Ultimate Beneficial Owner (UBO): The 2026 Compliance Guide

An ultimate beneficial owner (UBO) is the natural person who ultimately owns or controls a company, even when that control runs through several layers of holding entities. In most regimes a UBO is anyone holding 25% or more of the shares or voting rights, or who otherwise exercises effective control. Find the UBO and you find the real human behind the corporate name.

That last point is why compliance teams care. Shell companies do not commit financial crime by themselves; people use them. This guide sets out what a UBO is, how to identify one across different ownership structures, what the 2026 reporting rules now require on each side of the Atlantic, and how to verify the people you uncover.

What Changed for UBO Reporting in 2026

The US rules reversed sharply. In March 2025 FinCEN issued an interim final rule that removed beneficial ownership reporting under the Corporate Transparency Act for companies formed in the United States and for their owners. Reporting now applies only to foreign companies registered to do business in a US state, and even those entities do not report any US persons as beneficial owners. The rule is still interim, and FinCEN has said it intends to finalize it, so any UBO guidance written before March 2025 overstates the domestic US obligation.

Europe moved the other way. The EU's Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, sets a single beneficial owner threshold of 25% or more across every member state and widens which entities must identify their owners. It applies from 10 July 2027. The wording shifted from "more than 25%" to "25% or more," which pulls a person holding exactly a quarter of a company back into scope. For higher-risk sectors the European Commission can lower the bar to 15%. The new EU Anti-Money Laundering Authority (AMLA) became operational on 1 July 2025 and will supervise the highest-risk cross-border firms directly.

Firms operating on both sides now face genuinely divergent regimes. A group that files almost nothing in the US can still owe detailed ownership disclosures across its European subsidiaries.

What Is a UBO?

An ultimate beneficial owner is an individual who owns or controls a company or legal arrangement and ultimately benefits from its activities, even without running day-to-day operations. The Financial Action Task Force frames it as the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is conducted, including anyone exercising ultimate effective control over a legal person.

A UBO has four defining traits:

• A natural person. Not a company or a trust, but a flesh-and-blood human at the end of the chain.
• Ownership or control. Typically a holding of 25% or more of shares, voting rights, or ownership interest.
• Direct or indirect. Control can run through intermediate entities, nominee arrangements, or other structures.
• Influence over decisions. Meaningful say over the management and policies of the company.

The full form of UBO is simply Ultimate Beneficial Owner. The term turns up constantly in KYC and KYB work because regulators want a name and a face, not a registered office.

The 25% Threshold and Where It Bends

Most jurisdictions treat 25% as the line. Cross it, and you are a UBO who must be identified and verified. The figure is a screening trigger rather than a magic number, and several regimes flex it.

The EU's incoming AMLR fixes the threshold at 25% or more and lets the Commission drop it to 15% for high-risk sectors. The UK applies the same 25% test through its Persons with Significant Control regime. Some risk frameworks reach lower still, treating a 10% stake plus voting power as worth a closer look. The lesson for compliance teams is plain. Treat 25% as the floor, not the finish line, and apply judgment when control is exercised through means other than raw share count.

Control without ownership matters just as much. Someone holding only 5% of shares but wielding the right to appoint or remove most of the board still controls the company, and the rules treat them accordingly.

How to Identify a UBO

Identifying the ultimate beneficial owner is a structured exercise, not a single lookup. It runs roughly like this:

• Map the ownership structure. Establish who holds shares or interests, in what proportion, and whether the holding is direct or sits behind an intermediary entity.
• Unwind the layers. Where shares are held by another company, trace through each layer until you reach the natural persons at the top.
• Review the documents. Shareholder agreements, share registers, trust deeds, and partnership agreements all reveal who really controls the entity.
• Run due diligence. Check the company and the people behind it for risk signals, then escalate anything that warrants a harder look.
• Verify the people. Once a UBO is named, confirm their identity and their ownership claim against independent, reliable sources.

The work gets harder as ownership chains lengthen and cross borders. A three-country structure with a nominee shareholder at one node can take real effort to resolve, which is exactly why criminals build them that way.

How to Identify UBOs in Different Business Structures

The method shifts with the legal form of the entity.

Sole proprietorship. Straightforward. One owner holds complete control, so the proprietor is the UBO.

