Blogs
Beneficial ownership untangled: What's required and how APLYiD does the work for you
The Money Laundering Regulations 2017 require every nonindividual customer to have its ownership traced back to real people who own more than 25% or who control it. That means following the trail through every shareholder, trust, and holding company until an actual person is named, then risk assessing and verifying that person. APLYiD pulls the company and ownership data, then verifies and screens each named individual, so your team isn't chasing those checks one by one.
Who is a beneficial owner?
A beneficial owner is an individual who directly or indirectly owns more than 25% of the shares or voting rights in a customer, or who otherwise exercises control over it.
For a UK company, this overlaps closely with the persons with significant control (PSC) test under the Companies Act, and in most cases the individuals who qualify as beneficial owners under the MLR will be the same people listed as PSCs at Companies House. The two aren't the same thing though.
PSC is a company law filing with its own thresholds and disclosure duties, while beneficial ownership is the AML test that applies to every type of nonindividual customer, not only companies. A regulated business still has to carry out its own beneficial ownership assessment rather than treating the PSC register as the answer.
This applies whether ownership runs through a direct shareholding or through layers of companies and intermediaries (trusts have their own separate beneficial ownership rules and aren't covered in detail here). In practice, you're rarely just checking who owns the company in front of you. You're checking who owns the owner, until you reach an actual human being. A company can never be the final answer, only a person can be a beneficial owner.
This is where manual AML processes tend to slow down or go wrong, because a shareholding register only ever shows one layer at a time, and a company's own PSC filing at Companies House isn't something you can simply take on trust. The Money Laundering Regulations call this identifying the beneficial ownership structure, and require every individual holding more than 25% at any point in that chain, directly or indirectly, to be identified.
What does control mean if someone owns less than 25%?
Control is a separate test from ownership altogether. For a company, control exists through voting rights, the right to appoint or remove a majority of the board, majority shareholding, or the practical ability to exercise significant influenceover the company, even without any formal legal right to enforce it. For partnerships and other structures, the test narrows to control of management or that same practical influence standard.
What this means day to day is that someone can control a business with zero shares in it, simply by being the person everyone actually listens to. It's a judgement call rather than a number on a share register, which is exactly why it trips up manual reviews, and exactly why the public PSC register alone is never the full picture.
What do the Money Laundering Regulations actually require you to do?
Every nonindividual customer, meaning any company, partnership, trust, or unincorporated association, triggers three linked obligations:
| MLR 2017 requirement | What it means in practice | Handled in APLYiD by |
|---|---|---|
| Identify beneficial owners and reconcile against the register | Trace the chain until real individuals are named, and flag where your findings don't match Companies House | KYB check with PSC register pull and reconciliation |
| Assess ML/TF risk | Risk rate the customer and every person behind it | Risk scoring applied at both entity and individual level |
| Verify each beneficial owner | Every named individual needs the same identity checks as the customer | Digital document and biometric verification, PEP/sanctions screening |
In other words, onboarding "the company", or even pulling up its PSC filing, isn't the finish line. A regulated business has to independently verify every qualifying individual behind it, report it if what you find doesn't match the public register, and keep going until each one has been both risk assessed and verified, which in a layered structure can mean checking several people, not just one.
How does APLYiD take this off your plate?
APLYiD's KYB check gives you the company and PSC data alongside verification and screening for the named individuals, in one workflow and one audit trail, rather than pulling Companies House filings separately and chasing verification for each person by hand. Every document and result is retained against the customer file automatically, so the record the regulations expect is built as you go rather than assembled after the fact. Your team's role shifts from assembling paperwork to reviewing the outcome.
