Ultimate Beneficial Owner (UBO): Definition and Verification

An ultimate beneficial owner (UBO) is the real person who ultimately owns or controls a company, as opposed to the company's legal shareholders, which may be other companies, trusts or nominees. In the EU and under FinCEN's rules in the US, the usual test is owning 25% or more of the company, or controlling it in some other way. UBO verification is the KYB step where a bank, exchange or other regulated firm identifies those people and verifies their identities.

This guide covers the definition, the 25% and control tests, where the US Corporate Transparency Act stands in October 2026, how UBO verification works, and what it means for crypto businesses.

What is an ultimate beneficial owner?

A beneficial owner is always a natural person. A company can be a shareholder but never a beneficial owner. The point is to look through every layer of holding companies, trusts and nominees until you reach the individuals who benefit from or steer the business.

The EU's Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 (the AMLR), which applies from 10 July 2027, defines the beneficial owners of a legal entity in Article 51 as the natural persons who either:

• have, directly or indirectly, an ownership interest in the company; or
• control it, directly or indirectly, through ownership or via other means.

The two tests run in parallel. Someone with no shares can still be a UBO through control, and a firm has to look for both.

The 25% ownership threshold

Under AMLR Article 52, an ownership interest means direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest, including rights to a share of profits or of the liquidation balance. Every level of the ownership chain counts.

Indirect ownership is calculated by multiplying the percentages down each chain and adding the chains together. A simple example:

• Maria owns 40% of Holding A and 40% of Holding B. She controls neither.
• Holding A and Holding B each own 35% of Target Ltd.
• Maria's indirect stake is 40% × 35% = 14% through each holding, so 28% in total.

No single chain reaches 25%, but the sum does, so Maria is a beneficial owner of Target Ltd. Article 54 adds a further rule for structures where someone controls an intermediate company, and those cases need a closer look.

The threshold is not fixed forever. Article 52(2) lets the European Commission set a lower threshold, of no more than 15% unless a higher one is justified and always below 25%, for categories of companies that member states flag as higher risk. The Commission has until 10 July 2029 to assess this.

Control: the second prong

Under AMLR Article 53, owning 50% plus one share or vote is control through ownership. Control "via other means" always includes the ability to:

• exercise a majority of voting rights, including with others acting in concert;
• appoint or remove a majority of the board;
• use relevant veto or decision rights attached to shares;
• decide on profit distributions or shifts in the company's assets.

It can also arise from shareholder or voting agreements, provisions in the articles of association, family relationships, and formal or informal nominee arrangements, where a front person holds shares on someone else's instructions.

When nobody qualifies: senior managing officials

Some companies have no one who meets either test, such as a widely held company or one with genuinely dispersed ownership. Under AMLR Article 63, the company must then state that no beneficial owner could be determined, explain why, and provide details of its senior managing officials: the executive members of the management body and others responsible for day-to-day management. This is a fallback, not a loophole.

UBO rules in the United States: the CDD Rule and the CTA

The US has two separate regimes that are often confused.

FinCEN's Customer Due Diligence Rule (31 CFR 1010.230) applies to banks, broker-dealers, mutual funds and futures firms when a legal entity opens an account. It uses two prongs. The first is each individual owning 25% or more of the equity, which means up to four people. The second is a single individual with significant responsibility to control, manage or direct the entity, such as a CEO, CFO, COO, managing member, general partner or president. This rule is in force.

The Corporate Transparency Act (CTA) created a separate obligation for companies to report their beneficial owners directly to FinCEN. Its regulatory definition still uses 25% ownership or "substantial control" (31 CFR 1010.380). But its scope has been cut back sharply:

• On 26 March 2025, FinCEN issued an interim final rule exempting all entities created in the US, previously called "domestic reporting companies", from BOI reporting.
• On 14 August 2026, FinCEN published a final rule, effective the same day, adopting that interim rule with limited changes. Reporting companies need not report US-person beneficial owners or US-person company applicants, and US persons no longer have to update information given to obtain a FinCEN ID.

As of 8 October 2026, FinCEN's BOI page states that only entities formed under the law of a foreign country and registered to do business in the US are reporting companies. US-formed companies and their beneficial owners are exempt. Foreign reporting companies that register now have 30 days after registration to file.

The end of domestic CTA reporting does not remove UBO checks at onboarding: a US bank opening an account for an LLC still has to identify its beneficial owners under the CDD Rule.

The UK: people with significant control

The UK's equivalent register is the people with significant control (PSC) register at Companies House. According to GOV.UK guidance (updated 30 July 2026), a PSC is someone who holds more than 25% of the shares or voting rights, can appoint or remove a majority of directors, or can otherwise influence or control the company. Mandatory identity verification for PSCs at Companies House began on 18 November 2025, with each PSC given a 14-day window to provide their verification code.

