Ultimate Beneficial Ownership: Seeing Through Shell Structures

Anqa Compliance — Free AML Training Series | FATF R.24 & R.25 | Certificate on Completion

Page 1 of 7

Course Overview

What You Will Learn

  • The legal definition of beneficial ownership and the FATF 25% threshold rule
  • How to apply FATF Recommendations 24 and 25 (revised October 2022)
  • A five-step methodology for tracing UBO through complex corporate structures
  • How to identify non-ownership control — voting rights, board control, power of attorney
  • Why KPMG surveys show complex ownership structures are the top CDD failure mode
  • UBO challenges specific to Africa and Asia: registry gaps and nominee arrangements
  • Real estate, trusts, and legal arrangements as high-risk UBO vectors

Why UBO Matters

Shell companies, nominee arrangements, and layered holding structures are the most common technique used by criminals and corrupt officials to hide the proceeds of crime. FATF estimates that corporate vehicles feature in the majority of grand corruption cases. The criminal does not appear on any document — only a chain of legal entities does.

Identifying the ultimate beneficial owner (UBO) — the real human being who ultimately owns or controls the entity — is the critical CDD obligation that separates a superficial box-ticking exercise from genuine financial crime prevention.

FATF Revised R.24 — October 2022

FATF significantly strengthened its standard on beneficial ownership of legal persons in October 2022 — the first major revision since 2012. The revised standard requires countries to collect BO information through a multi-pronged approach and mandates that information be adequate, accurate, and up-to-date.

Course Structure

Module 1: What Is Beneficial Ownership?

Legal definition, FATF 25% threshold, the three control tests, and why nominees cannot substitute for UBO identification

Not started

Module 2: FATF R.24 & R.25 Revised

The October 2022 revision, multi-pronged collection approach, accuracy requirements, and legal arrangements under R.25

Not started

Module 3: Five-Step UBO Tracing

Practical methodology for tracing ownership chains, KPMG survey findings on complex structures, and verification sources

Not started

Module 4: Registries, Gaps & Africa/Asia

Company registries in practice, the registry gap in emerging markets, and compensating controls when registries are unreliable

Not started

Module 5: Trusts, Real Estate & High-Risk Structures

R.25 for legal arrangements, property held through shell companies, red flags for UBO concealment, and DNFBPs

Not started

Assessment & Certificate

Complete all five modules, then take the 30-question assessment. Pass at 80% or above to generate your personalised certificate of completion.

Page 1 of 7Course Overview

Module 1: What Is Beneficial Ownership?

The FATF Definition

FATF defines a beneficial owner as the natural person(s) who ultimately owns or controls a customer, and/or the natural person on whose behalf a transaction is being conducted.

Three key elements in this definition:

  • Natural person: A human being — not a company, trust, or other legal entity. The chain must always terminate at a person of flesh and blood.
  • Ultimately owns or controls: This requires looking through any number of intermediate legal entities to the person at the end of the chain.
  • On whose behalf: Even where a person does not own or control the entity, if a transaction is conducted for their benefit they are a beneficial owner.

The 25% Ownership Threshold

FATF uses a 25% threshold as an indicator of ownership or control: any natural person holding 25% or more of a legal entity's shares or voting rights is presumed to be a beneficial owner and must be identified and verified.

The 25% Threshold Is a Floor, Not a Ceiling

The threshold triggers a mandatory identification obligation. But a person holding less than 25% may still be a beneficial owner if they exercise control through other means. Similarly, where no natural person meets the 25% threshold, FIs must consider whether any person exercises control through other means before falling back to identifying senior managing officials.

The Fallback: Senior Managing Official

Where no natural person can be identified as a beneficial owner through ownership or control mechanisms, FIs must identify and verify the identity of the relevant natural person who holds the position of senior managing official — typically the CEO or equivalent. This is a last resort, not a way to avoid UBO identification.

Three Tests for Control

Ownership (shareholding) is only one dimension of control. FATF requires FIs to look beyond shareholding to identify persons who exercise control through:

1. Ownership / Shareholding

Direct or indirect shareholding above 25%. Must trace through all intermediate holding companies until natural persons are found.

2. Voting Rights

Control through disproportionate voting rights, shareholder agreements, or veto rights — even without majority equity ownership.

