Finding the people behind a company: a practical guide to beneficial ownership
Identify beneficial owners by reconciling two imperfect lists, the register and the applicant's own disclosure, then testing each person against an ownership threshold and, where nobody crosses it, against control by other means. Verify each person to a depth set by their role.
Charles Archibong, Co-founder
· 5 min read
Key takeaways
- A beneficial owner is always a natural person; the ownership threshold is a test, not the definition.
- FATF guidance says an ownership threshold should not exceed 25%; national rules can be lower.
- Reconcile the register with the applicant's list: omissions and removals are risk signals.
- When no one crosses the threshold, look for control by other means, then the senior managing official.
In practice, you identify a company's beneficial owners by reconciling two imperfect lists: what the company register says about the company's officers and shareholders, and what the applicant tells you. You then test each natural person against an ownership threshold and, where nobody crosses it, against control by other means, and finally verify each person to a depth that matches their role.
The threshold is where teams usually start, and where the common mistakes happen. It is a test for finding owners, not the definition of one. A beneficial owner is the natural person who ultimately owns or controls the company, and the FATF's 2023 guidance is explicit that the ultimate beneficial owner "is always one or more natural persons" (FATF Guidance on Beneficial Ownership of Legal Persons, March 2023 (opens in a new tab)).
Which threshold should you use?
There is no single number. The FATF Recommendations give 25% as an example of a controlling ownership interest (FATF Recommendations, updated October 2025 (opens in a new tab), note 38 to INR.10), and the 2023 guidance says a threshold "should not exceed a maximum of 25%", adding that higher risk "could signal the need for a lower ownership threshold". National rules then set their own figure.
Source | What it sets |
|---|---|
FATF guidance (March 2023) | A threshold, if used, should not exceed 25%; lower for higher risk |
US FinCEN CDD rule, 31 CFR 1010.230(d) (opens in a new tab) | Each individual owning 25% or more of the equity, plus one individual with significant responsibility to control |
Nigeria, Persons with Significant Control Regulations, 2022 (opens in a new tab) | A person with significant control includes anyone holding at least 5% of the issued shares, or exercising at least 5% of the voting rights, directly or indirectly |
Your threshold is a policy decision that must match the rules that apply to you and your risk assessment. Requirements differ by jurisdiction, and this article is general information, not legal advice.
Two refinements matter more than the headline number. First, test the controlling stake, the larger of economic ownership and voting rights: a person with 5% of the equity and 60% of the votes controls the company. Second, count indirect holdings, which is where layered ownership comes in (covered in its own guide).
How do you build the list of people?
Step 1: take the register's list
Registers often list one person several times: as a director, again as a shareholder, again as a person with significant control. Merge these into one party carrying every role. Otherwise you screen the same person three times and, worse, may send them three verification requests.
Step 2: ask the applicant
Ask the business to list its directors and owners, with contact details for the people you will need to verify. The applicant knows things the register does not, such as voting arrangements, recent share transfers not yet filed, and nominee relationships.
Step 3: reconcile the two
Compare the lists by name. Three outcomes each carry a different meaning:
On the register, missing from the applicant's list. An omission. Sometimes an honest lapse, sometimes a deliberate one. Flag it.
Shown the register's list, and removed from it. A choice, not a lapse. This deserves a stronger flag than an omission.
On the applicant's list, not on the register. Possibly a recent change not yet filed. Keep the person, mark them as uncorroborated and review.
Step 4: apply the threshold, then the cascade
FATF describes the identification of beneficial owners of a legal person as cascading measures, each used when the previous one has not identified anyone: the natural persons with a controlling ownership interest; then, where there is doubt or nobody controls through ownership, the natural persons exercising control through other means; and where nobody is identified that way, the natural person holding the position of senior managing official (INR.10, paragraph 5(b)(i) and note 37).
The guidance gives a simple illustration of why the cascade exists: with a 20% threshold, a company with as few as six shareholders can have nobody above the line (paragraph 42). An empty list is a prompt to keep looking, not a finding.
A worked example
Take an illustrative Nigerian private company applying for a merchant account. The register shows:
Party | Register role | Holding | Voting |
|---|---|---|---|
Amaka | Director, shareholder | 40% | 40% |
Tunde | Director | 0% | 0% |
Chidi | Shareholder | 8% | 8% (applicant declares 30% under a shareholder agreement) |
Hilltop Holdings Ltd | Shareholder | 52% | 52% |
The applicant's own list includes Amaka and Tunde, and omits Chidi.
Amaka is a beneficial owner at any threshold between 5% and 40%, and a director. Verify her fully.
Chidi holds 8% of the equity but, on the applicant's own declaration, 30% of the votes. His controlling stake is 30%, so he is a beneficial owner under a 25% threshold as well as under a 10% one. His omission from the applicant's list is itself a signal to review.
Tunde owns nothing but is a director. He is in scope for screening and, depending on your policy, identity verification.
Hilltop Holdings Ltd is a company. It cannot be a beneficial owner. The people behind it might be, which is an unresolved branch you still have to trace.
Under a 25% test on equity alone you would have found only Amaka, and approved a company that is 52% owned by an unknown party with an undisclosed controlling voter.
How deeply should you verify each person?
Not everyone needs the same check. Set a depth per role:
Screening only for roles you must know about but not identify in depth, such as some signatories.
Identified: screening plus corroboration by the register and a distinguishing detail such as date of birth or nationality, so you know which person with that name you screened.
Full identity verification: the person completes their own document and selfie check.
When a person holds several roles, hold them to the strongest requirement. A director who is also a beneficial owner meets the owner's bar.
Then make the decision wait. Approving the company the moment the register responds, while its owners' checks are still pending, is how a verified business ends up owned by nobody you have verified.
How Myaza Trust supports this
Business Verification discovers key people from the registry, merges repeated entries into one party with all their roles, and, when you collect the applicant's list, reconciles the two: registry people the applicant did not list are flagged undisclosed, removed names are flagged more strongly, and uncorroborated entries are marked for review. The beneficial-owner threshold defaults to 25% in most markets and 10% for Nigeria, and a value you set on the workflow always wins; the test uses the larger of economic ownership and voting rights.
Each role gets one of three tiers (screening only, identified or full KYC through a personal invite link valid for 14 days), people are screened through Watchlist Screening, and the decision can wait for everyone via the keyPeople.cddComplete field. The key people documentation covers each setting.
Checklist
Set a threshold that meets your applicable rules, and write down why.
Test the larger of equity and voting rights, and include indirect holdings.
Merge repeated register entries into one party per person.
Collect the applicant's own list and reconcile it against the register.
Treat omissions and removals as review signals.
When nobody crosses the threshold, look for control by other means, then the senior managing official.
Set verification depth by role, and hold multi-role people to the strongest.
Make approval wait for the people checks.
Sources
Charles Archibong
Co-founder
Charles Archibong co-founded Myaza Trust. He writes about identity verification, financial technology, and the practical work of building trusted digital services.
