Understanding who truly owns and controls a third party is becoming increasingly important for organizations managing risk, compliance, and due diligence obligations. In this episode of Third Party Risk Perspectives, Elliot Berman of AML RightSource is joined by Christopher Sindik and Sudip Iyer from Blue Umbrella to discuss the growing role of Ultimate Beneficial Ownership (UBO) intelligence in third-party risk management.
The conversation explores why ownership transparency matters, how hidden ownership structures can conceal sanctions exposure, corruption risk, connections to organized crime, or other reputational concerns, and why understanding ownership is about much more than simply identifying a legal entity.
Chris and Sudip explain the challenges organizations face when gathering UBO data across jurisdictions with differing disclosure requirements, the impact of evolving regulations, and the practical realities of using corporate registries, commercial databases, and investigative research to uncover ownership structures.
The discussion also examines how organizations can integrate UBO intelligence into broader third-party risk management programs by combining ownership analysis with sanctions screening, adverse media monitoring, and risk-based decision-making.
Whether you're navigating new markets or strengthening your compliance framework, this episode offers practical insights to help you stay ahead of emerging third-party risks.
Assessing the Risk in the Ownership of Your Counterparties - Transcript
Elliot Berman: Welcome. I'm Elliot Berman from AML RightSource, and I'm here with Chris Sindik and Sudip Iyer from Blue Umbrella. And we're going talk about the risks related to the ownership of your counterparties. So as we see more and more complex structures, it's difficult to know exactly what's happening with the entity in front of you.
That could be a simple business corporation, if you're here in the US that just has public shareholders. An identifiable board of directors and executive officers. But it could be privately held, it could be created in another jurisdiction where the formats are different.
And what's in front of you is rarely the whole story. And a major challenge in managing third-party risk is understanding who controls your counterparty. In this context, the question becomes: Why is ultimate beneficial ownership, the acronym is UBO, information important? And Chris, I'll start with you.
Why is it important?
Chris Sindik: Thanks, Elliot. I think it's a really great time to be having this conversation. Just speaking from the perspective of talking to various companies and hearing about their needs. It's something that's growing quite a bit right now.
They have a pretty good idea a lot of times of who the third party is or who, at least, they say they are. But people are really starting to try and look at other risk factors that might be there. A lot of times, we've seen an interest in subcontractors, things down the supply chain.
This is the same philosophy as looking up the ownership chain in a lot of ways. I think it's important because if someone is a bad actor, if they're trying to conceal their ownership because it's someone on a sanction list or has had problems in the past, business continuity problems, quality problems in their work, et cetera, whatever it might be.
If they're trying to hide that, there are more sophisticated ways to do it. So it's another way that companies can protect themselves against potential risk. When you look at third-party risk management, the big question is, how can this third party hurt us?
And one of the answers is, just by virtue of doing business with ownership or having money put into the pockets of people that are involved in armed conflicts around the world, drug trafficking, cartels, terrorism, et cetera. Knowing that UBO data is front and center.
Elliot Berman: UBO data is collected and maintained in a variety of ways around the globe. We saw here in the US that a new piece of legislation was passed a year and a half ago or so. A registry process was created, and it was starting to be done, and then a decision was made to reverse that. And so that all of that gathering and storing went away. Sudip, how can our listeners obtain UBO data given all these different formats?
Sudip Iyer: Elliot, I think that's one of the biggest challenges in UBO research because I'd say there's no single global registry for UBO information. And typically, what we've seen is organizations obtain UBO data through a combination of official corporate registries, regulatory filings, company disclosures, stock exchange filings, and also depend on a lot of commercial data providers. But the challenge is that, transparency requirements vary significantly from country to country.
And as you mentioned, the United States is moving away from domestic reporting. FinCEN's August 2026 filing rule permanently removed Corporate Transparency Act for reporting requirements in the US. So I'd say the current landscape is best described as a global UBO divide where, on one side, a country is moving away and on the other, there are some countries in EU, which have moved in the opposite direction.
