How to Verify the Beneficial Owner of a Corporate Client (and What Changes on 10 July 2027)

Almost every guide on this topic ends at the same sentence: find the natural persons who own more than 25% of the company. That sentence stops being correct across the EU on 10 July 2027. Regulation (EU) 2024/1624 — the AMLR — applies directly in all 27 member states from that date, and it fixes the threshold at 25% or more, held directly or indirectly. Spain's Ley 10/2010 today says "un porcentaje superior al 25 por ciento": strictly more than.

That one-word difference has a concrete consequence you can check in your own client list this afternoon. A company owned by four partners holding exactly 25% each has, under the current Spanish wording, *no* beneficial owner by ownership — you fall back to the directors. Under the AMLR it has four, and each of them needs identifying, documenting and screening. The same goes for a two-partner 75/25 split, a 50/25/25, or any cap table with a clean quarter in it. Those are common structures in family companies, small developers and SL holdings, and they are exactly the files that will look incomplete when reviewed after mid-2027.

Below is the procedure I would run on a corporate client today, written so it stays valid after the change.

Step 1: Identify the entity before you identify the people

Before anyone opens a shareholders' register, pin down what you are actually onboarding: registered name, legal form, registration number, jurisdiction, registered address and current directors. Get it from a source you did not receive by email — a company register extract, a recent filing, an incorporation deed — not from the client's own letterhead.

If the entity is incorporated outside the EU but is buying EU real estate, entering a business relationship with an EU firm or bidding for public procurement, the AMLR pulls it into scope too. "It's a foreign company" is not an exemption.

Step 2: Ask for the ownership chain in writing, down to natural persons

Request a structure chart or cap table that runs all the way down to individuals, with percentages at every level, signed and dated by a director. This document is the backbone of the file. If the client can only give you "the owner is Mr X", you do not have a chain — you have an assertion.

Cross-check the directors listed in the register against the shareholder list. Mismatches between who signs and who owns are the cheapest red flag you will ever get.

Step 3: Do the arithmetic yourself — multiply down, add across

This is the part generic guides skip, and it is where files break. Under the AMLR, indirect ownership is calculated by multiplying the ownership percentages down each chain, and holdings of the same person across different chains are added together.

Work through it with numbers:

Ana holds 60% of Holdco A, which holds 40% of your client. Her indirect stake is 0.60 × 0.40 = 24%. Not a beneficial owner by ownership — under either the old or the new threshold.
Now add a second route: Ana also holds 30% of Holdco B, which holds 20% of your client. That chain gives 0.30 × 0.20 = 6%. Added across chains: 24% + 6% = 30%. She *is* a beneficial owner, and nothing in either individual chain would have told you.
Luis holds exactly 25% directly. No beneficial owner today under the Spanish wording; beneficial owner from 10 July 2027.

Follow every branch to the end, however small it looks in isolation. A 5% sliver that appears in four chains is not a rounding error.

Step 4: Assess control separately from ownership

Ownership is only one of two tests, and they are not alternatives. Someone can be a beneficial owner through control even with a tiny stake or none at all: shareholder agreements, veto or golden-share rights, the power to appoint or remove the majority of the board, nominee arrangements, or a de facto right to the profits. Ask directly whether any shareholder holds shares on behalf of someone else, and record the answer.

Run the ownership test and the control test. Only if neither identifies anyone may you fall back to senior managing officials — in Spain, the *titular real asimilado*: the directors or whoever is responsible for management. That fallback must be documented as a conclusion you reached, with the reasoning, not used as a default because the chain was hard to unpick.

Step 5: Check the register — but don't stop there

In Spain, obliged entities can access the Registro Central de Titularidades Reales (RCTIR), which draws its data from the Colegio de Registradores and the Consejo General del Notariado, and returns the nature and extent of each interest, the percentage, and information on indirect holdings. Access requires an electronic certificate and proof that you are an obliged entity (articles of association, the F22 form filed with Sepblac). In Portugal the equivalent is the RCBE; other member states run their own registers, which will interconnect through a European platform.

Treat the register as corroboration, not source of truth. Registers are fed by declarations, and declarations go stale. Under the new rules entities must file changes without delay and no later than 28 days, plus review annually — which is precisely an admission that the data drifts. If the register and the client's chart disagree, that discrepancy is itself something to document and resolve.

Step 6: Identify each individual and keep the evidence

For every beneficial owner you land on, you need the identity of a real person: full name, date and place of birth, address, nationality and identification number, verified against an ID document. This is where a corporate onboarding quietly becomes an ID-handling problem — three or four passports or DNIs arriving by email or WhatsApp from people who are not in the room. The mechanics of collecting and storing those copies safely are covered in our guides on automating KYC and client identification and on storing ID copies without breaking GDPR.

Keep, in the file: the signed structure chart, the register extract with its date, your own calculation showing the multiplication and addition, the ID documents, the screening results, and a dated note explaining the conclusion. An inspector is not testing whether you were right. They are testing whether you can show how you got there.

Four mistakes with real consequences

Using the register as the whole file. A printout with no chain calculation behind it does not evidence due diligence; it evidences a lookup.
Jumping to the directors. Naming the *titular real asimilado* without first exhausting ownership and control is the single most common shortcut — and the easiest to spot, because the file contains no arithmetic.
Stopping at the first corporate layer. If a shareholder is a company, the analysis is not finished; it has just started.
Verifying once and never again. In Spain, breaches of the due diligence duties under Ley 10/2010 are classified as serious or very serious, with fines starting at €60,001 and €150,000 respectively and ceilings tied to net assets or annual turnover. The exposure is not theoretical.

How often to re-verify

Set a cadence rather than waiting for a trigger: refresh standard-risk corporate clients annually, higher-risk ones more frequently, and always on a known event — share transfer, change of directors, restructuring, a new transaction above your threshold. Between now and July 2027, add one extra pass: filter your client base for any shareholder sitting at exactly 25%, and for any structure with more than one layer. Those two filters catch nearly all the files the new threshold and the multiplication rule will reclassify.

If your agency also handles the AML duties around property transactions, the SEPBLAC obligations guide covers what sits around this process.

The part that actually eats the hours

None of the above is intellectually hard. What consumes the afternoon is the paperwork logistics: chasing four IDs, retyping names and document numbers into your CRM or client file, and doing it again next year. That transcription step is pure clerical work, and it is the step where names get mistyped and a screening quietly returns a false clear.

You can send a photo of each ID over WhatsApp and get the fields back as structured data ready to paste into the file — try it free, no signup.