Following our overview of the new EU anti-money laundering package, the expanded scope of obliged entities and the new CDD and KYC requirements, in the fourth part of our blog series we turn our attention to beneficial owners: what changes for companies with complex ownership structures, and what new requirements does the AMLR introduce for the identification and verification of beneficial owners?

Under the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 (AMLR), obliged entities must be able to trace which natural persons are behind their customers, on what basis these are deemed to be beneficial owners, and how their identity has been verified. Ownership structures and control must be examined independently of one another.

The AMLR will, in principle, apply from 10 July 2027. The Sixth Anti-Money Laundering Directive, Directive (EU) 2024/1640 (AMLD6), which must also be transposed by the Member States by that date, complements the AMLR by strengthening the quality and verification of register information.

Executive summary of the key changes

One of the fundamental changes introduced by the AMLR is that the concept of beneficial owner will, for the first time, be governed directly and uniformly throughout the EU (Articles 51 et seq. AMLR). This reflects the fact that the existing requirements under the directives have been interpreted and implemented differently across Member States, particularly when calculating indirect holdings. The same ownership structure could therefore result in different beneficial owners being identified depending on the Member State. This undermined transparency, which is particularly important for complex structures to prevent criminals from hiding behind opaque arrangements (recital 104 AMLR). The directly applicable definition is therefore intended to ensure a consistent approach to identifying beneficial owners throughout the internal market: obliged entities and corporate groups operating across borders will assess the same structure using the same criteria, and the information in the interconnected registers across the EU will become comparable. Level 2 regulation continues this harmonisation approach, as AMLA’s final draft CDD RTS expressly aim to ensure the consistent application of due diligence requirements in all Member States. To support practitioners, recital 105 AMLR envisages supplementary European Commission guidelines that may explain how the rules apply to complex ownership and control structures using case examples (recital 105 AMLR).

The EU anti-money laundering package introduces the following further key changes concerning beneficial owners:

• Threshold: A person is a beneficial owner by virtue of ownership if they hold 25 per cent or more of the shares, the voting rights or another ownership interest in the company, such as a claim to profits or liquidation proceeds. Until now, more than 25 per cent was required; in future, exactly 25 per cent will suffice.
• Indirect holdings: Until now, the WiEReG asked whether a natural person controls an entity which holds more than 25 per cent. In future, the percentages along the chain must be multiplied and several chains added together; the control logic is retained alongside this through Article 54 AMLR.
• Control: Control through other means was already part of the definition, but was often examined only as a secondary matter. In future, it must always be examined in parallel with the ownership assessment; Article 53 AMLR sets out a minimum list.
• Senior managing officials: Where no beneficial owner can be determined, the senior managing officials were until now treated as (fictitious) beneficial owners by way of fallback. In future, they remain the fallback but are expressly no longer beneficial owners: the legal entity reports them together with a reasoned statement that no beneficial owner could be determined (Article 63(4) AMLR).
• Register: Obliged entities were already prohibited from relying solely on the register and had to report discrepancies. What is new is the mandatory cross-check against the register as part of every verification, a reporting deadline of 14 calendar days and extended verification powers for the register authorities.

For companies with multi-tiered ownership structures, this means above all that the circle of beneficial owners will tend to become larger. Existing register filings and KYC files must therefore be reassessed in light of the new rules.

We examine these changes in more detail below:

Who will be considered a beneficial owner in future?

Ultimately, beneficial owners are always natural persons. When identifying these natural persons and appropriately verifying their status, the AMLR distinguishes between two key criteria for companies: a direct or indirect ownership interest and direct or indirect control over the company concerned, that is, the obliged entity’s customer.

With regard to ownership interests, the general threshold will in future be 25 per cent or more of the shares, voting rights or other ownership interests. This also covers certain claims to profits, other internal resources or liquidation proceeds (Article 52(1) AMLR). Exactly 25 per cent is therefore sufficient. A profit participation of at least 25 per cent may therefore give rise to beneficial ownership even without voting rights, for example in the case of usufruct or silent partnerships. For higher-risk companies, the Commission may also set a threshold of no more than 15 per cent (Article 52(2) AMLR).

However, it is crucial to note that the assessment must not stop at ownership percentages. Under Article 51 of the AMLR, control through other means must be examined independently of, and in parallel with, the ownership assessment. A person may therefore be a beneficial owner even without holding a stake of at least 25 per cent. This applies, for example, to a person who can appoint or dismiss the majority of the members of the management body under an agreement (Article 53(3)(b) AMLR). The control rights relevant in this context are explained below in the section ‘Control through other means: a look at the contracts’.

