Ultimate Beneficial Ownership (UBO): What It Means for Firms

Identifying the ultimate beneficial owner is the part of client due diligence most likely to be done badly and least likely to be caught. The definition looks simple, the register looks authoritative, and neither impression survives contact with a layered ownership structure.

Two things have changed what the work actually involves. Obliged entities now have a positive duty to report material discrepancies between what the register says and what they find. And since November 2025, the people named on the UK register have to verify their own identity, on a rolling timetable that is still working its way through every company on the register.

What a beneficial owner is

A beneficial owner is the natural person who ultimately owns or controls the customer. Two words carry the weight. Natural person — the answer is never a company, so an ownership chain has to be followed to its end rather than to the first corporate shareholder. Ultimately — the answer is not necessarily on the share register.

The familiar 25% figure is a trigger, not a definition. Holding more than 25% of shares or voting rights makes someone a beneficial owner, but so does exercising control by other means, and that second limb is where the difficult cases live: shareholder agreements, veto rights, the right to appoint or remove a majority of the board, or informal control exercised through family members or nominees.

The practical consequence is that a structure with no single holder above 25% has not answered the question. It has moved it. Our guide to beneficial ownership and control works through legal entity structures, trusts and the evidence standards that apply when ownership and control diverge.

The duty that most firms discharge badly

This is the obligation worth reading twice, because it is affirmative and time-sensitive rather than a background expectation.

Before establishing a new business relationship with a company or overseas entity customer, an obliged entity — which includes accountants — must obtain a register extract. Where it then identifies a material discrepancy between the register and its own findings, it must report it. The guidance is explicit: obliged entities must tell Companies House when they identify a material discrepancy, and should report any material discrepancies as soon as they are identified.

Material means the discrepancy could reasonably be considered linked to money laundering, terrorist financing, or concealing details of the customer's business, including its people with significant control or registrable beneficial owners. A different surname, an incorrect nature of control, a wrong date of birth or nationality, or a missing person with significant control are all given as examples.

Equally useful is what does not need reporting: spelling errors, shortened names and minor address variations; a Welsh, English, Scottish or Northern Irish nationality recorded as UK; discrepancies already reported or resolved before submission; information the register does not require; and owners holding under 25% of shares. The exclusions are what make the duty workable, and firms that have not read them tend either to report nothing or to report everything.

Two further points are routinely missed. Bulk reporting is not allowed — reports should not be accumulated and submitted together, which rules out the quarterly sweep some firms run. And a discrepancy report is not a suspicious activity report. Suspicion is reported separately through the proper channel, and the reporting obligations under the Proceeds of Crime Act 2002 sections 327 to 330 are unaffected by having filed a discrepancy report. Confusing the two leaves a firm exposed on the one that carries criminal liability.

The duty covers the register of people with significant control for companies, limited liability partnerships and eligible Scottish partnerships, and the Register of Overseas Entities for registrable beneficial owners.

Identity verification, and the birth-month timetable

Identity verification under the Economic Crime and Corporate Transparency Act 2023 became mandatory from 18 November 2025, and it reaches people with significant control as well as directors.

The mechanics matter because they determine when a given client is affected:

• Someone becoming a PSC after 18 November 2025 provides their personal identification code when they are reported to Companies House. If they have not already shared it with the company, they have 14 days from being listed on the register to submit it.
• An existing PSC who is also a director must verify and file within 14 days of the filing date of the first confirmation statement due after 18 November 2025 — so the deadline follows each company's own confirmation statement cycle rather than a single national date.
• An existing PSC who is not a director must verify and file within 14 days of the start of their birth month. Someone born on 22 January has a window opening on 1 January and a code due by 14 January.

Verification is done once, but the code has to be notified for every company or limited liability partnership the person is a PSC of. Extensions of 14 days can be requested online up to twice, provided the request comes within the original deadline.

Non-compliance is not purely administrative. The individual may be committing an offence and face a financial penalty, and a note is added against their name on the public register. Separately, where Companies House queries a PSC entry and the company does not respond within 14 days, that is a criminal offence which may lead to penalties or prosecution.

For a practice, the birth-month rule is the planning point: a client book is effectively spread across twelve rolling deadlines, and the non-director PSCs are the ones least likely to be watching for the letter.

