Money and matters: A lawyer’s guide to navigating Tranche 2 Part 8 - Understanding Ultimate Beneficial Owners (UBOs)

In our previous article, we discussed the foundation of an AML program - CDD and KYC procedures. Now it’s time to look at one of its most crucial components: identifying and verifying Ultimate Beneficial Owners (UBOs).

AUSTRAC has a comprehensive page describing the reasoning and regulations around UBOs. 

In this article, we won’t replicate AUSTRAC’s guidance but instead provide practical examples of how to approach UBO identification. We will focus on identification and verification for complex or international entities, as this is one of the most difficult and time-consuming parts of AML. Although it may seem daunting, it can be done using a systematic and measured approach.

What is a UBO?

An Ultimate Beneficial Owner is any natural person who ultimately owns or controls 25% or more of an entity, either directly or indirectly. 

This seems straightforward but can quickly become complex when dealing with corporate structures, trusts, or international ownership arrangements.

Why do UBOs matter?

Understanding UBOs is crucial because criminals often use complex ownership structures to hide their involvement in transactions. By identifying UBOs, you can:

• Prevent your firm from unwittingly facilitating money laundering
• Protect your firm's reputation by identifying all related parties
• Meet your regulatory obligations
• Identify potential conflicts of interest
• Better understand your client's business

As Jessie Mao, Chief Compliance Advisor at First AML explains, "Think of UBO identification like peeling an onion. You need to keep going through the layers until you find the actual people at the core. It's not enough to stop at the first company or trust you encounter."

What the legislation requires

Under the November 2024 draft update to the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No.1), commonly referred to as the ‘the Rules’ firms must:

1. Collect and verify the following information about their corporate customer e.g. company, sole trader, trust/SMSF, partnership, etc.
   1. Legal and trading name
   2. Unique identification number e.g. company number
   3. Address of registered and principal place of business
   4. The nature of the customer’s business (note this does not need to be verified)
2. Gather detailed information on ownership, control, and management structures.
3. Collect documentation that demonstrates how a customer is regulated. Examples include a company constitution, a partnership agreement, or a trust deed.
4. If a trust is involved in the structure, a reporting entity must collect and verify specific details about trustees, including:
   1. The type of trust (e.g., discretionary, unit, or bare trust)
   2. The identities of the settlor 
   3. The identities of any appointors, guardians, or protectors

Note that the above is based on how the rules are currently drafted, and will be updated if necessary once final rules are agreed.

Practical steps to identify UBOs

Note that there are four options:

• Manual
• Technology-aided
• Hybrid (manual + technology-aided)
• Outsource (get someone else to do it)

Each has its pros and cons, but for the sake of this article we’ll give the options of doing it manually and highlight what processes AML technology can automate.

Step 1: Initial information gathering

• Request a company structure chart (here are some good examples of what company structures can look like)
• Obtain beneficial ownership information e.g. shareholders register, structure charts
• Ask about any trust or nominee arrangements
• Get details of directors and senior management with control

 While this process can be done manually, many firms find success with modern platforms that automate registry searches, structure mapping and documentation request workflows.

Step 2: Documentation review

Review:

• Company extracts
• Trust deeds
• Partnership agreements
• Shareholder agreements
• Constitutional documents

Pro tip: Consider using systems that can help track document requests and submissions - this becomes particularly valuable when dealing with multiple entities or complex structures. 

Step 3: Verification

For each UBO identified (25% or more control or ownership), collect and verify their:

• Full name
• Date of birth
• Residential address
• Nationality
• Role in the organisation 

Special considerations for different entity types

Trusts

• Identify all trustees
• Verify beneficiaries with specified interests
• Understand the classes of beneficiaries
• Identify the settlor and other controlling parties e.g. protector (if any)

Partnerships

• Identify all partners with 25%+ interest
• Verify managing partners
• Understand profit-sharing arrangements

Foreign companies

• Understand equivalent ownership concepts
• Apply a risk-based approach depending on the risks presented by a foreign client
• Document additional verification steps

