Best Practices on Beneficial Ownership for Legal Persons

BEST PRACTICES ON
BENEFICIAL OWNERSHIP
FOR LEGAL PERSONS
OCTOBER 2019

The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes policies to protect the global financial system against money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money laundering (AML) and counter-terrorist financing (CFT) standard. For more information about the FATF, please visit www.fatf-gafi.org This document and/or any map included herein are without prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
FATF (2019), Best Practices on Beneficial Ownership for Legal Persons, FATF, Paris, www.fatf-gafi.org/publications/documents/beneficial-ownership-legal-persons.html © 2019 FATF/OECD. All rights reserved. No reproduction or translation of this publication may be made without prior written permission. Applications for such permission, for all or part of this publication, should be made to the FATF Secretariat, 2 rue André Pascal 75775 Paris Cedex 16, France (fax: +33 1 44 30 61 37 or e-mail: contact@fatf-gafi.org) Photocredits coverphoto ©Getty Images

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  1

Table of Contents
ACRONYMS ......................................................................................................................................... 3
Executive Summary .............................................................................................................................. 5
Section I - Introduction and key concepts........................................................................................... 7
Background and context ...................................................................................................................... 7
Scope of the paper................................................................................................................................ 9
Section II - Objectives......................................................................................................................... 10
FATF requirements............................................................................................................................ 10
Relationship between R.24 and IO.5 ................................................................................................. 12
Section III – Common challenges....................................................................................................... 13
Common challenges faced by countries ............................................................................................ 13
Challenges for specific approach....................................................................................................... 15
Registry Approach.......................................................................................................................... 15
Company Approach........................................................................................................................ 17
Existing Information Approach...................................................................................................... 18
Section IV – The Suggested Effective System ................................................................................... 21
Multi-pronged approach .................................................................................................................... 21
Roles and responsibilities of each key stakeholders.......................................................................... 22
Suggested roles and responsibilities of each key stakeholder............................................................ 23
Section V – Suggested key features of an effective system............................................................... 26
Risk assessment (relevant to core issue 5.2)...................................................................................... 27
Adequacy, accuracy and timeliness of information in beneficial ownership..................................... 31
Obliged parties to verify or/and monitor the accuracy of the information (relevant to core issue
5.3 and 5.4)..................................................................................................................................... 31
Supplementary information platform in addition to company registry (relevant to core issue 5.3
and 5.4)........................................................................................................................................... 37
Ongoing reporting at company level / to the reporting entities or company registry (relevant to
core issue 5.3 and 5.4).................................................................................................................... 40
Verification through different means (relevant to core issue 5.3 and 5.4)..................................... 44
Enhanced measures for companies with foreign ownership/directorship (relevant to core issue
5.3 and 5.4)..................................................................................................................................... 52
Highly effective law enforcement authorities with adequate resources (relevant to core issue
5.4) ................................................................................................................................................. 55
Using technology to facilitate checking and validation (relevant to core issue 5.3 and 5.4) ......... 56
Access by competent authorities (relevant to core issue 5.4)............................................................ 59
Forbidding or immobilising bearer shares and nominee arrangements (relevant to core issue 5.3) . 62
Effective, proportionate and dissuasive sanctions (relevant to core issue 5.6) ................................. 65
Section VI – Getting information on beneficial ownership of overseas entities............................. 70
Section VII - Conclusion ..................................................................................................................... 72

2  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

ANNEX 1: Detailed Arrangement of Mechanisms under R.24......................................................... 73
Registry Approach ............................................................................................................................. 73
Collection and verification of information on beneficial ownership.............................................. 73
Modalities of storage and access to that information ..................................................................... 73
Supervision and enforcement of the relevant obligations .............................................................. 74
Company Approach ........................................................................................................................... 74
Collection and verification of information on beneficial ownership.............................................. 74
Modalities of storage and access to that information ..................................................................... 75
Supervision and enforcement of the relevant obligations .............................................................. 75
Existing Information Approach – FIs/TCSPs and other DNFBPs..................................................... 75
Collection and verification of information on beneficial ownership.............................................. 75
Modalities of storage and access to that information ..................................................................... 76
Supervision and enforcement of the relevant obligations .............................................................. 76
Existing Information Approach – Competent authorities.................................................................. 77
Collection and verification of information on beneficial ownership.............................................. 77
Modalities of storage and access to that information ..................................................................... 78
Supervision and enforcement of the relevant obligations .............................................................. 78
Existing Information Approach – Companies listed on a stock exchange......................................... 78
Collection and verification of information on beneficial ownership.............................................. 78
Modalities of storage and access to that information ..................................................................... 78
Supervision and enforcement of the relevant obligations .............................................................. 78

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  3

ACRONYMS
AML/CFT Anti-money laundering/Countering the financing of terrorism CDD Customer due diligence DNFBP Designated non-financial businesses and professions FATF Financial Action Task Force FIU Financial intelligence unit FI Financial Institution INR. Interpretive Note to Recommendation LEA Law Enforcement Authorities ML Money laundering NRA National Risk Assessment R. Recommendation RBA Risk-based approach SRB Self-regulatory body STR Suspicious transaction report TCSP Trust and company service providers TF Terrorist financing

4  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  5

Executive Summary

1. The results of FATF Mutual Evaluations indicate that jurisdictions find it
   challenging to achieve a satisfactory level of transparency regarding the beneficial ownership of legal persons. This best practice paper aims to provide suggested solutions, supported by cases and examples of best practices from delegations, in response to challenges faced by delegations in implementing FATF Recommendation 24.
2. As stated in Interpretative Note to R.24, countries should use one or more of
   mechanisms (the Registry Approach, the Company Approach and the Existing Information Approach) to ensure that information on the beneficial ownership of a company is obtained by that company and available at a specified location in their country; or can be otherwise determined in a timely manner by a competent authority1 .
3. Countries’ experience shown in the FATF mutual evaluations echoes that
   jurisdictions using a single approach is less effective in making sure that competent authority can obtain accurate and up-to-date BO information to in a timely manner. Instead, a multi-pronged approach using several sources of information is often more effective in preventing the misuse of legal persons for criminal purposes and implementing measures that make the beneficial ownership of legal persons sufficiently transparent. The variety and availability of sources increases transparency and access to information, and helps mitigate accuracy problems with particular sources.
4. Under a multi-pronged approach, competent authorities can gain access to
   information on beneficial ownership through different sources. They can also ensure the accuracy of information by cross-checking. It is also easier for key stakeholders (including companies, directors, shareholders, obliged parties such as FIs and DNFBPs) to identify incorrect beneficial ownership information in their database by looking up different registers or requesting information from different sources. This will then trigger the obliged party to seek clarifications from the companies, and if necessary, report suspicious activities to competent authorities. Therefore, such approach encourages key stakeholders to fulfil their obligations through peer interaction and supervision.
5. This paper then identifies the following suggested key features of an effective
   system (Section 5): a) Risk assessment; b) Adequacy, accuracy and timeliness of information in beneficial ownership; b(i) Obliged parties to verify or/and monitor the accuracy of the information; b(ii) Supplementary information platform in addition to company registry; b(iii) Ongoing reporting at company level / to the reporting entities or company registry; b(iv)Verification through different means; b(v) Enhanced measures for companies with foreign ownership/directorship; b(vi) Highly effective law enforcement authorities with adequate resources; b(vii) Using technology to facilitate checking and validation; c) Access by competent authorities; d) Forbidding or immobilising bearer shares and nominee arrangements; e) Effective, proportionate and dissuasive sanctions.

1
Interpretative Note to R.24, para. 7 and 8, FATF (2013a).

6  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

6. The case examples covered in the best practice paper should be considered in
   the context of their national system. For jurisdictions that have undergone mutual evaluations, their case examples have been checked against their respective mutual evaluation reports and take into account the latest development in the jurisdiction as far as practicable. It should also be noted that some cases are provided by countries which have not yet undergone mutual evaluation to date, but they are included based on their relevance. Readers are advised to bear this in mind when drawing reference to these examples.
7. This best practice paper also puts forward suggestions on ensuring authorities
   can access getting information on beneficial ownership of overseas entities (Section 6).

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  7

Section I - Introduction and key concepts
This paper should be read in conjunction with the following, which are available on the FATF website: www.fatf-gafi.org. a) The FATF Recommendations, especially Recommendations 1, 2, 10, 11, 20, 22, 23, 24, 26, 27, 28, 30, 31, 34, 35, 37, 40 and their Interpretive Notes (INR), and the FATF Glossary b) FATF Guidance on Transparency and Beneficial Ownership (October 2014) c) The Joint FATF and Egmont Group Report on Concealment of Beneficial Ownership (July 2018) d) The FATF Horizontal Study: Enforcement and Supervision of Beneficial Ownership Obligations Background and context
8. In 2003, the FATF became the first international body to set international
standards on beneficial ownership. In 2012, the FATF strengthened its standards on beneficial ownership, to give more clarity about how countries should ensure information is available, and to deal with vulnerabilities such as bearer shares and nominees. The revised standards also clearly distinguish between basic ownership information (about the immediate legal owners of a company or trust), and beneficial ownership information (about the natural person(s) who ultimately own or control it). They also clarify that having accurate and up-to-date basic information about a legal person or legal arrangement is a fundamental prerequisite for identifying the ultimate beneficial owners, and require countries to provide international co￾operation in relation to ownership information.
9. The FATF further published the Guidance on Transparency and Beneficial
Ownership in 2014 to explain what the FATF Standards require. This guidance paper gives a step-by-step guide on how to access publicly available information on legal persons and legal arrangements, and establish procedures to facilitate information requests from foreign counterparts.
10. However, effective implementation of these measures is still challenging. At
the time of publication, 25 FATF members have been assessed since the FATF Standards were strengthened in 2012.2 For R.24, only 11 out of 25 were rated as largely compliant, 12 were rated as partially compliant and 2 were rated as non￾compliant. For IO.5, only 4 out of 25 countries attained a substantial level of effectiveness in preventing the misuse of legal persons and arrangements, 17 attained a moderate level of effectiveness and 4 attained a low level of effectiveness.

2 Consolidated assessment ratings, FATF www.fatf-gafi.org/media/fatf/documents/4th￾Round-Ratings.pdf

8  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

11. In 2016-17, the FATF undertook a horizontal study on the enforcement and
    supervision of beneficial ownership obligations. The FATF and Egmont Group also jointly published the Report on Concealment of Beneficial Ownership in July 2018. The results of the analysis pointed to that the root of the problem lies in the weak implementation of the existing standard, rather than in the gaps of the standard itself.
12. There is a need for more practical advice and examples for jurisdictions on the
    effective measures to ensure that legal persons are prevented from being used for criminal purposes, and information on their beneficial ownership is available to competent authorities without impediments.
13. Based on the reviews conducted in the fourth round of FATF mutual
    evaluation so far, the FATF has identified some specific obstacles in the following areas to effective implementation (detailed in Section II), including:
    a) risk assessment; b) adequacy, accuracy and timeliness of information on beneficial ownership; c) access by competent authorities; d) bearer shares and nominee shareholder arrangements; e) fines and sanctions; and f) international co-operation.
14. From countries’ experience, there is no single solution to tackle these
    obstacles that are intertwined with each other. The fourth round of FATF mutual evaluations reveals that systems combining one or more approaches under R.243 are often more effective than systems that rely on a single approach.
15. To ensure that the system is effective, it requires concerted efforts from
    different stakeholders to implement measures that prevent legal persons from being misused, and make available accurate information on the beneficial ownership of legal persons so that competent authorities can access the information in a timely manner.
16. This best practice paper aims to provide suggested solutions, supported by
    cases and examples of best practices that are correspondent to each challenge. This paper draws on countries’ experience concluded from adopted MERs, information provided by the delegations, as well as work carried out by other stakeholders in the field. The paper will also provide cases and examples to other inter-governmental organisation in developing their areas of expertise.
17. Taking into account the flexibility allowed by the FATF Recommendations, this
    best practice paper suggests different ways jurisdictions can use to ensure

3 The approaches include:
(a) Registry Approach – requiring company registries to obtain and hold up-to-date information on the companies’ beneficial ownership (b) Company Approach – requiring companies to obtain and hold up-to-date information on the companies’ beneficial ownership or requiring companies to take reasonable measures to obtain and hold up-to-date information on the companies’ beneficial ownership (c) Existing Information Approach – using existing information

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  9

compliance and provides advice on how to implement chosen approaches in the most effective way. Scope of the paper
18. In order to keep the scope of this project achievable, this paper will focus on
beneficial ownership of legal persons (not of legal arrangements such as trusts).
19. The implementation of R.24 and IO.5 also hinges on the effectiveness of other
FATF Recommendations (paragraph 44 refers). Although the discussion of the paper will touch on other FATF Recommendations, this paper will only cover examples of best practices that are directly related to approaches associated with transparency of beneficial ownership under R.24 and measures on preventing misuse of legal persons by criminals under IO.5.

10  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Section II - Objectives
FATF requirements
20. Under R.24, countries should take measures to prevent the misuse of legal
persons for ML/TF. Countries should ensure that there is adequate, accurate and timely information on the beneficial ownership and control of legal persons that can be obtained or accessed in a timely fashion by competent authorities. In particular, countries that have legal persons that are able to issue bearer shares or bearer share warrants, or which allow nominee shareholders or nominee directors, should take effective measures to ensure that they are not misused for ML/TF. Countries should consider measures to facilitate access to beneficial ownership and control information by financial institutions (FIs) and designated non-financial businesses and professions (DNFBPs) undertaking the requirements as set out in R.10 and 22.
21. In relation to beneficial ownership information, countries should ensure that
either information on the beneficial ownership of a company is obtained by that company and available at a specified location in their country; or can be otherwise

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  11

determined in a timely manner by a competent authority4 . In order to meet such requirement, countries should use one or more of the following mechanisms5 – a) requiring company registries to obtain and hold up-to-date information on the companies’ beneficial ownership (the Registry Approach); b) requiring companies to obtain and hold up-to-date information on the companies’ beneficial ownership or companies to take reasonable measures to obtain and hold up-to-date information on the companies’ beneficial ownership (the Company Approach); c) using existing information (the Existing Information Approach), including:
i. information obtained by FIs and/or DNFBPs, in accordance with R.10 and
22;
ii. information held by other competent authorities on the legal and BO of
companies;
iii. information held by the company as required; and
iv. available information on companies listed on a stock exchange, where
disclosure requirements ensure adequate transparency of beneficial ownership.
22. Regardless of which of the above mechanisms is used, R.24 specifically
requires countries to establish mechanisms to ensure that companies co-operate with competent authorities to the fullest extent possible in determining the beneficial owner. Under the existing R.24, countries have three options for facilitating such co￾operation which may be used alone or in combination6 :
a) Require companies to authorise at least one natural person resident in the country of incorporation to be accountable to the competent authorities for providing all basic information and available beneficial ownership information, and giving further assistance to the authorities as needed. b) Require companies to authorise a DNFBP in the country to be accountable to the competent authorities for providing such information and assistance. c) Take other comparable measures which can effectively ensure a company’s co-operation.
23. The FATF Guidance on Transparency and Beneficial Ownership7
states that the FATF Recommendations recognise these different mechanisms and the need to provide flexibility for countries to implement the requirements in a manner that corresponds with their legal, regulatory, economic and cultural characteristics.

4 R.24 applies broadly to “legal persons” meaning any entities, other than natural persons, that can establish a permanent customer relationship with a FI or otherwise own property. This can include companies, bodies corporate, foundations, anstalt, partnerships, or associations and other relevantly similar entities that have legal personality. This can include non-profit organisations (NPOs) that can take a variety of forms which vary between jurisdictions, such as foundations, associations or cooperative societies. 5 Interpretative Note to R.24, para. 7 and 8, FATF (2013a). 6 Interpretive Note to R.24, para. 9, FATF (2013a). 7 Guidance on Transparency and Beneficial Ownership, para. 38, FATF (2014).

12  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Whichever mechanism(s) is used, the fundamental requirement relating to beneficial ownership information remains the same. Countries should ensure that either:
a) information on the beneficial ownership of a company is obtained by that company and available at a specified location in their country; or b) there are mechanisms in place so that the beneficial ownership of a company can be determined in a timely manner by a competent authority8 .
24. Countries may choose the mechanisms they rely on to achieve the objective of
preventing the misuse of legal persons for ML/TF 9 . Countries should consider the feasibility of the possible mechanisms based on their particular circumstances and risk assessment. In determining the appropriate mechanism, countries should seek to strike an appropriate balance between allowing the legitimate operation of corporate vehicles and the need to combat ML/TF10 .
25. R. 24 states that countries should use one or more of the mechanisms (the
Registry Approach, the Company Approach and the Existing Information Approach). As stated in the Interpretive Note to R.24, it is also very likely that countries will need to utilise a combination of mechanisms to achieve the objective11 . Relationship between R.24 and IO.5
26. Compliance with R.24 is intrinsically linked with the effectiveness of the
measures assessed in IO.5 to prevent the misuse of legal persons for ML/TF12 . R.24 requires countries to ensure that competent authorities have timely access to adequate, accurate and up-to-date beneficial ownership information. As a result, measures to implement R.24 is fundamental to implement an effective system.
27. IO.5 states clearly that an effective system should put in place measures to:
a) prevent legal persons and legal arrangements from being used for criminal purposes; b) make legal persons and legal arrangements sufficiently transparent; and c) ensure that accurate and up-to-date basic and beneficial ownership information is available on a timely basis.
28. Persons who breach these measures are subject to effective, proportionate
and dissuasive sanctions. This results in legal persons being unattractive for criminals to misuse for ML and TF. Prohibitive measures should be imposed to deter criminals from using legal persons to obscure beneficial ownership of illicit assets.
29. Other measures to ensure transparency of beneficial ownership is also
essential to AML/CFT regimes so that competent authorities can trace and identify the right target to conduct investigation and prosecution effectively, as well as to provide the high quality of financial intelligence.

