identity-canon/research/commercial-identity/beneficial-ownership-kyc-boi.md

# Beneficial Ownership — CDD, BOI, and KYC Modeling

## Source Type

Regulatory framework synthesis. FinCEN CDD Rule (31 CFR 1010.230), Corporate
Transparency Act / BOI reporting, FATF Recommendation 24, and KYC industry
practice.

## Domain

Beneficial ownership identification for legal entity customers — financial
institution due diligence, government transparency registries, and regulated
commercial onboarding.

## Why This Source Matters

Beneficial ownership is the regulatory answer to "who really controls this
legal entity customer?" It is **not** the same as corporate parent ownership
(LEI Level 2), operational resource ownership (Cerbos), or CRM account hierarchy.
Regulators impose **two independent prongs** (equity and control), trust
look-through rules, nominee prohibitions, and evidence retention — all scoped
to **counterparty risk**, not general graph semantics.

## Key Concepts

### FinCEN CDD Rule (customer due diligence)

- **Legal entity customer**: corporations, LLCs, general partnerships, and
  similar entities opening accounts at covered financial institutions.
- **Beneficial owner — ownership prong**: each individual who directly or
  indirectly owns **25% or more** of equity interests.
- **Beneficial owner — control prong**: a **single** individual with significant
  responsibility to control, manage, or direct the legal entity (e.g., CEO,
  CFO, managing member, general partner, president).
- **Collection at account opening**: identify and verify BO identities when a
  new account opens (with 2026 exceptive relief allowing reuse after first
  account unless risk triggers update).
- **Nominee prohibition**: legal entity must identify **ultimate** beneficial
  owners, not nominees or straw men.
- **Trust look-through**: when a trust owns 25%+ equity, identify natural persons
  behind the trust (settlor, trustees, beneficiaries as applicable); a legal
  entity trustee does **not** satisfy the ownership prong — natural persons must
  be identified.
- **Risk-based updates**: ongoing CDD may require BO refresh on triggering
  events, not only at opening.
- **CIP alignment**: BO verification procedures must contain CIP-equivalent
  elements for individuals but are not identical to the institution's CIP.

### BOI / Corporate Transparency Act (entity reporting)

- **Distinct from CDD**: BOI is a **filing obligation on reporting companies**
  to FinCEN's BOI registry, not a financial-institution collection rule.
- **Reporting company beneficial owner**: similar dual-prong concept (substantial
  ownership + substantial control) with FinCEN ID for individuals.
- **US regulatory volatility (2025–2026)**: interim final rules and litigation
  have substantially narrowed or suspended BOI reporting for many US domestic
  entities. **CDD beneficial ownership collection by financial institutions
  remains in force** for covered institutions regardless of BOI reporting shifts.
- **Foreign entities**: BOI and transparency expectations remain more relevant
  for non-US reporting companies and cross-border KYC.

### FATF Recommendation 24

- Requires countries to ensure adequate, accurate, and up-to-date **beneficial
  ownership information** on legal persons, accessible to competent authorities.
- Supports **multi-prong** definitions (ownership threshold + control) and
  look-through for complex structures (trusts, nominees, layered ownership).
- Drives national registries and financial-sector CDD alignment globally.

### KYC practice overlay

- Institutions may adopt **lower equity thresholds** for high-risk customers
  (e.g., 10%) under AML program risk policies.
- **PEP screening** applies to beneficial owners, not only account signers.
- **Sanctions screening** (OFAC) must cover identified beneficial owners.
- BO evidence retained for years after relationship ends (BSA record retention).

## Relevant Terminology

| Term | Source meaning |
| --- | --- |
| Beneficial owner | Natural person owning 25%+ or exercising substantial control. |
| Ownership prong | Equity-interest threshold test. |
| Control prong | Significant management/control responsibility test. |
| Legal entity customer | Entity opening a financial account subject to CDD. |
| CDD Rule | FinCEN customer due diligence requirements (2016, amended). |
| BOI / CTA | Corporate Transparency Act beneficial ownership information reporting. |
| FinCEN ID | Individual identifier for BOI filers. |
| Nominee / straw man | Non-ultimate owner; prohibited as BO response under CDD. |
| Look-through | Identifying natural persons behind trusts or intermediary entities. |

## Modeling Assumptions

- **Beneficial ownership is relationship semantics**, not a new actor type.
  The natural person remains **Natural Person**; the assertion is regulatory.
- **Ownership prong and control prong are orthogonal** — one person may satisfy
  both, and multiple persons may satisfy ownership prong while exactly one
  control-prong person is required under US CDD.
- **Beneficial ownership ≠ corporate parent ownership** (LEI Level 2 describes
  corporate structure; BO describes natural persons behind a customer entity).
- **Beneficial ownership ≠ Representation** (authorized signers may represent
  without being beneficial owners).
- **Lifecycle is risk-triggered**, not merely account-open/close.
- **Regulatory regime is a scope dimension** — US CDD, EU AMLD, FATF R24, and
  BOI filing may differ; canon models the relationship, downstream applies law.