Complex ownership structures: simple arithmetic is not enough

For indirect ownership interests, Article 52(1) of the AMLR prescribes a calculation along the chain of ownership: the ownership percentages at each level are multiplied together. If there are several chains of ownership involving the same natural person, the resulting ownership interests must be aggregated.

A simplified example: a natural person holds a 50 per cent stake in a holding company, which in turn holds a 50 per cent stake in the client company. This results in an indirect ownership interest of 25 per cent. The general ownership threshold is thus met. Under the previous WiEReG, this person would not have been captured: a holding of exactly 50 per cent does not confer control over the holding company, and the holding of exactly 25 per cent would not have exceeded the threshold of more than 25 per cent.

However, this multiplication is not the entirety of the assessment. As noted above, the AMLR distinguishes between ownership interest and control. For control through an ownership interest, a majority of 50 per cent plus one share or voting right is generally decisive. Where ownership and control coincide at different levels, the attribution rules of Article 54 of the AMLR must also be observed. Under these rules, a beneficial owner also includes any person who controls an intermediate company which in turn holds an ownership interest of at least 25 per cent in the customer (Article 54(a) AMLR), or who holds an ownership interest of at least 25 per cent in a company that controls the customer (Article 54(b) AMLR). In these cases, the look-through percentage is irrelevant.

An example: a holding company holds 60 per cent of the client company and thereby controls it. A natural person holds 30 per cent of the holding company. On a look-through basis, this amounts to only 18 per cent; under Article 54(b) AMLR, the person is nevertheless a beneficial owner. Likewise, a person holding 60 per cent of a holding company which in turn owns 30 per cent of the customer must be captured. Here, the result follows not from the multiplication (18 per cent) but from control of the intermediate company (Article 54(a) AMLR). The second scenario essentially corresponds to the previous Austrian legal framework; the first is new.

For obliged entities, this means that an ownership chart should not only show percentages but also indicate who controls the respective intermediate companies.

Control through other means: a look at the contracts

According to Article 53 of the AMLR, control exists in particular where a person can, directly or indirectly, exercise significant influence and enforce key decisions within the legal entity.

Under Article 53(3) AMLR, control through other means includes, at least:

• the ability to exercise a majority of voting rights;
• the right to appoint or dismiss the majority of members of key management or supervisory bodies;
• veto or decision-making rights attached to the shares; and
• decision-making powers regarding the distribution of profits or the transfer of assets.

Beyond this, and depending on the structure, control may arise in particular from articles of association, syndicate agreements or other formal and informal arrangements. Family relationships and nominee structures may also be relevant, provided that they actually confer corresponding means of influence (Article 53(4) AMLR). Family relationships are not automatically to be treated as joint control. What matters is whether the family members actually act in concert. Nominee shareholders and nominee directors will in future have to disclose their status and the person on whose behalf they act (Article 66 AMLR).

In practice, this means that a list of shareholders alone will not suffice in every case. Depending on the structure and the level of risk, the legal basis for the exercise of influence must also be examined.

Identification and verification are two distinct tasks

Article 20(1)(b) of the AMLR requires the identification of beneficial owners and the implementation of appropriate measures to verify their identity. The first step is therefore to determine who the beneficial owner is. Subsequently, it must be verified whether the information regarding that person’s identity is reliable.

Article 22(7) of the AMLR sets out various methods for verification. In addition to the identity verification procedures intended for customers, appropriate measures may be employed on the basis of necessary information, documents and data provided by the customer or from other reliable sources. The scope and depth of the verification depend, in particular, on the risks associated with the business relationship, the individual and the ownership structure.

Register enquiries: mandatory, but not a substitute for the obliged entity’s own checks

Article 22(7) of the AMLR requires, in addition to the other verification measures, a check of the information by consulting the central registers.

In the case of a new business relationship with a legal entity, trustee or similar person subject to registration, valid proof of registration or a current register extract confirming the validity of the registration must also be obtained, as already required under the Fifth Anti-Money Laundering Directive (Article 23(4) AMLR).

A further new feature is a registration requirement for entities from third countries: where they enter into a business relationship with an obliged entity in the EU that is associated with a medium-high or high risk, they must first register their beneficial owners in the central register of a Member State (Article 67 AMLR). The obliged entity must request proof of registration before entering into the business relationship.

