual or excessively complex given the nature of the company's business" among its examples of higher risk. When refusal, layers in high risk countries or nominee patterns point to concealment, recording an official is the wrong tool. What remains is enhanced due diligence, declining or exiting the relationship, and an internal report to the MLRO under the firm's own process, without alerting the customer.

One decision is left. Record an official with a full trail because every means is exhausted and nothing points to concealment, or treat the gap itself as the risk and move the case to enhanced due diligence or exit.

Frequently asked questions

Who counts as a senior managing official?

Under the EU AML Regulation, the executive members of the management body and the people with executive functions who answer to that body for the entity's daily management (Art 63(4)), so a board member without executive functions may fall outside it. The UK MLR say the senior person responsible for managing the body corporate. FATF speaks of the natural person who holds the position of senior managing official.

Does the US CDD Rule have a senior managing official fallback?

Not as a separate step. The rule always asks for "a single individual" with significant responsibility to control, manage or direct the customer, such as a chief executive officer or a general partner, and that person is a beneficial owner under the rule. The ownership prong names each individual, "if any", with "25 percent or more". A US file with no owner at that level still names one control person. BOI reporting is a separate regime from the CDD Rule.

Do you have to report a register discrepancy?

In the EU, the current directive already requires obliged entities to report register discrepancies (Art 30(4)). From 10 July 2027 the AMLR sets the timing: "without undue delay" and within 14 calendar days of detection (Art 24(1)). A firm may instead ask the customer for more information over a typing error or a minor inaccuracy, or over outdated data where it knows the owners from another reliable source and has no grounds for suspicion. In the UK, regulated firms report discrepancies under MLR reg 30A.

What is control through other means?

Control that does not come from a holding above the threshold. The AMLR counts a majority of voting rights "whether or not shared by persons acting in concert" (Art 53(3)(a)) and lists "formal or informal nominee arrangements" among the other means (Art 53(4)(c)). FATF's guidance treats people with ultimate control as beneficial owners "regardless of whether they own shares above any specified minimum ownership threshold" (para 35). The UK guidance example is a founder whose voting recommendations are "always or almost always followed".

Does the EU threshold change in 2027?

The wording does. The current directive treats 25 percent plus one share as "an indication" of ownership and lets member states set a lower figure. From 10 July 2027 the AMLR draws the line at "25 % or more" (Art 52(1)), multiplying through each chain and adding the chains together, so a holder at exactly 25 percent meets it. Where ownership and control mix along a chain, the AMLR's Art 54 decides instead.

  • beneficial owner cannot be identified
  • hidden ubo
  • senior managing official
  • ubo verification
Dilara Diker
Written by Dilara Diker Head of Compliance Financial crime compliance since 2017

Dilara Diker is Head of Compliance at an electronic money institution in Istanbul. Dilara has worked in financial crime compliance since 2017: as an AML analyst at HSBC, a compliance specialist at Deloitte, and a senior compliance analyst and then Compliance Lead at iyzico. Dilara holds the MASAK compliance officer license and writes for complead as a guest author on beneficial ownership and KYB.

  • MASAK compliance officer license (2026)
  • ICA Advanced Financial Crime and Sanctions Course (2026)
  • Compliance Management Certificate Program, Istanbul Bilgi University (2025)

Writes about Beneficial ownership and KYB, AML compliance in payments and e-money, Financial crime operations

Originally published

Back to blog