To programmatically verify UBOs for KYB, trace each ownership layer to the people who ultimately own or control the business, calculate indirect interests, then verify identities and screen relevant risks. Many jurisdictions use a 25% ownership threshold, but the applicable threshold and control tests vary. An ownership chart is a starting point, not the conclusion: the evidence must support who sits at the end of the chain.
Complex ownership can make business onboarding feel less like a single check and more like an investigation. The aim is to make that process systematic without treating automation as the final decision. This article explains what UBO verification involves, how to map layered ownership and assess each person against relevant criteria, and how identity checks, sanctions screening and ongoing reviews fit into KYB onboarding. It also explains when human review matters, so the process is efficient and its conclusions remain grounded in evidence.
Key Takeaways
Start with the relevant jurisdiction’s ownership and control criteria; a single threshold won’t fit every KYB case.- Map each layer of ownership to the individuals at the end of the chain, and preserve the evidence behind your conclusions.
- Combine identity checks with risk screening, then use enhanced due diligence when findings call for closer review.
- Build UBO checks into onboarding so ownership information, verification results, and follow-up reviews form a coherent process.
Table of Contents
- What is an Ultimate Beneficial Owner (UBO)?
- How do you verify UBOs when ownership structures are complex or multi-layered?
- AML/KYC screening and enhanced due diligence
- UBO verification during business onboarding
- Gemba: Fast time to market embedded banking
What is an Ultimate Beneficial Owner (UBO)?
An ultimate beneficial owner (UBO) is the natural person who ultimately owns or controls a legal entity. Ownership may be direct or held through a company, trust or other structure. The goal is to identify the people behind the business, rather than stop at its registered shareholders. If a shareholder is another company, trace the ownership until you identify individuals with beneficial interests or effective control. The findings inform a KYB decision and can reveal structures that may conceal money laundering.
The Financial Action Task Force (FATF) sets international standards for identifying beneficial owners. Its Recommendation 10 calls for customer due diligence that identifies beneficial owners, takes reasonable steps to verify their identities, and builds understanding of ownership and control. Recommendations 24 and 25 address transparency for legal persons and arrangements such as trusts. FATF set beneficial ownership standards in 2003; in 2012, 198 jurisdictions agreed to its standards. These recommendations provide a framework, while local rules determine the specific tests used during onboarding.
Thresholds differ across jurisdictions, so a percentage alone may not settle the question. Some jurisdictions, including South Africa and Colombia, use a 5% ownership threshold. To trace indirect interests, follow each company in the chain and calculate the person’s share at each layer. For example, a person owning 50% of one company, which owns 60% of another, has a 30% indirect interest in the latter. An ownership map should show each entity, holding percentage, and control route, including voting rights where relevant.
Build that map by collecting incorporation records, shareholder registers, organizational charts, and identity documents. Extract names, share classes, and ownership percentages from each document, then compare them with government registries and commercial databases. Check that company names, registration details, dates, and share totals align across records. A mismatch, missing layer, or unexplained control right should remain visible for review, not be silently resolved by automation. According to the European Union, the Anti-Money Laundering Regulation (EU) 2024/1624 generally applies from 10 July 2027, with certain exceptions. This makes jurisdiction-aware evidence and decision records important parts of the verification process.
How do you verify UBOs when ownership structures are complex or multi-layered?
A programmatic KYB workflow should connect each owner or controller to evidence and a reviewable decision. The Financial Crimes Enforcement Network (FinCEN) Customer Due Diligence Rule generally covers individuals holding 25% or more ownership and one individual exercising control.
Identifying Owners and Controllers
Identify the natural people with ownership interests, decision-making authority or other significant control over the business. Control can extend beyond share ownership, for example through voting arrangements or governance rights. To understand how to programmatically verify UBOs for KYB, record each relationship as a traceable link between a person, an entity and supporting evidence. Flag unexplained links for review.
Automated Identity and Risk Checks
Automated checks compare identity details and documents with available records, then screen people against relevant watchlists. They help teams process connected owners consistently while directing reviewers’ attention to possible matches and conflicting evidence. A workflow for how to programmatically verify UBOs for KYB should retain the source, date and outcome of each check. A system-generated match is a prompt for review, not a final determination.
For KYB, collect the business’s registration details, ownership records, each person’s identifying information and evidence of their ownership or control. Verify the data against reliable sources, and record why each person is included in the case.
In the United States, privacy, data-retention and state-specific rules can affect how personal information is collected, accessed and kept. Define the business purpose, limit access to relevant staff, and document retention and deletion practices that account for applicable state requirements.
