The owner who is never on the paperwork

Most jurisdictions converge on the same number, which makes the arithmetic portable even when the filing regimes are not. Some sectors and situations pull it lower — 10% is common for high-risk categories — and plenty of institutions apply something stricter as internal policy.

Ownership is the test people remember; control is the one that catches what ownership misses. Someone can qualify through a senior officer role, through authority to appoint or remove directors, through the power to make or veto major decisions, through contractual or financing arrangements, or through influence exercised via family or close association.

This is the whole reason UBO work cannot stop at a shareholder register. The register answers who holds the shares. It does not answer who decides.

Collect the declared ownership. Trace it through the layers — this is the step that turns a five-minute check into a project, because each intermediate entity has to be resolved before the next one can be. Identify control persons who do not appear in the ownership chain at all. Verify the identities you have arrived at. Then document what you did and set the conditions under which you will do it again.

Most of the cost sits in step two, and most of the risk sits in step three.

Nominee shareholders and nominee directors hold on behalf of someone else, and professional service providers routinely act as corporate officers — all of which must be looked through rather than recorded. Trusts substitute one question for several: settlor, trustee, protector, beneficiaries, each a different kind of interest.

And some jurisdictions simply do not collect the information. A chain that passes through one of them does not end there; it goes dark there, which is a different fact and should be recorded as one.

Self-declaration is the cheapest and the weakest: it is the applicant’s account of itself. Registry lookup is stronger where a registry exists and is current. Document review — share registers, operating agreements, trust deeds — is stronger again and slower. Third-party data reaches where the customer will not.

Corroboration is the only one that is not a source at all. It is the practice of requiring two sources that were not written by the same hand to agree, and it is what separates a verified owner from a recorded one.

A risk-based approach means the depth follows the exposure, not the calendar. Set re-verification triggers rather than an annual sweep — ownership changes when it changes.

And handle incomplete information honestly. Where a chain goes dark, the file should say that it went dark and where, not present a partial answer as a complete one. A thin file that admits it is thin is far more useful six months later than a confident one that was never true.