Beneficial Ownership Verification for Platforms and UBO Rules That Control B2B Payout Risk

Verify the people behind the business within the rules that apply to you#

Beneficial ownership verification helps a payout team understand the natural persons who own or control a business payee. It does not replace checking the business itself, the destination bank account or whether the payment is owed. Start by determining which legal requirements and provider conditions apply to your platform, then design the collection, review and payout decisions around that scope.

This guide is for platform compliance, risk and finance teams handling business counterparties. It distinguishes U.S. financial-institution customer due diligence (CDD), Corporate Transparency Act reporting to FinCEN and a platform’s own controls. Those are separate obligations. A platform does not become subject to the bank CDD rule merely because it pays a seller or contractor.

The U.S. scope discussion uses primary guidance checked on October 3, 2026, including February account-opening relief and the final BOI reporting rule effective in August. Other countries may use different ownership thresholds, control tests, exceptions and record rules. Map the actual entities, regulated activities and provider agreements before adopting a global procedure.

Separate CDD, BOI reporting and platform policy#

FinCEN’s CDD FAQs identify covered institutions, including banks, federally insured credit unions, securities brokers or dealers, mutual funds and specified futures businesses. A marketplace or software platform should assess its own status and partner requirements; it should not describe every business recipient as its regulated bank customer.

For the separate destination-account task, see How Platforms Validate Bank Accounts Before Mass Payouts. A verified bank account does not resolve a missing owner, and a verified owner does not make an unrelated payout destination acceptable.

What changed in U.S. requirements in 2026#

FinCEN’s February 13, 2026 exceptive relief order allows a covered institution to limit beneficial-owner identification and verification to the customer’s first account, later facts that reasonably call previous information into question, and its risk-based ongoing CDD needs. Using the relief is optional; an institution may continue checking at each new account opening. The relief does not remove initial or ongoing CDD.

Document whether the institution has adopted the relief. Do not silently treat a second account as either a compulsory repeat check or an automatic exemption from review. New information can require an update even when no new account is opened.

FinCEN’s current BOI page states that the final reporting rule took effect August 14, 2026. U.S.-created companies are exempt. Reporting companies need not report U.S. person beneficial owners or company applicants, and U.S. persons need not supply BOI to reporting companies. FinCEN’s August announcement confirms that qualifying foreign reporting companies still report foreign individuals.

A BOI reporting exemption is not an exemption from a covered institution’s CDD checks. It also does not prevent a platform or provider from requesting appropriate information under a separate applicable requirement or policy. Conversely, do not require an exempt domestic business to produce a FinCEN filing as the only acceptable onboarding evidence.

Keep a reporting company’s filing and update duties separate from your refresh process. A CTA filing deadline is not a universal period in which a payout platform must re-verify every payee. If an actual reporting-company obligation is relevant, assess it under the current rule; use the platform’s applicable CDD and risk policy for its operational review.

Identify ownership and control before deciding which evidence to collect#

Under 31 CFR 1010.230, the ownership prong includes each individual, if any, with at least 25% direct or indirect equity. The separate control prong identifies one individual with significant responsibility to manage or direct the entity. The same person can meet both. Account and entity exemptions matter; do not apply the ordinary company test mechanically to every entity type.

For your platform’s policy, state the applicable threshold and control test before configuring a vendor. If you collect below a statutory threshold because risk warrants it, label that as an additional policy choice rather than changing the law’s definition. Do not assume all regimes use the U.S. CDD approach.

Identity verification and proof of ownership are different tasks. The U.S. rule permits reliance on customer-supplied owner information when there are no facts reasonably calling its reliability into question, while requiring risk-based verification of identified people’s identities. A vendor’s successful identity check does not independently prove the declared shareholding. Resolve a material contradiction in the ownership facts rather than asking for a second copy of the same passport.

Worked example: look through a holding company#

Assume an ordinary, in-scope legal entity customer with straightforward equity and no applicable exclusions. Holding Company H owns 60% of the payee; Carla directly owns the remaining 40%. Alice owns 60% of H and Bob owns 40% of H. Dan is the payee’s chief executive with significant management responsibility and no equity. The case is hypothetical and uses the U.S. CDD threshold.

Alice, Carla and Dan are identified under this example’s two-prong test. Bob is not automatically a required ownership-prong person merely because he owns 40% of H. Additional arrangements, another ownership path or control facts could change the analysis; a risk-based policy may also collect more information. Record the basis and do not mistake H, a company, for the final natural-person owner.