8
Interpretive Note to R.24 at para. 7 and Immediate Outcome 5 of the FATF Methodology, FATF (2013a). 9 Interpretive Note to R.24, para. 1, FATF (2013a). 10 Guidance on Transparency and Beneficial Ownership, para. 41, FATF (2014) 11 Interpretive Note to R.24, para. 1, FATF (2013a). 12 Guidance on Transparency and Beneficial Ownership, para. 22, FATF (2014)

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  13

Section III – Common challenges
Common challenges faced by countries
30. Based on the reviews conducted in the fourth round of FATF mutual
evaluation, the FATF has identified the following common challenges faced by countries in implementing measures on beneficial ownership, including:
a) Risk assessment – Inadequate risk assessment concerning the possible misuse of legal persons for ML/TF, e.g.
i. Not all types of legal persons were covered in the risk assessment.
ii. Relevant risk assessment was not consistent with the results of national
risk assessments.
iii. Only domestic threats and vulnerabilities associated with legal persons
incorporated were considered.

14  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

iv. Registries, companies, FIs, DNFBPs and competent authorities might not
possess a good understanding and knowledge of risks involved in legal persons. b) Adequacy, accuracy and timeliness of information on beneficial ownership – Inadequate measures to ensure that information on beneficial ownership was accurate and up-to-date e.g.
i. Information was not accurate – they are not adequately and actively
verified, tested or monitored. There was no obliged party13 to verify, test or monitor the information or the obliged party might not have rigorous implementation of customer due diligence (CDD) measures.
ii. Relevant parties were not required to keep records for a period of time (for
at least five years).
iii. Legal persons did not update their beneficial ownership information or
inform the company registry when there was a change of beneficial ownership.
iv. There was a lack of co-ordination among different sources of information
and there was no cross-checking to ensure the accuracy of the information.
v. Information on beneficial ownership was difficult to identify when
complex structure was involved.
vi. Information on beneficial ownership was not always available when
foreign ownership was involved. c) Access by competent authorities – Inadequate mechanism to ensure that competent authorities had timely access to beneficial ownership information on legal persons e.g.
i. There were obstacles to information sharing such as data protection and
privacy laws which impeded competent authorities from getting timely access to adequate, accurate and up-to-date basic and beneficial ownership information.
ii. There was no information sharing among competent authorities.
iii. The competent authorities did not have established procedures to seek
information from obliged parties.
iv. There was no registration/licensing mechanism of obliged parties so that
the competent authorities had difficulties in identifying the source of information.
v. Competent authorities did not have sufficient resources to carry out
investigations or law enforcement actions.

13 Obliged party refers to a gatekeeper that is subject to AML/CFT obligations to conduct customer due diligence, including verifying information on the beneficial ownership of the legal person

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  15

d) Bearer share and nominee shareholder arrangements – Insufficient risk mitigating measures in place to address the ML/TF risk posed by bearer share and nominee shareholder arrangements e.g.
i. When bearer shares and share warrants were allowed in the countries, the
ownership of bearer shares and share warrants was not sufficiently transparent and readily accessible by competent authorities.
ii. The use of nominee shareholder obscured the ultimate control and
ownership of the companies. e) Fines and sanctions – Lack of effective, proportionate and dissuasive sanctions on companies which failed to provide accurate and up to date information on beneficial ownership (e.g. companies providing false information to company registries, or not keeping information about their shareholders or members up-to-date), and reporting entities which failed to apply specific CDD measures required for legal persons. f) International co-operation – Inadequate mechanism for monitoring the quality of assistance received from other countries e.g.
i. It took long time to obtain information on beneficial ownership as it might
involve legal complexities and multiple agents to release the information.
ii. Other countries concerned did not keep the information on beneficial
ownership.
iii. Language barrier posed a challenge in understanding the information.
Challenges for specific approach
31. Under R.24, countries are allowed to choose to implement one or more of the
mechanisms to ensure the transparency of beneficial ownership14 . This section provides analysis on the implementation of each mechanism and covers issues that could impact the reliability of the information. The detailed arrangement of each mechanism under R.24 is at Appendix 1.
32. The issues mentioned in this section may intersect with the common
challenges faced by countries mentioned in Section II. Nevertheless, this section aims to provide an overall review (including challenges) from the perspective of each mechanism. Registry Approach
33. Countries may implement R.24 by requiring company registries to obtain and
hold up to date information on beneficial ownership.
34. Pursuant to R.24, all companies created in a country should be registered in a
company registry which should record and maintain (at a minimum) basic information on a company, including company name, proof of incorporation, legal form and status, address of the registered office, basic regulating powers and list of

14 Interpretive Note to R.24, para. 8, FATF (2013a).

16  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

directors15. The basic information held by registries should be made publicly available16 to facilitate timely access by FIs, DNFBPs and other competent authorities.
35. A well-resourced and proactive company registry holding beneficial
ownership information can be an effective mechanism because it provides a useful basis for competent authorities to access to such information. Other information agents and the public can also gain access to the information on beneficial ownership for cross-checking and verification.
36. The role of company registries varies greatly from country to country, as does
the level and quality of information obtained on companies. The following are the implementation challenges identified from countries’ experience:
a) The objectives of company registry may not be broad enough to cover the role of collecting, verifying/monitoring and maintaining information on beneficial ownership, leading to that:
i. the company registry plays a passive role, acting as repositories of
information or documents, rather than undertaking verifying and monitoring or other measures to ensure that the information they receive is accurate.
ii. the company registry may not be obliged to conduct AML/CFT activities
and its relevant performance may not be supervised.
iii. there may also be lack of sanction powers/insufficient sanctions for
missing/incorrect/false information.
iv. the provision of information on beneficial ownership to the company
registry may not necessarily be made a condition for incorporation.
v. the company registry does not keep information of ultimate beneficial
ownership, but only the immediate legal ownership of the company. b) There may be a lack of mechanisms for ensuring that the information provided to the company registry is accurate and up to date. c) There may be a lack of interface with other sources of information agents and/or other authorities and this may hamper the effectiveness of cross￾checking. d) Company registry may not have sufficient human and capital resources to enable it to undertake the additional functions of collecting, verifying/monitoring and maintaining information on beneficial ownership.
37. Most of the challenges in implementing the Registry Approach originate from
the institutional level – whether the registry is established to collect accurate and updated information on beneficial information, whether it is empowered to do so and to perform its roles with sufficient resources.
38. Countries that make use of registers of beneficial ownership information
should consider the resources and expertise that will be required in order to maintain these, and to ensure that the information recorded in the register is adequate,

15 Interpretive Note to R.24, para. 5, FATF (2013a).
16 Interpretive Note to R.24, para. 12, FATF (2013a).

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  17

accurate, and up-to-date, and can be accessed in a timely manner17. This is also true for the maintenance and supervision of company registries.
39. If the objective of the company registry is not well defined and the power and
responsibilities of the company registry are not clear enough, the company registry will not be able to collect the right information in order to meet the objective. Without sufficient resources, the effectiveness of the company registry will also be compromised. Company Approach
40. Another element that can help implement R.24 is the Company Approach.
Countries should require companies themselves to obtain and hold up-to-date information18 on beneficial ownership by maintaining a list of shareholders or members, and keeping it up-to-date. Companies should also keep updated the list of their representatives, including their roles, functions and authority19 .
41. Below are some problems which have been encountered in countries seeking
to follow/rely on this approach for countries taking this approach:
a) Shareholder registers contain information on legal ownership, but not necessarily on beneficial ownership. b) There is a lack of regulatory framework or mechanism to require and ensure that the beneficial ownership information collected by companies is accurate and up-to-date. For example,
i. companies may not have sufficient powers to require updated information
from their shareholders, including the power to request information on beneficial ownership at any time. Shareholders may not be required to notify the company within a set time period when there are changes in ownership or control.
ii. shareholders may not be required to disclose the names of person(s) on
whose behalf shares are held.
iii. companies may not have sufficient powers to impose sanctions for
shareholders failing to respond or provide false information.
iv. law enforcement entities may find it difficult to enforce the requirements
if these have to be implemented by non-resident subjects (e.g. directors), in particular when they cease to carry out their functions. c) It is difficult for companies to verify or/and monitor the information received from their shareholders, as well as to up-to-date the information. d) It is difficult for competent authorities to obtain information on beneficial ownership without alerting the company of a potential investigation.
42. As an alternative, countries may also require companies to take reasonable
measures to obtain and hold up-to-date information on their beneficial ownership. From countries’ experiences, it is not easy to establish a clear and practical framework

17 The Joint FATF and Egmont Group Report on Concealment of Beneficial Ownership (July 2018) 18 Interpretive Note to R.24, para. 4, FATF (2013a). 19 Interpretive Note to R.24, para. 3, FATF (2013a).

18  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

to set out the scope of reasonable measures. The difficulties lie in that the extent to which companies take measures to obtain and hold up-to-date beneficial ownership information should be proportionate to the level of ML/TF risk or complexity induced by the ownership structure of the company or the nature of the controlling shareholders. It is difficult for companies to perform their obligations if ‘reasonable measures’ are not well-defined and well-articulated to companies according to the risk levels involved for each type of legal persons.
43. If countries choose to implement this mechanism, countries should identify
and assess the ML/TF risks associated with legal persons to enable it to implement a risk-based approach as required by R.1 and 24. Based on the countries’ understanding of ML/TF risks through a comprehensive risk assessment, countries should then establish a legal or enforceable framework setting forth a mechanism governing how companies should take ‘reasonable measures’ to obtain and hold up-to-date beneficial ownership information.
44. In addition to the fundamental challenge on understanding ML/TF risks of
different legal persons, another challenge is that the companies are usually not obliged/empowered/motivated to seek to apply restrictions against shareholders for failure to provide BO information.
45. In this case, countries should put in place a legal framework which requires
and enables company to obtain updated and accurate beneficial ownership information through enforceable means e.g. seek information through appropriate courts or authorities, imposing restriction in relation to shareholder voting rights, or the sale of shares. The provision of false information by shareholders should also be subject to dissuasive administrative or criminal sanctions. Countries should also make sure that companies and shareholders are aware of their obligations. The authorities can provide guidance to companies or shareholders explaining their obligations, and make this guidance publicly available.
46. Last but not least, the legal framework should also govern that companies
should provide lists of shareholders and beneficial owners to competent authorities upon request in a timely manner. Failure by a company to provide the information to authorities is subject to sanctions, which may include administrative penalties or restrictions on incorporation. Where lists of shareholders and beneficial owners are held with a third party provider on the company’s behalf, the company should remain liable for the obligations. Existing Information Approach
47. Countries may also implement R.24 by using existing information collected on
the beneficial ownership of corporate entities to identify beneficial owner. Possible sources of information include company registries and other types of registries (such as, land, motor vehicle and moveable property registries); FIs and DNFBPs; other authorities (such as supervisors or tax authorities; information held by stock exchanges, and commercial databases) 20 .
48. Below are the specific challenges for countries taking this approach via
different channels:

20 Interpretive Note to R.24, para. 8, FATF (2013a).

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  19

FIs/DNFBPs a) Information may be only available where the relevant entity or structure has established or maintained business relationship with a FI or DNFBP. b) FIs and DNFBPs may not adequately implement CDD obligations as required under R.10, including measures to identify and verify/monitor the identity of the beneficial owner, and also apply specific measures required for legal persons. c) FIs and DNFBPs may not be adequately supervised or be provided with sufficient guidance on how to properly conduct CDD. d) FIs and DNFBPs may not have good understanding and knowledge to assist competent authorities in determining the BO of a complicated legal structure. Competent authorities a) Competent authorities may not be aware of the relationship between the legal person and FIs/DNFBPs. b) Competent authorities may not be able to identify and contact easily the FI/DNFBP if the FI/DNFBP is not subject to registration or licencing requirements. c) Competent authorities may not have sufficient procedures in getting information from FIs and DNFBPs which may lead to undue delays in receiving information. d) In relation to tax information, other competent authorities (particularly law enforcement authorities (LEAs)) may not be aware of the information collected and maintained by tax authorities. In addition, the extent to which tax authorities collect information on the ownership and control of legal persons varies greatly from country to country, depending on the tax regime. Companies listed on a stock exchange a) The information is only available if the company is listed on a stock exchange. b) There may not be specific obligation for stock exchange to collect, verify/monitor and keep the information up-to-date for the purpose of AML/CFT.
49. The root causes of the challenges mentioned in paragraph 40 are the lack of
established mechanism in obtaining existing information by competent authorities and the lack of mechanism on information sharing among competent authorities.
50. Competent authorities (particularly law LEAs) may not know where beneficial
ownership information is held if there is no registration/licensing system for FIs and DNFBPs, which may affect their timely access to such information.
51. The lack of mechanism for information sharing among competent authorities
is another obstacle to obtain and verify/monitor beneficial ownership information. In fact, the Existing Information Approach can be effectively used in investigations if there are mechanisms in place to facilitate authorities’ access to information held by other authorities (such as tax authorities, supervisory authorities, or land titles offices).

20  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

52. The effectiveness of the Existing Information Approach also hinges on the
    implementation of other FATF Recommendations including:
    a) R.2, 37 and 40: Country should rapidly provide international cooperation in relation to basic and beneficial ownership information. b) R.10 and 22: FIs and DNFBPs to adequately implement CDD obligations, including measures to identify and verify the identity of the beneficial owner. Failure to adequately implement CDD under R.10 can lead to poor collection of BO information. c) R.11: FIs and DNFBPs to record the CDD procedures performed and maintain these records for at least five years. d) R.20 and 23: FIs and DNFBPs to report suspicious transactions; e) R.26, 27 and 28: FIs and DNFBPs to be adequately supervised and supervisors should have adequate powers to supervise or monitor. f) R.30: competent authorities to be able to access the CDD information held by FIs and DNFBPs in a timely manner g) R.31: competent authorities to be aware of the existence of the legal person’s accounts held by a FI. h) R.34: FIs and DNFBPs to be provided with sufficient guidance on how to properly conduct CDD. i) R.35: Countries should ensure that there is a range of proportionate and dissuasive sanctions, whether criminal, civil or administrative, available to deal with natural or legal persons that fail to comply with the AML/CFT requirements.
53. Therefore, it is important to take a holistic view in implementing the Existing
    Information Approach. It is important to define the roles and responsibilities of each stakeholder, empower them and equip them with the necessary resources and support to carry out their functions.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  21

Section IV – The Suggested Effective System
Multi-pronged approach
54. As stated in Section II (paragraph 14 above refers), countries should use one
or more of mechanisms (the Registry Approach, the Company Approach and the Existing Information Approach) to ensure that information on the beneficial ownership of a company is obtained by that company and available at a specified

22  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

location in their country; or can be otherwise determined in a timely manner by a competent authority21 .
55. Countries’ experience shown in the FATF mutual evaluations echoes that
jurisdictions using a single approach is less effective in making sure that competent authority can obtain accurate and up-to-date BO information to in a timely manner. Instead, a multi-pronged approach using several sources of information is often more effective in preventing the misuse of legal persons for criminal purposes and implementing measures that make the beneficial ownership of legal persons sufficiently transparent. The variety and availability of sources increases transparency and access to information, and helps mitigate accuracy problems with particular sources.
56. As illustrated in Section III, information on beneficial ownership of legal
persons can be found in a number of different places, including company registries, the company itself, FIs, DNFBPs, and other national authorities, such as tax authorities22 or stock exchange commissions. Implementing different approaches under R.24 can therefore complement each other to verify or/and monitor the information on beneficial ownership and make sure that the information is accurate.
57. For example, an openly and publicly accessible central registry does not
necessarily mean that the information is accurate and up-to-date. It is important for an obliged party (e.g. notary, company registrar) to verify or/and monitor the information on beneficial ownership held under different approaches. The availability of other information agents (e.g. companies, FIs, DNFBPs) facilitates obliged party to cross-check, verify and/or monitor the information.
58. Under a multi-pronged approach, competent authorities can gain access to
information on beneficial ownership through different sources. They can also ensure the accuracy of information by cross-checking.
59. It is also easier for key stakeholders (including companies, directors,
shareholders, obliged parties such as FIs and DNFBPs) to identify incorrect beneficial ownership information in their database by looking up different registers or requesting information from different sources. This will then trigger the obliged party to seek clarifications from the companies, and if necessary, report suspicious activities to competent authorities. Therefore, such approach encourages key stakeholders to fulfil their obligations through peer interaction and supervision. Roles and responsibilities of each key stakeholders
60. To effectively implement the multi-pronged approach, it is important to
ensure that the responsibilities of various parties are clear and they have played their roles in defending the system of preventing misuse. The system is more effective if every key stakeholder can carry out “defence” in their roles duly. The roles of defence

