Category: AML and KYC

Beneficial Ownership

Also known as: BO, Beneficial Owner, Ultimate Beneficial Owner, UBO, Beneficial Ownership Information (BOI)

Simply put

Beneficial ownership refers to the real people who ultimately own or control a company or asset, even when that ownership is held indirectly or in someone else's name. Identifying beneficial owners helps businesses and regulators understand who actually benefits from and directs a legal entity. This matters for knowing who you are truly dealing with in a business relationship.

Formal definition

Beneficial ownership is the identification of the natural person or persons who directly or indirectly own or control a legal vehicle, or who otherwise benefit from or exercise control over it. In banking and finance contexts, a beneficial owner is commonly identified by an ownership threshold, typically a natural person holding over 25% of an entity, though thresholds and control-based criteria vary by jurisdiction and applicable regulation. In the United States, beneficial ownership information (BOI) reporting to FinCEN (US Department of the Treasury) encompasses details about the individuals who directly or indirectly own or control a reporting company; specific reporting obligations, thresholds, and definitions should be confirmed against the current published rules and applicable law, which change and vary by region.

Why it matters

Knowing the real people behind a legal entity is central to understanding who you are actually doing business with. Companies, trusts, and other legal vehicles can obscure the natural persons who ultimately own or control them, and that opacity can be exploited to conceal illicit activity, evade sanctions, or launder funds through layered ownership structures. Identifying beneficial owners helps financial institutions, payment processors, and acquirers assess counterparty risk during onboarding and throughout a relationship, rather than relying only on the name of the registered entity.

Beneficial ownership identification is a core component of Know Your Customer and anti-money-laundering programs, and it increasingly carries direct regulatory obligations. In the United States, beneficial ownership information (BOI) reporting to FinCEN, part of the US Department of the Treasury, requires reporting companies to provide details about the individuals who directly or indirectly own or control them. Because specific reporting obligations, thresholds, and definitions change over time and vary by region, organizations should confirm current requirements against the applicable published rules rather than assuming a fixed standard.

Who it's relevant to

Compliance and KYC teams

Teams responsible for onboarding and ongoing due diligence use beneficial ownership identification to determine the natural persons behind an entity, assess risk, and meet KYC and anti-money-laundering obligations. Where reporting rules such as FinCEN BOI apply, these teams also confirm current thresholds and definitions against the applicable published requirements, which vary by region and change over time.

Acquirers and payment processors

When onboarding merchants that are legal entities, acquirers and processors need to understand who ultimately owns or controls the business rather than relying solely on the registered entity name. Identifying beneficial owners supports counterparty risk assessment and helps clarify who actually benefits from and directs the relationship.

Merchant risk and financial institution onboarding staff

Staff evaluating new business relationships apply ownership thresholds and control-based criteria to identify beneficial owners, often unwinding indirect or layered ownership. Because a natural person may hold ownership indirectly or through a custodian or nominee, these teams may need to trace control beyond the immediate registered owner.

Inside BO

Ultimate Beneficial Owner (UBO)

The natural person or persons who ultimately own or control a legal entity, typically identified by meeting or exceeding a defined ownership or control threshold set by applicable regulation or program rules. The specific threshold and definition vary by jurisdiction and by the acquirer, payment processor, or sponsoring bank applying it.

Ownership prong

The component of beneficial ownership analysis that identifies individuals who own a qualifying percentage of the equity interests in an entity. The exact percentage and calculation method depend on the governing regulation and the onboarding party's policy, so it should be confirmed against the current applicable rules rather than assumed.

Control prong

The component that identifies individuals who exercise significant management or control over an entity, such as senior officers or those with authority to direct its activities, regardless of ownership percentage. This is distinct from the ownership prong and may identify different individuals.

Layered or indirect ownership

Structures in which entities are owned by other entities, trusts, or nominees, requiring the onboarding party to trace ownership through multiple layers to reach the natural persons who ultimately own or control the merchant.

Verification and documentation

The collection and validation of identifying information for identified beneficial owners as part of customer due diligence during merchant onboarding. The scope and rigor depend on the applicable regulatory framework and the risk profile assigned to the merchant.

Common questions

Answers to the questions practitioners most commonly ask about BO.

Is beneficial ownership a PCI DSS requirement?