Keep an audit trail of source documents, screening outcomes, reviewer decisions and subsequent changes. Monitor ownership and risk information after onboarding, and reopen the affected review when new evidence changes the assessment.
Businesses planning financial services can consider how multi-currency IBAN accounts fit their broader onboarding journey.
AML/KYC screening and enhanced due diligence
After identifying beneficial owners, screen each person for potential links to sanctions, politically exposed persons (PEPs), adverse media and regulatory enforcement. These checks add an individual risk perspective to know-your-business processes: company registration alone cannot reveal every concern associated with the people behind an entity.
Screen each UBO against applicable sanctions lists and terrorism-financing watchlists, then search for relevant adverse media and enforcement records. Compare identifying details, not just names, because similar names can belong to different people. For every search, record the source, date, identifiers compared and outcome. Review potential matches against the person’s identity and available evidence before using them to inform an onboarding decision.
PEP screening identifies people whose public roles may warrant closer risk assessment. A PEP result calls for analysis, not an assumption of wrongdoing. Review the person’s role, their relationship to the business and the context of any linked reporting. For example, check an adverse-media result about a similarly named individual against location, occupation and other identifiers before associating it with a UBO.
Enhanced due diligence (EDD) involves a deeper examination when screening results or the ownership profile raise concerns. The review may seek more information about the source of funds, expected account activity, business purpose and relationships between owners and associated people. Compare the explanations with company records and proposed activity. Document and escalate material gaps, contradictory details or unexplained control arrangements for a reasoned decision.
Keep screening proportionate to the risks identified. A clear result, a resolved name similarity and a credible adverse report carry different weight. Maintain an audit trail of the evidence reviewed, decisions made and reasons for escalation. Refresh risk information when significant ownership changes or new adverse information emerge. An annual review can also compare current findings with the previous assessment. These records make compliance decisions traceable rather than dependent on undocumented judgment.
UBO verification during business onboarding
UBO verification belongs within corporate onboarding, not in a separate review after approval. For financial institutions, payment processors and businesses in regulated industries, an onboarding decision depends on understanding the company, its owners and its risk profile together. A registry search may be quick, but the record can miss a recent ownership change. Compare it with current shareholder documents before relying on it.
Make the process a sequence of connected checks. First, collect the applicant’s registration details and ownership documents. Next, map the ownership and identify each UBO. Then verify identities, screen individuals for sanctions and other relevant risks, and record the evidence behind the decision. This structure keeps manual review focused on missing, inconsistent or higher-risk information instead of routine data entry.
Timing often depends on the people and records involved. Applicants may spend weeks gathering identity documents from owners, and submitted images may be unusable. A described KYB workflow estimates that beneficial-owner verification can take a week and a half, compared with under a minute for individual verification. Set expectations by explaining what each owner needs to provide, and flag incomplete documents early so they do not delay the corporate application.
Onboarding should also define what happens after approval. Keep the initial ownership map, screening results, reviewer decisions and document dates together so later reviews can compare new findings with the original case. Monitor filed ownership changes and relevant risk information. If a change affects one owner, reopen that part of the case rather than repeating every completed check. This creates a clear trail from application to decision and ongoing monitoring.
For teams refining financial-product onboarding, explore your onboarding approach alongside the customer and ownership checks that support it.
Gemba: Fast time to market embedded banking
Gemba helps non-banks bring branded financial services to market through fast time to market embedded banking. For businesses building a financial product, UBO verification is one part of a broader onboarding design. Ownership checks need to align with the accounts and payment services customers will use.
A White-label Banking Interface supports a branded customer experience, while Ultra fast bulk payments and Global payroll serve distinct business payment needs. The right fit depends on the service you’re building and how it connects with your customer journey. Gemba’s banking infrastructure is a practical next step if you want to launch branded financial services, rather than obtain a standalone UBO-checking tool.
Article by Alexander Legoshin. To discuss your embedded banking plans, contact Gemba or visit ge.mba.
Build verification into your next-stage design
As your business grows, how to programmatically verify UBOs for KYB becomes a design question: can ownership evidence, review decisions and subsequent changes stay connected as services evolve? Treat verification as part of the operating model, not a checkpoint that ends at account approval. Clear accountability for exceptions and disciplined record-keeping help your team adapt processes without losing sight of why each decision was made.
For businesses developing embedded financial services, the next step is to align that operating model with the customer experience and infrastructure behind it. Gemba can discuss how its banking infrastructure fits your plans, including how KYB and AML compliance management works within your broader service design.