21 Interpretative Note to R.24, para. 7 and 8, FATF (2013a).
22 For example, the Global Forum on Transparency and EOI (the GF)’s project on beneficial ownership, developed based on the FATF standard, encourages jurisdictions to develop complementary frameworks and enforcement programmes for tax transparency purposes. In March 2019, the GF’s Beneficial Ownership Toolkit was launched, which contains policy considerations that jurisdictions can use to implement legal and supervisory frameworks to identify and collect beneficial ownership information.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  23

may include, as appropriate, verification and monitoring of information, carrying out CDD, identifying suspicious patterns and trends on beneficial ownership, reporting suspicious cases and taking enforcement action.
61. Each key stakeholder should know their obligations, understand the risks
involved in the form of legal persons, carry out their duties actively and continuously on a timely manner with sufficient resources. The effectiveness of supervision and law enforcement, as applicable, are also important to make sure that the relevant parties have performed their duties.
62. Section 4.3 specifies the basic roles and responsibilities of each key
stakeholders and Section 5 supplements on the additional steps or defence that the stakeholders can take to help competent authorities to obtain accurate and up-to-date BO information to in a timely manner. Suggested roles and responsibilities of each key stakeholder
63. The key stakeholders involved in the system include the company itself,
company registry, obliged parties involved in company registration and verification of information (such as lawyers, notary, and accountants), FIs, DNFBPs, supervisors and self-regulated bodies (SRBs). The respective roles and obligations of each key stakeholder are suggested as follows:
a) Company and legal persons
i. Provide basic and BO information, via obliged parties (e.g. lawyers,
notaries, accountant, FIs) as required, for the company registry upon registration.
ii. Provide basic and BO information, via obliged parties (e.g. lawyers,
notaries, accountant, FIs) as required, both annually and when changes occur without delay to ensure that the information is up-to-date.
iii. Provide copies of documentation for verification of identity as requested.
iv. Keep shareholder registers, such as shareholder lists and information on
beneficial ownership (including the disclosure of the names of person(s) on whose behalf shares are held), and make it available to competent authorities or obliged entities upon request in a timely manner.
v. Keep updated the list of their representatives, including their roles,
functions and authority.
vi. Obtain updated information from their shareholders.
vii. Seek to apply restrictions against shareholders for failure to provide BO
information through appropriate courts or authorities, such as in relation to shareholder voting rights, or the sale of shares.
viii. Understand and/or hold information on their ownership structure,
including chain of ownership. b) Shareholders
i. Provide accurate information on beneficial ownership and updates on
changes to beneficial ownership without delay.

24  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

c) Company registry
i. Keep basic information and make it publicly available.
ii. Keep information on beneficial ownership and provide access to
competent authorities, including full search capability. The company registry may make the information publicly available, or available to FIs and DNFBPs. The company registry authority may also collect information on the board of directors, senior management and the natural person authorised to act on behalf of the company. In addition, directors are required to be natural persons.
iii. Verify or/and monitor the identity of the beneficial owners.
iv. Apply sanctions when obligations are breached. Companies that fail to
provide BO information are subject to dissuasive administrative sanctions, such as restrictions on incorporation. The company’s representative could also be held personally liable.
v. Report trend/pattern of activities to competent authorities as necessary.
d) Obliged parties (e.g. company registry authority, lawyers, notaries or accountant, other FIs and DNFBPs, as required by the country23)
i. Understand the ownership and control structure of the customer, and
understand the ML/TF risks in relation to legal persons.
ii. Adequately carry out CDD measures at the incorporation stage and
conduct ongoing CDD to make sure that the information on beneficial ownership is accurate and up-to-date.
iii. Identify indicators of misuse or unusual activity in the database and keep
in view the trend/pattern of suspicious structure of beneficial ownership and report to relevant authorities as necessary e.g. using red flags, sample testing, cross-checking with other data, and public data. e) FIs and DNFBPs
i. Adequately carry out CDD measures at the incorporation stage and
conduct ongoing CDD on the business relationship, and scrutinise transactions throughout the course of that relationship to ensure that the transactions being conducted are consistent with the institution’s knowledge of the customer and its business and risk profiles, including, where necessary, the customer’s source of funds.
ii. Record the CDD procedures performed and maintain these records for at
least five years.
iii. Report suspicious transaction activities.
f) Supervisors and SRBs
i. Conduct supervision and monitoring of all AML obliged persons including
FIs and DNFBPs and to ensure that they are complying with CDD requirements.

23 An obliged party could be a company registry, FI or DNFBPs. In this case, the obliged party needs to fulfil their duties in their own role and the role of being an obliged party.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  25

ii. Conduct outreach to obliged parties or as applicable, companies, to foster
a greater understanding of the ML/TF risks, in particular of companies being created for the sole or main purpose of laundering funds.
iii. Produce guidance on additional steps which could or should be applied as
part of (enhanced) due diligence on legal persons.
iv. Apply concrete and dissuasive sanctions (e.g. including monetary
penalties) in the case of non-compliance. g) Competent authorities
i. Know what basic and beneficial ownership information is available in the
country, and which relevant parties are holding it.
ii. Establish process and procedures in obtaining information on beneficial
information.
iii. Assess the risks of legal persons being misused for ML/TF purposes in
order to improve the understanding of risks.
iv. Ensure that there is adequate sharing of information on ML/TF risks,
trends and typologies between competent authorities and foster communication with the reporting entities. This would ensure that reporting entities, in particular, are more sensitive to and more familiar with typologies.
v. Provide guidance to companies or shareholders, FIs and DNFBPs
explaining their obligations, and provide awareness raising activities as necessary (e.g. through the provision of information to companies upon registration).
vi. Carry out enforcement to ensure that effective, proportionate and
dissuasive sanctions are applied in the case of breaches. h) National authorities
i. Ensure co-operation between government entities holding information on
beneficial ownership and set out the mechanism(s) in legislation or regulations to make sure that competent authority can access to information on beneficial ownership in a timely manner.
ii. Identify and assess the ML/TF risks associated with legal persons, to
enable it to implement a risk-based approach.
iii. Establish a legal or enforceable framework setting forth the appropriate
approach (Registry Approach, Company Approach and Existing Information Approach) to ensure transparency of beneficial ownership.
iv. Introduce measures to prevent legal persons from being misused by
criminals e.g. prohibiting bearer shares and bearer share warrants, converting them into registered shares or share warrants, or immobilising them by requiring them to be held with a regulated FI or professional intermediary, or requiring shareholders with a controlling interest to notify the company, and the company to record their identity.

26  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Section V – Suggested key features of an effective system
64. Along with the multi-pronged principle, the FATF has identified the following
suggested solutions to facilitate countries to tackle the challenges that they are facing. These suggested solutions are identified from the practical experience of countries as shown in the fourth round of FATF mutual evaluations and information provided by countries in the earlier Horizontal Study.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  27

Risk assessment (relevant to core issue 5.2)
65. Countries should conduct a comprehensive risk assessment of legal persons
so as to develop a more thorough understanding of vulnerabilities and potential of abuse of legal persons for ML/TF. This may also help countries to develop specific measures for legal persons that are easily being misused for ML/TF.
66. In some countries, there is a designated agent commissioned to analyse the
ML/TF risks posed by all types of legal persons. Such agent considers relevant legal and regulatory contextual issues particular to the country and multi-agency information sources to identify trends and patterns, including:
a) review of relevant court cases; b) suspicious transaction reports filed by obliged parties e.g. notaries, lawyers, company registry, other FIs and DNFBPs; c) practical experience of competent authorities; d) identified patterns/trends in ML/TF and relevant changes e.g. “preferences” amongst the various types of organised crime groups for certain forms of company.
67. The agent then conducts assessment regarding the risks of legal persons, and
share information on ML/TF risks, trends and typologies with competent authorities and obliged parties. The sharing of current trends and typologies enables obliged parties to consider the risks at the incorporation stage, and they can pay attention to potential red flags at the incorporation stage.
68. For countries which are an important regional and international financial
centre, more efforts should be put to identify, assess and understand the vulnerabilities of corporate structures for ML/TF particularly in relation to international threats. Belgium In 2018, an agent was hired at the Treasury (FPS Finance) to conduct a horizontal risk analysis on legal persons which could be established under the Belgian law. The analysis involved a study of the legal framework as well as meetings with competent authorities to identify trends and patterns. The purpose of the analysis was to enhance the understanding and knowledge of competent authorities on the vulnerabilities and potential abuses associated with each legal person, and also to identify the loopholes and necessary legal reforms or additional measures. The analysis concluded that the most vulnerable structure is the private limited liability company (SPRL/BVBA). This is the most common form of legal persons. While most of them are properly registered, some of them pose ML/TF risks. Fraudsters are aware of certain loopholes which allow them to circumvent controls and misuse the structure to conduct unlawful activities. This may lead to inaccuracy of the Registry. Another risk is that legal persons that are registered are not necessarily active.

28  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

This affects the accuracy of statistics and also allows the trading of dormant companies to avoid the administrative process of creating or dissolving a company. Belgian authorities are aware of the threats and vulnerabilities and have taken measures to address them. The Belgian Company Code has been recasted to reduce the number of types of legal persons and harmonise the rules applicable to profit and non-profit legal persons. Targeted actions have also been launched. For instance, a task force has been established by competent authorities to efficiently dissolve inactive entities. Indonesia* Sectoral Risk Assessment of Legal Person The Indonesia National Risk Assessment (NRA) 2015 indicated that financial criminals perceived it safer to disguise illicit funds through legal person(s). Corrupt government officials and drug dealers can easily hide their illicit gain behind the complex structure and network of corporate transactions. In many cases, this was made possible by the lack of governance in beneficial ownership. Criminals can appoint nominees to appear as the owners of their assets while leaving no trails anywhere in the corporate legal documents. In 2017, the Commission Eradiation Commission (KPK) together with PPATK (Indonesia’s Financial Intelligence Unit (FIU)) and Financial Service Authority (FSA/OJK) conduct the Sectoral Risk Assessment (SRA) of Legal Persons. This money laundering SRA of Legal Persons is separate with the terrorist financing SRA of Legal Persons. The SRA of Legal Persons identified all types of legal person in Indonesia, which are limited liability companies, foundation, cooperative, firm, partnership, and association. The money laundering SRA of Legal Persons identified six dimensions of risks, including(1) type of legal person; (2) type of business; (3) delivery channel; (4) reporting party; (5) international transaction (inflow); and (6) international transaction (outflow). The terrorist financing SRA of Legal Person identified four dimensions of risks, including (1) type of legal person; (2) type of business; (3) delivery channel; and (4) reporting party. The result of SRA of legal persons shed light on the risks faced by different legal persons as follows:
‒ Indonesia’s “Perseroan Terbatas (“PT” i.e. limited liability companies) are exposed to a higher ML risk, while “Yayasan" (i.e. foundations) are exposed to higher risk for TF.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  29

‒ Companies that operate trading business are prone to ML more than other types of business, while social foundations and religious institutions remain the most vulnerable to TF. ‒ From delivery channels perspective, fund transfers are the most frequently used for in both ML and TF scheme. ‒ Despite of the stringent regulations, banking remains the reporting party with the highest ML risk. ‒ Indonesia specifically covered international transactions in the assessment and noted that some jurisdictions with perceived low ML risk appear to have been used by Indonesian-based corporations to keep their money. *yet to undergo mutual evaluation as of September 2019 The United Kingdom A thematic review of relevant legal entities (RLEs) on the PSC Register Following engagement with NGO community and Companies House facilitating data analysis by NGOs, the risk of accidental or deliberate misuse of the Relevant Legal Entity (RLE) exemption for the PSC register was raised. Companies House has undertaken to check each RLE registered, prioritising on a risk-based approach by focussing on those registered in financial centres or countries with weaker transparency laws. Circular ownership of companies is prohibited by Companies Act 2006. The UK’s experience is that circular registrations are a result of a misunderstanding of the person with significant control (PSC) requirements, not deliberate. For a company to deliberately register a circular loop would essentially disclose that they had breached s.136 of the Companies Act and committing a false filing offence. UK National Crime Agency (NCA) Intelligence Report - “The use of corporate entities to enable international money laundering networks” The NCA report examined the case of an overseas international money launderer utilising UK corporate entities to launder the proceeds of crime. In this example, the controller routed illicit funds to an overseas based company from 11 UK corporate entities (Ltd company, Limited Liability Partnerships (LLPs), Scottish Limited Partnerships (SLPs)), all of which banked exclusively outside of the UK. The ownership of these companies highlighted that they were often nominee partners or directors who had been linked to suspicious offshore structures. The key insights from this report included: the use of several different “vanilla” structures for illicit purposes; the use of “nominee partners” can present a vulnerability; entities were often banked overseas where CDD requirements or enforcement of regulations might be lower; and criminals

30  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

take advantage of the perceived respectability of the UK business community in order to provide a façade of legitimacy. This intelligence report contributed to more fundamental reviews of the vulnerabilities posed by LLPs and SLPs in respect of high-end money laundering. After the report, the UK introduced several measures to improve transparency of these entities and is expected to have mitigated some of the vulnerabilities identified. For example, criminals can no longer hide beneficial ownership through one of the partners being a corporate body registered in an overseas jurisdiction. Strategic intelligence assessment: ‘The use of corporate vehicles to hide beneficial ownership’ This report identified the use of multiple corporate vehicles, and complex structures using multiple jurisdictions consisting of a series of corporate entities to obfuscate beneficial ownership. There are delays in identifying the relevant jurisdiction(s), requesting, and accessing the required information, assuming it exists. Organised crime groups and individuals will be aware of this and will seek to complicate the structures as much as possible. Furthermore, law enforcement have to rely on legal requirements of that country e.g., details required when incorporating a company, which vary considerably depending on the country. This is most apparent in a country where secrecy is one of the main attractions for using that jurisdiction. Furthermore, the report found that the use of SLPs created further complications as they do not need to register for tax or provide financial reports if the business is conducted abroad. SLPs can register companies abroad in foreign offshore centres, which limits Her Majesty’s Revenue and Customs (HMRC)’s ability to perform background checks as the beneficial ownership is disguised in these companies. This analysis has been used to inform the UK’s risk-based approach and to understand the vulnerabilities in the UK. Switzerland A dedicated inter-agency group for the assessment of AML/CFT risks Switzerland has established a national AML/CFT co-operation and co￾ordination framework led by the Interdepartmental Co-ordinating Group on Combating Money Laundering and the Financing of Terrorism (GCBF). All competent authorities regularly take part in this group. The Group is responsible for the ongoing identification of risks to which the country is exposed. Under the leadership of MROS (FIU), there is a specific working group dedicated to risk analysis. The GCBF, represented by high-level officials, proposes measures to address the identified risks. The results of the works of the GCBF are submitted each year to the Swiss Federal Council for information or for adoption of further measures. In June 2018, GCBF published an in-depth analysis on the AML/CFT risk of legal persons and arrangements. This report, adopted in November

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  31

2017, compiles extensive quantitative and qualitative data from multiple sources of information from competent authorities, academia and the private sector. It identifies the main threats and vulnerabilities affecting Switzerland with regard to legal per-sons and arrangements and addresses the residual risks by proposing measures, including at the legislative level. The report is publicly available which ensures a wide dissemination and awareness raising. Adequacy, accuracy and timeliness of information in beneficial ownership Obliged parties to verify or/and monitor the accuracy of the information (relevant to core issue 5.3 and 5.4)
69. The country may appoint a fully regulated and effectively supervised
gatekeeper i.e. an obliged party which is subject to AML/CFT obligations, to ensure the accuracy of the information. Such an obliged party should be fully aware of their obligations, understand thoroughly the risks associated with all types of legal persons, and verify or/and monitor the accuracy of information on beneficial ownership. The role of this obliged party in authenticating and verifying/monitoring the acts relating to the information on beneficial ownership throughout the whole lifecycle of legal persons reinforces the reliability of information in particular when its activities are constantly supervised and in sanctioned in case of identified non￾compliance.
70. In some countries, the company registrar is the obliged party who shall
perform CDD functions. The registrar checks information submitted by companies against other sources (such as national identity registers or tax administrative registers) to verify or/and monitor the information on beneficial owner. The registrar also identifies anomalies or inconsistencies and make reports to the competent authorities.
71. In some countries, the involvement of a notary, a lawyer or an accountant, who
is an obliged party subject to AML/CFT obligations, is required at the company incorporation stage, as well as subsequent stages to validate and ensure accuracy of information reflected in the business register and authenticate changes in ownership. Such obliged party is under the supervision of a designated supervisor that is responsible for verifying compliance with these CDD obligations. Some countries implemented additional mitigation measures by verifying or/and monitoring the identity of the obliged party. The company registry will check against the relevant register to confirm that the obliged party is a qualified professional and that his/her licence has not been suspended or revoked.
72. In some countries, it is mandatory to open a bank account with an obliged FI
(e.g. banks) before completing company registration. This entails a separate CDD process by FIs where beneficial owners of the company are identified. Such a requirement can help with verification of BO at the time the legal person is created. If there were a requirement to maintain this (or another) bank account throughout the life of the legal entity, then it could also contribute to maintaining up-to-date information, by leveraging the FI’s ability to periodically refresh customer files or identify when changes occur.