3. Other Means of Control

Board appointment rights, power of attorney, contractual arrangements, convertible instruments, or the right to appoint/remove directors or managers.

Nominees and Their Limitations

A nominee is a person who appears on company documents (as a shareholder, director, or signatory) on behalf of another person. Nominees are legal but are frequently used to obscure UBO.

Key principle: identifying a nominee does not satisfy the UBO obligation. The FI must identify the natural person for whom the nominee is acting — that is the beneficial owner. The nominee's identity is a starting point, not an endpoint.

Red flags for nominee use: professional nominees appearing in multiple unrelated companies; nominee directors from a corporate services provider in a secrecy jurisdiction; nominee arrangements where no commercial rationale is given.

Page 2 of 7Module 1

Module 2: FATF R.24 & R.25 Revised

Recommendation 24 — Legal Persons (October 2022 Revision)

FATF Recommendation 24 covers the transparency and beneficial ownership of legal persons — companies, partnerships, and similar entities. The October 2022 revision was the most significant update since 2012.

Key Changes in the 2022 Revision

  • Multi-pronged collection approach: Countries must collect BO information through a combination of mechanisms — company registers, FI-collected CDD data, and company-level obligations (companies themselves must know and disclose their BO). No single source is sufficient.
  • Risk-based approach: Countries must assess the ML/TF risks of different types of legal persons and apply proportionate measures. Higher-risk entity types need more robust BO disclosure.
  • Accuracy requirement: BO information must be adequate, accurate, and up-to-date — not just collected at onboarding. Companies have ongoing obligations to update BO when it changes.
  • Competent authority access: Law enforcement, FIUs, and tax authorities must have timely access to BO information. Public access is not mandated by FATF but many jurisdictions have moved to public registers.
  • Trustee disclosure: If a company's BO is itself a trustee, the underlying trust beneficiaries must be disclosed — closing a significant loophole.

Recommendation 25 — Legal Arrangements (Trusts)

R.25 applies specifically to legal arrangements — express trusts and other similar structures (foundations, fiducies, treuhand). Trusts are frequently used in estate planning, asset protection, and — unfortunately — in money laundering.

Who Must Be Identified for a Trust?

Settlor

The person who creates the trust and transfers assets into it. The settlor may retain influence even after formally transferring control.

Trustee(s)

The person(s) who legally hold and manage the trust assets. The trustee is the legal owner; beneficiaries are the beneficial owners.

Protector / Enforcer

A person with power to direct or remove the trustee. Often overlooked — but an important control mechanism.

Beneficiaries

The persons entitled to receive the trust's assets or income. These are the ultimate beneficial owners under R.25. Discretionary beneficiaries must also be identified.

Professional Trustees and Disclosure Obligations

Professional trustees (trust and company service providers) are DNFBPs under FATF R.22 and must apply AML/CFT measures including CDD on settlors and beneficiaries. The Pandora Papers (2021) exposed how professional trustees in low-oversight jurisdictions enabled large-scale BO concealment.

The FATF Guidance on BO — March 2023

Following the R.24/R.25 revision, FATF published updated guidance documents in March 2023:

  • Guidance on Beneficial Ownership of Legal Persons (March 2023) — detailed implementation guidance for R.24.
  • Guidance on Beneficial Ownership and Transparency of Legal Arrangements (March 2023) — implementation guidance for R.25.

These documents provide practical examples for applying the multi-pronged approach and address specific sector challenges including real estate, DNFBPs, and cross-border structures.

Page 3 of 7Module 2

Module 3: Five-Step UBO Tracing Methodology

Why UBO Tracing Fails in Practice

A KPMG survey on AML compliance highlighted that complex ownership structures represent one of the top drivers of CDD quality failures at financial institutions. The most common failure mode is stopping the ownership trace at the first legal entity rather than continuing to natural persons.

The challenge is compounded by deliberately layered structures: offshore holding companies, trusts as shareholders, nominee arrangements stacked across multiple jurisdictions. The goal is to make UBO tracing so complex that FIs give up.

