Beneficial Ownership Data: Resolving Who Owns Whom

Ownership and control are different questions

A beneficial owner is not whoever appears on the share register. The FATF Glossary, quoted in the FATF guidance on legal persons, defines the beneficial owner as "the natural person(s) who ultimately owns or controls a customer", adds that "only a natural person can be an ultimate beneficial owner" ^[1]. It separates legal ownership from beneficial ownership: individuals who exercise ultimate control "should be identified as beneficial owners, regardless of whether they own shares above any specified minimum ownership threshold" (paragraph 35).

For data design, ownership is arithmetic over a graph of shareholdings and yields a percentage per natural person; control is a fact about rights and relationships (board appointment, vetoes, nominee arrangements) and yields a yes or no with evidence. A model that stores only percentages cannot answer the second question; a model that stores only a final list of names cannot show how the first was computed.

The legal frame, by jurisdiction

FATF Recommendation 24 asks countries to ensure "adequate, accurate and up-to-date information on the beneficial ownership and control of legal persons", available to competent authorities "through either a register of beneficial ownership or an alternative mechanism"; Recommendation 25 does the same for express trusts and similar arrangements (FATF Recommendations, updated October 2025). FATF strengthened R.24 in March 2022 and R.25 in February 2023 ^[2].

The US CDD rule has two independent prongs. Paragraph (d)(1) covers each individual who "directly or indirectly ... owns 25 percent or more of the equity interests"; paragraph (d)(2) covers "a single individual with significant responsibility to control, manage, or direct" the customer ^[3]. FinCEN's FAQs state that the two prongs "are independent requirements" (B.23) and that when no individual owns 25%, one controlling individual must still be identified (B.10) ^[4].

OFAC says its rule "speaks only to ownership and not to control"; a controlled but not 50%-owned entity "is not considered automatically blocked", although OFAC may designate it ^[6].

The EU Regulation requires control via other means to be "identified independently of and in parallel to" ownership ^[5]. Article 53(2)(c) treats 50% plus one of the shares or voting rights as control through ownership, and Article 54 names, for multi-layered structures, the natural persons who control legal entities that hold a direct ownership interest. Article 90 sets application from 10 July 2027, with 10 July 2029 for two categories of obliged entities.

Current US status of Corporate Transparency Act reporting (dated 28 October 2026)

Beneficial ownership information (BOI) reporting under the Corporate Transparency Act is separate from the CDD rule. FinCEN's March 2025 interim final rule limited "reporting company" to entities formed under foreign law and exempted US persons as beneficial owners. FinCEN's page, updated 11 August 2026, states that a final rule took effect on 14 August 2026 and made those exemptions permanent, so US companies no longer file BOI reports ^[7]. The rule is "Beneficial Ownership Information Reporting Requirement Revision", published and effective on 14 August 2026 at 91 FR 52508. FinCEN's 11 August 2026 release adds that foreign reporting companies must still report foreign individuals.

The CDD rule itself also changed in practice. FinCEN's order FIN-2026-R001 of 13 February 2026 lets covered institutions, at their discretion, identify and verify beneficial owners at first account opening, when they learn facts that "reasonably call into question the reliability" of earlier information, and as their risk-based ongoing due diligence requires, rather than at every new account ^[8]. The date and source of the last verified ownership record therefore matter more.

Sources of ownership facts

The FATF guidance describes a multi-pronged approach: as a minimum, information held by companies, a registry or alternative mechanism, and supplementary sources such as financial institutions' customer due diligence (CDD) files, because several sources help "mitigate accuracy problems with individual sources" (paras 46-48). An analyst typically sees five inputs:

Register access is itself a constraint in the EU. In Joined Cases C-37/20 and C-601/20 (WM and Sovim, 22 November 2022), the Court of Justice held invalid the anti-money-laundering directive provision under which beneficial ownership information was "accessible in all cases to any member of the general public", finding the interference with private life and data protection neither strictly necessary nor proportionate ^[9]. An analyst outside an obliged entity or authority should not assume an EU register will answer.

The last row is a frequent mistake. In GLEIF's Level 2 data, entities report their "direct accounting consolidating parent" and "ultimate accounting consolidating parent" ^[10]. The Regulatory Oversight Committee policy defines the ultimate parent as "the highest level legal entity preparing consolidated financial statements" and notes that accounting definitions were "designed for a different purpose, i.e., to report relationships to investors" ^[11]. When an entity is controlled by natural persons with no intermediate legal entity, it reports an exception (NATURAL_PERSONS) instead of a parent ^[12]. Level 2 never names a person, so it cannot name a beneficial owner. Its use here is identifying a holding company through its LEI.