Common challenges and solutions

Challenge 1: Complex ownership structures

Complex ownership structures create significant obstacles in UBO identification because:

• They often involve multiple layers of corporate entities, trusts, and intermediary companies
• Ownership can be deliberately obscured through intricate cross-ownership arrangements
• Some structures use shell companies or nominees to hide the actual beneficial owners
• The more layers involved, the more difficult it becomes to trace the ultimate economic beneficiary
• Complex structures may span different jurisdictions, adding legal and regulatory complexity

Solution

• Create visual maps of ownership structures.
• Work backwards from the client entity until you reach natural persons.
• Document each step of your investigation.

While this can be done manually, some firms are leveraging technology that automatically maps structures using registry data and allows for manual additions such as Trust structures (which are not publicly available).

Challenge 2: International ownership

International ownership introduces challenges such as:

• Varying legal and regulatory frameworks across different countries
• Different reporting standards and transparency requirements
• Potential use of offshore jurisdictions with less stringent disclosure rules
• Language and documentation barriers when tracking ownership across borders
• Complexities in verifying ownership documents from multiple jurisdictions
• Differing definitions of what constitutes a beneficial owner in different legal systems

Solution

• Use international company registries
• Request apostilled, certified or notarised documents
• Use reputable electronic data providers with international coverage

Challenge 3: Resistant clients

Resistant clients are the most difficult and, what may look like red flag behaviour, can also be legitimate, especially for ultra high net worth individuals. Typical challenges include:

• Refusing to provide complete or accurate ownership information because “I’ve given this to you before.”
• Creating intentionally complex structures to obstruct transparency or for tax purposes
• Using legal loopholes or jurisdictional differences 
• Employing sophisticated legal strategies for tax purposes
• Showing reluctance or providing incomplete documentation during compliance processes (often due to concerns about privacy)

 Solution

• Explain the regulatory requirements and potential consequences
• Document all attempts to obtain information
• Consider whether continued service is appropriate if information isn't forthcoming
• Have clear escalation procedures

Red flags to watch for.

Be alert to:

• Reluctance to provide ownership information
• Overly complex structures without a clear business purpose
• Frequent changes in ownership or control
• Ownership structures involving high-risk jurisdictions
• Use of nominee shareholders or directors
• Bearer shares or similar arrangements

Practical tips for implementing UBO processes

Create clear procedures

• Develop standard approaches
• Implement verification checklists
• Establish escalation protocols
• Document decision-making processes

Automate where possible

• Implement solutions that connect directly to a broad number of corporate registries
• Use platforms that automatically build and visualise ownership structures
• Automate document collection and verification processes where possible
• Set up automated monitoring and alerts for PEP and sanction lists

Train your team

• Ensure staff understand UBO concepts -the why and the how
• Provide regular updates on new trends
• Share real-world examples
• Create clear guidance documents
• Create clear guidance for handling exceptions

Ongoing monitoring

Remember that UBO identification isn't a one-time exercise. You need to:

• Regularly review UBO information
• Update records when changes occur
• Monitor for red flags
• Keep verification documents current 

Common mistakes to avoid.

Stopping at the first layer

Don't accept a company as the UBO – keep going until you identify natural persons

Overlooking control

Remember that control can exist without ownership (e.g., through voting rights or agreements)

Poor documentation and record-keeping

Always document your reasoning and verification steps

Inconsistent approach

Apply your UBO identification procedures consistently across all relevant clients

Summary

Understanding and identifying UBOs is a crucial part of your AML/CTF compliance program. While it may seem daunting initially, a systematic approach and clear procedures will help make it manageable. Modern technology, such as platforms that can automate registry searches and build ownership structures, can significantly streamline the process. However, whether manual or automated, remember to:

• Take a risk-based approach
• Document everything
• Use available tools and resources
• Keep information up to date
• Train your team effectively

Most importantly, view UBO identification not just as a compliance exercise but as a vital part of understanding your clients so you can better serve them while protecting your firm.