32  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Denmark
When establishing a company in Denmark, obliged parties subject to AML/CFT obligations (lawyers or auditors) are often involved at the incorporation stage as the business register requires confirmation from a lawyer, auditor or bank that the required capital has been paid in full. Hence, obliged entities that must perform CDD are very often involved at the incorporation stage. Danish natural and legal persons that are creating or managing legal persons by making registrations in the Central Business Register (CVR) are required to use a special form of ID (NemID), issued by a government agency. NemID is a common secure login to the Internet that is used for a variety of purposes, such as online banking, finding out information from the public authorities, or engaging with businesses. This electronic login leaves an electronic footprint and gives the DBA digital information about the person making a registration which can be used in various control situations. Further, when making a registration in the Central Business Register, everyone must sign an electronic declaration stating that the information put in the business register is correct. Guernsey* Validating beneficial ownership information and providing information to TCSPs on their “gatekeeper role” in the formation and administration of legal persons Only licensed trust and company service providers (TCSPs) who are subject to full AML/CFT and prudential supervision in Guernsey by the Guernsey Financial Services Commission (GFSC) can incorporate legal persons in Guernsey. TCSPs have been subject to requirements to identify and verify the beneficial owners of all structures for whom they act under Guernsey’s Proceeds of Crime legislation. In 2017, Guernsey introduced additional legislation requiring all Guernsey legal persons to disclose the identity of their beneficial owners to a central register of beneficial ownership. Transitional provisions in this law required accurate and up to date beneficial ownership information to be provided to the Register on existing legal persons before the end of February 2018. In the second half of 2018, the GFSC undertook a thematic review to assess the effectiveness of the 2017 legislation for ensuring the accuracy of information on the Register about the beneficial ownership of Guernsey legal persons, which are administered by TCSPs. The review consisted of an extensive survey of all licensed TCSPs who were required

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  33

to provide detailed information on the proportion of beneficial owners who fell within each of the FATF’s “3 tier ownership test” for the legal persons for whom they act. The results were examined and together with input from the Registrar and Guernsey’s Financial Intelligence Unit. Twenty TCSPs were selected for focused on-site inspections to review the beneficial ownership records of up to twenty legal persons per firm. The GFSC also compared information on the beneficial ownership register with that on TCSPs’ files to check the accuracy of beneficial ownership information submitted to the Register. The GFSC issued a public report on its findings from the review in 2019 to help inform TCSPs of their obligations under both the Proceeds of Crime law and the 2017 law. The report included case studies on different types of beneficial ownership structures observed by the GFSC during the inspections to highlight examples of good practice and areas for improvement. *yet to undergo mutual evaluation as of September 2019 Hong Kong, China Information provided to the Companies Registry (CR) are subject to checking and verification by the CR. Financial institutions are also subject to statutory CDD and record-keeping requirements when any company opens a bank account. The CR also conducts regular site inspections to check if significant controllers registers (SCRs) are properly kept or not by companies. The CR will check the accuracy of information contained in the SCR against other available sources on a risk based approach.

34  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Italy
Notaries in Italy perform a public function. The information that they provide is deemed self-sufficient, and its content is verified through the automated checks. At the time of incorporation, the information is entered on the basis of a public deed prepared by a notary and processed online through the use of a digital signature. The public deed itself is available to external parties “as is.” Basic checks are conducted by the IT system upon registration. They include an automated calculation of shares (to ensure that they don’t exceed 100%) and of the capital (to ensure it does not exceed the proposed total) as well as an automated validation of information such as the tax ID number entered, digital signature –and therefore the identify– of the applicant, and of the payment of the mandatory fees and taxes. Additional automated checks are also performed with respect to new information entered into the system (for example to ensure that shares are only transferred by persons who are already in the system). Any anomaly highlighted by these automated checks is analysed by the Business Register staff before the publication is authorised. Israel In addition to the mandatory involvement of an Israeli lawyer for both the online and paper registration process to verify the signatures of shareholders and directors, the vast majority of applications made in paper form are submitted to the registry by lawyers who are subject to CDD obligations, including an obligation to obtain and retain beneficial ownership information. The Israel Companies Authority (ICA) confirmed that the vast majority of all registered company applications are submitted by Israeli lawyers. These lawyers are subject to CDD obligations on beneficial ownership. The MoJ is in charge of verifying compliance with these CDD obligations. The ICA has implemented additional mitigation measures in relation to potential abuse by use of online applications. Such applications must be submitted by a lawyer subject to AML/CFT obligations, who is identified by an electronic certificate. The identity details of that lawyer are checked against the Bar Association's register to confirm he/she is a qualified lawyer and that his/her licence has not been suspended or revoked. There is one exception, which is rarely used, when the application is submitted by a shareholder who is the sole shareholder and a director of a company. Such applications require the identification of that shareholder on the on-line system by an electronic certificate (which is issued only after a face-to-face meeting with the shareholder/director concerned). In addition, the ICA requires the applicant (i.e. the lawyer or shareholder) to upload a copy of the by-laws, signed in the presence of a lawyer required to verify the signature of the shareholder on the articles of association – hence, sole shareholders making online applications are also subject to identification measures.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  35

Japan*
On 30 November 2018, the amendment of the Ordinance for the Enforcement of the Notary Act came into force. Under the amended ordinance, to incorporate stock companies (the most commonly used form of legal entity), general incorporated associations and general incorporated foundations (hereinafter called ‘stock companies etc.’), the founders (clients) are required to report to notaries the information regarding the identity of the person who ultimately owns or controls the legal person they establish when notaries certify articles of association. In Japan, the articles of association must be certified by notaries to incorporate these legal entities. The clients also need to report to notaries whether the person who ultimately owns or controls the legal person is a member of organised crime groups or international terrorists. The notary database is kept in a centralised and systemic way. Competent authority can access the information in the database through notaries. Notaries are required to check the accuracy of the reported information regarding the identity of the person who ultimately owns or controls the legal person by examining the submitted articles of association and other documents. Notaries also make use of their database on organised crime groups and international terrorists and when the person who ultimately owns or controls the legal person falls into these categories, the notaries refuse to certify the articles of association. The information regarding the identity of the person who ultimately owns or controls the legal person acquired by notaries is stored in their database to which competent authorities can refer upon their request. yet to undergo mutual evaluation as of September 2019 Jersey Fully regulated and supervised obliged persons are required to form and maintain legal persons, along with vetting by registry The incorporation of most legal persons in Jersey is conducted by regulated trust and company service providers (TCSPs).24 TCSPs are subject to full supervision in Jersey, including fit and proper requirements and regulation of both AML/CFT and prudential/conduct. TCSPs are required under the Money Laundering (Jersey) Order 2008 to find out, and to verify, the identity of the beneficial owners of structures that they administer, and to keep information and records up to date. TCSPs are also required to update the central register of beneficial ownership and control within 21 days of knowledge of a change of beneficial ownership.

24 Local trading companies may incorporate without the use of a TCSP, but are subject to additional identity verification and due diligence by the Jersey Financial Services Commission.

36  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

In 2018, with a focus on the accuracy of the Register, the Jersey Financial Services Commission (JFSC) carried out a series of themed examinations to a cross section of TCSPs who provide administration services to Jersey registered entities. The accuracy of client information held by TCSPs continues to be a focus of the JFSC. Customer data is reviewed against data held on the register of beneficial ownership during on-site examinations. The Companies Registry itself conducts a three stage, sequential vetting process, which involves 3 separate individuals when vetting a) on incorporation; and b) on change of beneficial ownership or control. The vetting process on incorporation must be signed off by either a Head of Unit or a Director of the JFSC within which the Companies Registry sits. Each beneficial owner and controller and the activities of each entity is vetted against sanctions lists and court regulatory decisions made anywhere in the world, using various sources including a consolidated sanctions and Office of Foreign Assets Control (OFAC) lists, World-Check, internal Customer Relationship Management systems check, internal intelligence/enforcement database check, open source internet searches and regulatory databases maintained by the JFSC. Any negative information found during the vetting process will be escalated to Head of Unit or Director level and will either result in shared internal intelligence and/or filing of a Suspicious Activity Report. An active feedback loop is exercised to ensure that deficiencies are taken into account by the Supervision division of the JFSC, and, where relevant, the Enforcement division. *yet to undergo mutual evaluation as of September 2019 Spain Notaries are required in all cases, to identify and record the beneficial owner of a newly incorporated entity on the basis of a declaration made by the company’s representative Customer due diligence undertaken by obliged entities makes a significant contribution to Spain’s systems for providing authorities access to beneficial ownership information and to ensuring the quality of that information. The notary profession is particularly relevant in virtue of the legal requirements for their involvement to validate most acts involving legal persons. Notaries are very aware of their significant gatekeeper role, as well as of the importance of the information they hold, and have actively worked with the authorities to develop systems to open up their wealth of information for the authorities.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  37

Supplementary information platform in addition to company registry (relevant to core issue 5.3 and 5.4)
73. In addition to company registries, some countries have another database
holding information on beneficial ownership. Competent authorities or obliged parties can access these repositories, and cross-check the information against that held by obliged parties and authorities such as company registry, notary profession, tax or stock market authorities.
74. In some countries, their notary profession, being the obliged party, keeps a
centralised database on beneficial ownership of legal persons. This includes information obtained and recorded by notaries when incorporating entities or conducting certain other acts or transactions by persons and entities, and information on the transfer. This creates another repository of corporate information which is used to validate the information on the company registry.
75. Some countries may also have their tax authorities maintain beneficial
ownership information for certain legal persons. The tax authorities may hold basic and beneficial ownership information on legal persons who have an income, have ownership and/or make transaction of real estate or hire employees. Some even require that all legal persons making disclosures to the tax authorities are required to have a bank account and are subject to banks’ CDD requirements.
76. In some countries, professional associations have made free access to certain
private databases available to their members. This facilitates the professionals to cross-check information with existing customers or exchange with other obliged parties while complying with data protection measures. China In March 2014, China launched the National Enterprise Credit Information Publicity System (NECIPS), which includes information of all enterprises registered with the State Administration of Market Regulation (SAMR). The NECIPS is an authoritative, nationally unified information system established by the competent authority to disclose statutory information. Written inspection, on-site inspection and network monitoring are conducted to randomly check the publicity information. Enterprises that violate the information disclosure requirements are listed on the “grey list” and “black list” for creditworthy sanctions, and may also be subject to fine or even licence revocation. The system strengthens the transparency of business operations, promotes the company’s integrity and self-discipline, and strongly supports the supervision. Since 2017, the average number of visits has reached 19.4 million times per day, and the average number of inquiries has reached 3.2 million times per day. The available information of the NECIPS includes the company’s basic information, shareholders and funding information, mortgage registration, administrative licensing and sanctions, as well as some business information. This does not include beneficial ownership information, but may nevertheless contribute to efforts to identify the beneficial owner.

38  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Israel
Information held by Tax Authorities
The Israel Tax Authority (ITA) holds basic and beneficial ownership information on all legal persons which have an income, which own real estate, which buy/sell real estate, which have any employees in Israel, which have any assets in Israel or which undertake any financial transactions. All legal persons making disclosures to the ITA are required to have a bank account and are subject to banks’ CDD requirements, including those on beneficial ownership. Italy The Guardia di Finanza (GdF) has been successful in a number of instances in identifying the beneficial owners of companies misused by criminals, especially mafia-type organised crime groups, through a combination of measures, including consultation of the information collected by reporting entities (mainly notaries and banks) and of various databases. Indonesia* Since 2018, all legal persons are required to disclose their beneficial owner and to provide beneficial ownership electronically through AHU Online. AHU Online is an application that consist of basic information and beneficial information of legal person that maintain by Ministry of Law and Human Right (companies registry). To ensure that the reporting parties can access the beneficial ownership information in timely manner, Presidential Regulation Number 13 year 2018 regulates specific requirement that oblige the companies registry to provide direct access for reporting parties. Moreover, competent authorities, especially government agencies (e.g. Ministry of Energy and Mineral Resources, Ministry of Agriculture, Ministry Agrarian Affairs and Spatial Planning), are empowered to consider whether to provide business license to legal person which has not yet disclosed or designated its beneficial owner. Competent authorities will decide based on the assessment of the authorised institution, (a) audits of the legal person by the competent authorities; (b) information from a government institution or private entity that manages data and/or information of the beneficial owner, and/or report from certain professions that keep information of the beneficial owner; and/or (c) other relevant information. *yet to undergo mutual evaluation as of September 2019

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  39

‒ on the basis of the data contained in Suspicious Transaction Reports (STRs) – Instructions issued by the FIU establish that the transmission of STRs shall always be complemented with indication of the beneficial owner. The incapability to identify the beneficial owner represents, in itself, a reason for filing a STR; ‒ from notaries – whereby the legal person under investigation has been part of public acts (e.g. purchase of properties). Information acquired from the Business Register, Anagrafe Tributaria, records held at notaries, and Notarial Archives; ‒ from accountants. Consultation of the Anagrafe Tributaria allows to identify the custodian of the accounting records or the intermediary who transmitted the compulsory returns for income tax and VAT purposes; and consultation of records (registers) held by professionals; ‒ from banks, other financial intermediaries and trust companies, identified through queries of the Archivio dei Rapporti Finanziari. After identifying the intermediary, the AUI (Archivio Unico Informatico) shall be consulted. The same sources may also be utilised in criminal investigations on the basis of an ad-hoc decree (Article 248 Code of Criminal Procedure) issued by the relevant Judicial Authority. Spain In Spain, there are currently three databases that hold information on beneficial ownership of companies, each one of them set up with information collected by different obliged entities (Notaries, Registrars and credit institutions). All of them are accessible on-line to LEAs by means of web portals or web services. Such network of overlapping mechanisms together secure the availability of beneficial ownership information of all commercial entities operating in Spain. The mechanisms are as follows:

1. The Single Notarial Computerised Index: beneficial ownership
   information obtained by notaries through their CDD is held in the notary profession’s Single Computerised Index. This database records separately the information obtained through customer declarations at the time of notarised transactions and the verified, aggregated information compiled by notaries.
2. The Business Registry also collects information on beneficial
   ownership as reported by the authorised representative of the company. On 21 March 2018 a Ministerial Order was issued, requiring all companies (except for publicly listed companies) to annually submit a form, identifying their beneficial owners, to the Business Registry when fulfilling the obligation to file annual accounts. Failure to file the annual accounts (including this form, as accounts deposited

40  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

without it shall be rejected for being incomplete) causes the Registry sheet of the company to be locked and has other legal consequences, such as a possible monetary fine, the exclusion of the company from any public tender and, in cases where the company reaches an insolvency state, there is the legal presumption that such state has been reached by negligence or fraud. Even though the period for depositing accounts is not closed yet, on 1st April 2019 more than 1 154 000 companies have already filed their 2018 annual accounts and more than 1.5 million beneficial owners have already been reported.
3. The third database is the Financial Ownership File held by Sepblac
(the Spanish FIU and AML/CFT supervisor). Credit institutions will submit a monthly report about the bank and securities accounts opened/held by them to Sepblac. One of the fields required for credit institutions to fill in (except for publicly listed companies) is the identification of the beneficial owners of the account holders. Therefore, information that comes from the CDD carried out by banks to legal persons whenever opening or holding a bank or securities account is also accessible to LEAs for the purposes of preventing, detecting or investigating ML/TF cases. Ongoing reporting at company level / to the reporting entities or company registry (relevant to core issue 5.3 and 5.4)
77. To ensure that the information on beneficial ownership is updated in a timely
manner, a country may require legal persons to undergo ongoing reporting. If there is change to the beneficial ownership, legal persons are obliged to file changes that are verified by the obliged party.
78. In some countries, the company registry imposes an annual updating
requirement on companies to make sure that the information of the company’s beneficial ownership is up-to-date. Some registries may implement automated systems to monitor deadlines for filing annual returns or certifications. In addition, legal persons are required to file updates within a designed period if there is any change in beneficial ownership. Otherwise, the change may not have legal effects. Some registries require companies to provide an annual report confirming the basic information previously provided to the registry by the end of the calendar year and making such annual reports publicly available so that the public can see the contents of a report and when it was last submitted.
79. A point to note is that such updates on beneficial ownership to the company
register are to be verified by an obliged party. In some countries, involvement of a notary is further required to validate changes in basic information. Information submitted to the company registry must be accompanied by a notarial document. Notaries also maintain the same information, as well as information related to changes in shareholders in a separate database that is updated within a specified timeframe.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  41

80. For registers of shareholders, if these are held by the company itself or a
    depository institution, the company director is responsible for ensuring their accuracy, and for updating them immediately when changes take place. A Registry system that is held at the company level allows keeping a complete and full record of beneficial ownership information. The register can show the changes of beneficial owner. This allows competent authorities to obtain or retrieve beneficial ownership information from the company. a) Ongoing reporting at company level Switzerland Companies in Switzerland must keep a record of their shareholders (SAs) or members (SARLs and SCs) and their beneficial owners (Art. 686, 697j, 697l, 747, 790, 837 CO), including for bearer shares. Shareholders must inform the company within a month of any acquisition of the shares (697i CO). All shareholders, of both registered and bearer shares, or of units where the holding reaches or exceeds the threshold of 25% of the capital or of the votes, must inform the company of the name of the natural person who is the beneficial owner of the shares or units. The information must be kept up to date. They must also notify the company of any changes (Art. 697i, Art. 697j and 790a CO). In addition, the company must be notified of any changes to the information identifying the shareholders or beneficial owner (first name, surname, address) (Art. 697i, 697j para. 2 and 790a para. 2 CO). b) Ongoing reporting to the reporting entities or company registry Austria Based on Art. 3 of the Beneficial Owners Register Act (BORA), legal entities are required to conduct and review their due diligence requirements pursuant to Art. 3 para. 1 BORA at least once a year, and verify whether the beneficial owners listed in the Register are still up-to-date. Moreover, changes related to beneficial ownership have to be reported within four weeks of obtaining knowledge of these changes. Legal entities will be required to not only perform their due diligence obligation at least once a year, but also to confirm the reported beneficial ownership data within four weeks after the due date of the annual review. All reporting requirements will be enforced by automated coercive penalties.

