Key people & ownership
A registry lookup proves a business exists. Regulators (FATF, the EU AML directives, FinCEN's CDD rule) additionally require identifying, and in many cases verifying, the natural persons who own or control it: directors, beneficial owners (UBOs), and signatories. A KYB workflow does this for you, and this page explains who ends up on the list, how deeply each person is checked, and what happens when a shareholder turns out to be another company.
Everything here is configured per workflow under Dashboard → Workflows → [your KYB workflow] → Key People.
Where the list comes from
Two sources, reconciled against each other:
- The registry. The lookup's own record of officers and shareholders. One person often appears several times in a register (as a director, again as a shareholder, again as a person with significant control); we merge those into one party carrying every role they hold.
- The applicant. When Collect from the applicant is on, the form asks the business to list their own directors and owners, with contact emails.
After the lookup, the two lists are compared by name. A registry person the applicant did not list is flagged undisclosed; one who was shown the register's list and removed a name is flagged more strongly (keyPeople.removedFromRegistry); an applicant entry the registry does not corroborate is kept but marked unrecognised for review.
Roles
A party can hold several roles at once: director, beneficial_owner, signatory, shareholder. The webhook and API carry the full set as roles alongside the single headline role (the strongest one, beneficial owner first). Where the workflow asks different things of different roles, a party is held to the strongest requirement among the roles they hold, so a director who is also a beneficial owner clears the owner's bar.
Beneficial owners and the threshold
A shareholder whose stake reaches the workflow's beneficial-owner threshold is treated as a UBO. The default is per register: 25% in most markets (the FATF / EU / FinCEN indicative line), 10% for Nigeria, where CAMA 2020 requires disclosure of persons with significant control from 5%. Set your own threshold on the workflow; an explicit value always wins.
The test uses the party's controlling stake: the larger of their economic ownership and their voting rights. The two are equal until a company issues dual-class or preference shares, and testing ownership alone would file the holder of 5% of the equity and 60% of the votes as a minor shareholder, which is exactly the structure used to stay off a UBO register. Registers do not publish voting rights, so they are applicant-declared when they differ.
Verification depth
Each role is set to one of three tiers:
| Tier | What it does |
|---|---|
| Screening only | AML screening: sanctions, PEP and adverse media. |
| Identified | Screening, plus the person must be corroborated by the register and carry a distinguishing detail (date of birth or nationality). No biometric check. |
| Full KYC | The person completes their own identity verification (document + selfie) via a personal invite link, valid for 14 days. |
Invites can be emailed automatically, handed to the applicant as copyable links on the success screen, or both; a hosted key-people portal page lets the business chase stragglers. Each role can run its invite through a different published individual workflow, so a UBO can face a stricter check (NFC, proof of address) than a signatory. When the form requires email addresses, it asks only for the people who will actually be sent a link; a company is never asked for one.
The decision graph can wait for the whole group: gate on keyPeople.cddComplete (everyone met their own tier's standard) or keyPeople.kycComplete (every full-KYC person finished). See Decisioning.
Corporate shareholders
A shareholder is sometimes not a person but another company. A beneficial owner is by definition a natural person, so a corporate shareholder is never classified as a UBO, is never sent an identity check (there is no selfie a company can take), and never blocks the decision on its own. It is screened against sanctions lists as an entity, recorded with its registration number, and surfaced as an unresolved branch of the ownership chain, because the real owners sit further up.
Two decisioning fields carry this:
keyPeople.corporate: how many in-scope shareholders are companies.keyPeople.ownershipUnresolved: true while any corporate shareholder has nobody recorded above it. Route these applications to a person; every other check can pass while the actual owners remain unknown.
The applicant can also mark a party as a company themselves and, where they know them, declare the people who own it. Declared owners are recorded as exactly that: disclosed, corroborated by nothing.
Following the chain (look-through)
Optionally, the workflow can look a corporate shareholder up in its own register and pull in the people it finds, up to three levels deep (default one). Each person found this way joins the same list, indented under the company they were found through, and is screened and verified like anyone else.
- Effective ownership multiplies down the chain. Someone holding 75% of a company that holds 60% of the applicant owns 45% of the applicant, and 45% is what the beneficial-owner threshold tests.
- Chains cross borders. The company search resolves which register a parent is filed in, including region-split registers such as US states, so a Delaware parent of a Nigerian company is looked up in Delaware.
- Each step up is billed as a registry lookup, at the same rate as the workflow's own business lookup, which is why the feature is off by default. A branch that is already below the threshold is not looked up (nothing above it can cross the line), a company with no resolvable registration number is left unresolved, and a register outage refunds the lookup. A genuine "not found" keeps its charge: the register answered, and that answer is a finding about the chain.
- Once a branch has been walked,
keyPeople.ownershipUnresolvedstops flagging it.
In sandbox and development the chain never calls a real register. The standard sandbox company includes a corporate shareholder (Sandbox Holdings Ltd, RC0000900) with a person and a second company above it, so the whole feature, including the depth limit, is testable at no cost. See Sandbox testing.
What you receive
- Each
key_person.completedwebhook fires as a person's check resolves, carrying theirroleand fullroles. - The verification detail (dashboard and API) lists every party with their roles, economic and voting percentages, corporate flag, registration number, and, for people found up a chain, the parent company and their effective share of the applicant business.
- The decisioning roll-up:
keyPeople.status,anyFlagged,allCleared,total,inScope,waived,undisclosed,removedFromRegistry,unrecognized,kycRequired,kycVerified,kycFailed,kycPending,kycComplete,dataRequired,dataConfirmed,dataMissing,cddComplete,corporate,ownershipUnresolved.
Next steps
- Business verification (KYB): the full KYB guide.
- Decisioning: gate approval on the key-people roll-up.
- Screening: what the AML screen checks and how matches are adjudicated.