The UBO Ownership Threshold Rule: 25%, 50%, and How to Trace Indirect Control

A company applies to open a payment account. Its two directors are holding companies, each owning 50%. Behind each sits another layer of shell entities. By the time you reach the natural persons at the top, nobody appears to own more than 20% — so no one triggers your 25% threshold. The beneficial owner stays hidden. That is exactly what Ultimate Beneficial Owner (UBO) rules were designed to break.

This post covers what a UBO is, how the 25% threshold works, why indirect ownership through layered structures is the harder problem, and how to calculate and verify beneficial ownership in practice.

Key takeaways

• A UBO is any natural person who ultimately owns or controls a legal entity, regardless of how many corporate layers sit between them and the business.
• The standard threshold is 25% of shares, voting rights, or ownership interest — FATF, EU AMLD, and FinCEN CDD Rule all converge on this figure.
• The 50% indirect-ownership rule closes the most common obfuscation: if a natural person owns more than 50% of an intermediate holding company, their effective stake is traced proportionally through the chain to the operating entity.
• Ownership and control are separate tests — a 15% holder who appoints the majority of the board is still a UBO.
• The compliance obligation is to identify and verify UBOs — the same identity checks required for individuals in a KYC flow.

What is an Ultimate Beneficial Owner?

A UBO is the natural person who ultimately owns or controls a company — the human behind the legal entity, however many layers of corporate structure separate them from the register.

Two tests apply:

• Ownership test: who holds equity, shares, capital, or profit interests above the threshold?
• Control test: who exercises control through voting agreements, board appointment rights, contractual management rights, or powers of attorney — or who is the senior managing official when no natural person clears the ownership threshold?

A shareholder registry alone cannot satisfy a UBO check. It tells you who the shareholders are; only control analysis tells you who actually runs the company.

The 25% threshold

Most jurisdictions have settled on 25% as the minimum ownership or voting-interest stake that triggers UBO identification:

• FATF Recommendation 10 — natural persons who own or control 25% or more must be identified.
• EU AMLD4/AMLD5 — 25% is the standard threshold across the EU; AMLD6 tightens enforcement further.
• FinCEN CDD Rule (31 CFR Part 1010) — covered US financial institutions must identify every natural person owning 25% or more, plus one controlling-person regardless of ownership.

Some higher-risk sectors apply a stricter floor (10% or any material ownership), but 25% is the international baseline. If nobody owns 25% or more, you do not stop — you move to the control test and, if that also yields no natural person, identify the senior managing official as a fallback UBO.

The 50% indirect-ownership rule

For a flat structure the 25% test is straightforward. It gets harder when a company is owned by other companies that are themselves owned by other companies.

The standard method is proportional multiplication. If a natural person owns 60% of Company A, and Company A owns 50% of Company B, their effective interest in Company B is:

60% × 50% = 30%  →  above 25% → UBO

Add another layer — 60% of Company A → 40% of Holding Co X → 70% of Company B:

60% × 40% × 70% = 16.8%  →  below 25%

That looks clean until you apply the 50% rule for intermediate entities. Under FATF guidance, when a natural person owns more than 50% of an intermediate entity, their effective stake is traced proportionally through the full chain — not capped at the intermediate level. A person at 51% of a holding company is treated as directing everything it owns. This closes the classic obfuscation: inserting a holding company where the real owner holds 51–55% but appears to own only a fraction downstream.

Aggregating stakes and control without ownership

Ownership can arrive through multiple chains simultaneously. A person holding 15% directly, 60% of a vehicle that holds 20%, and a 10% trust interest has an aggregated stake of 37% — above threshold. A person cannot stay below threshold by distributing their stake across multiple vehicles.

The 25% test does not exhaust your obligation. Apply a control analysis whenever nobody clears the ownership threshold. Red flags include: dual-class or veto-right shares; shareholder agreements granting board appointment rights; management contracts to an off-cap-table person; trusts where the settlor or protector retains meaningful control; and nominees holding legal title on behalf of the true owner.

The compliance obligation: identify and verify

Identification is not enough. AMLD5, the UK Money Laundering Regulations, and FinCEN's CDD Rule all require UBOs to be verified: confirm identity against an official document, screen against sanctions and Politically Exposed Person (PEP) lists, and apply enhanced due diligence when risk factors are present.

Standard workflow: collect the ownership structure (registry extract, shareholder register) → trace UBOs through proportional ownership and control analysis → run full KYC for each UBO above threshold (document + liveness + AML) → screen the entity itself → document your rationale → refresh on trigger events and periodically.

How Didit helps

Didit's Business Verification (KYB) module, starting at $2.00, covers the full UBO stack — no stitching together of separate registry, extraction, and identity vendors.

Company registry lookup pulls the registered ownership record from official sources — directors, shareholders, registered address, company status — across supported jurisdictions.

UBO extraction maps the ownership structure from registry and filing data, applying proportional ownership calculation through holding-company chains to surface the natural persons who meet the beneficial ownership threshold.

Officer data surfaces directors and authorized signatories for the control test when ownership alone is inconclusive.

Entity AML screens the company against sanctions lists, PEP registries, and adverse-media sources.

Linked KYC sessions close the loop: for each UBO identified, Didit spawns a full individual KYC session — document verification, passive liveness, face match, and AML screening — billed at the standard User Verification rate, tied back to the parent KYB record in one unified audit trail.

Use cases

Payments and fintech — corporate client onboarding requires UBO verification before account activation. Didit's KYB + linked KYC handles the full chain in one flow.

Crypto and VASPs — FATF R.15 and Travel Rule requirements apply the same beneficial ownership obligations to crypto businesses as to banks. UBO verification is a prerequisite for CDD compliance.

Corporate banking — banks and neobanks under AMLD5 or equivalent cannot open accounts for legal entities without completing UBO identification and verification.

Lending and marketplace — lenders need UBO extraction to surface the controlling persons whose history matters to underwriting; regulated marketplaces need KYB on merchant entities before enabling payouts.

Frequently asked questions

What happens if a UBO refuses to provide identity documents?

Refusal is itself a red flag. Most regulated entities are required to decline the relationship or file a Suspicious Activity Report (SAR). Document the refusal and your decision.

Do nominee shareholders count as UBOs?

No. A nominee holds legal title on behalf of someone else. You must look through the nominee to the actual beneficial owner.

What threshold applies when there is no ownership-based UBO?

Move to the control test. If that also yields no natural person, most frameworks require you to identify the senior managing official as fallback UBO and apply the same verification obligations.

How often should UBO records be refreshed?

At minimum on trigger events: ownership change, new sanctions or adverse-media hit, jurisdiction change, or significant transaction-volume increase. Periodic rescreening — often annually for lower-risk customers — is standard under most CDD programs.

Does Didit's KYB cover all jurisdictions?

Coverage varies. Didit connects to official registry sources where accessible via API and flags where manual supplementation is required. Check the docs or your account team for current coverage.

Ready to get started?

UBO identification and verification is a compliance requirement, not a nice-to-have — and it's the step most often incomplete in corporate onboarding flows. Didit's Business Verification module gives you registry lookup, UBO extraction, officer data, entity AML screening, and linked KYC sessions for each UBO in one closed-loop API.

• Learn the module → Business Verification (KYB) docs
• See it in the platform → Business Verification
• Check the price → Pricing — KYB from $2.00, no minimums
• Start free → business.didit.me