Partnership. The UBO is whoever ultimately controls the partnership's decisions. The partnership agreement, which sets out voting rights and decision-making authority, is the document to read.

Corporation. The UBO is the individual who controls the company through direct or indirect ownership of a significant share of stock or voting rights. Resolving it means working through the share register, shareholder agreements, and any holding entities above it.

Trust. Trusts spread control across several roles, so a trust can have more than one UBO. The settlor, the trustees, the protector if there is one, the beneficiaries, and any other person exercising ultimate effective control can each qualify, depending on the deed and the powers it grants.

Across every structure the principle holds. Keep tracing until you reach a person, document each step, and do not stop at the first company you hit.

UBO Declaration: What It Is and What It Captures

A UBO declaration is a formal, usually signed statement in which a legal entity names its ultimate beneficial owners. For a regulated firm onboarding a corporate client, it is the document that puts the client's own attestation on record before verification begins.

A declaration typically captures each owner's full name, date and country of birth, nationality, country of residence, the percentage held, and the nature of the ownership or control. It is a starting point, not proof. Under FATF guidance and EU rules a firm cannot simply accept the declaration; it takes reasonable measures to check the named people against independent sources, dialing the intensity up as risk rises.

Talk to our team about automating UBO discovery.

UBO vs Related Terms: Nominee Director, IBO, and PSC

The vocabulary around ownership gets crowded, and the distinctions carry compliance weight.

Nominee director. A nominee director is appointed to act on behalf of the true owner, often to supply anonymity or satisfy a local residency rule. They may run day-to-day operations, but they are not the UBO. The beneficial owner is the person on whose behalf the nominee acts.

Immediate Beneficial Owner (IBO). An IBO is the entity or person directly holding an asset at an intermediate level, which may sit in front of the real end beneficiary. The UBO is the person at the very top of the chain. IBO is the next rung up; UBO is the roof.

Person with Significant Control (PSC). PSC is the UK's term for an individual with significant influence or control over a company, reported to Companies House. The concepts overlap heavily, though they are not identical. Every PSC is effectively a UBO, but a UBO defined under another regime may not meet the precise PSC test. Other jurisdictions use their own labels; Singapore, for instance, speaks of Registrable Controllers.

Challenges in UBO Identification and Verification

Several factors make the work slow and uncertain.

• Complex ownership structures. Multiple layers of holding companies across jurisdictions obscure the chain and demand patient unwinding.
• Weak transparency. Some jurisdictions barely regulate company ownership, so accurate, current data is hard to come by.
• Nominee arrangements. Nominee directors and shareholders are designed to break the visible link between the company and its true owner.
• Limited access. Key information may sit with third parties or simply not be public, leaving gaps that have to be closed by other means.

None of this excuses giving up. The penalties for getting it wrong are steep, and regulators expect a documented, risk-based effort rather than a perfect result.

UBO Reporting Requirements Across Regions

Reporting duties vary widely by jurisdiction, and 2026 has widened the gaps.

European Union. The incoming AMLR and AMLD6 standardize the 25%-or-more threshold and tighten how ownership is recorded and accessed, applying from July 2027. They replace the patchwork built on the 4th and 5th AML Directives with one rulebook. Member states still run beneficial ownership registers, but access rules changed sharply after a key court ruling, covered below.

United Kingdom. Companies report Persons with Significant Control, those holding more than 25% of shares or voting rights, to Companies House, the national registrar.

United States. Following the March 2025 interim final rule, entities formed in the US are exempt from beneficial ownership reporting to FinCEN. Only foreign companies registered to do business in a US state report, and they do not report US persons as owners.

China. Guidance from the People's Bank of China defines a UBO as the person who ultimately owns or controls a customer or exercises ultimate effective control over a legal entity, with the threshold set at 25%.

United Arab Emirates. Companies incorporated in the UAE, outside the financial free zones, maintain a register of real beneficiaries, defined as those owning or controlling 25% plus one share, holding voting rights, or able to appoint or dismiss the majority of directors.

The practical takeaway is that a single multinational client can sit under four or five different definitions at once. A risk-based program that defaults to the strictest applicable standard tends to age better than one tuned to a single country.

How UBO Verification Works Under the Rules

Naming a beneficial owner is only half the job. Confirming that the named person is real, and that the ownership claim holds, is governed by a stack of overlapping rules, and they mostly point the same way: take reasonable, risk-based steps to confirm the UBO's identity.