The Five-Step UBO Tracing Process

  1. Obtain the ownership structure. Request company documents: certificate of incorporation, memorandum and articles of association, shareholder register, most recent annual return. Ask explicitly: "Who are the natural persons who ultimately own or control this entity?"
  2. Trace shareholders above 25% upward. For each shareholder above 25%, if that shareholder is itself a legal entity, repeat the process. Continue until all chains terminate at natural persons. Document the full corporate tree.
  3. Check for non-ownership control. Review articles of association and shareholder agreements for voting rights, veto powers, board appointment rights, convertible instruments. Identify any person who can exercise control despite low ownership.
  4. Verify: are these the actual owners? Confirm identified natural persons are not themselves nominees. Cross-reference against adverse media, sanctions lists, and corporate filings. Ask for source of wealth if the structure is complex or high-risk.
  5. Document the full chain. Record the entire ownership and control structure in the customer file. If any link cannot be verified, escalate — do not close the file with an unresolved gap in the chain.

Verification Sources

FIs have access to a range of verification sources for UBO identification:

Commercial Registries

Companies House (UK), South African CIPC, Kenyan Registrar of Companies, Nigerian CAC. Reliability varies significantly — some are current, others lag by years.

GLEIF / LEI Database

Global Legal Entity Identifier database links entities to their parent organisations. Useful for tracking corporate group structures across borders.

Adverse Media & Open Source

News searches, court records, corporate filings, Wikileaks-style datasets (Panama Papers, Pandora Papers). ICIJ Offshore Leaks Database is publicly accessible.

Commercial Data Providers

World-Check (Refinitiv), LexisNexis Bridger, Dun & Bradstreet, Dow Jones. Aggregated corporate ownership and adverse media data.

The ICIJ Offshore Leaks Database

The International Consortium of Investigative Journalists (ICIJ) maintains a free, searchable database of offshore entities and their beneficial owners — drawn from the Panama Papers, Paradise Papers, Pandora Papers, and other leaked datasets. Over 800,000 offshore entities are searchable at offshoreleaks.icij.org. For high-risk or complex customers, this is a valuable supplementary check.

Applying the RBA to UBO

The depth of UBO tracing should be proportionate to risk:

  • Low risk: Confirm shareholder structure and identify UBO above 25%. Verify identity documents.
  • Medium risk: Trace full ownership chain with documentation. Verify against registry and one commercial database.
  • High risk (EDD): Full corporate tree with source documentation. Verify each named UBO against multiple sources. Obtain explanation for complex structure. Senior management sign-off for onboarding.
Page 4 of 7Module 3

Module 4: Registries, Gaps & the Africa/Asia Challenge

Company Registries in Theory and Practice

FATF's revised R.24 envisions that company registries are one pillar of the multi-pronged BO collection approach. In many developed jurisdictions — UK, EU, Australia, New Zealand — registries are publicly accessible, relatively current, and increasingly require BO information directly.

The UK's Companies House register was a pioneer in public BO registration, requiring all UK companies to file a "persons of significant control" (PSC) register since 2016. The EU's Anti-Money Laundering Directive (AMLD5, 2018) required member states to establish central BO registers accessible to the public.

Registry Gaps in Africa and Asia

In much of Africa, South Asia, and Southeast Asia, company registries present significant limitations for UBO identification:

  • No public access: Many registries are accessible only to the companies themselves, regulators, or law enforcement — not to FIs conducting CDD.
  • No BO requirement: Many registries collect legal ownership (nominee shareholders) but not BO. A nominee holding 100% of shares satisfies the legal filing requirement while concealing the real owner.
  • Inaccurate or outdated data: Annual returns may not be filed, or filed incorrectly, with no meaningful enforcement of accuracy requirements.
  • Poor digitisation: Physical-only records that require in-person access, limiting verification speed and increasing costs.

ESAAMLG and GIABA mutual evaluation reports consistently identify weak company registry infrastructure as a material gap in the multi-pronged BO approach — meaning FIs cannot rely on registry data and must apply more direct customer disclosure and document verification.

Compensating Controls When Registries Are Unreliable

When registry information cannot be relied upon, FIs must increase reliance on other verification mechanisms:

Direct Customer Disclosure

Require customers to complete a UBO declaration form, confirming the identity of natural persons above 25% and control mechanisms. Obtain supporting documents: identity documents of named UBOs, shareholder certificates, corporate resolutions, constitutional documents.

Independent Documentary Verification

Cross-reference customer-provided UBO information against audited financial statements, prospectuses, stock exchange filings (for listed entities), and other official sources that independently confirm ownership structure.