Talk with Gemba about your plans and consider how a thoughtful verification framework can support responsible growth. Keep the standard of evidence high, and let your services grow on a foundation your team can explain. This article was written by Alexander Legoshin.
Frequently Asked Questions
What is UBO verification?
UBO verification tests whether evidence supports the people reported as owners or controllers, rather than relying on names listed on an application. For example, if a shareholder is a corporate entity, trace its ownership and compare the resulting individual with the applicant’s declaration. A sound record distinguishes verified identity, the verified basis for ownership and unresolved inconsistencies, helping reviewers make decisions from evidence rather than assertion.
Can RegTech Tools Help Mitigate UBO Risks?
Yes. RegTech tools can extract ownership data from filings, connect entities across records and run identity or watchlist checks consistently. They can flag duplicate identities, missing ownership links and possible matches for review. Retain source details and results to support sound decisions, and send ambiguous findings to a reviewer. Automation can organize evidence and surface anomalies, but it should not replace accountable judgment.
How Do Companies Identify a UBO?
Companies identify UBOs by applying relevant ownership and control tests to corporate records, then tracing qualifying interests to natural persons. For example, a person with a small shareholding but contractual veto rights over major decisions could be missed by an ownership-only search. Compare shareholder data with governance documents, and record why each associated person was included in or excluded from the assessment.
How do you build a UBO verification workflow step by step?
Build the workflow in gated stages: identify the entity and relevant jurisdiction; collect company and owner data; resolve each entity layer; assess direct and indirect interests and control; verify identities; screen for risks; and route exceptions for review. Set a completion rule so a case cannot close while required checks remain outstanding. Record the reason for each exception, such as a missing filing or identity mismatch.
How do you verify UBO data against official sources?
Start with the official company registry for the entity’s registration jurisdiction. Use its legal name and registration identifier to find the record, then compare filing dates and ownership details with corporate documents. If the government register provides only partial ownership information, review relevant filings to investigate the missing link. Record the source and date. Commercial databases can help surface leads, but distinguish those from official evidence.
UBO compliance requirements: who needs to identify UBOs?
UBO identification commonly applies to financial institutions, payment processors and businesses in regulated industries, depending on jurisdiction and activity. Define which customer types and onboarding routes trigger due diligence. For example, a payment provider assessing a corporate customer considers the business and its ownership structure, not just the person authorized to sign its application.
Frequently Asked Questions
What is UBO verification?
UBO verification tests whether evidence supports the people reported as owners or controllers, rather than relying on names listed on an application. For example, if a shareholder is a corporate entity, trace its ownership and compare the resulting individual with the applicant’s declaration. A sound record distinguishes verified identity, the verified basis for ownership and unresolved inconsistencies, helping reviewers make decisions from evidence rather than assertion.
Can RegTech Tools Help Mitigate UBO Risks?
Yes. RegTech tools can extract ownership data from filings, connect entities across records and run identity or watchlist checks consistently. They can flag duplicate identities, missing ownership links and possible matches for review. Retain source details and results to support sound decisions, and send ambiguous findings to a reviewer. Automation can organize evidence and surface anomalies, but it should not replace accountable judgment.
How Do Companies Identify a UBO?
Companies identify UBOs by applying relevant ownership and control tests to corporate records, then tracing qualifying interests to natural persons. For example, a person with a small shareholding but contractual veto rights over major decisions could be missed by an ownership-only search. Compare shareholder data with governance documents, and record why each associated person was included in or excluded from the assessment.
How do you build a UBO verification workflow step by step?
Build the workflow in gated stages: identify the entity and relevant jurisdiction; collect company and owner data; resolve each entity layer; assess direct and indirect interests and control; verify identities; screen for risks; and route exceptions for review. Set a completion rule so a case cannot close while required checks remain outstanding. Record the reason for each exception, such as a missing filing or identity mismatch.
How do you verify UBO data against official sources?
Start with the official company registry for the entity’s registration jurisdiction. Use its legal name and registration identifier to find the record, then compare filing dates and ownership details with corporate documents. If the government register provides only partial ownership information, review relevant filings to investigate the missing link. Record the source and date. Commercial databases can help surface leads, but distinguish those from official evidence.
UBO compliance requirements: who needs to identify UBOs?
UBO identification commonly applies to financial institutions, payment processors and businesses in regulated industries, depending on jurisdiction and activity. Define which customer types and onboarding routes trigger due diligence. For example, a payment provider assessing a corporate customer considers the business and its ownership structure, not just the person authorized to sign its application.
