The UBO verification process, traced through one owner's 27% stake

The UBO verification process is how a bank identifies the ultimate beneficial owners of a business customer and verifies that each is who the customer says. In the US it means naming everyone who owns 25% or more, directly or indirectly, plus one controller, under FinCEN's Customer Due Diligence Rule, verifying each person to the standard of the bank's Customer Identification Program, and keeping records that show how. Most errors do not happen at the end, when the identity is checked; they happen in the handoffs before it, when a figure in a document is copied, multiplied, compared and recorded. Botminds' Beneficial Ownership Verification is built around those handoffs: every number carries its source, every computation is done twice, and every decision has a maker and a checker. This guide follows one owner's stake all the way through.

The owner is Marisol Ortega, and the customer is Pellridge Hospitality Group, a fictional Georgia LLC opening an operating account at a fictional bank, Corvane National Bank. All names, times and figures below are sample data. Her effective ownership is 27.0%. The certification Pellridge signed did not mention her.

What does UBO verification mean at a bank?

It means two things the rule keeps separate. Identification is the customer's job: the person opening the account certifies who the owners and controller are, to the best of his or her knowledge. Verification is the bank's: it must check the identity of every owner the customer names, using at least the elements of its CIP, and may rely on the customer's account of who the owners are unless it knows something that gives it reasonable cause to doubt it (31 CFR 1010.230(b)). UBO verification in practice is both at once: checking the people, and checking that the right people were named.

Examiners test both halves on a sample of files. The FFIEC procedure, in the version published in April 2026, asks whether the bank obtained identifying information for each owner, verified it in a reasonable time once the account was open, properly dealt with any owner whose identity could not be reasonably established, and "maintained a record of the identity information required …, the method used to verify identity, and verification results" (FFIEC examination procedures). A trace like this one is how QC and internal audit can test a file the way an examiner will.

UBO identification and verification requirements, in the order they apply

The rule's requirements fall into four steps. First, the bank must have written procedures "reasonably designed to identify and verify" owners, included in its AML program (1010.230(a)). Second, it identifies the owners at the customer's account opening, by the certification or equivalent information (1010.230(b)(1)); under FinCEN's optional February 2026 relief, at the customer's first account, and later only on doubt or the bank's own risk triggers (FIN-2026-R001). Third, it verifies each person's identity to CIP elements, and may use photocopies (1010.230(b)(2); FAQ B.14). Fourth, it keeps records: identification for five years after the account closes, verification for five years after each record is made (1010.230(i)).

For each person, the identifying information is the same four elements as CIP: name, date of birth, address, and a Social Security number or, for a foreign person, a passport or similar number (FAQ B.7). Those four are the fields a QC reviewer should expect to see verified, discrepancy by discrepancy, on every owner and on the controller.

Steps 1 and 2 of the process: from the clause to the chart

The trace starts in two documents. Pellridge's operating agreement lists Marisol Ortega at 18% and Ortega Family Holdings LLC at 15%; the holding company's own agreement lists Marisol at 60%. A Document Reader agent extracts each figure with the passage and page it came from. What can go wrong here is mundane: a unit count read as a percentage, an amendment missed, a cap table older than the agreement. The evidence that guards against it is equally mundane: a citation on every stake, opened and checked by a person whenever a figure matters.

The chart then multiplies. 60% × 15% is 9.0%, which added to 18% gives 27.0%. A second agent recomputes on a different model and reaches the same figure independently; a difference of more than 0.05 percentage points would have held the file for the analyst. The method, and how to handle loops and trusts, is in how to calculate beneficial ownership percentage.

Steps 3 to 5: the certification, the request to correct it, and the reply

Pellridge's president certified one owner, Daniel Pellridge at 34%, and herself as controller. Compared with the tree, the form agrees on two people and is missing one. That comparison is the reliance question answered on the file: the bank's own documents show a 25% owner who is not on the form, so it cannot rely on the certification as signed. Why the signer's knowledge standard produces exactly this miss is explained in beneficial ownership certification: who signs.

The fix is the customer's, not the bank's. On Thursday 22 October an agent drafted a letter explaining the 27% from Pellridge's own documents and asking for a corrected certification and Marisol's identifiers; the analyst submitted it at 10:20 a.m., a QC reviewer approved it at 10:31, and it went to the customer through the client portal at 10:33, with the relationship manager copied. At 2:47 p.m. the president signed a corrected certification naming both owners. Two minutes later the agents had matched it with the tree.

The reply, read and matched with the tree

Step 6: the identity, and one difference explained

Verification is the same exercise for Marisol as for any CIP customer. The Identity Verification agent checks her name, date of birth, address and ID number against the bank's identity service, masks the date of birth and ID number on screen so that revealing either asks for a reason and is logged, and screens her and every entity in the tree against OFAC lists. FinCEN expects banks to use beneficial ownership information as they use other customer information, "including for compliance with OFAC-administered sanctions" (FAQ G.1).

