The FCA's 22 July 2026 review of 242 asset managers found beneficial ownership verification gaps in complex ownership structures. What it changes for CDD.
Table of contents
On 22 July 2026 the Financial Conduct Authority reported that beneficial ownership verification is breaking down at asset managers handling complex ownership structures. Its review of 242 firms found a fifth had weak or missing risk assessments, and some private-markets firms had no formal process to establish who ultimately owns their customers.
- The FCA engaged with 242 asset management and alternatives firms during 2025/26 and published findings, not a fine, on 22 July 2026.
- Just over a fifth of firms had not completed a business-wide risk assessment, and 18% had no formal customer risk assessment methodology.
- A small number of private-markets firms had no formal ultimate beneficial owner verification process for multi-layered or offshore structures.
- Around a fifth of private-markets firms said over 30% of their customers use complex ownership structures, concentrating the risk in a specific segment.
- The findings are guidance under the Money Laundering Regulations 2017, but firms remain fully responsible for compliance today.
What did the FCA actually find?
The Financial Conduct Authority published the results of a multi-firm review into how asset management and alternatives firms run their financial crime controls. It engaged with 242 firms during 2025/26 and set out where practice was strong and where it fell short. The weakest area was the foundation of any anti-money laundering programme: knowing who the customer really is.
The regulator was blunt about the ownership problem. It found some private-markets firms had "no formal UBO verification process" for multi-layered or offshore structures. That is a gap at the exact point where laundering risk concentrates. It echoes the FCA's earlier censure of CACEIS over weak financial crime controls, where diligence failings were the theme. When beneficial ownership verification fails, sanctions screening, source-of-funds checks and suspicious activity monitoring all inherit a blind spot they cannot close.
| FCA finding (2025/26 review of 242 firms) | Figure |
|---|---|
| Firms with no, or an incomplete, business-wide risk assessment | Just over 20% |
| Private-markets firms whose BWRA did not cover private-markets risk | 18% |
| Firms with no formal customer risk assessment methodology | 18% |
| Private-markets firms where over 30% of customers use complex structures | Around 20% |
| Non-private-markets firms reporting no complex-ownership customers | 85% |
Why do complex ownership structures concentrate the risk?
Complex ownership structures are where beneficial ownership verification is hardest and where it matters most. The FCA notes these are "complex ownership structures that can cross jurisdictions", layering holding companies, nominees and offshore vehicles between a fund and the natural person who benefits. Each layer is an opportunity to obscure the ultimate beneficial owner.
The review shows the exposure is not evenly spread. Firms active in private markets carry almost all of it: around a fifth of them said more than 30% of their customers use complex structures, while 85% of firms outside private markets reported none at all. That concentration matters for supervisors and for anyone building controls, because it tells you where to spend the diligence budget.
The reason regulators keep returning to ownership is mechanical. A shell layered over a shell can move illicit funds, evade sanctions and hide the origin of money precisely because no one has resolved the chain to a verified person. The control that defeats this is not more documents; it is authoritative resolution of the ownership graph against registries and reliable data.
What does this change for your CDD obligations?
The findings are guidance, but the duties they map to are hard law. Under the Money Laundering Regulations 2017, Regulation 28 requires firms to identify the beneficial owner and take reasonable measures to verify their identity, and Regulation 18 requires a business-wide risk assessment. The FCA is signalling how it will judge compliance, so treat each finding as an audit checklist.
Customer due diligence changes first. If your beneficial ownership verification stops at a self-declared ownership chart, you are not meeting Regulation 28 for a customer with a multi-layered structure. You need to resolve ownership to the natural persons above the 25% threshold and evidence how you did it.
Enhanced due diligence is the second lever. A customer whose structure crosses jurisdictions or uses offshore vehicles should trigger EDD, and your customer risk assessment must be able to flag that. European supervisors have penalised exactly this, as the ABN AMRO due diligence fine over high-risk customers showed. The 18% of firms with no formal CRA methodology cannot make that call consistently, which is why the FCA singled it out.