They've revised their anti-money laundering framework and Transparency Act, where some information has to be collected, stored centrally, and is available through a different collection and access model. So I'd say the direction of travel is not simply more public data, but some combination of different ways where you can access this information.
Chris Sindik: It's a triangulation approach, a lot of time to the UBO effort. There are few, if none, databases out there where you can type in the name in official records, type in the name of a company and get the UBO. It, it just doesn't exist a lot of time. So relying on other techniques. Official documents are the golden standard if you can get them.
Sometimes you gotta peel the onion back, get one layer of ownership, and then who owns them and who owns them until you get to a natural person or a termination point one way or another. If that's not possible, you go down the list of databases that might be privately housed, media searches, sometimes even asking the third party themselves, that's a part typically of the onboarding process too.
Very common to see in questionnaires, who are your ultimate owners? A lot of times before, maybe five to 10 years ago, it was who are your shareholders, and we're seeing that question being asked more in that onboarding questionnaire, along with all the other things, who are your UBOs?
And sometimes having documents to support that as well. So it's a triangulation of a lot of different sources to come up with that UBO answer.
Elliot Berman: I think there's a couple challenging things here. One is, and you've already touched on it, there are non-transparent regions, either because they've collected it, but access is limited, or in the US, we've now decided not to collect it in any centralized way, so then all of these disparate sources need to come into play.
In the United States, corporations are generated at the state level, so there are no federal corporations. So if you have a company and you've incorporated in Wisconsin, where I live, the information you have to provide as part of the incorporation process, or the annual reporting process, is whatever Wisconsin says. So maybe they want to know who the directors are. Maybe they want to know who the shareholders are.
But not every state wants to know the same information. So even Chris, following your official documents approach and digging into the incorporation process, or you may or may not find it just because of what's required. So those are some of the pitfalls, but as more third-party data providers come on, what are some pitfalls people should look out for?
Chris Sindik: I'll take this one, and Sudip, I'd like to hear your thoughts too. I think as you're looking at potential pitfalls, you hit a great one there, Elliot, the size of the entity. There might be some data sets where we have 800 billion records. And that's great. Probably more companies than have ever existed on the face of the earth. But they got them in one way or another. Although there's a certain number that's there, and that's great, you want a lot of records. How does that align with your needs?
Maybe you don't need UBO data in the US. Maybe you need it in China and in Russia and in Venezuela and South Africa and Japan, Turkey, so on and so forth. And seeing if those types of entities are there. And a lot of times if you're working with a third party that's very large or publicly traded, the UBO maybe doesn't come out as much.
You want to know the significant shareholders. You're interested in the corporate structure. But a lot of times, the use case that we're hearing about is the smaller companies, the midsize companies, the ones that have only been around for five, 10 years. So seeing if those types of records are in the database are really keen.
And I think too, just how easy it is to understand. Having a table with various labels, lines, and things like this, it can be a little hard to understand which direction you're going and who owns what. Is this a dotted line or a straight line? Are these both coming in?
So I think having a clear org chart is just a visual deliverable. It really helps. I think that type of functionality is king. And then, too, just seeing how fresh the data is. It could be that there was a great push 10 years ago to get UBO data in globally, and then it's just sat there. So you're really looking at 10-year-old data when some of these things might have changed in the last year or two years or six months whatever it might be.
But Sudip, what are your thoughts on some of those, I don't want to say gotchas, but pitfalls to look at when trying to find and ferret out some UBO data?
Sudip Iyer: One of the first pitfalls, Chris, is assuming that lack of ownership information means there's no risk. Absence of reliable ownership information can itself be a risk indicator. And this comes from the fact that some jurisdictions simply do not have strong disclosure requirements, while others have fragmented or difficult-to-access records.
So I think the right combination sits in the intersection of technology and understanding what sort of third parties you are screening through the databases. But the other important factor is human expertise, which also is an important part where you can leverage certain corporate registries, or manual validation through such registry searches, wherever you feel that the databases are not sufficient.