One element did not match. The identity service still held Marisol's previous address until August 2026; her current address had matched since. The agent marked it Explained, with the reason, rather than leaving a mismatch in the file. That sentence is the kind of thing the rule asks banks to keep: the verification record must describe "the resolution of each substantive discrepancy" (1010.230(i)(1)(ii)).

UBO verification of each owner's identity

What is a substantive discrepancy?

The rules use the term without defining it. Both the CIP rule and the beneficial ownership rule require a description of "the resolution of each substantive discrepancy" discovered when verifying identity (31 CFR 1020.220(a)(3); 1010.230(i)). A workable reading is a difference between what the customer gave and what the bank found that, unresolved, would stop the bank forming a reasonable belief about who the person is: a different date of birth, an ID number that belongs to someone else, an address the person has no link to. A transposed digit or an old address in a data source is a discrepancy too, but one that is resolved in a sentence.

For beneficial ownership there is a second kind. A certification that leaves out an owner the documents show is a discrepancy between the customer's statement and the bank's evidence, and its resolution, a corrected certification, belongs in the file with the same care as an identity mismatch.

Step 7: the decision, and what must be kept

At 3:05 p.m. the analyst recorded the outcome, "Verified: all beneficial owners identified and verified", with reason code BV-02, corrected certification received and matches, and an evidence checklist at seven of seven. At 3:18 p.m. a QC reviewer who had not made the decision approved it. Only then were two owners and one controller written to the client lifecycle system and the core banking system. Every version of the tree, from the certification as signed to the approved decision, is kept and can be exported as of its date.

The verification decision, recorded by the analyst and approved by QC

The decision text names each owner with the arithmetic, and each holder below 25% with a reason code: the file answers why someone was not named as well as who was.

What if a beneficial owner changes?

Then the bank updates the file, and how much depends on what changed. If only an existing owner's address changes, "full re-certification would likely not be required" and a verbal confirmation may do; if the owners change, the new owner is identified, certified and verified in full (FAQ B.19). The trigger is knowledge, not the calendar: a scheduled review does not, on its own, oblige the bank to collect ownership again (FAQ B.18; beneficial owner declarations for existing customers covers both FAQs), but a change the bank learns of through monitoring is. Under the February 2026 relief, knowledge that calls the earlier information into question is precisely the second scenario in which owners must be identified and verified again; the scenarios are set out in FinCEN CDD rule relief (Feb 2026).

What UBO verification helps the bank prevent

Anonymous access. FinCEN described the gap the 2016 rule closed as a deficiency that "enable[d] criminals, kleptocrats, and others looking to hide ill-gotten proceeds to access the [U.S.] financial system anonymously" (FIN-2026-R001, quoting the 2016 rule). The FFIEC manual adds why the bank's record matters beyond the bank: beneficial ownership information gives law enforcement leads on criminals who hide behind companies to conceal what they do and what they own, and is relevant to suspicious activity monitoring and OFAC compliance (FFIEC BSA/AML manual).

In the trace above, a 27% owner would otherwise have been invisible to the bank's sanctions screening, its risk rating and any later subpoena. That is the practical point of tracing one percentage to its source: the person at the end of the chain is the one every other control depends on.

Questions people ask

What is UBO verification in simple terms?

Finding out which people ultimately own or control a business customer, and checking that each is who the customer says. In the US that means everyone with 25% or more, directly or through other companies, plus one controller, each verified with name, date of birth, address and an ID number.

Is UBO verification the same as KYC?

It is one part of it. KYC for a business covers the entity itself, the purpose of the relationship and a risk profile; UBO verification covers the individuals behind the entity. US banks do the first under the CIP and CDD rules and the second under 31 CFR 1010.230.

Does every beneficial owner need to be verified, or only the controller?

Every person the customer names: each owner of 25% or more and the controller. FinCEN's FAQ B.10 says banks must "collect and verify the beneficial ownership information of each person who meets the definition under the ownership prong, and of one person under the control prong".

How quickly must beneficial owners be verified?

Within a reasonable time after the account opens, the same standard as CIP; examiners check exactly that phrase. The bank's procedure should define it and say what the customer may do with the account until verification is complete.

Can the bank rely on its own earlier verification of an owner who is already a customer?

Yes. If the owner is an existing customer verified under the bank's CIP, FAQ B.17 lets the bank rely on that verification, provided the information is current and the legal entity's representative confirms it, verbally or in writing. The beneficial ownership file can cross-reference the CIP record.