Verifying beneficial owners of corporate clients

For a corporate client, an accountant must identify every individual who ultimately owns or controls it, take reasonable measures to verify who they are, and understand the ownership and control structure in between. The PSC information at Companies House is a starting point, but regulation 28(9) of the Money Laundering Regulations 2017 says a firm cannot meet the duty by relying solely on it. The firm also has to collect a register excerpt before taking the client on and report material discrepancies.

Who is a beneficial owner of a company?

Regulation 5(1) of the Money Laundering Regulations 2017 (MLRs) defines the beneficial owner of a body corporate, other than a company listed on a regulated market, as:

• any individual who exercises ultimate control over the management of the body corporate;
• any individual who ultimately owns or controls, directly or indirectly, more than 25% of the shares or voting rights; or
• an individual who controls the body corporate, which for a company or LLP means meeting one of the PSC conditions in Part 1 of Schedule 1A to the Companies Act 2006, or being an individual of whom the body corporate would be a subsidiary undertaking under section 1162.

For ordinary partnerships, regulation 5(3) applies a similar more than 25% test to capital, profits or voting rights. Trusts are dealt with in regulation 6, where the settlor, trustees, beneficiaries or class of beneficiaries, and anyone with control over the trust are all beneficial owners. The rest of this page concentrates on companies and LLPs. The company law side, meaning what the client itself must record, is covered in persons with significant control.

What does the firm have to do?

Regulation 28 sets out the duties for a corporate client:

• obtain and verify its name, company number and registered office address, and principal place of business if different (regulation 28(3)(a));
• take reasonable measures to determine and verify the law it is subject to, its constitution, the full names of its board and the senior persons responsible for its operations (regulation 28(3)(b));
• take reasonable measures to understand the ownership and control structure (regulation 28(3A));
• identify each beneficial owner and take reasonable measures to verify their identity so that the firm is satisfied it knows who they are, and where a beneficial owner is itself an entity or arrangement, understand its ownership and control structure too (regulation 28(4)).

Note the difference in wording. Identifying the beneficial owner is absolute. Verifying their identity requires “reasonable measures”, which allows a risk based approach to how much evidence is gathered for each person.

Why is the PSC register not enough?

Regulation 28(9) is explicit: a firm does not satisfy regulation 28(4) by relying solely on information delivered to the registrar about registrable persons or registrable beneficial owners. HMRC’s guidance at AMLG11400 repeats the point. There are practical reasons as well as legal ones:

• The definitions differ. Companies House guidance notes that a beneficial owner under the MLRs is not always the same as a PSC. In particular, regulation 5(1)(a) catches an individual who exercises ultimate control over management, which may not appear on the PSC record.
• Entities appear instead of people. Where a company is owned by another company, the register may show a relevant legal entity. The firm must look through it to the individuals behind.
• Nominees and trusts. HMRC points out that the beneficial owner may differ from the legal owner, for example where shares are held as nominee or on trust.
• Self reported data can be wrong or out of date. The PSC record is filed by the company and is not independent of the client.
• Companies House identity checks are not a substitute. ICAEW has confirmed that the MLRs do not permit firms to rely on Companies House identity verification, including personal codes, for AML purposes. See Companies House identity verification.

How are beneficial owners verified in practice?

HMRC suggests identifying beneficial owners by asking the company, searching the PSC record, checking company websites and using public records in the UK and overseas. For verification, it gives examples such as searching the relevant company registry and obtaining a copy of the company’s register of members. Regulation 43 helps: a UK company that is not listed must, on request, give the firm information on its legal and beneficial owners, including those of any company or trust above it in the chain, and must notify the firm of changes within 14 days of becoming aware of them.