FATF's Recommendation 10 is the anchor. It requires a financial institution to identify the beneficial owner and take reasonable measures to confirm that identity to its own satisfaction, and the Interpretive Note allows the underlying information to come from a public register, the client, or another reliable source. In the European context, the duty runs deeper than a one-time check. Firms keep verifying a UBO's identity over time, raising or lowering the intensity with risk. A client can declare who the UBO is, after which the institution checks that declaration against independent, reliable sources. The European Banking Authority's risk factor guidance lands in the same place, telling firms to ask the client, document what they receive, and verify it, raising the bar on both the quantity and quality of information as risk climbs.

Verification in practice draws on several sources at once. Corporate registries, identity documents, and sanctions and watchlist screening of each named owner all feed the picture, and a hit on any one of them changes the risk calculus immediately.

How the FATF Standard Shapes UBO Rules

The Financial Action Task Force sets the international benchmark that national regimes follow. In March 2022 it tightened Recommendation 24, the standard on beneficial ownership of legal persons, and it published updated guidance on 10 March 2023 to help countries put the change into effect.

The revised standard expects a multi-pronged approach. Countries should require companies to hold accurate, current information on their own beneficial owners, maintain a beneficial ownership registry or an equally effective alternative mechanism, and draw on supplementary sources of information as risk warrants. The aim is to make sure competent authorities can get reliable ownership data quickly, and to close the gap that lets criminals hide behind anonymous shell companies. Most of the national rules above are downstream of this benchmark.

Why National Central Registries Fall Short

National central registries hold beneficial-ownership data and are meant to pull corporate ownership into the open. Useful in theory. In practice their value rests on three things, and each one is shaky.

Accuracy. Without an automated way to check what gets submitted, a registry can end up as little more than a mailbox, collecting whatever it is handed regardless of whether it is true. Unverified data undercuts the whole point.

Access. Pulling data back out can be awkward, especially for someone outside the country that holds it, and some registries charge fees that put people off entirely. EU access narrowed further after the courts weighed in.

Reliability. Both FATF and EU rules are explicit that obliged entities cannot lean on registries alone. A risk-based approach still applies, weighing the type, form, and structure of each legal entity against its laundering and terrorist-financing risk.

In November 2022 the Court of Justice of the European Union invalidated the open public access that the 5th AML Directive had granted to these registers, ruling that unrestricted public access was a serious interference with privacy rights. The newer AMLD6 framework restores access on a legitimate-interest basis: competent authorities and obliged entities keep full access, and other parties, including providers of AML/CFT products and the press, get in where they can show a qualifying interest.

Cost is the quiet part of the story. Standing one of these registers up is not cheap, and the bills vary widely with the size of the jurisdiction and what the register is asked to do. The register is a useful input to UBO work, rarely the whole answer.

How KYC Hub Helps You Find and Verify UBOs

Working out who genuinely owns the companies you onboard, then proving it, is the hard core of Know Your Business. KYC Hub's global KYB solution is built around that problem. It automates corporate onboarding and due diligence so the answer rests on evidence rather than guesswork.

The platform leads with the parts that matter most for ownership work:

• UBO detection and verification. Automated discovery traces ownership chains through their layers to the natural persons at the top, and verifies them, including PSC detection where it applies.
• Automated, swift onboarding. A configurable KYB workflow moves corporate clients through checks quickly instead of stalling on manual research.
• Global compliance. Coverage spans the divergent definitions and thresholds described above, so a multinational client is assessed against the rules that actually bind it.
• Tailored workflows. Risk policy and rating engines, red-flag alerts, and ongoing monitoring keep ownership data current after onboarding, not just on day one.

For a fragmented regulatory picture like the one 2026 presents, automating UBO discovery and keeping it monitored beats re-running the research by hand every quarter. Book a corporate due diligence demo.

Conclusion

A UBO is the real person behind a company, and identifying them underpins transparency, risk management, and AML compliance. The 25% threshold gives you a starting line, the structure of the entity dictates the method, and the 2026 split between a lighter US regime and a broader EU one means the right approach is a risk-based one tuned to each client's actual footprint. Find the person, verify them against reliable sources, and keep watching for change.