Verifying that a business exists is one thing. Establishing who ultimately owns it, who controls it and how its risk changes is another. Complex corporate structures, fragmented ownership records and changing business relationships can leave significant gaps in traditional know your business (KYB) checks.
AI and entity resolution offer new ways to connect information, uncover hidden relationships and monitor changes beyond onboarding. But can RegTech give firms a clearer picture of who they are doing business with, or will the complexity of global corporate structures continue to outpace the technology?
Establishing ownership
How can firms establish who ultimately owns or controls a business when corporate structures span multiple jurisdictions?
For Nir Carciente, partner and head of RegTech at ACA Group, the short answer is that firms cannot rely on a single document, registry or data source.
He remarked, “A business may be incorporated in one country, owned through a holding company in another, financed by investors elsewhere and ultimately controlled through a trust, voting arrangement or board structure that is not immediately visible. Legal ownership and practical control are not always the same thing.”
For Carciente, the starting point is to build an ownership and control picture using multiple sources including corporate registries, incorporation documents, shareholder registers, director and officer information, customer declarations, sanctions and PEP screening, adverse media and credible third-party data. “Each source contributes part of the picture. The role of the compliance team is to test whether those pieces align,” he said.
This, the ACA Head of RegTech details, also means looking beyond percentage ownership. A person that has a smaller economic stake, he states, may still exercise significant control through voting rights, a trustee role, a management position or contractual rights.
He added, “Firms need to understand both who benefits economically and who can influence the company’s decisions. There will always be cases where information is incomplete, especially where structures are layered across jurisdictions with different disclosure standards. The objective should not be to create false certainty. It should be to identify where uncertainty remains, assess the associated risk and apply enhanced due diligence when appropriate.”
Meanwhile, Daniel Farías, VP Sales and Marketing at TWC, believes that most firms here start from the wrong end.
He explained, “They try to solve it with a single registry lookup, and then discover that every jurisdiction defines ownership, control, and thresholds a little differently. A 25% ownership test in one place, a different test in another, and “control through other means” interpreted unevenly in a third.”
In TWC’s corner of the industry, CRS and FATCA are already forcing this question. As he states, identifying controlling persons of passive entities is a core due diligence step, and it only works if you can trace through layers until you reach a natural person.
He continued, “The practical answer is layered evidence, not a single source. Self-certifications, documentary evidence, registry data, and the institution’s own AML/KYC records should be cross-checked against each other, with every conclusion traceable to the document and rule that produced it.”
When such sources disagree – and in multi-jurisdiction structures they commonly do – the discrepancy needs to be flagged and resolved by a person, not smoothed over, said Farías.
“A clean-looking ownership chart that nobody can trace back to its sources isn’t verification. It’s a liability,” he added.
In the view of Zurab Kotaria, co-founder and CEO at Identomat, the challenge is that the company you see on paper isn’t always the whole story.
He commented, “A business might have several layers of ownership, with companies registered in different countries, making it difficult to identify who actually owns or controls it. Firms need to look beyond basic registry checks and combine corporate data, beneficial ownership information, identity verification, and AML screening to understand who they’re really dealing with.”
In the Identomat CEO’s view, when information is lacking or doesn’t match, that should be an even bigger reason to look closer, not simply move forward, adding that KYB isn’t ultimately about verifying a company, it’s about understanding the people behind it and the risks they may bring.
Moving beyond point-in-time KYB
How can firms move beyond point-in-time KYB checks to identify changes in ownership, control and business risk?
For Kotaria, a business that may look perfectly legitimate today might present a very different risk six months from now.
“Ownership changes, directors come and go, sanctions lists are updated, and businesses can become involved in suspicious activity long after onboarding,” he said.
This is why KYB shouldn’t stop once a company passes its initial checks. He said, “Companies need ongoing monitoring and risk-based reassessments to identify meaningful changes and flag them before they become bigger problems.”
Kotaria believes that verification should be part of an ongoing process, supported by connected verification and compliance capabilities that help businesses manage risk throughout the customer lifecycle.
Carciente is clear in his view that traditional KYB processes were built around onboarding and periodic review. This approach, he quips, is increasingly hard to defend in a market where ownership, sanctions exposure and business risk can change fast.
He said, “A company can look low risk at onboarding and present a very different profile six months later. It may be acquired by a new parent, appoint directors with new risk exposure, expand into higher-risk markets, receive adverse media attention or become connected to sanctioned parties. None of those developments are likely to wait for an annual review cycle.”
Businesses need to move towards ongoing risk-based monitoring in the view of Carciente. The key question he believes should be centered around what has changed since was last looked, and does such a change matter.