Why the register is not the answer

The register is a starting point and a cross-check. It is not evidence that the ownership information is correct, which is precisely why the discrepancy duty exists: the regime assumes obliged entities will find errors in it and depends on them saying so.

Identity verification narrows one gap — whether the named person exists and is who they say they are. It does not establish that the right person has been named. A nominee who verifies their identity successfully is a verified nominee.

What good practice looks like

Work from the structure down, not from the register out. Obtain the ownership chain, follow it to natural persons, and only then compare against the register extract — the opposite order anchors the analysis to whatever the register happens to say.

Where the structure resists explanation, that is itself the finding. A customer who cannot or will not produce a clear ownership structure, offshore layers with no commercial rationale, or control that sits visibly outside the shareholdings all point towards enhanced due diligence rather than more patient enquiry. Ongoing monitoring then has to be live rather than periodic, which is the function of transaction monitoring and adverse media screening.

Internally, two things carry the obligation. Someone has to own the decision to report, which falls to the money laundering reporting officer — see our guide to the MLRO role in an accountancy firm. And the firm has to be able to show its staff were trained to spot this, which is what supervisors examine under Regulation 24 of the Money Laundering Regulations 2017.

Our suggestions

Three things follow for a firm reviewing its approach.

Check whether the register extract is actually being obtained before the relationship starts, rather than at some point during onboarding. It is a sequenced requirement and the sequence is the part that gets lost. Second, write the materiality test and the exclusions into the procedure itself, so the judgement is made against the standard rather than against each reviewer's instinct. Third, build the rolling identity verification deadlines into the client cycle now: a confirmation statement date for PSC-directors, a birth month for everyone else.

The wider framework these obligations sit inside is set out in our AML and KYC guides hub.

The jurisdiction map, and why one procedure will not cover it

Everything above describes the UK position. Beneficial ownership is one of those obligations where the underlying concept travels and the mechanics do not, so a firm with clients in more than one jurisdiction cannot run a single procedure and assume it satisfies all of them.

• Ireland — companies. The Register of Beneficial Ownership has its own filing deadline, its own PPSN-based identity validation and its own penalty regime, and it imposes a discrepancy-reporting duty directly on designated persons. Set out in our guide to RBO obligations for Irish companies, with the practice-side view in the RBO for accountants.
• Ireland — trusts. Trusts sit on a separate register, CRBOT, with its own discrepancy notice process: CRBOT and discrepancy notices.
• United States. The CDD rule at 31 CFR 1010.230 approaches the same problem from the financial institution's side rather than the registry's, which changes what a client will be asked for: the US CDD rule and legal entity customers and what the FinCEN CDD rule means for your clients.
• Onboarding mechanics. Where this actually bites day to day is in business customer onboarding under regulation 28: KYB onboarding and regulation 28.
• Approval of owners and managers. A separate and frequently missed obligation, under regulation 26: BOOM approval and HMRC criminality checks.

What changes in the EU from July 2027

The EU has replaced its money laundering directives with a package built around a directly applicable regulation. Regulation (EU) 2024/1624, adopted on 31 May 2024 and recorded by EUR-Lex as entering into force on 10 July 2027, sits alongside an accompanying directive, Directive (EU) 2024/1640, and a new EU-level anti-money laundering authority.

The structural significance is the choice of instrument. A regulation applies directly in every member state rather than being transposed into twenty-seven national variations, which is the point: beneficial ownership rules have diverged in exactly the way a cross-border firm feels most. Detailed implementing standards are still being developed, so the sensible position for a practice today is to keep working to the regime described here while treating 2027 as a date on the training plan rather than a reason to redesign procedures now.

For UK firms the practical takeaway is narrower but real: the UK is outside that package, and from 2027 a UK practice with EU clients will be operating across two beneficial ownership frameworks that are deliberately moving apart.

Building this into a training programme

Beneficial ownership is the part of client due diligence that staff most often treat as a form-filling step, and it is the part where a wrong answer is hardest to spot afterwards. The identification work sits with the people doing onboarding, not with the MLRO, which makes it a training problem rather than a policy problem.

Learnsignal's CPD courses cover AML, client due diligence and financial crime for accountancy and finance teams, with the firm-wide obligations set out in our guide to AML training for accountants.