42  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Belgium
In Belgium, there is a duty for legal entities and arrangements (LE/LA) to update the ultimate beneficial ownership information within a month of the change Such update should be registered directly in the online UBO Register platform. LE/LA also have the duty to confirm on an annual basis that the information registered is up-to-date, accurate and adequate. Accountants or notaries can also file the UBO information directly in the UBO Register and do the annual confirmation for their clients. They can also choose to send an extract of the register to the legal representative and ask them to confirm the information by directly clicking on a link embedded in the email. Denmark In Denmark, corporate and legal entities covered by the BO rules are obliged to register its beneficial owners in the Central Business Register (CVR). If the entity is informed that there might have been a change of the beneficial ownership, the entity is obliged to investigate it and update the registration in the BO registry as soon as possible and no later than within two weeks. Corporate and legal entities must keep information on the company’s beneficial owners, including attempts to identify the beneficial owners, for five years after the ownership ended or identification was attempted. This information shall be provided if for example the Danish Business Authority (DBA), the State Prosecutor for Serious Economic and International Crime (SØIK) or the Danish Tax Agency (SKTST) considers the information necessary to fulfil its supervisory and control tasks. If the company ceases to exist, the last registered management must ensure that information and documentation regarding the investigation into the beneficial owner(s) can be produced five years after the ownership ended or identification was obtained. In 2020, corporate and legal entities will be required to screen the BO information registered in the CVR at least once a year and, if necessary, update the BO information. The relevant information shall be presented on the meeting where the annual report is approved by the board of directors. France* In France, pursuant to Article R. 561-55 of the Monetary and Financial Code, any corporate or legal entity that has change(s) in its beneficial ownership chain needs to file an up-to-date BO document with the “greffier de

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  43

commerce”(commercial court’s clerk) within 30 days following the change. Corporate and legal entities must keep updated and accurate BO information. Failure to submit information within appropriate time or to provide accurate information is subject to 6 months of imprisonment and a fine of € 7 500, according to Article L. 561- 49 of the Monetary and Financial Code. Natural persons may also face a disqualification from practice of business activities or a partial privation from national and civil rights. The legal persons convicted may face a sanction payment equal to five times the sanction applicable for natural persons (37 500 euros) and supplementary penalties as described by Article 131.39 of Penal Code. yet to undergo mutual evaluation as of September 2019 Jersey Legal Persons required to update the central register within 21 days of any change in beneficial ownership Under the Control of Borrowing (Jersey) Order 1958 (COBO) every Jersey entity is required to obtain the consent of the Jersey Financial Services Commission (JFSC) on incorporation. The JFSC uses this regime to impose conditions on all Jersey companies which facilitate the collection of beneficial ownership and control information. All TCSPs must provide information where an individual acquires beneficial ownership of 25% or more (the threshold being flexed on a Risk Based Approach) or becomes a controller (the Jersey Registry adopts the FATF “3 tier test”). TCSPs must notify the Companies Jersey Registry within 21 days of knowledge of a change. In respect of legal persons formed not by TCSPs but by local residents, under COBO, there has always been a requirement to obtain the permission of the Commission before a change of beneficial ownership and to therefore update the central register upon change of beneficial ownership. *yet to undergo mutual evaluation as of September 2019 Italy Changes to the ownership and control structure of the legal person must be recorded in the Register within different timeframes, namely within 30 days of the notarial act that validates them, in the case of limited liability companies (società a responsabilità limitata; SRL), and once a year for the joint stock companies (società per azioni) (i.e. at the time of filing the annual accounts). Transfers of shares must be filed with the Business

44  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Register by a notary or be performed by a bank or stockbroker in the case of SRL, the information may be filed by notaries or chartered accountants. The checks are performed with respect to the information filed by notaries. Verification through different means (relevant to core issue 5.3 and 5.4)
81. The effective mechanism also involves active and adequate verification of
information to ensure that the information on beneficial ownership is accurate. Verification of information can be conducted through the following means. Cross-checking
82. Countries may adopt cross-checking measures to verify or/and monitor the
information on beneficial ownership, taking advantage of the availability of different information agents. For example, FIs and DNFBPs, as well as tax authorities, can cross￾check the basic and beneficial ownership information provided to them by companies with the information available at the at the registry held by the company or by the registry. Obliged parties such as FIs and DNFBPs can also continuously monitor changes in the registries, including designations of violating companies (through automated computerised interfaces) and inquire with their customers with regard to any potential discrepancies.
83. Given the interrelatedness of the information available and the procedures
implemented by government authorities, some countries implement automated cross-checking controls among databases held by different government authorities. For example, a common portal is developed so that the system of company registry can cross-check the beneficial ownership database against other government databases (e.g. law enforcement databases, tax administration database, land register, and other open sources) to verify or/and monitor the accuracy of information on beneficial ownership.
84. Some countries have developed a blacklist, where all individuals and
organisations listed in the United Nations are included, in addition to any local individual or organisation which is subject to domestic listing. Those who are listed will not be able to register or own or transfer ownership of any kind. Obliged party can cross-check the identity of shareholder/director against the blacklist at the company incorporation and subsequent stages. Red flags
85. Some countries identify indicators that suggest suspicious activities e.g. a
single credit card or email address being used to incorporate many companies, which on the surface are unconnected. The company registry will then report to law enforcement/competent authorities regarding suspicious activities.
86. In some countries, the obliged party determines a set of indicators and then
reviews and assesses the legal persons’ financial statements to properly identify the nature and size of the business. For example, the obliged party may establish indicators on sector’s income specifically cash income, and the level of assets. This is then compared to the industry average. Subsequent abnormal and/or significant results are deemed suspicious and are therefore subject to further assessment.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  45

87. In some countries, the company registry system is capable of detecting any
    variations in the information submitted by companies (i.e. increase in shares, transfers of ownership) and to also compare the relevant indicators against the industry average. In case of abnormal variations, an alert is triggered and is subsequently sent to the concerned department for further investigation. Where the primary finding does not justify the business purpose of the behaviour that generated the alert, an in-depth investigation is conducted to determine whether such behaviour is associated with ML/TF risks. Sample testing with public and non-public data
88. Some registries conduct ongoing sample testing or targeted audits to verify
    or/and monitor the accuracy of information on selected legal persons. In some countries, company registries conduct sample testing for specific industries/ companies of specific business nature/ risk features by using the annual reports provided by companies to conduct periodic verification. They may check the annual report submitted against the information in its database. Co-ordination among authorities
89. In some countries, relevant obliged parties and authorities (e.g. company
    registry and tax authorities) have worked closely together on cases of fraud and market manipulation. The authorities may jointly conduct detailed analysis of transactions and trading patterns, leveraging of certain parameters e.g. IP addresses and use of telephone system information. This helps identify connections between beneficial owners and facilitate further investigations. External parties engaged in verification of register information
90. Some countries introduce a reporting feature on the public register to
    encourage external parties to voluntarily notify it of suspected errors. Some organisations e.g. NGOs may then undertake data analysis and report on potential inaccuracies and issues of concern. Some countries also require FIs and DNFBPs to report inaccuracies when they conduct CDD process. Austria The BO Registry Authority is responsible for ensuring the correctness and completeness of the data as well as for the prevention of money laundering and terrorist financing. To fulfil these obligations, the BO Registry Authority is authorised to carry out analyses, or may at all times request information and documents from legal entities and their beneficial owners and perform off-site analyses of the correctness of beneficial ownership on the bases of the documentation received and other available sources. Where an obliged entity determines during the application of its due diligence obligations towards customers that a different beneficial owner has been entered as beneficial owner than was determined, and is convinced that the entry is incorrect or incomplete, then the obliged entity may electronically report this case to the BO Registry Authority by setting

46  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

a remark – a “red flag” – for the respective legal entity. The same applies to all competent authorities. By setting a remark the legal entity will automatically be notified about the remark (without identifying the obliged entity that set the remark) and informed that the reported beneficial owners could not be verified and that the legal entity therefore has to examine its report. The remark is only removed if the legal entity then files a new report. However, the remark will still be visible in the historical data. Consequently, a remark will be visible in all excerpts from the BO Register. In addition the BO Registry Authority is monitoring the list of all remarks set in the register and may request documentation on beneficial ownership if a remark is not resolved by a correct report. Belgium In Belgium, a centralised beneficial ownership register (UBO Register) has been implemented for both legal entities and arrangements (LE/LA). It is developed, managed and controlled by the Treasury administration of the Federal Public Service Finance and is separate from the Commerce registry managed by the Federal Public Service Economy. The UBO register is an online and fully digitalised platform through which all LE/LA can submit and update their UBO information and that can directly be accessed by competent authorities, obliged entities and members of the general public. An additional condition of demonstrating a legitimate interestis applicable to access the UBO information of certain LA. For data-privacy protection reasons, the access to the platform is only authorised to persons (both nationals and non-nationals) that have a Belgian electronic identity card. The access is also extended to eIDAS (i.e. Regulation (EU) N°910/2014 on electronic identification and trust services for electronic transactions in the internal market) compliant jurisdictions. Considering the limited resources available and extent of the task, the Treasury cannot conduct systematic ex ante controls of the information registered by LE/LA. However, in order to ensure a high level of data quality, several control mechanisms have been embedded in the platform. They are intended to avoid mistakes during the registration process and facilitate the implementation of (targeted) controls of the data. These include:
 To avoid spelling mistakes or typos during the registration phase, a direct link has been made between the UBO register and both the commerce registry (for LE/LA) and the national identification registry (for natural persons);

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  47

 The connection with the commerce and national register enables the prefilling of all the information pertaining to the LE/LA and the natural person available in those registries. This prefilling must however be confirmed by the legal representative of the LE/LA, the purpose being to avoid extracting inaccurate, inadequate or outdated information. If the information is not correct, the LE/LA will have to modify it directly at the commerce or national registry. It has been observed that during the registration of their UBO, LE/LA realise that the information is not up to date in the Commerce registry and make the necessary changes in said registry; this mechanism thus also enhances the quality of the information available in the commerce registry;  This mechanism also enables the Treasury to implement the “only￾once” regulatory framework by allowing public authorities to request the communication of an information/document if it has already been provided to another public authority; the resulting process is therefore less costly and more efficient for LE/LA and public authorities;  Several business rules have also been set to avoid the registration of certain situations (e.g. ownership of more than 100% of the shares/voting rights, registration of a deceased person or a Belgian national that is not registered in the national register of natural persons, start of control before the incorporation of the company). China Under the current AML laws and regulations of China, all regulated institutions are required to establish and formulate proper CDD processes. The CDD process is embedded into various operational workflows of the organisation in order to improve the process effectiveness. The verification of corporate customers can be conducted through the National Enterprise Credit Information Publicity System established by the State Administration of Industry and Commerce, to verify the licenses, certification documents and the operation status of licenses in accordance with the law. The regulated institutions will not establish relationships or engage in business before CDD is completed. FIs should obtain information and materials related to legal person while conducting CDD to identify BO, which is very helpful for verifying the materials required in the CDD process. The regulated institutions would commonly make use of either the official public channels to enquire and verify customer information, as well as maintain on-going understanding of the customers’ background. The official public channels including Administration of Industrial and Commercial Registration Information System, National Enterprise Credit Information Publicity System, Unified Social Credit Code Inquiry of National

48  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Organization System, Commercial Entity Registration Information Platform, Commercial Entity Credit Information Publicity Platform, Tax Registration Inquiry System and so on. The "grey lists" and "black lists" on the National Enterprises Credit Information Publicity System (NECIPS) are not only the sanction lists, but also the red flags. Once FIs find legal persons listed in these lists, they will conduct enhanced CDD measures and require more materials in identifying BO, which will in turn ensure the accuracy of BO information in FIs. Denmark Cross-checking Denmark operates with an official online company registry called the Central Business Register (CVR). The CVR contains and publishes free of charge information on legal entities registered according to both company law and tax law. To secure data quality, several automatic control mechanisms have been incorporated in the Business Register. They are intended to avoid mistakes during the registration process and facilitate the implementation of targeted control. The CVR automatically checks information that is filed (which must be done electronically), and will cross￾check this information with various governmental registers, the CPR number - Civil registration number / CVR number - Unique identification number for legal entities and other details such as address (Danish Address Register - DAR) and dates. Furthermore, business rules are set up in the system to avoid impossible situations ex. registration of a deceased person, and as the Business Register entails information about legal entities, certain information about the entity is prefilled in order to ease the registration and to avoid mistakes. These automated checks are then followed by more detailed manual checks in suspicious cases. The system is also designed to use large datasets and with machine learning to better identify potential risks. Sample testing/checking To ensure that BO information in the CVR is accurate and current, the Danish Business Authority (DBA) starts to select and manually control 500 companies and their registration of BOs in 2019. The control is divided into two approaches: In the registration phase, and after the information is registered. In the registration phase, the BO information is in specific suspicious cases checked and verified by the DBA before the incorporation of the company is completed. If the BO information is not adequate when checked, the company will not be incorporated. If the BO information is checked in the following phase, the DBA has the legal basis to dissolve the company compulsorily. The possibility to enforce the winding up relates to both missing and inadequate

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  49

BO information and can also be used if the corporate or other legal entity does not hold BO information or the information held is inadequate. External parties engaged in verification of register information In 2020, entities within the CDD framework will be obliged to report to the DBA any discrepant BO information available in the CVR and the BO information available to them. In case of reported discrepancies, the relevant authority must take actions to resolve the discrepancies. It is possible for the DBA to make a note in the CVR about the reported discrepancy. France* In France, the verification of information is two-fold: firstly, the clerk verifies that the company has submitted all the necessary information. Secondly, the clerk verifies the declared information by mainly cross￾checking against information held by the Trade Register. As of April 2019, (Art. 561 46-3), the information contained in this register can be disclosed to : the legal entity itself, one of the 18 competent authorities, one of the entities subject to AML/CFT obligations or any person justifying a legitimate interest and authorised by the judge responsible for the surveillance of the BO register. *yet to undergo mutual evaluation as of September 2019 Hong Kong, China The Companies Registry (CR) has introduced a complaint form for reporting breaches of the Companies Ordinance (CO). Companies or members of public can use the form to report any breaches of the CO (including failure to keep a Significant Controllers Register) to the CR for investigation. The introduction of the complaint form greatly facilitates the public members to report any breaches of the Companies Ordinance to the CR in a timely manner. Among the 2 310 complaints received by CR between 2017 and 2019 (up to July), 40% of them were reported via the complaint forms.