The individual beneficial owners themselves are verified like any other individual, from reliable independent documents or a secure electronic identification process (regulation 28(18) and (19)). ICAEW’s summary of the 2026 CCAB guidance says the updated guidance sets a hierarchy of evidence for verifying a beneficial owner’s identity with a passport as the preferred form, and that digital verification services should be certified and registered against the UK Digital Verification Services trust framework; uncertified services cannot be relied on alone.

What if no beneficial owner can be identified?

Regulation 28(6) and (7) allow a firm to treat the senior person responsible for managing the company as its beneficial owner, but only if it has exhausted all possible means of identifying the beneficial owner and has either failed or is not satisfied that the person identified really is the beneficial owner. Regulation 28(8) then requires written records of every step taken, reasonable measures to verify the senior manager’s identity, and a record of any difficulties encountered. HMRC describes this as for exceptional circumstances and suggests considering whether the client should be treated as higher risk, or even as suspicious, because of the number of layers.

Where the inability to identify the owner means CDD cannot be completed, regulation 31 applies: the firm must not establish the relationship, must end an existing one, and must consider a suspicious activity report.

What are the register excerpt and discrepancy duties?

Regulation 30A(1) requires a firm, before establishing a business relationship with a UK company, LLP, eligible Scottish partnership, registrable trust or registered overseas entity, to collect an excerpt of the register showing the beneficial ownership information held, or to establish that there is none. Regulation 30A(2A) repeats the requirement when CDD or ongoing monitoring is carried out later in the relationship.

If the firm finds a material discrepancy between the register and what it has learned, it must report it: to Companies House for companies, LLPs and Scottish partnerships, and to HMRC for trusts (regulation 30A(3)). Schedule 3AZA says a discrepancy is material if it may reasonably be considered linked to money laundering or terrorist financing, or to conceal details of the client’s business, and lists forms such as a different name, an incorrect nature of control or date of birth, or a missing PSC. Companies House guidance adds that a difference caused only by the gap between the PSC and MLR definitions is not material, and that a discrepancy report is not a substitute for a suspicious activity report, or the other way round.

What does this look like for a two tier structure?

Illustration only. A new client, Trading Ltd, is wholly owned by Holdings Ltd. The Companies House record for Trading Ltd shows Holdings Ltd as a relevant legal entity; Holdings Ltd shows two PSCs, A with 60% and B with 40%. The firm saves the register excerpts for both companies, obtains Holdings Ltd’s register of members to confirm the split, and verifies A and B from passports. Discussion with the finance director reveals that B holds her shares as nominee for her father, C, who runs the business day to day. C is therefore a beneficial owner and must be identified and verified. The firm asks whether the register is to be corrected; if the omission looks designed to hide C, it is a material discrepancy to report to Companies House, and the firm considers whether suspicion arises.

What are the common mistakes?

• Printing the PSC page and treating that as verification.
• Stopping at a corporate shareholder instead of looking through it.
• Not saving the register excerpt before the engagement starts.
• Defaulting to the senior manager route without documented attempts to find the real owner.
• Forgetting that the listed company carve out in regulation 28(5) applies only to the listed company itself.

Lower risk clients may justify lighter verification under simplified due diligence, but the register excerpt and discrepancy duties still apply.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

• Customer due diligence for accountants (AML)
• Due diligence on trusts, charities and similar clients
• Electronic identity verification for clients
• Nominee shareholders
• Due diligence on overseas and remote clients

Sources

• legislation.gov.uk: SI 2017/692, regulation 5
• legislation.gov.uk: SI 2017/692, regulation 6
• legislation.gov.uk: SI 2017/692, regulation 28
• GOV.UK: Manual page AMLG11400
• legislation.gov.uk: SI 2017/692, regulation 43
• ICAEW: Aml latest updates and reviewer insights webinar
• ICAEW: 2026 ccab aml guidance for the accountancy sector
• legislation.gov.uk: SI 2017/692, regulation 31
• legislation.gov.uk: SI 2017/692, regulation 30A
• legislation.gov.uk: SI 2017/692, schedule 3AZA

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.