Behind every company sits at least one natural person who ultimately owns or controls it. That person is the beneficial owner, the UBO (ultimate beneficial owner).
If you work in KYB or AML operations, beneficial ownership is a crucial data point in your onboarding file. Regulators ask for it and auditors verify it. The global framework governing who counts as a beneficial owner has changed more since 2022 than in the two decades before.
The legal definition: who qualifies as a UBO
A beneficial owner is any natural person who ultimately owns or controls a legal entity. Not the company that holds shares, the human being behind it. Corporate structures exist that obscure who is actually in charge: holding companies, nominee shareholders, trusts, layered subsidiaries. The concept of beneficial ownership cuts through those layers.
In the EU, the foundational definition comes from the Fourth Anti-Money Laundering Directive (Directive 2015/849, Art. 3(6)). A beneficial owner is any natural person who holds, directly or indirectly, more than 25% of the shares, voting rights, or ownership interest in a corporate entity, or who exercises control through other means. If no natural person can be identified through ownership or control, the senior managing official is recorded as the UBO by default.
The UK uses a parallel but distinct concept: Persons with Significant Control (PSC). Under the Small Business, Enterprise and Employment Act 2015, a PSC is anyone who holds more than 25% of shares or voting rights, can appoint or remove the majority of directors, or exercises significant influence or control. Same threshold, different terminology, different register infrastructure.
In the United States, the Corporate Transparency Act introduced beneficial ownership reporting to FinCEN, defining a beneficial owner as anyone who exercises "substantial control" over a reporting company or owns at least 25% of ownership interests. The CTA's implementation has been turbulent. We cover the full story in a separate post. The short version: after injunctions, reinstatements, and a March 2025 interim final rule, domestic companies are effectively exempt from reporting. Only foreign-formed entities registered to do business in the US must still file.
FATF Recommendation 24 sets the international standard. The March 2022 revision reframed the 25% ownership threshold as a maximum rather than a recommendation, a signal that lower thresholds may better serve the anti-money laundering purpose.
The 25% threshold and its limits
Most jurisdictions converge on 25% as the ownership or control trigger. The number is more arbitrary than it looks.
A person holding 24.9% through a direct chain sits below the declaration threshold. A person holding 13% through one subsidiary and 12% through another (25% in aggregate, split across parallel ownership paths) may or may not trigger the obligation depending on how the jurisdiction calculates indirect ownership. Under the current EU framework (AMLD4/5), member states have applied different calculation methods, producing different outcomes for the same structure.
The AMLR (Regulation (EU) 2024/1624, Art. 52), effective July 10 2027, addresses this. Indirect ownership will be calculated by multiplying percentages along each chain and summing across parallel paths. All shareholdings at every level must be considered. Member states may adopt a lower threshold, as low as 15%, for entities assessed as high risk. The threshold itself shifts from "more than 25%" to "at least 25%." That one-word change brings a new set of entities into scope.
The 25% line also misses control-by-other-means entirely. Voting agreements, the right to appoint or remove directors, veto powers, family arrangements. These can give a person effective control with zero ownership. AML frameworks recognise this category, but detecting it requires the company to disclose honestly in its UBO declaration. Shareholder chain analysis alone cannot surface it.
Why beneficial ownership matters
The concept exists to fight financial crime. Anonymous corporate structures enable money laundering and sanctions evasion. If you know who benefits from a company, you can better trace illicit flows.
Under EU AML directives and the upcoming AMLR, obliged entities (banks, payment institutions, insurers, accountants, lawyers, real estate agents, crypto-asset service providers) must identify and verify the beneficial owner of every corporate customer. CDD cannot be completed without it. EDD requires deeper verification for higher-risk relationships.
The register infrastructure underpinning this obligation has been in flux since the CJEU's November 2022 ruling reversed public access to UBO registers on privacy grounds. AMLD6 requires member states to transpose updated access rules by July 10 2026. The AMLR, applicable from July 10 2027, further harmonises the framework and mandates interconnection through BORIS. We covered the AMLD6 register provisions and their current transposition status in a separate post.
Beyond AML, the Corporate Sustainability Due Diligence Directive (CSDDD) extends governance obligations into value chains. Knowing who owns your business partners is no longer just an AML exercise. It feeds directly into the G (Governance) pillar of ESG.
UBO registers around the world
Open Ownership counts 104 countries with live beneficial ownership registers. Another 31 are implementing and 35 are at the planning stage. But "live register" is not the same as "accessible register." The gap between a register existing and being queryable from outside the country is where compliance teams run into trouble.