Each input is best stored as a claim: who asserted that X holds Y% of Z, in which document, as of which date, retrieved when. The EU Regulation asks for "the date as of which the beneficial interest is held" ^[5].

Resolve entity identity before computing percentages

If two nodes in an ownership graph are the same company, or one node is really two, every downstream percentage is wrong. That is an entity resolution problem, the task the statistical literature also calls record linkage or de-duplication ^[13]. Resolve every legal entity in the chain to a canonical identifier (register number plus jurisdiction, or LEI) before any multiplication. Name similarity is evidence, not a match; the site's article on merging or relating organization records covers when two records should become one. The EU Regulation asks for "identification numbers of the individual legal entities" in a multi-entity structure ^[5].

Worked example: Halden Therapeutics AG (fictional)

All names below are fictional. Halden Therapeutics AG has these shareholders, from its share register:

• Fjordline Holdings Ltd: 50%
• Brask Invest GmbH: 30%
• Dispersed holders, none above 1%: 20%

Fjordline Holdings Ltd, from its own filing: Ana Petrov 40%, "Brask Investment GmbH" 60%. Brask Invest GmbH, from its register entry: Jonas Weber 60%, Ana Petrov 40%.

Step 1: resolve the entities

Fjordline's filing spells its shareholder "Brask Investment GmbH". The register number matches Halden's shareholder: one company. Without that check the graph has two nodes, one with no known owners.

Step 2: multiply along chains, add across chains

This is the method in the EU text and in FinCEN's FAQ example, where Betty's indirect 20% through one company and 16⅔% through another are added to "a total of indirect ownership interest of 36⅔%" ^[4].

Check: 44% + 36% + 20% dispersed = 100%. Both persons meet the 25% ownership prong of the US CDD rule and Article 52(1) of the EU Regulation. A US bank must still name one individual under the control prong.

Step 3: the same chain with a mis-resolved entity

If "Brask Investment GmbH" is left unresolved, the Fjordline → Brask chains disappear into an unknown node. Ana's total drops to 32%, still a beneficial owner. Jonas's total drops to 18%, and he no longer appears. One unresolved spelling variant removed a 36% beneficial owner from the output, and nothing in the output says so.

The opposite error, merging an unrelated "Brask Invest GmbH" registered elsewhere, would give its shareholders stakes in Halden they do not hold.

Step 4: the OFAC reading of the same structure

Suppose Jonas Weber were a blocked person. His multiplied 36% is below 50%, so a team reusing its CDD calculation would conclude Halden is not blocked. OFAC's text gives a different method. "Indirectly" refers to ownership "through another entity or entities that are 50 percent or more owned in the aggregate by the blocked person(s)"; in OFAC's Example 1, a 50% chain makes each lower entity "a blocked person" in turn ^[14]. Applied here:

1. Jonas owns 60% of Brask, so Brask is blocked.
2. Brask owns 60% of Fjordline, so Fjordline is blocked.
3. Brask (30%) and Fjordline (50%) together own 80% of Halden. Stakes of blocked persons are aggregated ^[15], so Halden is blocked.

OFAC's Examples 4 and 5 show the other side: a blocked person's 25% in an intermediary that is not itself 50% or more owned by blocked persons contributes nothing to the lower entity ^[14]. The two US regimes therefore need two computations over the same resolved graph, not one percentage reused.

With the mis-resolved node from step 3, Fjordline's majority holder is unknown, so Fjordline's status is unknown, and Halden is 30% owned by a blocked entity plus 50% by an entity of undetermined status. The correct output is "undetermined", not "not blocked".

When sources conflict

The register says 30%; the certification says 20%. Three practices help:

• Keep both claims, each with source, as-of date and retrieval date; never overwrite one with the other.
• Prefer by an explicit rule and record it. A register entry and a certified declaration are both self-reported; do not rank them by habit.
• Route material conflicts. FATF describes discrepancy reporting, where institutions report differences between their CDD findings and the register, and suggests countries define a "material threshold" and record discrepancy reports (paras 68-70). The US CDD rule allows reliance on the customer's information only if the institution "has no knowledge of facts that would reasonably call into question the reliability of such information" ^[3]; a conflicting register entry may be such a fact.

