Anonymising Beneficial-Ownership Files for AML Review – UK GDPR-compliant anonymisation per Money Laundering Regulations 2017
A beneficial-ownership identification file is the due diligence record MLR 2017 Regulation 28 requires to trace natural persons who own or control a corporate customer — typically those holding 25 percent or more of shares. ECCTA 2023 increased UBO scrutiny; the FCA fined NatWest £264.8 million in 2021 for inadequate UBO identification. anonym.legal pseudonymises personal identifiers while preserving ownership structure and control-tracing methodology.
When this applies
This task applies when beneficial-ownership files are reviewed by second-line compliance, quality assurance, or external audit functions assessing whether the firm has adequately identified and verified all persons with significant ownership or control under MLR 2017, and those reviewers require the structural methodology rather than individual identities.
How anonym.legal handles it
- Upload the beneficial-ownership declaration, UBO register extract, and any supporting corporate structure chart.
- The engine identifies named UBOs, their nationalities, dates of birth, addresses, and ownership or control percentages.
- Each UBO and associated individual is pseudonymised consistently; ownership percentage thresholds, control mechanisms, and the tracing methodology are preserved.
- Verification-outcome records and any unexplained-ownership flags are preserved in clear text.
- A reversible mapping table is produced with UK/EU data residency.
- Release the pseudonymised file for compliance review; restore originals before any regulatory submission or counterparty disclosure.
What you provide
- Beneficial-ownership declaration or UBO register extract
- Corporate structure chart (if separate from the declaration)
- Compliance officer's UBO-verification notes
Limitations & cautions
- Beneficial-ownership information submitted to regulators or correspondent banks must contain the real identities; the pseudonymised file is for internal review only. UK GDPR maximum fines reach up to £17.5 million or 4 percent of annual global turnover under DPA 2018 s.157.
- The tool does not verify whether the UBO identification methodology meets the 25 percent threshold requirements of MLR 2017 Regulation 28 or the ECCTA 2023 identification doctrine.
- Complex multi-tier ownership structures should be reviewed post-processing to confirm that the pseudonymisation has not disrupted the structural narrative.
FAQ
Does the tool handle nominee shareholder arrangements?
Named nominees and the beneficial owners on whose behalf they act are each pseudonymised individually with distinct pseudonyms, preserving the nominee/beneficial-owner relationship structure.
Are trust structures covered as well as corporate ownership chains?
Yes. Named trustees, settlors, and identified beneficiaries in trust structures are detected and pseudonymised. The trust's structural relationship to the corporate customer is preserved.
Can a pseudonymised UBO file be used to train staff on complex ownership structures?
Yes. Pseudonymised UBO files that preserve the ownership percentages, control mechanisms, and tracing methodology are valuable training materials for demonstrating how to work through complex structures. MLR 2017 Regulation 39 requires regulated-sector firms to provide AML training at appropriate intervals, and UBO case studies are particularly effective for illustrating multi-layered control arrangements.