UBO verification process: 7 steps, with a worked example

What is UBO verification?

UBO verification is the process of finding the natural persons who ultimately own or control a company, then confirming who they are: you identify them from the ownership structure, verify each person's identity against reliable sources and reconcile the result with the central beneficial ownership register. Under the AMLR, a UBO is any natural person who holds 25% or more of the company, directly or indirectly (Article 52(1), Regulation (EU) 2024/1624), or who controls it by other means.

The hard part is rarely the identity check. It is the data that comes before it. In the ownership data Dotfile collected for its customers over the past year, 8.1% of the ownership links arrived from the source with no percentage at all, and 6.4% of ownership structures used an official document on top of registry data. This guide sets out the seven steps, the legal basis for each and a worked example.

What is a UBO?

An ultimate beneficial owner (UBO) is a natural person who owns or controls a legal entity, either through an ownership interest or through control via other means. The EU Anti-Money Laundering Regulation sets out both routes in Articles 51 to 53, Regulation (EU) 2024/1624, which applies from 10 July 2027 (Article 90). A UBO is always a person, never a company: a holding company is a link in the chain, not the end of it.

The threshold depends on the date and the country. The AMLR counts 25% or more (Article 52(1)). Until it applies, the directive points to more than 25% (Article 3(6)(a)(i), Directive (EU) 2015/849), and so do national laws such as Germany's and France's. The UK's person with significant control test is also more than 25% (Companies Act 2006, Schedule 1A). From 10 July 2027, a person at exactly 25% is a beneficial owner in Paris and still not a PSC in London.

The UBO verification process in 7 steps

All articles refer to Regulation (EU) 2024/1624.

1. Map the ownership structure

UBO identification starts with the ownership structure: the company's direct shareholders, then the shareholders of every corporate shareholder, layer by layer, until each chain ends with a person. Article 20(1)(b), Regulation (EU) 2024/1624 asks the obliged entity to be satisfied that it "understands the ownership and control structure of the customer", so the map itself is part of the obligation, not a working note.

2. Calculate each person's total stake

A person's stake is the product of the percentages along each chain, summed across all chains (Article 52(1), Regulation (EU) 2024/1624). The step fails silently when a percentage is missing: registries often list a shareholder without saying how much it holds. Fill the gap from a document (share register, articles of association, annual return) or from the customer, and record which one.

Indirect stakes are small: median 10% in our data, against 50% for direct ones. The few that cross 25% are exactly the ones a first-layer check never sees.

3. Test control separately

Control is "the possibility to exercise, directly or indirectly, significant influence and impose relevant decisions" (Article 53(2), Regulation (EU) 2024/1624): a majority of voting rights, the right to appoint or remove the majority of the board, veto rights or agreements between owners. A person at 5% with a right to appoint the majority of the board is a UBO. Article 54 adds chains where ownership and control mix across layers, the kind percentage arithmetic clears by mistake.

When no person qualifies by either route, the legal entity has to state that none could be determined and give the details of its senior managing officials (Article 63(4), Regulation (EU) 2024/1624). The FATF Interpretive Note to Recommendation 10 sets out the same cascade. A "no UBO" outcome is only defensible with the trail that led to it.

4. Verify each UBO's identity

Identification is collecting who the person is; verification is proving it. Article 22(7), Regulation (EU) 2024/1624 lets you verify a beneficial owner through identity evidence or "reasonable measures" using reliable sources, including public registers other than the central registers. The depth follows risk: a registry match and a declaration may be enough for a standard case, while a high-risk file warrants an identity document check with liveness.

5. Screen every UBO

Each beneficial owner is screened against targeted financial sanctions and checked for politically exposed person status (Article 20(1)(d) and (g), Regulation (EU) 2024/1624), with adverse media on a risk basis. Screening only the company misses the person who matters.

6. Reconcile with the central register

After your own analysis, consult the central beneficial ownership register. If your findings differ from it, Article 24(1), Regulation (EU) 2024/1624 gives you 14 calendar days to report the discrepancy. Article 24(2) lets you ask the customer to correct it instead when the difference is limited to typographical errors, transliteration or minor inaccuracies, or to outdated data where you know the beneficial owners from another reliable source and have no grounds to suspect an intent to conceal. The exception never applies in higher-risk situations. That deadline only works if you know which source said what, and when.

The register is a check, not a source of truth, and it is no longer open to everyone: on 22 November 2022, the Court of Justice of the EU invalidated general public access to beneficial ownership registers (joined cases C-37/20 and C-601/20). Obliged entities keep their access, but the register only reflects what the company declared.

7. Keep it current

Beneficial ownership changes. Article 26, Regulation (EU) 2024/1624 caps the time between updates at 1 year for customers under enhanced due diligence and 5 years for everyone else, and requires an update whenever the relevant circumstances of a customer change. A change of shareholder is exactly that.

Worked example: three UBOs, one discrepancy

This example applies the AMLR rules, as they stand from 10 July 2027. A fictional German company, Orchard Payments GmbH, applies to become your customer. Its shareholder list shows Marc at 35%, Julia at 25% and Ferrum Holding SARL, a Luxembourg company, at 40%. The Luxembourg registry extract for Ferrum lists two shareholders, Ines and Paul, but no percentages. Ferrum's articles of association fill the gap: Ines 80%, Paul 20%.

You verify the identity of Marc, Julia and Ines, and screen all three. Then you consult the German register, which lists Marc and Julia only. Ines, at 32% the second-largest stake, is missing. That is a discrepancy to report within 14 calendar days, with the articles of association as evidence.

Two steps would have gone wrong without a document: step 2, because the registry gave no percentages, and step 6, because the central register was incomplete. Neither is rare.

What the data says about UBO verification

Based on ownership structures built on Dotfile over the past year; aggregates only.

• 8.1% of ownership links had no percentage in the source data. That is about 1 in 12, and every one of them is a stake nobody can calculate without another document.
• 6.4% of structures used an official document as a source, on top of registry data.
• 7.6% of the person-level stakes we computed ran through at least one holding company. Their median size was 10%, against 50% for direct stakes.

Frequently asked questions

Is a UBO always a person?

Yes. A UBO is always a natural person. Companies, trusts and funds can sit in the chain, but the analysis continues until it reaches people, or until it can document that none qualifies.

What documents prove who the UBO is?

The ownership side is proven by registry extracts, share registers, articles of association and shareholder agreements. The identity side is proven by an identity document or by reliable independent sources, as Article 22(7), Regulation (EU) 2024/1624 allows. Keep both, with dates.

What is the difference between KYC and UBO verification?

KYC verifies an individual customer. UBO verification verifies the people behind a business customer, and is one step of the KYB process. Our KYC vs UBO verification guide compares the two.

How often should UBOs be re-verified?

At least once a year for customers under enhanced due diligence and every 5 years for the rest (Article 26, Regulation (EU) 2024/1624), and whenever ownership or control changes.

Where Dotfile fits

Dotfile's ownership unravelling builds the structure from registry data and documents, computes each person's total stake split into direct and indirect and shows control next to ownership. Each person found can be added to the case for identity verification and AML screening, and official documents can be ordered when the registry falls short. Data Lineage keeps the source and date of every value, which is what a 14-day discrepancy report needs.