In Europe, the access spectrum runs from fully public registers (Estonia, Latvia, Poland, Iceland) to restricted registers accessible only to national authorities (Netherlands, Turkey, Belarus). In between sit legitimate-interest regimes with vastly different conditions: Denmark, Finland, and Luxembourg offer free access to obliged entities; Austria charges €4 per entry and Cyprus charges €100 per application; Germany has processing wait times exceeding a year; and Spain, Portugal, Croatia, Lithuania, and Bulgaria require national ID credentials.
Some countries have suspended public access entirely after the CJEU ruling and have yet to reopen. Italy's register has no current access. Slovakia's main register (RBO) closed to the public in July 2025, though a parallel register of public-sector partners remains open. Greece restricted access in December 2022 and faces EU infringement proceedings.
The UK's PSC register at Companies House remains public and free. Data quality is a different problem: Open Ownership found roughly 20% of PSC entries list no individual owner and another 20% show combined shareholdings exceeding 100%. Mandatory identity verification, effective November 2025, is a direct response.
Switzerland has no UBO register. One is expected around 2027, likely restricted to competent authorities. Hong Kong maintains a Significant Controllers Register at each company's registered office: not centrally, not publicly, accessible only to law enforcement.
The US had no centralised beneficial ownership register before the CTA, and after the March 2025 rule change, domestic companies are effectively exempt. Norway's register accepts filings but is not yet searchable. Armenia's register covers primarily the extractive sector.
Declared UBO vs. derived UBO
There are two ways to determine who the beneficial owner of a company is.
Declared UBO: the company files a declaration with a government authority. The register holds a legal statement: "Person X owns more than 25% of this entity." This carries regulatory weight and is what auditors expect to see.
Derived UBO: when register declarations are unavailable or inaccessible, an algorithm traces the shareholder chain across company registers, multiplies ownership percentages through intermediary entities, and identifies the natural persons at the end of the chain. The result is computed, not declared.
Both produce a list of names with ownership percentages. Both can be correct. They are different in kind. A register declaration is a legal document. A derived UBO is an analytical output.
Most KYB providers blend these into a single field without telling you which method was used. You get a UBO but cannot explain its source to an auditor. We wrote about this in detail in a separate post on declared vs. derived UBO.
What UBO identification looks like in practice
For a compliance analyst onboarding a corporate customer, UBO identification comes down to a sequence of concrete questions.
Who are the natural persons holding 25% or more of this entity, directly or indirectly? If the entity is in a jurisdiction with a UBO register, can you retrieve the register declaration? Is the data current?
If no register declaration is available (because the register is restricted or does not exist), can you trace the ownership chain through company registers to derive the UBO?
If no natural person meets the ownership threshold, who is the senior managing official?
And for each answer: can you document the source? A register extract, a filed document, a data point with a timestamp?
Most compliance processes break down on that last question. Having the data is one thing; tracing it to a source document is what the AMLR makes explicit from 2027.
How Topograph handles UBO data
Topograph retrieves UBO data live from official registers in 40+ countries. Every UBO in an API response is tagged with its source: declared at register or derived from the ownership graph.
Declared UBOs come directly from national beneficial ownership registers where Topograph has access, retrieved on demand, not from cached databases or batch exports. Derived UBOs are built from shareholder data queried in real time from official company registers, with full chain traversal and percentage multiplication across intermediary entities.
When both sources are available for the same entity, Topograph surfaces them together, so compliance teams can cross-check declared ownership against the computed chain and flag discrepancies. We maintain country-level documentation of what data is available and under which access conditions.
FAQ
What does UBO stand for?
Ultimate beneficial owner: the natural person who ultimately owns or controls a legal entity. The term is used across EU AML directives and FATF guidance, and adopted by most national frameworks. The UK equivalent is Person with Significant Control (PSC).
What is the 25% ownership threshold?
Most jurisdictions define a beneficial owner as any natural person holding at least 25% of shares or voting rights, or at least 25% of the ownership interest, in a corporate entity. The AMLR (effective July 2027) will standardise indirect-ownership calculation across the EU and allow member states to lower the threshold to 15% for high-risk entities.
What is the difference between declared and derived UBO?
A declared UBO comes from an official register filing: a legal statement by the company identifying its beneficial owners. A derived UBO is computed by tracing the shareholder chain through company registers and multiplying ownership percentages. Most KYB providers combine these without distinguishing between them.
Do all countries have UBO registers?
No. Open Ownership counts 104 countries with live registers, but access conditions vary widely. Some are public and free (UK, Estonia), some require legitimate-interest applications (Germany, Austria), some are restricted to authorities (Switzerland, Hong Kong), and some have been suspended (Italy, Slovakia's public register).
Does the US have a beneficial ownership register?
The Corporate Transparency Act created federal BOI reporting in 2024, but a March 2025 interim final rule exempted all domestic companies, narrowing the scope to roughly 12,000 foreign-formed entities. Congress is moving to make the exemption permanent and delete the data already collected.