50  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Ireland
Data interfaces have been established between the Companies Registration Office (CRO) and Revenue, as the two key data repositories of corporate information in Ireland. Such interfaces allow the authorities to conduct ongoing red-flag monitoring and some verification of the information held. For example, Ireland has assessed that higher ML/TF and tax evasion risks attach to entities which, although incorporated through CRO, fail to engage with Revenue. The interface between CRO and the Revenue combats risks associated with ‘non-engaged’ entities and enquiry letters are generated. The Netherlands* The automated information system TRACK of the Scrutiny, Integrity and Screening Agency (part of the Ministry of Justice and Security) continuously monitors the integrity of legal persons, including its directors and affiliated persons or legal persons. The system was introduced in January 2011. The Scrutiny, Integrity and Screening Agency performs risks analysis by automatically scanning several closed and public sources on a daily basis, to look for any relevant financial or criminal records of directors, and the (legal) persons in their immediate surroundings. Data includes the Company Registry, Citizens Registry of the municipalities and the Central Insolvency Registry, as well as other public sources. In addition, data is obtained from the tax authorities, the Judicial Information Service, and the National Police Services Agency. If the computer system reveals a heightened risk, either immediately upon registration or later on, during the life span of the legal person, this dedicated Agency will carry out a more in-depth analysis. If the analysis confirms that there is indeed a heightened risk, a risk alert will be sent to a group of recipients, including law enforcement and supervisory authorities such as the Public Prosecution Service, the Police, the Tax Intelligence and Investigation Service, the Dutch Central Bank, the Netherlands Authority for the Financial Markets and the Tax and Customs Administration. In 2018, 264 of such risk alerts were made, and another 50 in the first quarter of 2019. A risk analysis can also be performed upon request from these authorities. In 2018, 17 risk alerts were made following a request. The Scrutiny, Integrity and Screening Agency also provides ‘network maps’ for inter alia law enforcement and supervisory agencies. A network map plots the relevant relationships between a (legal) person of interest, and other persons or legal persons, including bankrupted or disincorporated legal persons. In 2018, the agency provided 947 network maps, and 217 in the first quarter of 2019. *yet to undergo mutual evaluation as of September 2019

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  51

The United Kingdom
Civil society using PSC information
In November 2016, Global Witness worked in collaboration with DataKind UK, OpenCorporates, Spend Network and OCCRP to bring together a team of 30 volunteer data scientists to analyse the information provided in the first batch of data from the person with significant control (PSC) register. The team worked on the first three months’ worth of data available (around
1.3 million companies out of 3.5 million). In a weekend, the team were able
to provide a number of insights which illustrate the value and potential use of public PSC information:
 The team were able to build a map of complex corporate structures. As an example, they partially mapped the ownership structures of Reckitt Benckiser, the healthcare company. The PSC data enabled them to develop an understanding of complex ownership structures and while they did not identify any wrongdoing, it shows how the information can be used to increase transparency.  The team were able to identify 9 800 companies that listed their beneficial owner as a foreign company. This is allowed if the foreign company was listed on one of the stock exchanges deemed equivalent to the UK system (e.g. the US, EU and Japanese exchanges). Global Witness informed Companies House that there were over 4 000 companies who appeared to have filed details of a relevant legal entity (RLE) who may not be registrable; as they were based in jurisdictions such as Costa Rica, Panama and the Isle of Man. Companies House have taken action by writing to these companies. Upon receipt of the information, approximately 70% of the companies had already corrected their PSC information on the Companies House register. While Companies House would have identified many of these errors, by having publicly accessible information, it has accelerated the identification of these issues. Sweden Flagging suspected incorrect information in the beneficial ownership register The Swedish system for information on beneficial ownership is based on a combination of the Company Approach and the Registry Approach. A report to the registry is made by a representative of the legal person and signed electronically. The register of beneficial ownership is publicly accessible. In case the quality of an entry in the register is insufficient, relevant FIs, DNFBPs or state authorities are obliged to report this to the registry authority. The registry authority will then evaluate if the registered information is incorrect based on the report. If so, an official notice will be given to the

52  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

legal person either to submit a correction or to submit additional information that supports the registered information as correct. If that is not done, another official notice will be sent with an administrative fee. This has proven to be an effective measure during the relatively short period of time the Swedish register has been in effect. Most legal persons who receive the first official notice file a correction within the required timeframe. Apart from keeping the registered information in the register correct through official notices, the registry authority may flag up registered information connected a the legal person with a warning triangle and an explicatory text that the registry authority has reason to presume that the information is incorrect. This flag is shown to anyone looking at the legal person in the registry and remains until a report with correct information has been registered. The flag functions as a warning for FIs, DNFBPs or any other party dealing with the legal person. This is an indication in a CDD situation that caution is needed and that clarifications should be requested before initiating or continuing a business relationship. Enhanced measures for companies with foreign ownership/directorship (relevant to core issue 5.3 and 5.4)
91. It is understood that foreign ownership/directorship is a main concern on
tracing beneficial ownership of legal persons.
92. In some countries, foreign individuals/legal persons who wish to carry out
business or acquire ownership of local companies must obtain another licence from a designated competent authority. As part of the application process, the individual/legal person is required to provide a comprehensive set of information, including on the financial standing of the foreign individual/legal person, the ownership and control structure of the foreign legal person, and copies of founding documents and agreements regulating the powers to bind the legal person. Certified documents by obliged party have to be provided. The obliged party is required to undertake enhanced CDD and undertake a comprehensive screening and verification of each applicant’s financial background, ownership and control structure, previous commercial activity, etc. In some countries, where a shareholder/director is not a local citizen, the registry authority requires the applicant to provide a certified copy of the passport for individuals and a certified certificate of incorporation for legal persons. Some countries rely on the certification by an obliged party, or by an official local representative in the foreign country where the passport or certificate was issued to conduct verification to this group of foreign shareholders/ directors. Austria As part of the risk based approach of the BO Registry Authority, legal entities, which report beneficial owners with foreign citizenship or place of residence, or ultimate legal entities with a registered address in a foreign

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  53

country will receive a certain number of risk points based on the ISO Code of the foreign country. Thus those legal entities will be more likely be in the risk category high or very high, resulting in a greater chance that the BO Registry Authority will request documentation on beneficial ownership and will carry out an off-site analyses of beneficial ownership. Belgium The electronic identification system (“eID”) in Belgium implemented since 2002 greatly facilitates the identification process of foreign citizens that had a prior contact with an administrative authority in Belgium. If a foreign citizen has been in contact with an authority in Belgium for any reason, e.g. for VAT or other fiscal purpose, traffic offence, employment, they will be assigned a unique eID number that will be registered in the national register for natural persons. This eID will be used to identify them in the UBO register and verified by an authority. In the medium term, the EU eIDAS (electronic IDentification, Authentication and trust Services) Regulation aims to ensure that people and businesses can use their own national eID schemes to access public services in other EU countries where eID is available. For non-EU citizens that do not have any (compatible) EU eID, several solutions are being investigated besides the request for substantiating documents upon registration (e.g. simplified remote authentication method). Denmark Under the beneficial ownership legislation, corporate and other legal entities are obliged to register BO information in the Central Business Register. This applies whether it is a foreign or national beneficial owner. If a beneficial owner is a foreign citizen, further registration information is necessary e.g. copy of passport, national identification number etc. Hong Kong, China Under Part 16 of the Companies Ordinance (CO), a non-Hong Kong company that has established a place of business in HKC is required to register under the CO. Corporate documents of the non-Hong Kong company such as constitution, certificate of incorporation and latest accounts have to be delivered together with the application of registration. Such corporate documents have to be certified in accordance with s.775 of the CO. For example, they should be certified by a notary public, lawyer, professional accountant, professional company secretary, etc.

54  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Jersey
Foreign owned are subject to enhanced requirements reflecting their higher risk All Jersey companies that are foreign owned are subject to enhanced requirements reflecting their higher risk. The beneficial owners and controllers of companies, which will be owned by local residents, are subject to identity checks by the Companies Registry on incorporation and when new beneficial owners and controllers become connected with the company. In addition to those checks, all companies incorporated at the behest of a foreign owner must engage the administration services of a locally regulated TCSP which is subject to AML/CFT regulation. The TCSP will hold the certified copy and conduct risk-based due diligence. The Taxation (Companies – Economic Substance) (Jersey) Law 2019 strengthens the requirement for Jersey companies to demonstrate real economic substance in the Island and the overall level of responsibility that Jersey-resident directors shall take in relation to foreign-owned companies that they direct and administer. The Netherlands* There is a general obligation for all foreign incorporated companies with an office in the Netherlands, or who provide employment in the Netherlands, to register basic company information in the company register of the Dutch Chamber of Commerce. FIs and DNFBPs are obliged to perform enhanced CDD if the country of residence of the customer is declared a high-risk country by the European Commission. *yet to undergo mutual evaluation as of September 2019 Switzerland Enhanced measures for the identification of beneficial owners of non￾operational legal entities (domiciliary companies) The risk of the abuse of legal persons is taken into account in preventive due diligence measures applicable by the financial intermediaries. The complexity of the structures involved in the business relationship, particularly the use of domiciliary companies, whether Swiss or foreign, is one of the criteria of higher risk according to Art. 13(2)(h)of the FINMA

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  55

Anti-Money Laundering Ordinance (OBA-FINMA). Art. 2a OBA-FINMA defines domiciliary companies as entities such as legal entities, trusts or foundations, that do not have any operational activity. They do not carry out any commercial or manufacturing activity or any other activity as a commercial enterprise. Financial intermediaries adopt a very prudent approach with such types of entities and do not enter into business relations when a natural person cannot be identified as the actual beneficial owner of the company. A written declaration will be required from the domiciliary concerning its beneficial owners. (Art. 4 para. 2 of the Federal Act on Combating Money Laundering Act and Terrorist Financing). The threshold of 25% of the capital or voting rights in the legal entity does not apply to such type of entities. This means that all beneficial owners must be identified, regardless of the amount of their participation in the company. Highly effective law enforcement authorities with adequate resources (relevant to core issue 5.4)
93. In some countries, the AML supervisors/law enforcement authorities (LEAs)
prioritise ML/TF and financial investigations, and routinely and proactively pursues ML/TF investigations. Investigative tools and information-sharing gateways are robust, and resources are applied flexibly both within and across enforcement agencies to respond to investigative needs.
94. Where prosecution is not possible, LEAs actively use a wide array of other
alternative measures to disrupt offenders, including pursuing the predicate offence, seeking civil recovery, taking action for tax offences, or obtaining serious crime prevention orders to restrict behaviour. The efforts are supported by adequate human and capital resources. The Netherlands* Dutch law enforcement agencies work closely and share information with each other, as well as with other agencies such as the Tax and Customs Administration. The national police and the Tax Intelligence and Investigation Service (in Dutch: Fiscale Inlichtingen en Opsporingsdienst or FIOD), which both work under the authority of the Public Prosecution Service investigate suspected ML/TF criminal activity and carry out extensive law enforcement measures. These authorities also work together in the Dutch Financial Expertise Centre (FEC), which is a partnership among authorities that carry out supervisory, prosecution or investigation activities in the financial sector. Partners of the FEC are: Dutch Central Bank DNB, AFM Netherlands Authority for the Financial Markets, FIU￾Netherlands, Tax and Customs Administration, Tax Intelligence and Investigation Service (FIOD), National Police and the Public Prosecution Service. The Ministry of Finance and the Ministry of Justice and Security act as observers. The FEC also plays an important role in providing and

56  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

disseminating information. The various criminal law enforcement agencies, FIU-Netherlands and the Public Prosecution Service also work together in the Anti Money Laundering Centre. *yet to undergo mutual evaluation as of September 2019 The United Kingdom The UK competent authorities manage to use Companies House records to identify those individuals acting as company officers, and undertake further enquiries to test the credibility of their appointments and of the company, through the examination of company records, tax returns, and both corporate and individual financial activity. Sometimes, these enquiries showed that the company officers were simply acting as the agent of the defendant, and knew nothing about the operation of each company. These companies were used as a device to hide the beneficial ownership of the assets. Using technology to facilitate checking and validation (relevant to core issue 5.3 and 5.4)
95. In some countries, basic checks are conducted by the IT system in the company
registry upon registration. They include an automated calculation of shares and of the capital as well as an automated validation of information such as the tax identification number entered, digital signature–and therefore the identify–of the applicant, and of the payment of the mandatory fees and taxes.
96. Some systems will perform automated checks when there is new information
entered into the system (for example to ensure that shares are only transferred by persons who are already in the system). Any anomaly highlighted by these automated checks is analysed by the register staff before the publication is authorised.
97. In some countries, data mining technology is used to cross-check the
information available and report suspicious activities to the various authorities. False information can be easily detected and the system can help highlight any inconsistency. Some countries even appoint a dedicated data miner to monitor cross￾checking systems among different databases in order to ensure compliance of requirements on beneficial ownership.
98. For countries that adopted a national standardised electronic identification
system, such electronic ID (for all directors and authorised signatories) is one of the required information to register companies in the company registry. Competent authorities can also make use of trustworthy electronic identification system to gather information.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  57

Austria
The BO Register integrates existing information from other registers, such as the Central Register of Residents related to information on the beneficial owner or the other national registers containing information about legal entities concerning the reporting of ultimate beneficial ownership of legal entities. Through an automated alignment with other registers, it is ensured that beneficial owners and legal entities can only be reported if their data is also contained in other public registers. If, for example, a person with a main residence address in Austria is entered as a beneficial owner, there is a real time check with the Central Residence Register in the background if the entered person has a valid main residence in Austria. Another key factor is the reporting form for reporting beneficial ownership itself. The reporting form provides a digital guidance throughout the reporting process and makes reporting for both legal entities and their legal professionals as easy as possible. The reporting form itself is dynamic and tailor made to the specific legal form for which the report is made. Incorrect reports can be prevented largely by built-in conditions and error indications. Denmark Information on any natural person registered in the Central Business Register (CVR) is updated automatically for all Danish persons from the Danish CPR-register. The DBA’s IT-system (CVR) also automatically checks the business address in the Danish Address Register (DAR) to make sure that the address exists. When a new business is registered or changes are made to a governing body, the DBA’s IT-system (CVR) will automatically notify the affected person(s) to make sure that the changes are correct. The digital self-registration systems have been designed with several built￾in minimum requirements that must be met for completion of the registration. These include that certain types of document must be enclosed with the individual type of registration case, as well as requirements for the information that must be disclosed to the DBA. The IT-system (CVR) is under an ongoing development and most recent developments is using machine learning to check enclosed documents signatures and read if certain documents entail demanded text and conclusions. The DBA can perform checks to verify the registrations. In these cases, DBA can ask for documentation for the registrations. If the company cannot provide this, or the incorrect registrations are not rectified, DBA can enforce a forced winding up. With the modernisation of IT systems for company registrations, the DBA has enhanced its enforcement activities to prevent misuse and to check

58  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

registrations, including 1) activities that take place automatically in connection with a registration in the DBA’s systems, and 2) the manual follow-up activities that the DBA conducts up to three years after the registration. Italy The MOLECOLA platform* used by the Guardia di Finanza (GdF, the financial police), facilitates the identification of the real beneficial owner of legal persons incorporated in Italy by processing the information maintained in various sources (Business Register, law enforcement databases, tax administration database, land register, lists of designated persons under the United Nationals Security Council Resolutions (UNSCRs), and other open sources). As established in the cases provided, this has enabled the GdF to successfully identify the ultimate beneficial owner in a number of instances, including in cases involving complex, transnational corporate structures. The MOLECOLA platform has proven useful notably by considerably reducing the length of time needed to conduct cross￾checks. MOLECOLA: This tool is used in financial investigations with software integrated within GdF and National Anti-mafia Directorate (Direzione Nazionale Antimafia). MOLECOLA imports electronically bulk information from different databases (e.g., the various law enforcement databases, tax administration database, land register, company register and information from other open sources). The information is analysed according to the operational activities investigated, allowing to elaborate standardised reports suitable for investigations and also operational analysis reports detecting links between people and financial operations, and the disproportion between incomes and expenses of the persons that are under investigation. The Netherlands The company register of the Dutch Chamber of Commerce performs automatic checks of specific information upon registration. For example, information on the identity of natural persons is checked against the citizens register (in Dutch: BRP or Basis register personen) automatically, amongst which the name, date of birth and the Dutch Citizen Service Number (Burgerservicenummer or BSN). *yet to undergo mutual evaluation as of September 2019

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  59

Access by competent authorities (relevant to core issue 5.4)
99. Competent authorities (including LEAs) may have direct access to the
beneficial ownership information held by company registry, database held by other competent authorities and information held in FIs and DNFBPs (e.g. notaries’ database). According to the 2018 FATF-Egmont report, FIUs should have access to the widest possible range of financial information. Consideration of possible measures to increase the breadth and depth of information available to FIUs is merited.
100. In some countries, competent authorities have direct access to the beneficial
ownership information through the company registries and the centralised database kept by notary profession, which ensures the timeliness of the access to information on beneficial ownership. The private sector discloses information to the competent authorities in due time and within the time limits set by the requesting authority. Whenever necessary, the information is collected directly from and/or verified directly with the companies. Competent authorities (especially LEAs) can also compel the provision of beneficial ownership information through available investigative measures such as production or disclosure orders. Production orders can be obtained relatively quickly through an electronic filing and granting system. Moreover, access has been authorised by the data protection agency so that there is no impediment to competent authorities in obtaining information on beneficial ownership. Belgium In Belgium, the Ultimate Beneficial Owner register (UBO register) is accessible by competent authorities. The Security officer or Data Privacy Officer of each competent authority will be granted the right to manage the access to the platform for the employees of said competent authorities. This Security or Data Protection Officer is tasked to authorise any agent of the competent authority to consult the UBO register in accordance with the law. Such a system enables the Treasury to:
 Enable competent authorities to have access to the past and present UBO information instantly;  Offer flexibility to competent authorities in the internal organisation of the accesses. They will be able to tailor the access to their needs and specificities. Subsequently, certain entities limit the access to the UBO register to certain categories of agents or employees (e.g. head of departments, specially designated investigators…);  Assign clear responsibilities. The responsibility to consult the UBO register in accordance with the AML/CFT and UBO regulation lays on the competent authority and its agents; This system also enables the Treasury to keep track of the logs of each user, for data privacy concerns and in order to enable an audit to be conducted on the use of the information.