Unknown links: declared, not guessed

Under the open-world assumption, a missing shareholder record means "not known", not "does not exist". The regulations make the same distinction.

• European Union: where, "after having exhausted all possible means of identification, no natural persons are identified" or there are doubts, obliged entities "shall record that no beneficial owner was identified", identify the senior managing officials, and "keep records of the actions taken" ^[5]. Legal entities in that situation must provide "a statement that there is no beneficial owner or that the beneficial owners could not be determined", with a justification ^[5].
• FATF: the senior managing official is recorded "as holding this position"; this "does not amend or supersede the definition of who the beneficial owner is" ^[1].

"No one above 25%" (verified dispersed ownership), "chain broken at Fjordline" (unknown) and "senior managing official recorded in lieu" are three different states. Collapsing them into an empty list is how the error in step 3 becomes invisible. See the method for declaring unknowns.

Evidence to retain

The US CDD rule requires procedures for "making and maintaining a record of all information obtained" under its identification and verification procedures ^[3]. In the EU, the information on undetermined beneficial owners must be kept for five years after the legal entity ceases to exist ^[5]. To reproduce a determination, a reviewer needs: each source document with retrieval date; the resolved entity identifiers and match evidence; the ownership graph as of the determination date; the per-chain calculation and its method; control findings with evidence; and declared unknowns with the steps taken to fill them.

Review triggers

Checklist

1. Resolve every legal entity to a canonical identifier before any arithmetic.
2. Compute per regime: multiply and add for CDD and the EU Regulation; propagate blocked status for OFAC.
3. Evaluate control separately, with its own evidence.
4. Keep "dispersed", "unknown" and "senior managing official in lieu" distinct.

This article is educational and is not legal or regulatory advice; obligations depend on the jurisdiction and on the institution's own program.

Reliable Context keeps one canonical record per real thing, with a cited, dated source behind every value, unknowns declared and any past state reproducible, inside the customer's perimeter.

Sources

1. FATF Guidance on Beneficial Ownership of Legal Persons, FATF, March 2023 — definition, threshold, multi-pronged approach, discrepancy reporting.
2. The FATF Recommendations, FATF, updated October 2025 — Recommendations 24 and 25.
3. Beneficial ownership topic page, FATF — 2022 and 2023 revisions.
4. 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers, eCFR — ownership and control prongs, reliance, recordkeeping.
5. CDD Rule Consolidated FAQs, FinCEN, 6 May 2026 — prongs, indirect ownership (B.13), triggers (B.18).
6. Order FIN-2026-R001, exceptive relief from identifying beneficial owners at each new account, FinCEN, 13 February 2026 — when to identify and verify.
7. Beneficial Ownership Information Reporting, FinCEN, updated 11 August 2026 — 2025 interim and 2026 final rules.
8. FinCEN permanently ends beneficial ownership reporting requirements for millions of small business owners, FinCEN, 11 August 2026 — US exemption; foreign companies still report.
9. OFAC FAQ 399, OFAC, 13 August 2014 — aggregation.
10. OFAC FAQ 401, OFAC, 13 August 2014 — indirect ownership examples.
11. OFAC FAQ 398, OFAC, 11 August 2020 — ownership, not control.
12. OFAC FAQs, Entities Owned by Blocked Persons (50 Percent Rule) — FAQ 402, divestment.
13. Regulation (EU) 2024/1624 (AML Regulation), Official Journal, 19 June 2024 — Articles 22, 51-54, 62, 63, 90.
14. Level 2 data: who owns whom, GLEIF — accounting consolidating parents.
15. LEI ROC policy on Level 2 data, GLEIF — consolidation definition and limits.
16. Level 2 data: reporting exceptions format, GLEIF — NATURAL_PERSONS exception.
17. Binette, O. and Steorts, R. C., (Almost) All of Entity Resolution, arXiv:2008.04443 — entity resolution terminology.
18. Court of Justice of the European Union, Press release No 188/22, Joined Cases C-37/20 and C-601/20, 22 November 2022 — general-public access to beneficial ownership registers invalid.
19. Beneficial Ownership Information Reporting Requirement Revision, final rule, 91 FR 52508, 14 August 2026, Federal Register — US reporting companies exempt; effective 14 August 2026.
20. Sanctions Advisory: Guidance on Sham Transactions and Sanctions Evasion, OFAC, 31 March 2026 — sham divestments do not unblock property.