No. Beneficial ownership identification is not a control defined within PCI DSS, which governs the protection of cardholder data and the security of the cardholder data environment. Beneficial ownership requirements typically arise from anti-money-laundering and know-your-customer obligations that apply to acquirers, payment processors, and other regulated financial entities. When you evaluate a merchant relationship, treat beneficial ownership as part of your onboarding and due-diligence program rather than assuming it is satisfied by PCI DSS validation, and confirm the applicable obligations against the relevant regulatory framework in your region.

Does verifying a merchant's beneficial ownership mean the merchant is not a fraud risk?

No. Identifying who ultimately owns or controls a merchant helps reduce certain risks, such as concealment of true ownership behind shell structures, but it does not by itself confirm the merchant is free of fraud risk. Beneficial ownership information is intended to support due diligence, not to eliminate account takeover, transaction laundering, first-party fraud, or synthetic identity risk. Treat it as one input among several, and combine it with ongoing monitoring, because ownership verified at onboarding may not reflect later changes in control or behavior.

At what point in the merchant lifecycle should beneficial ownership be collected and verified?

Beneficial ownership is commonly collected during onboarding and due diligence, before or as part of establishing the merchant relationship, and then reviewed on a periodic or event-driven basis. Because ownership and control can change over time, many programs refresh the information at defined intervals or when trigger events occur, such as a change in signatories, processing patterns, or corporate structure. Confirm the specific timing and refresh obligations against the regulatory framework that applies to your organization and region, as these vary.

What kinds of records should be retained to evidence beneficial ownership checks?

Retain records that show what information was collected, how it was verified, when the check was performed, and who performed it, consistent with your applicable regulatory and audit obligations. This may include the identifying details captured for each beneficial owner, the verification method or source used, and the date of review. Retention periods and acceptable evidence depend on the governing framework and jurisdiction, so align your retention schedule to those requirements rather than to a generic default.

How does beneficial ownership fit alongside a fraud-monitoring program for merchants?

Beneficial ownership information supports risk-based onboarding and can inform how closely a merchant is monitored, but it does not replace transaction and behavioral monitoring. Ownership data may help you flag higher-risk structures for enhanced review, while monitoring is intended to detect issues such as unusual processing patterns, transaction laundering, or elevated chargeback activity over time. Treat the two as complementary layers, and note that any risk scoring derived from ownership data carries false-positive and false-negative trade-offs that require review.

How should discrepancies or unverifiable beneficial ownership information be handled?

Define an escalation path in advance so that discrepancies, incomplete disclosures, or ownership you cannot verify are reviewed rather than accepted by default. Depending on your program and the applicable regulatory framework, this may involve requesting additional documentation, applying enhanced due diligence, restricting or delaying onboarding, or declining the relationship. Document the rationale for the decision, and confirm the required actions against the obligations that govern your organization, because acceptable outcomes and thresholds vary by framework and region.

Common misconceptions

Beneficial ownership is a PCI DSS requirement.

Beneficial ownership identification is a customer due diligence and anti-money-laundering concept applied during merchant onboarding by acquirers and payment processors under applicable financial regulation and card brand or network rules. It is separate from PCI DSS, which governs the protection of cardholder data. The two address different objectives and should not be conflated.

Identifying beneficial owners eliminates fraud or money-laundering risk.

Beneficial ownership analysis is intended to increase transparency about who ultimately owns or controls a merchant and may help detect certain risks, but it does not by itself prevent fraud, account takeover, or illicit activity. It is one control among many and carries limitations, including reliance on self-reported or obtainable information.

A single fixed ownership percentage universally defines a beneficial owner.

Thresholds and definitions for the ownership and control prongs vary by jurisdiction, regulatory framework, and the onboarding party's own risk-based policy, and they can change over time. The applicable threshold should be confirmed against the current governing rules rather than assumed to be a fixed number.

Best practices

Confirm the applicable beneficial ownership thresholds and definitions against the current governing regulation and your program's own policy before onboarding, rather than assuming a fixed percentage, since these vary by jurisdiction and change over time.

Apply both the ownership prong and the control prong when identifying beneficial owners, recognizing that they may surface different individuals and that control can exist independent of equity ownership.

Trace layered, indirect, trust, or nominee ownership structures through to the natural persons who ultimately own or control the merchant, and document the analysis at each layer.

Adopt a risk-based approach that adjusts the depth of verification and documentation to the merchant's assigned risk profile, and record the basis for that risk assessment.

Keep beneficial ownership records current through periodic review or event-driven updates, so that changes in ownership or control are captured after initial onboarding.

Keep beneficial ownership due diligence processes distinct from, but coordinated with, PCI DSS cardholder data protection controls, since they serve different objectives and are governed by different frameworks.