Ultimate beneficial owner (UBO)

An ultimate beneficial owner (UBO) is the natural person who ultimately owns or controls a company, directly or through layers of intermediate entities. Most jurisdictions set the threshold at 25% of shares or voting rights, or effective control by other means. Regulated firms must identify, verify, and screen every UBO before onboarding a business customer.

UBO meaning: the person behind the paperwork

Companies do not launder money; people do. That is the logic behind ultimate beneficial ownership rules. A "beneficial owner" is always a human being, never another company, trust, or nominee. If Company A is owned by Company B, which is owned by Company C, the UBO is the individual standing at the top of that chain.

Two tests determine UBO status in nearly every framework:

1. Ownership: the person holds a qualifying percentage of shares, capital, or voting rights (typically 25%, calculated through the full chain of entities).
2. Control: the person exercises control by other means, such as the right to appoint or remove directors, veto rights, dominant influence over decisions, or acting as a senior managing official when no one meets the ownership test.

A person who fails the ownership test can still be a UBO through the control test. This matters in practice: sophisticated bad actors deliberately keep their stakes just under the threshold and govern through side agreements instead.

UBO identification sits inside the broader KYB (Know Your Business) process, alongside verifying the company's registration, status, and directors. It is required under the FATF Recommendations, the EU's anti-money-laundering framework, the UK's PSC regime, and the US Bank Secrecy Act rules for financial institutions.

What is a UBO vs. a shareholder, director, or nominee?

These terms get conflated, and the differences drive compliance outcomes:

• Shareholder of record: whoever appears on the share register. Can be a holding company, a fund, or a nominee, so it tells you little about who ultimately benefits.
• Director: manages the company but may hold no equity at all. Directors are verified in KYB, but directorship alone does not make someone a UBO unless the control test is met.
• Nominee: a person or firm holding shares on behalf of someone else. Nominees are precisely what UBO rules are designed to look through.
• UBO: the natural person at the end of every chain, once all intermediate entities, nominees, and trust arrangements are unwound.

UBO ownership thresholds by jurisdiction

There is no single global UBO threshold. The 25 percent figure dominates, but the exact wording (“more than 25 percent” versus “25 percent or more”), the control tests and the reporting obligations differ by regime. The table reflects the position in September 2026.

Two takeaways for compliance teams. First, if you operate across borders, build your workflow to the strictest applicable threshold rather than a single 25% rule. Second, the EU's shift from "more than 25%" to "25% or more" in July 2027 means a shareholder at exactly 25% becomes a UBO overnight; ownership data that was compliant under AMLD5 will need re-assessment.

FinCEN BOI and the Corporate Transparency Act: where US rules stand in 2026

The US beneficial-ownership landscape changed dramatically in 2025, and any pre-2025 guidance you have on file is likely wrong.

The Corporate Transparency Act (CTA) originally required most US companies to report their beneficial owners to FinCEN's BOI database, with a January 1, 2025 deadline for existing entities. After litigation and a change in enforcement posture, FinCEN issued an interim final rule in March 2025 that removed the reporting requirement for US companies and US persons entirely.

As of September 2026, the position is:

• Domestic US companies do not file BOI reports with FinCEN. The interim final rule redefined "reporting company" to cover only entities formed under foreign law that have registered to do business in a US state or Tribal jurisdiction (Federal Register, March 26, 2025).
• Foreign reporting companies still must report, but they are exempt from reporting beneficial owners who are US persons (FinCEN IFR Q\&A).
• A final rule is pending. FinCEN missed its original end-of-2025 target and a final Corporate Transparency Act rule was still under review in September 2026. Watch fincen.gov/boi for the published text.

Critically, none of this relieves financial institutions of their own obligations. The FinCEN CDD Rule still requires banks, broker-dealers, mutual funds, and futures firms to collect and verify beneficial ownership (25% equity plus a control person) when a legal-entity customer opens an account. In other words: the government's registry retreated, so the burden of ultimate beneficial ownership discovery sits even more squarely on regulated firms and their KYB tooling.

