Beneficial ownership is an identity and control question, not a company-name check. Under the Act a beneficial owner is an individual who directly or indirectly owns 25 per cent or more of a customer, or who controls it. Enterprise teams fail this most often on evidence, not on arithmetic.
What is the actual test?
A beneficial owner is an individual who directly or indirectly owns 25 per cent or more of a customer, or who controls the customer. AUSTRAC guidance requires reporting entities to follow the ownership chain until the relevant natural persons are identified.
For enterprise onboarding, that means the legal entity named on the engagement is the starting point rather than the answer. The team may need to work through intermediate companies, trusts or other legal arrangements, and to identify both ownership and non-ownership forms of control.
The part most often underbuilt is the record. A defensible workflow preserves how the conclusion was reached, not just a final name in a field. A stored owner name with no chain behind it cannot be defended in a file review, because nobody can tell whether it was established or assumed.
What should an ownership pack contain?
For a body corporate or complex business customer, collect enough to establish the legal entity, its directors or office holders, ownership interests, controlling persons, and the chain through any intermediate entities. For trusts, the relevant information can include trustees and other parties with ownership or control significance under the applicable customer due diligence rules and guidance.
The exact documents depend on the customer and the risk. Common sources include company extracts, constitutional documents, partnership or trust deeds, shareholder registers, ownership charts, regulatory filings and reliable independent data sources.
Whatever the source, the workflow should record where each data point came from and the date it was checked. Ownership changes, and a chart with no date on it gives a reviewer no way to know whether it was current when the decision was made.
Customer-supplied charts deserve particular care. They are useful as a starting map and they are not verification, because they were produced by the party whose structure is being tested. Where a chart is used, record that it came from the customer and note which links in it were independently confirmed and which were not.
How far down does the chain go?
Until natural-person ownership or control is established. Treat a layered structure as a chain of evidence and repeat the same three questions at each level.
| At each level, establish | Why it matters |
|---|---|
| Who owns 25 per cent or more | The ownership limb of the definition |
| Who otherwise controls decisions | Control can exist without qualifying ownership |
| Whether another entity sits between that person and the customer | Determines whether the chain continues |
| The source and date of each data point | Makes the conclusion reviewable later |
Do not stop at an intermediate corporate shareholder, which is the single most common shortcut. Continue until the individuals who meet the beneficial-owner definition are identified, subject to the relevant rules and any applicable exceptions or fallback steps.
Where ownership and control do not point to the same people, capture both analyses rather than choosing between them. Control can exist without a qualifying ownership percentage, and a structure designed to obscure ownership will often leave control visible.
How should time pressure be handled?
Property settlements and corporate transactions create genuine timing pressure, and pretending otherwise produces a policy nobody follows. The answer is to define the control response before the pressure arrives rather than during it.
Teams should know which missing information blocks service provision, what enhanced due diligence is required, who can approve an exception where the law permits one, and when a matter must be escalated or delayed. Each of those is a decision someone will otherwise make alone, at speed, on the day.
Operational service-level targets help. Simple Australian companies can be routed through a standard workflow, while layered foreign ownership, trusts, nominee arrangements or inconsistent documentation move to a specialist queue.
The purpose of that split is to protect quality while allocating experienced reviewers to the cases that actually need them. It also makes the difficult cases visible as a group, which is useful management information in its own right.
What the split should never do is create a fast lane that skips steps. Routing by complexity changes who does the work and how long it takes; it does not change the standard the work has to meet. If a queue exists whose purpose is to clear cases before a deadline, it will eventually be used for cases that belong in the specialist one. Our Tranche 2 checklist sets out where this sits in the wider sequence.
Why is screening a separate step?
Because it answers a different question. Identifying a beneficial owner establishes who ultimately owns or controls the customer. PEP, sanctions and adverse media screening then assesses the risk associated with those people and entities.
Neither replaces the other, and conflating them produces two distinct failures. Screening a customer entity without resolving ownership can miss the person the screening was meant to find. Resolving ownership without screening the individuals identified leaves the risk unassessed.
A complete decision trail should therefore show the ownership conclusion, the verification evidence behind it, the screening performed under the organisation's policy, any potential matches, the review outcome, the risk rating, and any enhanced due diligence or approval.
Read in that order, the trail explains itself to a reviewer. Read in any other order, it tends to raise the question of what was known when.
What does a defensible file look like?
One that lets someone who was not involved reconstruct the decision. That is the practical test, and it is worth running on real files rather than assuming.
Take a recently onboarded layered customer and ask a colleague to establish, from the file alone, who the beneficial owners are, how that was determined, what evidence supports each link in the chain, when each source was checked, what screening ran, how any match was resolved, and who approved the outcome.
If that reconstruction needs a conversation with the original reviewer, the file is not yet defensible, however sound the original decision was. Personal knowledge is not a record, and staff turnover eventually removes it.
Where does technology fit?
Corporate and individual screening, customer risk workflows, monitoring and audit records around know-your-business and beneficial ownership processes are where a platform carries weight. The value is in connecting the owners and controllers identified to the screening and review steps the programme requires, so the two halves of the decision trail sit together rather than in different systems.
No system should be assumed to resolve every complex ownership structure automatically, and a vendor claiming otherwise is overselling. Reporting entities remain responsible for establishing ownership and control on reasonable grounds using appropriate evidence, and the harder structures will need a human analyst. The Tranche 2 hub covers the surrounding programme obligations.
Important information
This article provides general information about Australia's AML/CTF framework and does not constitute legal advice. Whether an obligation applies depends on the designated services provided and the circumstances of the business.
Customer due diligence requirements, including the treatment of trusts and any applicable exceptions, depend on the rules in force and on the customer's circumstances. Take your own advice on your own obligations. Reporting entities remain responsible for meeting their obligations under the AML/CTF Act, the Rules and applicable AUSTRAC guidance, and the Act is available on legislation.gov.au.
