Know your business work asks two linked questions: does this entity exist and operate as described, and who ultimately owns or controls it. The second question is where most files weaken, because ownership chains cross jurisdictions, registers disagree with documents, and structures change quietly after onboarding.
On this page
What KYB actually covers
A complete corporate file usually answers six things: that the entity legally exists and is in good standing; who its directors and officers are; what it actually does and where; who ultimately owns it; who ultimately controls it, which is not always the same thing; and what the relationship with the firm is intended to be. Ownership is one strand, but the strand that most often carries the residual risk.
Regulatory basis, stated carefully
HMRC guidance for supervised businesses describes customer due diligence as including customer and beneficial owner checks where applicable, understanding ownership and control, understanding the purpose and intended nature of the relationship, ongoing monitoring, record keeping and updating information on change. GOV.UK guidance also sets out the position for obliged entities on reporting discrepancies about a beneficial owner on the PSC register, both when establishing a new business relationship and during ongoing due diligence.
Precisely which obligations apply, and to what depth, depends on the firm's sector, supervisor and the risk presented. FCA findings describe practice the FCA observed in the firms it reviewed rather than a uniform standard for all businesses. This page is general information, not legal or compliance advice.
Resolving the ownership chain
- Establish the immediate entity. Legal name, registration number, jurisdiction, status, registered address and filing currency of the record.
- Capture direct shareholders. Each holder, holding percentage and holder type, from the most authoritative source available.
- Recurse upward. Repeat for each corporate holder until natural persons are reached, or until a regulated or listed entity makes further tracing unnecessary under the firm's policy.
- Calculate effective ownership. Multiply through the chain rather than reading only the immediate layer, so indirect holdings crossing the threshold are caught.
- Identify control separately. Voting rights, rights to appoint or remove directors, golden shares, shareholder agreements and significant influence exercised by other means.
- Verify identified individuals. Apply reasonable measures proportionate to risk, and record the method used and the result.
- Screen every identified party. Not only the top-level customer. See screening false positives for how to keep that volume manageable.
- Record the terminal point. Where tracing stopped and why.
Practitioner note
The most common structural defect we see is a file that names beneficial owners without showing the chain that produced them. A reviewer cannot test a conclusion they cannot reconstruct. Keeping the resolved chain, with source and date per layer, is what converts a name into evidence.
Registers and discrepancies
Public registers are valuable but imperfect: they are self-declared, updated on filing rather than on change, and structured differently across jurisdictions. Treat a register as one corroborating source alongside constitutional documents, shareholder registers, customer declarations and commercial data.
Where the firm's information differs from the register, that difference should be handled deliberately rather than quietly reconciled. In practice that means recording the discrepancy, establishing which source is correct and why, considering the discrepancy reporting position for obliged entities under the GOV.UK guidance, feeding the outcome into the customer risk assessment, and keeping the evidence of the conclusion.
Hard cases
- Dispersed ownership. Where no individual meets the threshold, evidence the consideration of control by other means before relying on a senior managing official.
- Trusts. Identify settlor, trustees, protector, beneficiaries or class of beneficiaries, and anyone otherwise exercising control, with verification proportionate to risk.
- Nominees. Record the nominee relationship explicitly and identify the person behind it; a nominee named as owner is a stopping point, not an answer.
- Foundations and partnerships. Map the equivalent control roles rather than forcing the structure into a company template.
- Opaque jurisdictions. Where registry data is thin, the firm should rely more heavily on documents and attestations and reflect the residual uncertainty in the risk rating and monitoring intensity.
- Circular or self-referencing holdings. Detect loops explicitly so the chain terminates with an explanation rather than a truncation.
Evidence standards
For each party identified, a strong file holds the role, the ownership or control basis, the percentage where relevant, the source and the retrieval date, the verification method and result, the screening result and disposition, and the identity of the person who concluded the assessment. Chain snapshots should be retained so a later reviewer can see the structure as it stood at the time of the decision, which is the point of a defensible audit trail.
Common pitfalls
- Reading only the immediate shareholder layer and missing indirect holdings.
- Accepting a register extract as the whole of the firm's reasonable measures.
- Defaulting to the senior managing official without evidencing the earlier steps.
- Screening the customer but not the identified owners and controllers.
- No mechanism to detect ownership change after onboarding. See periodic versus perpetual KYC.
- Discrepancies resolved in conversation and never written down.
Where technology helps
Registry retrieval, chain construction, effective ownership calculation, party screening and snapshot retention are all well suited to automation, and automation improves consistency across a large book. Judgement about the adequacy of evidence in an opaque structure remains with an accountable person. The Agora Due Diligence Platform includes ownership resolution, screening and identity verification modules with the resulting chain and its sources held against the case record.
Primary sources
- HMRC AMLG11300, customer due diligence (updated 16 July 2026)
- GOV.UK, report a discrepancy about a beneficial owner on the PSC register by an obliged entity
- The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017
- FCA, Firms' customer due diligence processes and controls: our findings (8 April 2026)
Frequently asked questions
What is the difference between KYB and beneficial ownership verification?
Know your business covers the whole exercise of understanding a corporate customer: its legal existence, status, activity, structure and the people behind it. Beneficial ownership verification is the part of that exercise concerned with identifying the natural persons who ultimately own or control the entity, and taking reasonable measures to verify their identity.
Can a firm rely on a public register such as the PSC register?
Registers are a useful source but are not a substitute for the firm's own reasonable measures. Obliged entities also have discrepancy obligations to consider where the information they hold differs from the register, both when establishing a new relationship and during ongoing due diligence.
What if no natural person meets the ownership threshold?
Where ownership is dispersed and no individual meets the applicable threshold, firms generally look to control exercised by other means and then to the senior managing official position, recording the reasoning and the evidence considered at each step rather than jumping to the final option.
How should trusts and nominee arrangements be handled?
Identify the relevant parties to the arrangement, such as settlor, trustees, protector, beneficiaries or class of beneficiaries and anyone otherwise exercising control, and apply verification proportionate to risk. Nominee arrangements should be recorded explicitly, with the person behind the nominee identified.
How deep should an ownership chain be traced?
Far enough to identify the natural persons who ultimately own or control the entity, and to satisfy the firm that the structure is understood. The firm should record where tracing stopped and the basis for stopping there, rather than leaving an unexplained gap in the chain.
Related resources
Regulatory answer
What should firms do when beneficial ownership changes?
Remediation and ongoing KYC
KYC Trigger Events: When Should Customer Due Diligence Be Reviewed?
CDD and onboarding
Enhanced Due Diligence (EDD): Triggers, Evidence and Controls
Governance and assurance
Building a Regulator-Defensible CDD Audit Trail
Where the technology fits
Agora is a technology provider: the platform supports the control described above, and your own teams operate it and hold the accountable decisions.
Next step
Struggling with layered structures?
See automated ownership chain construction, registry retrieval and discrepancy handling with a full evidence trail.