Record-keeping and governance close the loop. Regulation 28 measures are only defensible if documented, and SYSC requires senior management to own the framework. Sanctions and PEP screening depend on the same resolved ownership: you cannot screen a beneficial owner you never identified, so a verification gap is also a screening gap.
What is still uncertain and where will firms struggle?
The hardest open question is evidence. The Money Laundering Regulations require "reasonable measures" to verify beneficial owners, but "reasonable" is not defined for a five-layer offshore structure, and firms will read it differently until the FCA tests specific cases. Under-do it and you fail Regulation 28; over-do it and you delay legitimate onboarding for weeks.
Cost and capacity are the next risk. Resolving beneficial ownership verification across jurisdictions means reconciling company registries of varying quality, some paid, some stale, some closed to the public after recent access rulings. Smaller managers may lack the tooling to do this at scale, and the FCA has said resources should be commensurate with a firm's size and activities, which stops short of telling anyone how much is enough.
There is also a moving-target problem. The UK operates a "more than 25%" ownership threshold, while the incoming EU AML Regulation moves to "25% or more" and lets the Commission drop to 15% for high-risk sectors from July 2027. Firms with EU customers or entities will soon verify to a lower bar, and a control built only for the UK threshold will need rework.
How does the UK compare with other beneficial ownership regimes?
The UK is not an outlier, which is why this review matters beyond Britain. Most major regimes anchor on a 25% ownership test plus a control test, but the definitions and thresholds are diverging, and firms operating across borders must verify to the strictest applicable standard rather than a single global rule.
| Regime | Beneficial owner threshold | Notable feature |
|---|---|---|
| UK Money Laundering Regulations 2017 | More than 25% of shares or voting rights | Plus control test; verification duty under Reg 28 |
| EU AML Regulation 2024/1624 | 25% or more | Commission may lower to 15% for high-risk sectors; applies 10 July 2027 |
| US Corporate Transparency Act / FinCEN CDD | 25% ownership or substantial control | Reporting to a central registry, plus the control prong |
The direction of travel is clear: thresholds are edging down and control tests are becoming as important as ownership percentages. A firm that can only chase a fixed 25% line will keep missing beneficial owners who sit below it but still direct the entity.
How should compliance teams respond?
Start with the three gaps the FCA named. Confirm your business-wide risk assessment is complete and covers private-markets risk, give every customer a documented risk classification, and put a formal beneficial ownership verification process in place for multi-layered and offshore structures. Re-run a sample of your highest-risk files as if the FCA were reviewing them, and keep the evidence trail.
Then fix the root cause. Most verification gaps come from treating ownership as a document to collect rather than a graph to resolve. Zyphe resolves ownership through its KYB engine recursively across 240+ registries in 190+ countries, walking every layer to the natural persons behind it and returning an exportable audit trail, so a customer's ultimate beneficial owner is established and evidenced rather than self-asserted. You can see how the network works end to end, and if beneficial ownership verification is your weak point, book a demo and run it against a real structure.
The bottom line
The FCA did not levy a fine, but it drew a clear line: beneficial ownership verification is where asset management financial crime controls are failing, and complex ownership structures are where the damage lands. Firms that treat ownership as a form to file rather than a chain to resolve will keep failing Regulation 28. The fix is authoritative, evidenced resolution of who really owns the customer, applied to every high-risk structure and documented so a supervisor can follow it.
Cited sources
- FCA, asset management and alternative firms' financial crime controls: our findings (22 July 2026)
- Money Laundering Regulations 2017, Regulation 28 (customer due diligence measures)
- Regulation (EU) 2024/1624 on the prevention of money laundering (AMLR), EUR-Lex
- FinCEN, Beneficial Ownership Information (US Corporate Transparency Act reporting)
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.