Nominee Arrangements Are Common in Emerging Markets

In several African and Asian jurisdictions, nominee shareholders and directors are widely used for legitimate tax and privacy reasons — not solely for ML. The FI's obligation is not to refuse all nominee arrangements but to identify the beneficial owner behind them. A disclosed, documented nominee with a verified principal is acceptable; an undisclosed nominee where the principal cannot be identified is not.

Listed Companies: A Simplified Route

FATF permits simplified CDD for customers that are companies listed on a regulated stock exchange. The rationale: stock exchange listing requirements (disclosure, regulatory oversight, transparency) mean the company is subject to equivalent or greater BO transparency than AML/CFT measures require.

However, simplified CDD applies to the listed entity itself — not to its subsidiaries. If a listed parent company has unlisted subsidiaries seeking to open accounts, the UBO of the subsidiary must still be identified.

Page 5 of 7Module 4

Module 5: Trusts, Real Estate & High-Risk Structures

Real Estate as a UBO Risk

Real estate is one of the highest-risk sectors for ML via legal persons and arrangements. A 2007 FATF report and subsequent research establish the following as common ML techniques involving real estate:

  • Property purchased through a shell company where the real buyer is not disclosed on the title deed — only the company name appears.
  • Layered holding structures: Company A (domestic) owned by Company B (offshore, secrecy jurisdiction) owned by a trust — with only Company A visible in land registry records.
  • Cash purchases used to launder illicit funds, with subsequent mortgage fraud to extract "clean" funds.
  • Use of foreign company structures to hold domestic real estate — the actual property appears on domestic records but BO traces to an offshore structure with weak transparency.

DNFBPs and Real Estate

Attorneys/conveyancers and real estate agents acting in property transactions are Designated Non-Financial Businesses and Professions (DNFBPs) subject to FATF R.22. They are required to conduct CDD on buyers and sellers — including UBO identification — and to file STRs on suspicious transactions. In many African and Asian jurisdictions, DNFBP supervision remains weak, creating a significant gap in the property sector's AML defences.

Trusts: UBO Identification Under R.25

Where a trust is the customer (or is a beneficial owner of a corporate customer), FIs must identify:

  • The settlor — identity documents, verification of source of wealth if high value.
  • The trustee(s) — full CDD including identity verification and, for professional trustees, confirmation of their regulatory status.
  • The protector/enforcer (if any) — identity documents.
  • All named beneficiaries — identity documents for fixed beneficiaries; class descriptions with identity on distribution for discretionary beneficiaries.
  • Any other natural person exercising ultimate effective control over the trust.

The Pandora Papers Lesson

The 2021 Pandora Papers leak exposed how professional trustees in low-oversight jurisdictions — including several in Pacific territories and Central America — had established trusts for heads of state, politicians, and business oligarchs without conducting meaningful CDD. The trusts held high-value real estate in the UK, France, and USA. The leak demonstrated that R.25 compliance failures enable state-level corruption to be shielded by trust structures.

Red Flags for UBO Concealment

The following red flags should trigger enhanced scrutiny or escalation in the UBO identification process:

Unexplained Complexity

Multi-layered ownership with no commercial rationale. Holding companies in multiple secrecy jurisdictions (BVI, Cayman, Delaware, Panama) where no business operations are conducted.

Nominee Chains

Multiple levels of nominee shareholders/directors. Professional nominees appearing in unrelated companies. Nominees based in secrecy jurisdictions.

Resistance to Disclosure

Customer refuses to identify UBO or provides evasive answers. Claims that BO information is "confidential" or "protected" without legal basis.

Registry Mismatch

Information provided by customer contradicts registry data. Shareholder information has not been updated after a change in control. Mismatch between declared ownership and corporate documents.

Non-Starter: "The Lawyer Told Me I Don't Have to Disclose"

Customers sometimes claim that legal professional privilege or confidentiality obligations prevent UBO disclosure. This is almost always incorrect. While legal privilege may apply to some communications, it does not exempt a customer from their obligation to disclose beneficial ownership to their FI. If a customer makes this claim, treat it as a red flag and escalate.

Page 6 of 7Module 5

Final Assessment

30 questions — Multiple Choice, Scenario-Based, and True/False. Pass mark: 80% (24/30). Select one answer per question.