How UBO verification works in KYB

UBO verification is the centre of any KYB process. The steps are broadly the same whichever vendor or regulator is involved:

1. Verify the entity. Pull the company's record from the official registry: legal name, number, registered address, status, directors.
2. Collect the ownership structure. Obtain a shareholder register or ownership chart down to the natural persons, with percentages at each level. Corporate shareholders need their own registry extracts.
3. Calculate and identify. Apply the 25% ownership test, including multiplied indirect chains, and the control test. Record who qualifies and why.
4. Verify each UBO's identity. AMLR Article 22(7) requires firms to verify UBOs either through ID documents and reliable sources or by other reasonable measures. Either way, they must also check the central beneficial ownership register. In practice each UBO goes through the same KYC checks as an individual customer.
5. Screen everyone. Run sanctions and PEP screening on the entity and every UBO. AMLR Article 20(1)(d) specifically requires checking whether sanctioned persons control the entity or hold more than 50% of it. See watchlist and PEP screening.
6. Report discrepancies. If what the customer says differs from the register, Article 24 requires EU firms to report the discrepancy to the register within 14 calendar days, except for minor typos or outdated data.
7. Keep it current. Ownership changes. Under Article 63, EU companies must report changes to the register within 28 days, and firms must refresh their own records on a risk-based cycle.

Complex or opaque structures are a recognised higher-risk factor and can move a customer into enhanced due diligence. Much of this work is now automated: KYB tools such as iDenfy's business verification pull registry data and break down ownership structures before the UBOs are sent through KYC.

Beneficial ownership registers and who can see them

Every EU member state keeps a central register of beneficial owners. Public access has changed. On 22 November 2022, the Court of Justice of the EU ruled in WM and Sovim (Joined Cases C-37/20 and C-601/20) that the rule giving the general public access to beneficial ownership information was invalid.

The new framework in the Sixth AML Directive, Directive (EU) 2024/1640, replaces open access with tiers. Authorities get direct, unfiltered access. Obliged entities such as banks and CASPs get timely access when performing due diligence (Article 11). People with a "legitimate interest", including journalists, civil society groups and prospective counterparties, can get core data such as name, month and year of birth, nationality and the nature of the interest (Article 12). Member states had to transpose those access rules by 10 July 2026. Most of the rest of the directive must be transposed by 10 July 2027.

UBOs and crypto businesses

UBO checks matter in crypto from both sides.

When a crypto firm onboards a company, such as a corporate trading account, a market maker, an OTC client or a token issuer, it must identify and verify that company's UBOs just as a bank would. EU crypto-asset service providers are obliged entities under the AMLR. Corporate clients are also where sanctions exposure most often hides, which is why the 50% sanctions-ownership check matters. Our crypto AML compliance guide covers the wider programme.

When a crypto firm is itself onboarded by a bank, payment provider or licensing regulator, the same questions come back the other way. Founders should expect to produce a full ownership chart down to natural persons, ID for every 25%-plus owner and controller, and explanations for any trusts or foundations. For licensing in the EU, see getting a CASP licence under MiCA.

JewelSwap's DeFi apps are non-custodial and don't onboard customers or run KYB themselves. See KYC in DeFi explained.

Frequently asked questions

What is an ultimate beneficial owner?

The natural person who ultimately owns or controls a company, after looking through every layer of holding companies, trusts and nominees. Under EU rules and FinCEN's CDD Rule, that usually means owning 25% or more, or controlling the company by other means.

Is the UBO threshold always 25%?

It is the standard threshold in the EU AMLR and FinCEN's CDD Rule, and the UK's PSC test uses more than 25%. Firms may look below it based on risk, and the EU Commission can set a lower threshold of up to 15% for higher-risk categories of companies.

Can a company have no UBO?

If no one meets the ownership or control tests, EU rules require the company to explain why and to provide details of its senior managing officials instead. Regulators expect that only after the ownership and control tests have genuinely been exhausted.

Do US companies still have to file BOI reports under the Corporate Transparency Act?

No. As of October 2026, FinCEN's final rule of 14 August 2026 exempts all US-formed companies and their beneficial owners. Only foreign companies registered to do business in the US must report, and they need not report US-person beneficial owners.

What documents are needed for UBO verification?

Typically a company registry extract, a shareholder register or ownership chart down to natural persons, and an ID document for each beneficial owner. Higher-risk cases may also need trust deeds, shareholder agreements or source-of-wealth evidence.

What is the difference between a UBO and a shareholder?

A shareholder is whoever is recorded as holding shares, which can be another company or a nominee. A UBO is always a natural person who ultimately owns or controls the company, directly or through those layers.

Keep reading

• What is KYB? Compliance checklist
• Customer due diligence vs enhanced due diligence
• KYB in crypto: best KYB software in 2026
• Source of funds vs source of wealth
• CASP licence under MiCA

This article is educational and is not legal or financial advice. Legal references are to Regulation (EU) 2024/1624, Directive (EU) 2024/1640, 31 CFR 1010.230 and 1010.380, and FinCEN's final rule published on 14 August 2026, all checked on 8 October 2026. UK details are from GOV.UK guidance updated 30 July 2026. Rules change; check current versions before relying on them.