60  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Germany*
In Germany, access to the Transparency Register is possible through a central platform. The access is available depending on the type of the applicant. There are three possible types of applicants.  Competent authorities are granted access for fulfilling their legal requirements. They have, as far as it is necessary in fulfilling their statutory tasks, full access to the database of the Transparency Register.  Obliged entities are granted access to the register if they inspect the entries in the Transparency Register while acting in the exercise of their professional activities to fulfil due diligences. Obliged entities are for example credit institutions, financial companies, auditors, chartered accountants or tax advisors.  Any natural or legal person, domestic or foreign, that can demonstrate a legitimate interest can access the information available. The decision is made on a case-by-case basis. yet to undergo mutual evaluation as of September 2019 France According to article L. 561-46 of the CMF, 18 of competent authorities shall have access to the beneficial ownership register among which :
 Judicial authorities;
 The national Financial Intelligence Unit (FIU);  The custom administration officials;  The public finances officials in charge of control and recovery in fiscal matters. The French FIU has a direct access to the electronic beneficial ownership register. When orientating the information or when further investigating, FIU officials are able to check instantly all the information transmitted by the company to the “greffier de commerce” (commercial court’s clerk) when registering as mentioned above. The aforementioned provisions differ from those of Section 3 of the Monetary and Financial Code on customer due diligences which provide that obliged entities shall identify the beneficial owner before entering in a business relationship or before performing a transaction. After applying those due diligences on beneficial ownership, if they suspect or know that the operation which is about to be performed is linked with ML or FT, they must transmit the information to the FIU. Therefore, the French FIU has two different sources of information on beneficial ownership at its disposal and is able to cross-check it. *yet to undergo mutual evaluation as of September 2019

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  61

Hong Kong, China
On demand by a law enforcement officer for the purpose of performance of functions relating to the prevention, detection or investigation of money laundering or terrorist financing, a company must at any reasonable time make its Significant Controllers Register (SCR) available for inspection by the officer at the place at which the SCR is kept and permit the officer to make copies (s.653X of the Companies Ordinance (CO)). If the company fails to comply with the requirements of s.653X, the law enforcement officer can apply to the Court for a court order to direct the company to permit the inspection or making copies of the SCR (ss.653Y and 653Z of the CO). Jersey Jersey’s FIU, the Joint Financial Crimes Unit of the States of Jersey Police (JFCU), has direct access to the register of beneficial ownership and control through a dedicated portal in the JFCU’s headquarters. Searches can be made for entities based on entity registration number, name and/or country of incorporation. Searches can also be made for natural persons based on first name, surname, alias, date of birth and/or nationality. The JFCU also acts as the designated contact point for exchanging beneficial owner and controller information with foreign law enforcement agencies. Since 1 July 2017, an agreement between Jersey and the United Kingdom has been in place to enhance the speed of information exchange between the jurisdictions (the ‘Exchange of Notes’). The Exchange of Notes agreement provides for the exchange of adequate, accurate and current beneficial ownership information between Jersey and the UK within 24 hours on a normal request, or within 1 hour, where the request is urgent (due to TF concerns, for example). Switzerland In Switzerland, legal entities (public companies, private limited liability companies and cooperative companies) must be represented by individuals (directors or managers) domiciled in Switzerland. The presence of a representative of the company in Switzerland facilitates the cooperation with the competent authorities and timely access by authorities to beneficial ownership information, especially in case the information spans several jurisdictions.

62  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

The United Kingdom
UK authorities are able to access basic and BO information on legal persons and arrangements via one of three sources: from financial institutions and DNFBPs, from registers, or from the legal entity itself. The variety of sources increases transparency and access to information, and helps mitigate accuracy problems with particular sources. There are several channels available for LEAs to obtain information on legal entities from FIs and DNFBPs. At the intelligence-gathering stage, LEAs can request information through Joint Money Laundering Intelligence Task Force (JMLIT) provided the request is justified, proportionate and necessary. LEAs can also compel the provision of BO information through available investigative measures such as production or disclosure orders. These orders require judicial authorisation, which can be obtained in a matter of hours for urgent cases. Production orders can be obtained relatively quickly through an electronic filing and granting system. Once issued, the orders typically receive a response within seven days, although immediate disclosure can also be sought. Both production and disclosure orders require suspicion of an indictable offence so are used at the investigative stage once sufficient evidence has been collected to meet this threshold. The Serious Fraud Office (SFO) has access to additional investigative powers to compel the provision of information believed to be relevant to an investigation or inquiry within a timeframe set by the SFO (typically no longer than 14 days). Forbidding or immobilising bearer shares and nominee arrangements (relevant to core issue 5.3)
101. The Interpretive Note to R.24 requires countries to take measures to prevent
the misuse of bearer shares and bearer share warrants, as well as the misuse of nominee shares and nominee directors. Measures include prohibiting, dematerialising, immobilising and disclosing them. According to the 2018 FATF￾Egmont report, given the vulnerabilities associated with use of nominees, individual countries and the FATF, working with the broader global community may wish to consider measures to limit their misuse.
102. In some countries, shares may be issued in bearer form in limited
circumstances, and must be dematerialised. They must be deposited with a central depository and the exercise of the rights that they confer may only be performed through a reporting entity. The central deposit opens an account for each intermediary to record the movements of the financial instruments deposited into that account. In some countries, the holder of bearer shares is obliged to declare purchase or transfer of shares within a specified timeframe, and done through an obliged entity.
103. In some countries, shareholders may be represented by third parties, but the
latter may only intervene on their behalf on the basis of a duly signed power of

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  63

attorney, which ensures the transparency of the operation. Companies must maintain a copy of the power of lawyer when the non-shareholder third party exercises the rights carried by the shares in the company’s general assembly. The same applies to notaries (and, where relevant, accountants), in the case of a transfer of the shares performed by the third party on behalf of the shareholder, and the normal CDD requirements apply.
104. In most of the cases, although bearer shares and bearer shares warrants are
not explicitly prohibited, there is no real incentive because of the lack of legal protection offered. The same applies to the nominee arrangement. Demark Corporate and legal entities are required to identify those individuals exercising their rights through a nominee scheme and hold information about this. A person may not exercise the rights conferred to an owner of capital unless he/she is registered in the registry of owners or has notified and documented the acquisition. In 2015, Denmark abolished the possibility to issue bearer shares and established an obligation for holders of bearer shares below 5% to register those shares with the Danish Business Authority. France* Since April 2016, bearer shares are necessarily nominatives: from subscription, the bearer designates a beneficiary by its name (this latter being himself most of the time) without any possibility of further modification. This beneficiary can ask for the reimbursement of the share if he is in its possession. *yet to undergo mutual evaluation as of September 2019 Hong Kong, China Since March 2014, Hong Kong, China (HKC) has prohibited the issue of bearer share warrants.
Section 6, Division 2, Schedule 5A of the Companies Ordinance (CO) states
that a share held by a nominee for another person is regarded as being held by “that other person”. If the nominee holds more than 25% of the issued shares of the company, “that other person” should be identified by the company and be entered into the Significant Controllers Register. Moreover, anyone who by way of business acts or arranges for another person to act as a shareholder or a director of a company for another person would be considered to be providing trust or company service under Anti￾Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and is required to obtain a license from the CR to do so. Since March 2018,

64  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

licensees are subject to statutory customer due diligence and record￾keeping requirements under AMLO. HKC applies director duties to “shadow directors”. Under the interpretation of the Companies Ordinance (Cap. 622 of the Laws of Hong Kong), “director” includes any person occupying the position of director (by whatever name called). Under section 3 of the CO, the “responsible person” in the context of a contravention of the Ordinance, or of a requirement, direction, condition or order, includes an officer or shadow director who authorises or permits, or participates in, the contravention or failure. The Netherlands* The Netherlands prohibits companies from issuing bearer shares, and requires holders of bearer shares to change them to regular registered shares at the issuing company, or to deposit and register their shares at a central institution (Euroclear) or an intermediary such as a bank or investment firm. Companies are obliged to alter their articles of association, insofar necessary, to allow bearer shares to be changed to registered shares. Any bearer shares not deposited or registered before 1 January 2020 are deemed to be registered shares. After this date, holders of (former) bearer shares that have not presented them to the company, nor deposited them at the central institution or an intermediary, cannot exercise their rights under those shares, such as voting rights and rights to dividend. All (former) bearer shares have to be presented at the issuing company or deposited at the central institution or intermediary before 31 December 2020. After the deadline, the issuing company will become the owner of these unregistered (former) bearer shares. Holders of (former) bearer shares then have a final chance to receive their registered shares by presenting their former bearer shares to the issuing company before 1 January 2026. *yet to undergo mutual evaluation as of September 2019 Switzerland In Switzerland, there are mechanisms for identifying the holders of bearer shares, along with obligations on purchasers of such shares to declare their identity to the company either themselves or through a financial intermediary, and on the company to keep a list of the holders of these shares. Furthermore, the conversion of these shares into registered shares is facilitated: according to Art. 704a of the Code of Obligations, the shareholders’ meeting may decide by a majority of the votes, to convert bearer shares in-to registered shares. The decision to convert must be taken by a simple majority, since it is prohibited to set a higher quorum in the Articles of Association.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  65

Effective, proportionate and dissuasive sanctions (relevant to core issue 5.6)
105. Effective, proportionate and dissuasive sanctions may range from
administrative sanctions and prosecution action against corporate entities that fail to comply with information filings. These include rejection of registration or business relationships, de-registration and abortion of business relationships, fines and penalties or criminal sanctions, measures taken by the courts to dissolve legal entities involved in ML schemes, or seize their assets.
106. In some countries, company registry, notaries and others obliged parties do
not proceed with the requested activity in the absence of all the requested information. Entities that fail to provide information on beneficial ownership is not possible to register as a company or establish a business relationship with FIs or DNFBPs. Companies that fail to complete the required annual filings of information are ultimately liable to be struck off the company register. A change in legal status will not take effect if it is not recorded with and verified by the company registry/obliged entity. This significantly limits the ability of companies to obtain credit, change the company name or purpose, and register mergers. In some cases, the company registry can also deny the controlling shareholder and any director who has not paid a fine from registering new companies.
107. In some countries, disclosure of false information to notaries constitutes a
criminal offence. In some cases, the courts are even empowered to dissolve legal entities involved in ML schemes, and or seize their assets. This forms a strong deterrent to the misuse of legal persons. Austria Under the Beneficial Owners Register Act (BORA), it will be penalised to violate the reporting obligation either by an incorrect or incomplete report or by a failure to submit a report with up to € 200 000 for intentional acts or up to € 100 000 for gross negligence (Art. 15 para. 1 BORA). This includes in particular the following cases: Inaccurate report of beneficial owners, unclear information leading to inability to identify beneficial owner, annual reporting obligation has not been fulfilled, report was not made within the statutory time periods; cases in which the legal entities are exempt from the reporting obligation, but have not reported another natural person as the beneficial owner through control (the additional beneficial owners are beneficial owners through a Treuhand or other control relationships) have not been reported to the BO Register; cases of not reporting changes of beneficial owners within four weeks of obtaining knowledge of the changes. In case of a persistent failure to report, coercive penalties will be imposed twice according to Art. 16 BORA. In addition, it will be sanctioned with up to € 75 000 for intentional acts or up to € 25 000 for gross negligence, if the legal entity has breached its obligation to retain copies of the documents and information required for their due diligence obligations based on the BORA.

66  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Cases, where the correct information about beneficial owners has been reported, but in the course of the voluntary submission of a Compliance￾Package false or falsified documents are transmitted to the BO Register, will be punished with up to € 75 000. Cases, in which beneficial owners have been disclosed but individual details of beneficial owners are incorrect or missing or in which no copies of an official photo ID are submitted with the report, will be punished with up to € 25 000. Cases, where the legal entity seemed to intend to provide a correct report but in which individual documents with the submission of the voluntary submission of a Compliance-Package were not transmitted or cases, where other obligations in relation to the submission of a Compliance-Package, that are not already covered by an individual sanction, will be punished with up to € 10 000. Compliance with the obligation to report is ensured on an ongoing basis through the implementation of automated coercive penalties. If a report is not filed within the deadline – either within the initial reporting period or within 28 days of newly established legal entities – then the competent tax office will automatically send a reminder letter with the threat of a coercive penalty of € 1 000 to the legal entity. If the legal entity fails to report within the deadline given in the reminder, the penalty will be set and a higher penalty of € 4 à00 is threatened. If the legal entity still fails to report within the given deadline, the coercive penalty of € 4 000 will be set and the case will be forwarded to the responsible fiscal penal authority. With this automated system, the BO Registry Authority was able to achieve an overall reporting rate of more than 93% as of July 2019. Belgium In Belgium, penalty (€ 4K-40K) and administrative fines (€ 250-50K) are available in case of non-compliance by legal entities and arrangements (LE/LA) with their obligation to hold information on their ultimate beneficial ownership (UBO) and register it. The Treasury has identified additional mechanisms that could be implemented in the medium/long term. These include:
 Procedures for “automatic” administrative fines;  Consider declarations as non-valid if no substantiating documents are provided;  Loss/suspension of the rights associated with shares or suspension of the payment of dividends;  Duty for UBOs to notify their status to LE/LA;  Duty to notify when an intermediate LE/LA or a legal person refuses to provide UBO information  Publication of a black list of non-compliant LE/LA;  System of flags based on, among others, notifications received.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  67

Denmark
The Danish Business Authority (DBA) can demand the documentation that prove the validity of the information registered within 3 years after a registration has taken place. If the documentation or the circumstances under which the registration has taken place is not sufficient, the DBA can file a report to the police or impose a daily/weekly fine to the company until the registration is complete. Registering BO information is a pre-requisite to get a CVR-number for most types of legal persons. It is also possible to enforce a winding up of the existing entities if there is no or inadequate beneficial ownership information registered / inadequate recordkeeping. If a company does not register the BO information or provide it to the authorities, the company and their management have committed a criminal offence. If the company has an auditor (which most have), the auditor is legally obliged (according to the Danish audit regulation) to check if the management has fulfilled its obligations in the company law. If not, the auditor must make a note in the annual report about the offence of the company law. This way non￾compliance of BO-registration will be visible in the annual report to the company stakeholders. Compulsory dissolution is also possible if a corporate or other legal entity has not registered BO information or the registered information or recordkeeping is inadequate. It is possible to strike off Partnerships (I/S) and Limited Partnerships (K/S) (that are required to register accordingly to the Certain Commercial Undertakings Act) from the CVR register due to inadequate beneficial ownership information or recordkeeping or if no beneficial owners are registered. By November 2018, the DBA had compulsorily dissolved around 7500 companies that had failed to register their BO information in due course. As of January 2019, approximately 96 % of all entities covered by the BO legislation had registered BO information. And 99.80 % of the entities covered by the company laws under the DBAs area of responsibility had registered BO information.

68  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

France*
France introduced dissuasive sanctions in the event of failure to declare a beneficial ownership document containing inaccurate or incomplete information (article L. 561-49 of the Code monétaire et financier (CMF)). In order to reinforce the effectiveness of the system, injunctions and penalties can also be imposed:
 - Art. L. 561-48 of the CMF allows the president of the court, spontaneously or at the request of the public prosecutor or any interested person, to order a company to proceed to the deposit of documents on beneficial owner, if necessary under penalty payments. The president may also appoint someone else to perform these formalities;  -Art. L. 561-49 of the CMF punishes with imprisonment of 6 months and a fine of 7,500 euros the fact of not filing the document relating to the beneficial or filing a document containing inaccurate or incomplete information. Additional penalties prohibiting management and partial deprivation of civil and civic rights may also be imposed. The maximum amount of the financial penalty is multiplied by five in the case where the author of the breach is a legal person. *yet to undergo mutual evaluation as of September 2019 Hong Kong, China Hong Kong, China (HKC) has various provisions in the Companies Ordinance (Cap. 622 of the Laws of Hong Kong) for sanctions against companies that fail to comply with information filings, below are some examples:
Section 662 of the Companies Ordinance provides that if a company fails to
deliver to the Registrar of Companies for registration an annual return within the specified time, the company, and every responsible person of the company, commit an offence, and each is liable to a fine at level 5 (i.e. HK$ 50 000) and, in the case of a continuing offence, to a further fine of $ 1000 for each day during which the offence continues. HKC will strike companies off the Companies Register if they fail to file annual returns for consecutive years, as this is a cause to believe that the companies are not in operation or carrying on business.
Section 653H of the Companies Ordinance provides that if a company fails
to keep a register of its significant controllers, the company, and every responsible person of the company, commit an offence, and each is liable to a fine at level 4 (i.e. HK$ 25 000) and, in the case of a continuing offence, to a further fine of HK$ 700 for each day during which the offence continues.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  69

Under section 895 of the Companies Ordinance, a person commits an offence if, in any return, report, financial statements, certificate or other document, required by or for the purposes of any provision of the Companies Ordinance, the person knowingly or recklessly makes a statement that is misleading, false or deceptive in any material particular. The person is liable on conviction to a fine and imprisonment. Spain Corporate criminal liability was introduced in Spain. With the ease of access to basic and beneficial ownership information, the strong preventive measures imposed on FIs and DNFBPs, (including notaries and company registrars, which are obliged entities under the AML/CFT law), and the measures taken by the courts to dissolve legal entities involved in ML schemes, and or seize their assets should, over time, act as strong deterrents to the misuse of Spanish legal persons.