Section A: Multiple Choice (15 Questions)

Q1. Under FATF guidance, the beneficial owner of a legal entity is defined as:

Q2. FATF's standard ownership threshold for triggering UBO identification obligations is:

Q3. Where no natural person can be identified as a beneficial owner through ownership or control mechanisms, FATF requires FIs to:

Q4. The October 2022 revision to FATF Recommendation 24 introduced which key change?

Q5. Under FATF R.25, which of the following parties to a trust must be identified as part of CDD?

Q6. A KPMG survey on AML compliance identified which issue as a top driver of CDD quality failures?

Q7. FATF permits simplified CDD for which category of customer?

Q8. The ICIJ Offshore Leaks Database is most useful for which UBO verification activity?

Q9. Under the EU's AMLD5 (2018), member states were required to:

Q10. Which of the following is NOT a recognised method of control for UBO purposes?

Q11. When a customer's UBO is identified as itself a trustee, FATF's revised R.24 requires:

Q12. What is the primary limitation of relying on company registries for UBO identification in many African and Asian jurisdictions?

Q13. FATF Recommendation 22 requires which type of entity to conduct CDD including UBO identification on real estate transactions?

Q14. Which of the following is a legitimate response when an FI cannot fully verify the UBO of a corporate customer?

Q15. The Global Legal Entity Identifier (GLEIF / LEI) database is useful for UBO tracing because it:

Section B: Scenario-Based Questions (10 Questions)

S1. A corporate customer's shareholder register shows three shareholders: Company A (60%), Company B (30%), and an individual, Mr. Adu (10%). Companies A and B are both incorporated in the British Virgin Islands and have no publicly accessible shareholder information. What is the FI's obligation?

S2. A customer informs you that their company's shareholder of record is a professional nominee, and that they (the customer) are the actual owner. The customer provides a nominee agreement confirming this. What is the correct response?

S3. A trust seeks to open an account. The trustee is a professional trust company. The settlor is a 72-year-old retired businessperson. The beneficiaries are three adult children, with distributions at trustee discretion. How should the FI conduct UBO identification?

S4. A real estate agent refers a cash buyer who is purchasing a commercial property via a Cayman Islands company. The buyer refuses to disclose who owns the Cayman company, stating it is "strictly confidential." What should the real estate agent (as a DNFBP) do?

S5. Your AML system flags a match in the Pandora Papers database for a corporate customer's named UBO. The customer has not disclosed any connection to offshore trusts in their onboarding documents. What is the appropriate response?

S6. A listed holding company in Nigeria has a 40%-owned unlisted subsidiary seeking to open a USD account with your bank. What CDD approach should apply to the subsidiary?

S7. A shareholder register shows two shareholders each holding 50% — Company X (incorporated in Delaware, USA) and Company Y (incorporated in Mauritius). Mauritius is currently on the FATF grey list. What are the UBO implications?

S8. A customer discloses a holding structure with five layers of offshore companies before reaching a natural person. No single layer appears unusual on its own. Is the structure a red flag?

S9. A long-standing corporate customer notifies you that their major shareholder has sold their stake and a new investor now holds 35%. You conduct no further CDD as the customer is low-risk. Is this approach compliant?

S10. A customer claims legal professional privilege prevents them from disclosing the UBO of their company, on advice from their lawyer. How should the FI respond?

Section C: True or False (5 Questions)

TF1. A natural person holding exactly 24% of a company's shares can never be a beneficial owner of that company.

TF2. FATF Recommendation 24 (October 2022 revision) mandates that all FATF member countries establish publicly accessible beneficial ownership registers.

TF3. Under FATF R.25, where a trust's beneficial owner is a discretionary beneficiary who has not yet received any distribution, the FI still has an obligation to identify them.

TF4. Simplified CDD that applies to a listed parent company automatically extends to all subsidiaries within the same corporate group.

TF5. A change in beneficial ownership of an existing corporate customer is a trigger event requiring re-verification of the new UBO under FATF's ongoing due diligence obligation.

Congratulations — you have passed!

Enter your name to generate your certificate of completion.

Certificate of Completion

Anqa Compliance

This certifies that

has successfully completed

Ultimate Beneficial Ownership: Seeing Through Shell Structures

anqacompliance.com | Free AML Training Series

Page 7 of 7Assessment
All Courses