Why UBO discovery is hard

If UBO rules were as simple as "read the share register," compliance teams would not spend hours per case on them. The difficulty is structural:

• Layered entities. Ownership routed through three, five, or ten intermediate companies means percentages must be multiplied down each branch and aggregated across branches. A person holding 60% of a holding company that owns 45% of the target holds 27%, a UBO, even though neither single link looks decisive.
• Cross-border chains. Each layer may sit in a different registry, in a different language, with different disclosure standards. Some jurisdictions publish ownership data; others reveal almost nothing.
• Nominees, trusts, and foundations. Legal arrangements exist specifically to separate legal title from beneficial enjoyment. Trusts require identifying settlor, trustees, protector, and beneficiaries, not a single "owner."
• Stale and self-reported data. Registry filings lag reality, and criminals do not helpfully update them. Global Witness-style investigations and the FATF's own reviews have repeatedly found registers riddled with gaps and implausible entries.
• Deliberate threshold engineering. Splitting a stake into four 24.9% holdings defeats a naive ownership check, which is why the control test and risk-based judgment exist.

Manual approaches collapse under this complexity, which is why teams automate traversal of the ownership graph. UBO screening software resolves layered structures to natural persons and flags the branches it could not complete instead of hiding them.

UBO verification workflow: 6 steps

UBO verification is the process of proving that the individuals you identified as beneficial owners are real, correctly identified, and acceptable from a risk standpoint. A defensible workflow looks like this:

1. Collect the company's self-declaration. Ask the business customer to declare its ownership structure and UBOs. Regulations expect you to obtain this, but never to rely on it alone.
2. Retrieve registry and documentary evidence. Pull company filings, shareholder registers, and UBO/PSC register extracts for the target and every intermediate entity in the chain.
3. Resolve the ownership graph. Traverse each layer, calculate effective ownership percentages, apply the relevant threshold, and run the control test. Flag circular holdings, nominees, and trust structures for manual review.
4. Verify each UBO's identity. Treat every UBO like a KYC subject: government-ID verification and, where risk warrants, biometric liveness checks to confirm the document holder is a live, present person.
5. Screen every verified UBO. Run sanctions and watchlist screening plus PEP and adverse-media checks. A clean company with a sanctioned 30% owner is a prohibited relationship in most regimes.
6. Monitor and refresh. Ownership changes, and so do sanctions lists. Event-driven re-verification beats fixed annual reviews, and a material change should trigger enhanced due diligence.

Document every step. When a regulator asks why you onboarded a business, the answer needs to be a case file, not a recollection.

UBO screening: what you check owners against

UBO screening is step five above, and it is where financial-crime risk actually surfaces. At minimum, screen each beneficial owner against:

• Sanctions lists (OFAC SDN, EU consolidated list, UK OFSI, UN). Under OFAC's 50 Percent Rule, an entity majority-owned by sanctioned persons is itself blocked even if unlisted, you cannot apply that rule without knowing the owners.
• PEP databases, since politically exposed persons as owners trigger enhanced due diligence.
• Adverse media, for fraud, laundering, or corruption allegations that have not yet reached a formal list.
• Internal and regulator watchlists, including your own previously offboarded customers.

Screening once at onboarding is not enough; lists change daily. Dedicated UBO screening software automates both the initial sweep and ongoing re-screening, and routes hits into alert triage instead of a spreadsheet.

How Zyphe identifies and verifies UBOs

Zyphe’s KYB software purchases the live register record for the company, then traverses corporate shareholders through every available tier until it reaches natural persons. There is no fixed layer limit; the bound is a credit budget you set per verification, and branches the budget cuts stay visible as truncated so a reviewer can extend them node by node behind a cost preview. A branch that reaches a jurisdiction with no register coverage is held as an unresolved UBO proxy and is never reported as a person.

The threshold is 25 percent direct or indirect by default and configurable, with stakes multiplied along each chain: a person holding 50 percent of an entity that owns 60 percent of your customer holds 30 percent and is a UBO. Where nobody crosses it, the documented fallback records control through other means, then senior managing officials or directors, with the basis stored. Each identified UBO and director then receives a linked KYC flow with email invitations and reminders, and the KYB cannot be approved until it completes; PEP, sanctions and adverse media screening runs on the company and on every person found. For the review step, the UBO and EDD review desk assembles the trace, the screening results and a draft rationale for your MLRO.

Verification results, audit logs and proofs are what Zyphe retains. The owners’ documents and biometrics are processed transiently and stored in each individual’s own encrypted vault, so a complete UBO case file exists without a central database of directors’ passports. Book a demo with the structure that took your team three days.