Beneficial owner for customer due diligence (AML): how to reconstruct it for a customer

In short: if you are an obliged party under anti-money laundering rules and the customer is a company, the beneficial owner is reconstructed by applying in order the criteria of art. 20 of Legislative Decree 231/2007 (ownership above 25%, control, powers of administration or management) to two sources: the information the customer must provide to you in writing and under its own responsibility (art. 22) and the Companies Register data on shareholders, shares and offices, which you use to verify it. The register of beneficial owners, in October 2026, remains suspended for third parties: this does not exempt you from the check; you only need to carry it out with these sources, keeping a record of the process.

Who must do it, and when

The customer due diligence obligations apply to the parties listed in art. 3 of Legislative Decree 231/2007. Among others: banks and financial intermediaries, credit brokers and agents in financial activity, chartered accountants, accounting experts and labour consultants, statutory auditors, notaries and lawyers when they assist clients in certain transactions (for example the incorporation or management of companies), real estate agents.

The identification of the customer and of the beneficial owner, and the verification of their identity, must be carried out before establishing the relationship or accepting the engagement (art. 18, paragraph 2). Only in the presence of a low risk, and if necessary to allow the ordinary conduct of the activity, can the verification of identity be postponed: the identifying data must in any case be acquired immediately, and the verification completed as soon as possible and in any case within thirty days (art. 18, paragraph 3).

What the law requires on the beneficial owner

Art. 18, paragraph 1, letter b), requires identifying the beneficial owner and verifying their identity with measures proportionate to the risk, including, for legal persons, measures that allow the ownership and control structure of the customer to be reconstructed with reasonable reliability. Art. 19, paragraph 1, letter b), specifies that for customers other than natural persons, measures commensurate with the risk suitable for understanding the ownership and control structure are required, and that the verification may use reliable and independent sources, including databases referable to a public administration.

The criterion for identifying them is that of art. 20 (also explained in the guide to the beneficial owner), to be applied in order:

1. Ownership: in companies with share capital, a shareholding above 25% of the capital, held by a natural person directly or through controlled companies, trust companies (fiduciarie) or a nominee.
2. Control: if the ownership structure does not unambiguously identify anyone, whoever controls the majority of votes in the ordinary shareholders' meeting, or sufficient votes for a dominant influence, or has contractual ties that enable it.
3. Residual criterion: if even this does not unambiguously identify anyone, the beneficial owner coincides with whoever has powers of legal representation, administration or management of the company.

Two points often overlooked. First: you keep a record of the checks made to identify the beneficial owner and, if you reach the residual criterion, also of the reasons why the first criteria did not work (art. 20, paragraph 6). Second: if you find yourself objectively unable to complete customer due diligence, you must refrain from establishing or continuing the relationship and assess whether to make a report of suspicious transaction (art. 42, paragraph 1).

The register is suspended: what changes for you

Legislative Decree 231/2007 provides that obliged parties, after accreditation with the Chamber of Commerce, access the information on beneficial ownership communicated to the register, solely in support of customer due diligence (art. 21-ter). But in October 2026 consultation by third parties remains suspended pending the decision of the Council of State (Consiglio di Stato): the updated status and the stages are in the guide on who can consult the register of beneficial owners.

Even when it reopens, the register will not replace your check: the same provision requires accredited obliged parties to report to the Chamber of Commerce any inconsistencies between what appears in the register and what was acquired during customer due diligence (art. 21-ter, paragraph 7). It is one more source to compare, not an answer to copy.

The sources for reconstructing it today

• The customer's declaration: customers provide in writing, under their own responsibility, all the necessary and up-to-date information for customer due diligence (art. 22, paragraph 1). Companies with legal personality must obtain and keep adequate, accurate and up-to-date information on their beneficial ownership and provide it to the obliged parties (art. 22, paragraph 2); the directors acquire it also from accounting records, financial statements, the shareholders' register and communications on the ownership structure (art. 22, paragraph 3).
• The Companies Register: shareholders, shares and offices of the customer company, to be compared with the declaration. If another company appears among the shareholders, repeat the check on that one, level by level, down to the natural persons. Steps and do-it-yourself costs are in the guide on how to see the beneficial owner of an srl.
• The company's documents: articles of association, agreements that attribute voting or control rights, shareholders' register. These are the information needed when the ownership criterion is not enough and you must assess control.

The typical case in which the Companies Register is not enough is a shareholding registered to a trust company (società fiduciaria): the extract shows the trust company, not who stands behind it, whereas art. 20 also considers indirect ownership through trust companies. There, the information must come from the customer's declaration, and you assess it.

Where Veryfy helps, and where it does not

The Beneficial owner micro-product reconstructs from the Companies Register the persons with a relevant office or shareholding in the customer company and shows them with role, source and date: an external check to be compared with the customer's declaration, with a date to keep in the file. If you also need the chain of shareholdings and related companies, the full report follows ownership up to three levels when a relevant shareholder is itself a company.

Veryfy, however, does not:

• identify the customer or the beneficial owner by document, nor verify their identity;
• run checks on politically exposed persons or sanctions lists;
• profile the risk, assess the purpose and nature of the relationship, keep the data or decide whether to refrain or to report;
• consult the register of beneficial owners, to which it has no access: the reconstruction starts from the company register data, and behind a trust company it shows the trust company.

These obligations remain yours, as does the choice of sources and how to document them according to the rules of your profession. When you purchase, you declare the purpose, as provided by the Code of Conduct for commercial information services (Codice di condotta per le informazioni commerciali) (see the privacy notice).