Suppose a later document shows Alice actually owns 30% of H and Bob owns 70%. Their effective interests would become 18% and 42%. Determine whether this is a completed change, a proposal or an outdated record before replacing the original conclusion. If confirmed, refresh the affected owner determination and identities as required, retain the effective date and show who approved the updated status. The arithmetic alone does not authenticate the document.

Compare three delivery choices and two controls they all need#

In-house, vendor-led and hybrid describe who performs the work. Event-triggered refresh and a decision-linked evidence file describe controls needed across those choices. They are not five alternatives from which you should select only one. A hybrid process still needs refresh triggers and records, and an in-house team can use external data without outsourcing its decisions.

Choose delivery based on the counterparties you actually handle, staffing and provider requirements. Hybrid can suit mixed cases, but it is not universally the most defensible option. A vendor with suitable scope may handle routine cases well; a dedicated internal team may be necessary for a specialized book. Assess evidence quality and unresolved queues rather than model labels.

Before delegating, confirm supported jurisdictions and entity types, the threshold and control logic used, which facts the vendor verifies, access to the basis of its result and the procedure for corrections. Agree security, retention, export and service-exit arrangements. An ordinary vendor contract is not automatically the special regulated-institution reliance arrangement described in the CDD rule.

Build intake around the actual counterparty and risk#

Start with the legal name, registration details, relevant entity type, business activity and relationship purpose. Obtain the appropriate ownership and control declaration and identify who supplied it. Use registry records, corporate records or other reliable evidence as the applicable policy requires. Explain a request clearly enough that a legitimate business can supply the right information.

FATF’s 2023 guidance on legal persons supports combining information sources to improve transparency. Its standards guide national implementation; they are not a single directly applicable global platform filing rule. Registry information can help, but its coverage, date and content determine what it proves.

A layered company, foreign owner or holding company is not proof of wrongdoing. Escalate the specific unresolved fact: an unexplained share gap, inconsistent effective dates, an unidentified controller or evidence that contradicts a declaration. Ask for the missing link rather than automatically marking every complex structure suspicious.

For identity information, use the collection and verification procedures applicable to your arrangement. U.S. CDD identifying fields include name, date of birth, address and an appropriate identification number; non-U.S. persons may use passport or other permitted identification information rather than a U.S. Social Security number. The Appendix A form is optional. Do not copy sensitive identity numbers into general finance or support notes.

Refresh information when facts or risk require it#

An event-triggered review complements any periodic work your risk-based policy requires. It does not mean “never review on a calendar.” Give each trigger an owner, response target and affected scope. A name similarity can require investigation without justifying an immediate permanent block. Keep sanctions screening and its applicable ownership rules separate from the UBO collection threshold.

Distinguish collecting an updated declaration, verifying an affected identity and reassessing the relationship. They may require different evidence. Avoid restarting every completed step without a reason, but do not carry forward a previous approval when its factual basis is no longer reliable.

Make payout decisions authorized, proportionate and reviewable#

A platform policy may restrict activation or a particular payment while a material ownership issue is reviewed, subject to applicable law and contracts. UBO uncertainty is not a universal legal instruction to withhold every amount indefinitely. Identify who may impose or lift a restriction, its scope, the reason and when it must be reviewed. Route legal freezes and other mandatory actions through the applicable procedure.

For example, an unresolved new corporate payee could remain unactivated while the missing ownership link is supplied. An existing payee with a disputed change needs an assessment of affected activity and obligations, not an unexplained permanent stop on the entire batch. Record the decision and any lawful alternatives without presenting one outcome as required in all cases.

When communicating, give the customer an appropriate description of missing information and a contact for follow-up. Limit access to sensitive review material. If suspicious-activity reporting duties apply to the responsible institution, use its confidential escalation and disclosure procedures; a generic vendor flag is not itself a reporting determination.

Keep a decision file without collecting everything forever#

The U.S. CDD record rule distinguishes retention periods: identifying records are retained for five years after account closure; verification records for five years after they are made. Other requirements can apply. For a platform’s own file, map the governing obligations and provider terms instead of copying one period to every artifact. Use controlled access, appropriate deletion and reliable retrieval.

The file should let an authorized reviewer answer why these people were identified and what action was permitted. A folder of documents without a decision is incomplete; so is a “verified” status whose basis cannot be retrieved. Keep sensitive evidence in its controlled system and use case references in payout operations.

Choose delivery and controls together#

Define the rules that apply, the people to identify, acceptable evidence and decision authority before configuring a vendor. Use the worked ownership chain to check the logic, then follow a case through onboarding, a later change and any payout restriction. The result should be a proportionate process your team can explain and operate.