This does not, however, mean that obtaining a register extract completes the verification process. The final AMLA draft of the CDD-RTS also expressly states that central registers alone are not sufficient to meet the verification requirements. Under the draft, this generally also applies in low-risk cases, albeit with a significantly reduced workload: under simplified due diligence, the central register may be used for identification. For verification, however, one further source not already used for identification is sufficient, such as a commercial register extract, information from the customer or a reliable, publicly accessible source (Article 19 of the draft RTS). The extent to which checks must go beyond the register cross-check therefore depends on the specific risk.

What the AMLA has already specified

Of particular relevance to operational implementation is the final draft of the regulatory technical standards on customer due diligence pursuant to Article 28(1) of the AMLR. The AMLA announced the finalisation of these standards on 1 October 2026 and submitted the draft to the European Commission. The Commission must still adopt the RTS as a delegated regulation before they can take effect.

Articles 10 and 11 contained therein set out in detail, in particular, the appropriate verification measures and the understanding of the ownership and control structure. Sources of information may include other public registers, reliable data providers and appropriate documentation from the legal entity. In the case of multi-tiered structures, the draft provides for additional information on intermediate companies, including their legal form, the countries in which their registered offices are located, ownership percentages and any nominee arrangements.

Compared with the consultation draft of February 2026, AMLA has introduced at least one significant simplification: the rigid definition of “complex” structures, which would automatically have triggered additional measures from three ownership layers onwards where further criteria were met, has been dropped. Complexity is now to be assessed on a risk-sensitive basis using indicators such as the number of layers, interposed trusts or similar legal arrangements, registered offices in high-risk third countries and nominee structures.

No beneficial owner identifiable: management as a fallback solution only

If, despite exhausting all possible means of identification, no beneficial owner can be identified, or if there are doubts as to whether the persons identified are the beneficial owners, the fallback provision of Article 22(2) of the AMLR In such cases, the natural persons holding positions at the highest level of management must be identified and, as a general rule, verified. The steps taken and any difficulties encountered must be documented.

However, this does not make these individuals the actual beneficial owners. In particular, the fallback solution must not be used as a shortcut simply because clarifying an international shareholding structure is a complex process.

If the necessary due diligence measures cannot ultimately be fulfilled, the consequences set out in Article 21 of the AMLR must be observed: as a general rule, the transaction must not be carried out, the business relationship must not be established or continued, and it must be assessed whether a suspicious activity report is required. These decisions must also be documented in a comprehensible manner.

Foundations and trusts: specific rules rather than blanket ownership thresholds

Special rules apply to foundations, express trusts and comparable structures. Depending on the legal form, the persons to be included are, in particular, the founder or settlor, members of relevant governing bodies, trustees, protectors, beneficiaries and other controlling persons (Articles 57 and 58 AMLR). For foundation-like legal entities – which, under section 1(2)(2) WiEReG 2027, expressly include the Austrian private foundation (Privatstiftung) – Article 57 AMLR also covers the members of supervisory bodies. Where one of these positions is held by a legal entity, its beneficial owners must also be captured.

Article 55 of the AMLR is particularly relevant to group structures: if such a foundation or legal arrangement holds an ownership interest of at least 25 per cent or exercises control, its beneficial owners are at the same time beneficial owners of the downstream company. Founders, management board members and beneficiaries of a private foundation must therefore also be recorded as beneficial owners of an operating subsidiary.

Discrepancies: findings from independent checks must be reported to the register

If an obliged entity identifies discrepancies between the information in the register and the information gathered during its own assessment, it must, in accordance with Article 24 of the AMLR, report these to the register without delay, and at the latest within 14 calendar days of their discovery.

For certain minor discrepancies and out-of-date data, there is a limited procedure for prior clarification with the customer. This is subject to statutory conditions and is not available in higher-risk cases. If a required correction is not made within the specified time limit, the obliged entity must report the discrepancy itself.

For lawyers, notaries and certain other professionals bound by professional secrecy, Article 24(4) of the AMLR provides for an activity-specific exemption, in particular for determining the legal position and for representation in judicial proceedings. This does not constitute a general exemption for all activities carried out by these professional groups.

AMLD6 supplements the obligations of obliged entities with a separate quality assurance mechanism at the register level. Under Article 10(7), mechanisms must be in place whereby the registration authorities verify information after it has been submitted and subsequently on a regular basis to ensure it is appropriate, accurate and up to date. The intensity and frequency of such checks must be risk-based.