The other pitfall I can think of is applying one ownership threshold everywhere. A lot of these databases have common benchmarks of about 25%. But if you see more recently EU's new AML framework, which is going to be applicable next year, it permits a reduction to about 15% for specific categories, where entities are assessed as high risk.
And there are several jurisdictions where they use lower statutory thresholds. So a review before you set an ownership threshold across the board, is also understanding what sort of testing controls are exercised through different regions.
And the range can be striking. I know that Nigeria's PSC framework and Colombia's beneficial ownership regimen, use a five percent threshold, while there are some jurisdictions in the world that have zero percent threshold for specific sector companies.
I guess that's one area where there needs to be some flexibility in the threshold that matches your risk-based policy to identify them. And identifying the owner is half the job. Once the beneficial owners have been identified, the organizations, still need to determine whether there is some sort of a sanction, AML, corruption, or reputational risk involved. And that's where ownership analysis probably needs to be combined with effective sanction screening or adverse media screening, where these two factors can be combined, and there's some conclusive evidence that, you can present to your internal teams, or board, or management.
Elliot Berman: That is a perfect lead into my last question, and that is once you pick through all these challenges and the data quality, data sources, data availability, and you have some data, probably not all the data you want, but you have some data.
How should you integrate it into your third-party risk management process? Because as you pointed out, Sudip, it's not the whole puzzle by any means.
Sudip Iyer: Yeah, your process or workflow needs to not only identify the beneficial owners but also have some sort of supportive risk assessment. And it should enable at least the basic screening of all the beneficial owners, shareholders, and directors. I would also include senior management because they hold some sort of decision-making in your third party's organization. I think finding the owner is important, but understanding the owner's risk profile is what actually informs your compliance decisions.
Those criteria should also test whether the solution can accommodate different national verification models. Because again, different countries, would have their own thresholds, their own rules around them. So that's equally important.
Chris Sindik: I think that's great points there, Sudip. And I think you bring up a couple things. One point that comes to mind, as our listeners are ingesting this episode and thinking, "Oh, okay, UBO it sounds important," or, "I've been thinking about that it's nice to hear this approach." When you are doing UBO data, and you're getting potentially dozens or even hundreds of new names from your subject to that UBO entity, you're gonna have a lot more data on your hands. And, data is very good, very powerful, but it can also be something that needs to be dealt with.
Once you have that potentially long chain of ownership, you may have a lot more names in your environment. So what are you gonna do with that? Be sure you do something with it. Even if it's a simple screening. Are they sanctioned individuals? Is it something that you're gonna look at your other research you've done as a company on your various third parties to see if there are names that you've come across before? Maybe they're on a blacklist. Maybe you've had a bad experience with them before, whatever it might be.
So I just say, don't ask a question if you're not prepared to deal with the answer. So don't ask for the UBO data if you're not going to do what you should be doing with it. Think it through and think about your volume and what you're willing to do.
I think the next point that is it's all about the risk-based approach with third-party risk management and compliance programs generally. If you're looking to do UBO research on your entire population of 35,000 third parties, that's great, but that is probably going to look a lot different in terms of the approach of gathering and processing that information as opposed to doing it with 35 entities.
There are just different processes that should probably be taken with those, depending on the provenance of the data, whether it's from official sources or databases. Those can overlap a lot of times too. But, what exactly it looks like can change depending on the volumes that are there.
Again, I think it's important that people be prepared for that data and what it's supposed to do, and ideally picking a solution that talks to other technologies. Hey we're talking in 2026 right now. 2027 is right around the corner. Where exactly does the data live? Does it talk to other data points in your system? I think having that UBO data ideally in a tool that you have, or at least talking to another tool that you have, you could get a lot more mileage out of that data.
Elliot Berman: Sudip and Chris, thanks. This has been a great conversation. I think our listeners have gotten some real insights into the challenges of the UBO data issue and a lot of good things to think about in terms of finding it. So I look forward to speaking to both of you again on this topic and related third-party risk management topics, and hope you and our audience have a great day.