70  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Section VI – Getting information on beneficial ownership of overseas
entities
108. For entities registered abroad, the information sources on beneficial
ownership mainly used by competent authorities are the public companies/business register available in the country and information collected by FIs/DNFBPs of the country in question, information disclosed following requests made to foreign authorities, and information from foreign tax authorities. The exchange of information with a foreign counterpart is a critical component of measures pursuant to an international ML/TF investigation.
109. According to the 2018 FATF-Egmont report, increased sharing of relevant
information and transaction records would benefit global efforts to improve the transparency of beneficial ownership. Further consideration of possible ways to enhance this information sharing is merited.
110. There is a good practice that basic information relating to legal persons is
available online and in several languages, which can enable foreign authorities to continue their investigations without necessarily having to wait for a reply from the authorities. Nevertheless, it is also understood that countries have encountered difficulties in getting information on beneficial ownership that is not publicly available.
111. The effectiveness of getting beneficial ownership information of foreign legal
persons is generally more reliant on foreign countries’ active co-operation, with varying degrees of timeliness and success. Despite FATF general requirement on international co-operation and the specific requirements to provide co-operation on identifying the beneficial ownership of corporate vehicles under R.24, some countries do not effectively facilitate requests from their foreign counterparts by providing information held by domestic authorities and companies.
112. Imposing restriction on activities of foreign legal persons may affect a
country’s direct foreign investment. Balancing the need of obtaining information on beneficial ownership of foreign legal persons and ensuring legitimate business operation of foreign legal persons, countries can consider adopting the following approaches with an aim to achieving the objectives of R.24 and IO.5 based on the risk level of legal persons registered aboard identified from the risk assessment. a) No specific prior requirements - Not applying specific ex-ante requirements on legal persons registered abroad, but only seeking mutual legal assistance when there is a problem. b) Rating jurisdictions’ level of co-operation - Rating jurisdictions based on the availability and extent of their co-operation. Impose defensive measures such as restriction of certain business activities accordingly. c) Requiring re-registration with a local beneficial ownership. d) Requiring re-approval by domestic national authorities based on detailed investigation of the relevant legal entities.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  71

72  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Section VII - Conclusion
113. Many countries have made progressive efforts in putting in place a more
robust legal framework in preventing legal persons from being misused since 2012. With the flexibility provided by the FATF in implementing R.24 and achieving IO.5, it is also seen that countries are exploring different measures to ensure the transparency of beneficial ownership. With the sharing of best practices among countries, it is expected that countries will continue to improve their system particularly in relation to the requirements to ensure that adequate, accurate and up￾to-date basic and beneficial ownership information is available to the authorities in a timely manner.
114. Under a multi-pronged approach, it is vital that there is effective monitoring
of key gatekeepers (including company formation agents, lawyers, and trust-and￾company-service providers) for compliance with their CDD obligations, and enforcing those requirements – including identifying and shutting down those who facilitate misuse of corporate structures.
115. More importantly, it is also expected that countries will take action to facilitate
the timely sharing of basic and beneficial ownership information at the domestic and international level to address barriers to information-sharing (e.g. reviewing data protection and privacy laws). The FATF will continue to intensively monitor the steps taken by countries to meet the FATF Standards on legal and beneficial ownership and ensuring they are properly enforced.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  73

ANNEX 1: Detailed Arrangement of Mechanisms under R.24

1. Under R.24, countries should use one or more of mechanisms (the Registry
   Approach, the Company Approach and the Existing Information Approach) to ensure that information on the beneficial ownership of a company is obtained by that company and available at a specified location in their country; or can be otherwise determined in a timely manner by a competent authority25 .
2. Countries’ experience shown in the FATF mutual evaluations points out that
   more than one approach may be needed in order to ensure a complete and effective system. Based on countries’ experience and good practices, this Annex aims to set out the arrangements of the mechanisms (Registry Approach, Company Approach and Existing Information Approach) which vary in different aspects, including collection and verification of information on beneficial ownership, modalities of storage and access to information on beneficial ownership, and supervision and enforcement of the relevant obligations. Registry Approach Collection and verification of information on beneficial ownership
3. All companies created in a country are registered in the company registry. The
   registry records and maintains basic information of a company, including company name, proof of incorporation, legal form and status, address of the registered office, basic regulating powers and list of directors. Registries are also required to hold information on beneficial ownership or a separate register of beneficial owners might be set up. This register may include beneficial owner data as well as company information. Excerpts from the register may be used for CDD considering the risk￾based approach.
4. The basic information held by registries are made publicly available and the
   availability of information on beneficial ownership varies with the practice of each countries. Information in the company register is generally recorded digitally and is preferably searchable. The search function supports searches by multiple fields.
5. In some countries, the registry is entrusted with oversight function, including
   verification of completeness or accuracy of filings, conducting CDD in certain cases, or cross-checking their information with data held by other authorities (e.g. with tax authorities). Some registries conduct sample testing or targeted audits to verify or/and monitor the accuracy of information on selected legal persons. Some countries rely on notarial systems or other gatekeepers to verify or/and monitor the information for company registration. Registry in some countries do not verify or/and monitor the information by itself, but rely on surveillance by civil society on reporting. Modalities of storage and access to that information
6. Company registries generally keep the information on beneficial ownership in
   public domain and impose annual updating requirement for registered companies. When the company initiates a change, it should notify and submit supplementary

25 Interpretative Note to R.24, para. 7 and 8, FATF (2013a).

74  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

information and relevant proof to the company registry, via obliged party if required, within a specified period.
7. Some company registries will verify or/and monitor information changes. In
some countries, the company registry only accepts notary-certified information/ updates. Some registries accept self-declared information. Nevertheless, the reliability of self-declared information is in doubt.
8. Competent authorities generally have access to the company registry online,
including full search capability on both basic information and information on beneficial ownership. Basic information of the company is publicly available. The trend of openly accessible information on beneficial ownership is on the rise among countries. Supervision and enforcement of the relevant obligations
9. If a company fails to provide information or has provided false information on
beneficial ownership, it is subject to proportionate and dissuasive administrative sanctions e.g. rejection of registration, de-registration. Owners and senior management that effectively control the company are also held personally liable and are subject to administrative and criminal sanctions.
10. The company registry authority regularly applies such sanctions by reviewing
annual return, conducting sample testing, conducting investigations arising from report of suspicious activities, validating the information by cross-checking information by other authorities. Company registry may de-register/struck-off the company if the information is not accurate and up to date. It may also apply fines when the company fails to provide the requested information. In some cases, the company registry can refuse registration application from the same person/legal entity which breached the obligations before. Company Approach Collection and verification of information on beneficial ownership
11. Companies are required to maintain basic information, including company
name, proof of incorporation, legal form and status, the address of the registered office, basic regulating powers (for example, memorandum and articles of association), and a register of their shareholders or members, containing the number of shares held by each shareholder and categories of shares (including the nature of the associated voting rights).
12. Companies also hold information on beneficial ownership, and to achieve this
they are generally provided with the authority to request information from shareholders on the beneficial ownership of shares.
13. In general, the company needs to rely on shareholders to provide them with
information. It is rare for company to involve an independent third party to verify or/and monitor the information. Some companies may not have the legal knowledge and experience to identify and verify their beneficial owners. This could be in particular true, when knowledge of foreign jurisdictions and legal persons is necessary to determine their beneficial owners. Even if it is rare for company to involve an independent third party to verify or/and monitor the information, an

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  75

effective company approach could therefore allow the involvement of independent third parties (e.g. tax advisors, lawyers). Modalities of storage and access to that information
14. Companies, or a third person under the company’s responsibility, are required
to keep shareholder registers, such as shareholder lists which are made available to competent authorities.
15. Under this approach, companies are generally provided powers to require
updated information from their shareholders (including the power to request information on beneficial ownership at any time). Shareholders are required to disclose the names of person(s) on whose behalf shares are held. When there are any changes in ownership or control, shareholders are required to notify the company within a specified time period.
16. The information on beneficial ownership is maintained within the country at
a location notified to the company registry. Lists of shareholders and beneficial owners may be held, and provided, in electronic form.
17. Companies are required to provide lists of shareholders and beneficial owners
to competent authorities upon request in a timely manner. Companies are generally not required to disclose its information on beneficial ownership to public. Where information on beneficial ownership cannot be identified, companies may be required to publish this fact on their website. Supervision and enforcement of the relevant obligations
18. Companies can seek to apply restrictions against shareholders for failure to
provide information on beneficial ownership through appropriate courts or authorities, such as in relation to shareholder voting rights, or the sale of shares.
19. Failure by a company to provide the information to authorities is subject to
sanctions, which may include administrative penalties or restrictions on incorporation. Where lists of shareholders and beneficial owners are held with a third party provider on the company’s behalf, the company remains liable for the obligations. Existing Information Approach – FIs/TCSPs and other DNFBPs Collection and verification of information on beneficial ownership
20. Under R.10 and 22, FIs and DNFBPs are required to identify and take
reasonable measures to verify the identity of the beneficial owner such that the FI/DNFBP is satisfied that it knows who the beneficial owner is. FIs and/or DNFBPs should obtain sufficient information from their clients so that they can identify and verify the identity of clients, and understand the nature of its business, and its ownership and control structure, including name, legal form, proof of existence, company arrangement and persons exercising control from the company. If there is a discrepancy between the records of FIs and DNFBPs with those on the central registry, the FIs and DNFBPs have an obligation to report such discrepancy to a responsible entity to carry out further investigation and make clarifications.

76  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

21. FIs and DNFBPs also collect information on beneficial ownership when they
    carry out CDD and ongoing monitoring, maintenance of records, training and reporting.
22. FIs and DNFBPs generally need to rely on information provided by the client
    (for example, certificate of incorporation, certificate of good standing, partnership agreement, deed of trust, memorandum and articles of association of a company, proof on address of the registered office) and existing information available in the public domain to verify the information. In some case, FIs and DNFBPs may hire risk management service providers that collect data on corporate entities when carrying out CDD.
23. The effectiveness of verification also hinges on the availability of a reliable
    independent source and whether they are authorised to authenticate the identity of the natural persons directly. Modalities of storage and access to that information
24. FIs and DNFBPs generally store information on beneficial ownership, e.g.
    clients’ files, in their private domains. In some countries, TCSPs (e.g. notary) maintain a central computerised platform that is accessible on public domain. How the information on beneficial ownership is stored and updated are subject to the requirement of financial supervisors and SRBs. FIs and DNFBPs are required to conduct ongoing CDD on the business relationship, and scrutinise transactions throughout the course of that relationship to ensure that the information on beneficial ownership is kept up-to-date.
25. Actions may include undertaking reviews of existing records, request
    information from their clients, cross-check information from reliable sources or hire services from a commercial database, particularly for higher-risk categories of customers.
26. FI and DNFBPs are required to provide information on BO to competent
    authorities upon request in a timely manner. In some countries, notary profession who is the obliged party has maintained and made publicly available a register on beneficial ownership of legal persons. In some countries, professional organisations maintain an internal register which is accessible by the profession themselves. In general, the public is not granted access to information held by FIs, TCSPs and other DNFBPs. Supervision and enforcement of the relevant obligations
27. FIs and DNFBPs should adequately implement CDD obligations, including
    measures to identify and verify the identity of the beneficial owner, as is required by R.10 and 22. FIs and DNFBPs should be adequately supervised by supervisors, competent authorities or SRB in accordance with R. 26 and 28.
28. FIs and DNFBPs are provided with sufficient guidance on how to properly
    conduct CDD in accordance with R.34. Such guidance will facilitate implementation of the CDD requirements, thereby improving the quality and sufficiency of information on beneficial ownership being collected by these entities.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS  77

29. To ensure compliance, supervisors, competent authorities and SRBs will
    perform monitoring (e.g. inspections) and impose a range of disciplinary and financial sanctions e.g. penalties, disciplinary proceedings, suspension or ban of professional practice on FIs and DNFBPs. Existing Information Approach – Competent authorities Collection and verification of information on beneficial ownership
30. Competent authorities (particularly LEA) generally rely on information held
    by registries, companies, FIs and DNFBPs, and other asset registries such as for land, property, vehicles, shares or other assets. Therefore, the collection of information on beneficial ownership hinges on whether the concerned entities (registries, companies, FIs and DNFBPs, and other asset registries) hold accurate and up-to-date information and whether competent authority can have timely access to the basic and information on beneficial ownership of legal persons.
31. Competent authorities should be aware of the availability of information, and
    are able to identify the FIs, DNFBPs or entities concerned for access to information, for example, through a national register of bank accounts or a central register of transactions of shares, or a register of TCSPs.
32. The effectiveness of obtaining information on beneficial ownership hinges on
    whether competent authorities have adequate powers, mechanisms and expertise to access to information on beneficial ownership in a timely manner.
33. Competent authorities generally verify the information by conducting further
    desk-based reviews and on-site inspections. An authority responsible for the Beneficial Owner Register or the beneficial owner data held in the business register might also contribute to an effective system. Competent authorities should generally verify the information i.e. by conducting risk based reviews and having the power to request information on beneficial ownership from companies, legal and beneficial owners.
34. Desk-based reviews involve analysis of existing information available on
    different domains, e.g. annual independent audit reports and other mandatory reports, identifying risky intermediaries (i.e. on the basis of the size of the firms, involvement in cross-border activities, or specific business sectors), automated scrutiny of registers to detect missing beneficial ownership information and identify the gatekeeper responsible for the filing.
35. On-site inspections involve reviewing internal policies, controls and
    procedures, gatekeeper’s own risk assessments, spot-checking CDD documents and supporting evidence, sample testing of reporting obligations.
36. Taxation database is also a useful means of identifying indicators of
    criminality and schemes designed to obscure beneficial ownership and verifying information on beneficial ownership. Further investigation often uncovers dubious control structures or corporate dealings designed to conceal beneficial ownership.

78  BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS

Modalities of storage and access to that information
37. Competent authorities, including regulators, tax authorities, intelligence
authorities store and update information in accordance with their functions and obligations – e.g. some tax authorities will keep an account of names of company owners and directors, some stock registries will hold information on meaningful shareholders or persons directly or indirectly controlling meaningful voting rights in public companies.
38. Competent authorities (such as supervisory authorities, tax authorities, or
land titles offices) generally share information on beneficial ownership upon requests by other competent authorities. In some countries, certain electronic databases are made readily accessible among competent authorities. There should be sufficient mechanisms in place for information sharing between competent authorities so that competent authorities can gain access to information held by other authorities for verification and investigation in a timely manner. Supervision and enforcement of the relevant obligations
39. Competent authorities are subject to national governance, for example, audit
checking, monitoring and surveillance on their compliance.
Existing Information Approach – Companies listed on a stock exchange Collection and verification of information on beneficial ownership
40. The information on beneficial ownership is usually collected when the
company goes on initial public offering. The availability of information on beneficial ownership hinges on the disclosure requirement (either by stock exchange rules or through law or enforceable means).
41. The information of stock exchange is generally verified by the responsible FIs
and/or DNFBPs that provided services to the company. The FI and/or DNFBP is held accountable for the verification of accuracy in performing their functions. Modalities of storage and access to that information
42. The information on beneficial ownership may be stored at the stock exchange
at the time of initial public offering. The information is generally accessible on the website of the stock exchange. Whether and how frequent it will be updated depends on the policy and rules of the stock exchange.
43. Public, FIs, DNFBPs, competent authorities can gain access to the information
as long as the website of the stock exchange is public and contain information on beneficial ownership. Supervision and enforcement of the relevant obligations
44. In general, there is no particular obligation for stock exchange to collect, verify
and keep the information up-to-date for the purpose of AML/CFT.

BEST PRACTICES ON BENEFICIAL OWNERSHIP FOR LEGAL PERSONS Transparency of beneficial ownership is essential to prevent the misuse of companies, associations or other entities for money laundering or terrorist financing. The Financial Action Task Force (FATF) is the global standard-setter for measures to fight money laundering and terrorist financing. Since 2003, the FATF Recommendations require countries to ensure that authorities can obtain up-to-date and accurate information about the person(s) behind companies, foundations and other legal persons. This best practices paper, with examples from across the global network of FATF and FATF-Style Regional Bodies’ members, will help countries effectively implement the FATF’s requirements. The report highlights that jurisdictions using a multi-pronged approach with several sources of information are often more effective in preventing the misuse of legal persons for criminal purposes. The report identifies the most common challenges that countries face in ensuring that the beneficial owner(s) of legal persons is identified, and suggests key features of an effective system. www.fatf-gafi.org / October 2019