## Identity-Canon Implications

### Resolved: dedicated relationship type

**Beneficial Ownership Relationship** is a first-class relationship type — **not**
an Ownership subtype with `beneficial` metadata.

**Rationale:**

| Concern | Why not Ownership subtype |
| --- | --- |
| Semantic collision | Ownership in canon covers records, tenants, resources, corporate parents — not regulated natural-person BO. |
| Dual prongs | Ownership prong (%) and control prong (role) are regulatory-specific; corporate Ownership edges lack this structure. |
| Trust look-through | Requires intermediary entity traversal metadata absent from generic Ownership. |
| Evidence & scope | BO ties to CDD/AML Evidence Source, Commercial Relationship, and jurisdictional scope — distinct lifecycle from LEI parent edges. |
| Projection safety | Prevents Cerbos/Zanzibar "owner" tuples from silently implying KYC beneficial owner compliance. |

**Beneficial Owner** remains a glossary label for the **natural person** who is
the target of a Beneficial Ownership Relationship — not a participation root.

### Recommended relationship fields

- `relationship_type`: `beneficial_ownership`
- `source`: Natural Person
- `target`: Organization / Legal Entity (the legal entity **customer**)
- `scope`: jurisdiction + institution/program (e.g., US CDD, EU AMLD)
- `ownership_prong`: boolean
- `control_prong`: boolean
- `equity_percentage`: optional numeric (when ownership prong)
- `control_basis`: optional enum (e.g., `ceo`, `managing_member`, `general_partner`)
- `intermediary_chain`: optional ordered list for trust/entity look-through
- `evidence_reference`: CDD certification, BOI filing, registry extract
- `lifecycle_state`: proposed, active, superseded, revoked
- `regulatory_basis`: optional reference (CDD Rule, FATF R24, national statute)

### Mapping table

| Source concept | Canonical mapping |
| --- | --- |
| Beneficial owner (person) | Natural Person |
| BO linkage | Beneficial Ownership Relationship |
| CDD certification | Evidence Source |
| Legal entity customer | Organization / Legal Entity + Commercial Relationship |
| BOI filing record | Evidence Source (registry) on Legal Entity |
| FinCEN ID | Identifier (government registry) on Natural Person |
| PEP/sanctions hit on BO | Lifecycle State / Trust Relationship on BO relationship |
| LEI Level 2 parent | Ownership Relationship (corporate structure — separate) |

## Terminology Conflicts

- **Beneficial owner (CDD)** vs. **beneficial owner (BOI filing)** vs.
  **beneficial owner (transparency registry)**: same conceptual person, different
  regulatory scopes and evidence — use `scope` and `regulatory_basis` metadata.
- **Owner (Cerbos resource)** vs. **beneficial owner**: authorization attribute
  vs. regulated natural-person linkage.
- **Shareholder** vs. **beneficial owner**: not all shareholders meet BO thresholds;
  control prong may identify non-shareholders.

## Open Questions

*(none — settled in `commercial-identity-nuance-settlement.md`)*

## Settled

- `control_basis` enum — jurisdiction-neutral role codes + `regulatory_basis`.
- FinCEN ID → **Registry Identifier** on Natural Person.
- Exempt entities → **Beneficial Ownership Exemption** Evidence (not absence).
- BOI filing volatility separated from CDD Beneficial Ownership Relationships.

## References

- FinCEN, CDD Rule FAQs — https://www.fincen.gov/resources/statutes-and-regulations/cdd-rule-faqs
- FinCEN, CDD Final Rule — https://www.fincen.gov/resources/statutes-regulations/cdd-final-rule
- FinCEN, Account Opening Exceptive Relief Order (FIN-2026-R001) — https://www.fincen.gov/system/files/2026-02/FinCEN-Order-CCDExceptiveRelief.pdf
- FATF, Recommendation 24 — https://www.fatf-gafi.org/en/topics/fatf-recommendations.html
- Open Ownership, reliable identifiers for corporate vehicles — https://www.openownership.org/en/publications/using-reliable-identifiers-for-corporate-vehicles-in-beneficial-ownership-data/
- Internal: `kyc-aml-commercial-identity-binding.md`, `lei-gleif-legal-entity-identifier.md`