Austria: WiEReG 2027 adopted

As part of the implementation of the EU anti-money laundering package, the Austrian legislator has already adapted the national register legislation: the Beneficial Owners Register Act 2027 (WiEReG 2027) was adopted by the National Council in October 2026 and enters into force on 10 July 2027, at the same time as the AMLR becomes applicable. It no longer contains its own definition of beneficial owner; Articles 51 et seq. AMLR apply directly. The WiEReG 2027 essentially governs the register procedure, accompanying obligations of legal entities and the powers of the register authority.

Of particular practical relevance: discrepancy reports under Article 24 AMLR replace the existing annotation (Vermerk) (section 16 WiEReG 2027). Where the report concerns the current entry, it is noted in all register extracts, proof of registration cannot be retrieved until a new filing is made, and the legal entity is requested to carry out a review within two weeks. The compliance package is retained (section 7 WiEReG 2027). According to the legislative materials, a valid compliance package is a reliable source within the meaning of Article 22(7)(b) AMLR and can therefore be used for verification; it does not replace the cross-check against the register. In addition, the register authority may have inspections carried out by the Financial Police (section 18 WiEReG 2027).

Legal entities subject to reporting obligations should review their filings against the new definition well before July 2027 – especially where senior management has so far been reported for lack of control in the chain of ownership.

Keeping information up to date: beneficial ownership checks are not a one-off task

Beneficial owners must continue to be monitored even after onboarding. Article 26(2) of the AMLR stipulates maximum intervals of one year for updating relevant customer information in higher-risk cases, and five years for all other customers. The European financial industry has been particularly critical of these maximum intervals in view of the extensive data collection that the new regime undoubtedly entails, including for beneficial ownership checks. Additional customer and beneficial ownership data must not only be collected and verified but also kept up to date on an ongoing basis. Particularly in complex ownership structures, this can tie up significant resources and lead to repeated requests for information from customers. Consultation respondents therefore called for more scope for event-driven, automated reviews, particularly in low-risk cases where no changes have been identified, as well as greater flexibility beyond the five-year limit. The industry also pressed for greater flexibility in updating information in the consultations on the Level 2 legal acts. This has so far left the maximum intervals themselves unchanged: they are laid down in the AMLR and cannot be extended by AMLA legal acts or guidelines. Flexibility exists only as to the depth and intensity of the review.

The draft AMLA guidelines complement these maximum intervals: changes to the ownership structure, new control relationships and risk-relevant findings should trigger ad hoc reviews. However, the draft does at least envisage that an expired identification document should not automatically trigger a request for new documentation in every case; a documented risk-based assessment remains decisive.

This is to be distinguished from the legal entities’ own obligations: the AMLR requires, in particular, the prompt updating of information on beneficial owners – in principle within 28 calendar days of any changes – as well as a review of the register details at least once a year.

What this means in practice

The following key implementation priorities for obliged entities can be derived from the new requirements:

• Revise the approach to identifying beneficial owners: The calculation of ownership interests, the aggregation of multiple chains and an independent control assessment must be reflected in the procedure.
• Reassess existing structures: Customers’ multi-tiered structures, usufruct and silent partnership interests as well as rights under syndicate agreements and veto rights should be reviewed against the new definition – including where only senior management has been recorded so far.
• Document structures in a traceable manner: Customers’ organisational charts should be supplemented with appropriate information on intermediate companies, control rights and nominee arrangements.
• Separate identification, verification and register reconciliation: For each step, it should be clear on which information and supporting evidence the obliged entity’s findings are based.
• Establish a procedure for resolving discrepancies: Responsibilities, steps for clarification and the relevant reporting or correction deadlines must work in practice for obliged entities.
• Check third-country customers: For entities from third countries, the obliged entity must establish whether a registration requirement under Article 67 AMLR applies and whether proof of registration is available.

The key message for obliged financial institutions is therefore this: beneficial ownership checks are neither a mere percentage calculation nor simply a matter of retrieving information from a register. Obliged entities must understand ownership and control, carry out appropriate checks on the individuals behind them, and cross-check their findings against the information in the registers. As the AMLR will apply from 10 July 2027 without any further implementing act, obliged entities and legal entities subject to reporting obligations should start adapting their processes and filings as soon as possible, if they have not already done so.

Outlook

In the next part of our blog series, we turn to the role of AMLA: which obliged entities will it supervise directly in future, and how will it interact with the national supervisory authorities?