“That requires monitoring relevant events across the customer lifecycle, including ownership changes, new directors or officers, changes to the corporate structure, sanctions and PEP updates, regulatory actions, negative news and shifts in customer activity,” he explained. “Not every change should generate the same response. The most effective programs use risk rules and triage to distinguish a routine record update from a development that requires investigation.”
Carciente is clear that this is not about creating more alerts, but instead, about creating better triggers. In his opinion, a useful monitoring model should surface meaningful changes, provide enough context for a reviewer to understand why they matter and retain a clean audit trail of the decision made.
He said, “Regulatory expectations support this direction. In the United States, ongoing customer due diligence includes maintaining and updating customer information on a risk basis, including beneficial-owner information for legal-entity customers. Internationally, the direction is similar: beneficial-ownership information needs to be accurate and kept current.”
Farías’s answer to this question was simple: by treating verification as a status that expires, not an event that’s completed.
He remarked, “A KYB check tells you who owned the entity on the day you looked. Ownership changes, a trust gets restructured, a controlling person’s residence moves to another jurisdiction, and the file you hold is wrong without anyone having done anything improper.”
Reporting regimes already assume this. Change-in-circumstances rules exist because the information goes stale, and a firm that only revisits entity data at onboarding or at the annual reporting push is carrying risk for the months in between.
Farías stated that the shift is to define what counts as a trigger (a change in registry data, an updated self-certification, a new jurisdiction in the structure), monitor those continuously, and route the exceptions to someone accountable with the full history attached.
He finished, “It’s the same logic as continuous regulatory change management, applied to the entity rather than the rule. Firms that build it once find it also improves the quality of what they report, because the data going out is the data they’ve kept current.”
Uncovering hidden relationships
Can AI and entity-resolution technology uncover hidden relationships between businesses, beneficial owners and financial crime networks?
First, Carciente stated his view that they can help uncover relationships that would otherwise be difficult and time-consuming to identify. However, he believes they are not a substitute for sound data, strong controls or experienced compliance judgment.
He explained, “The practical challenge is often not a lack of information. It is that the information is scattered. The same person may appear under different name formats across jurisdictions. A company may have a slightly different legal name in multiple data sources. A beneficial owner may be connected to a business through a chain of entities, a trust or a director role that is not obvious from a single record.”
Going further, he stressed entity-resolution technology helps firms determine whether those separate records may refer to the same person or organization. “It can compare names, addresses, dates, identifiers, corporate roles and other attributes, then map the potential relationships among companies, directors, beneficial owners and counterparties. AI can make that work more efficient,” he said.
He added that it can extract relevant information from corporate documents, summarize complex ownership records, identify possible connections across large volumes of data and help prioritize the cases that warrant human review. This, he claims, allows compliance teams to spend less time locating information and more time assessing risk.
There is a key caveat, however, which is that technology should support investigators, not make unchallenged decisions. A possible connection is not proof of wrongdoing. He said, and firms need transparency into the data and logic behind an alert, along with human review for higher-risk cases.
Carciente finished, “That is where the real opportunity lies. Financial crime rarely operates through one isolated company or one obvious transaction. It often emerges through networks of relationships. By combining reliable data, entity resolution, ongoing monitoring and human expertise, firms can develop a much clearer view of the businesses they serve and the risks that may be forming around them.”
Kotaria’s last words on this topic were loud and clear, with a strong agreement on the question.
He said, “One of the biggest challenges in financial crime prevention is that suspicious relationships aren’t always obvious. Two companies might have different names and operate in different countries, yet share the same beneficial owner, director, or other important connection.”
He stated that AI and entity-resolution technology can help connect these dots by matching records across databases, identifying inconsistencies, and highlighting relationships that might otherwise go unnoticed.
He finished, “This can help compliance teams investigate complex ownership structures and focus on potentially higher-risk cases. But finding a connection doesn’t automatically mean finding a crime. The data still needs to be verified, and the context matters.”
The last word on this discussion went to Farías, who shared his agreement on the idea, and stated his belief that this is one of the places where he thinks the technology earns its keep.
He explained, “Matching name variants across languages and scripts, linking shared addresses, directors, and filings across jurisdictions, and surfacing connections no analyst would find by hand are real pattern-recognition problems at a scale humans can’t cover. Entity resolution can turn a pile of disconnected records into a possible network in minutes. The word that matters there is possible. A link between two entities is a lead, not a finding.”
Farías also said that false positives in this space are costly in both directions, as wrongly tying a legitimate customer to a financial crime network is a serious outcome, and so is missing a genuine link because the model scored it low.
He concluded, “The same standard we apply everywhere else applies here. The system should show why it connected two records, a human should confirm before anything is acted on or reported, and the whole chain should be auditable if a regulator asks. Used that way, AI widens what compliance teams can see.
“Used as a black box that issues verdicts about who controls what, it creates a new blind spot where the old one used to be.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
