Indirect ownership exists when a person controls a company through one or more intermediary entities rather than holding shares directly. Tracing indirect ownership is essential in UBO analysis because the true controlling individual may sit several layers away from the legal entity being onboarded.
What indirect ownership means in practice
Indirect ownership is a control relationship, not a simple name-on-share certificate test. A person may sit behind one holding company, a trust, a nominee arrangement, or several corporate layers, yet still exercise ownership or control for legal, compliance, and onboarding purposes. The key question is who ultimately benefits from or directs the entity.
That is why indirect ownership matters in UBO analysis. A surface-level register can miss the real decision-maker if analysts stop at the first legal entity in the chain. In practice, ownership tracing has to follow each intermediary until the controlling person, controlling group, or point where control no longer remains attributable is clear.
Why layered control structures create due diligence complexity
Layered ownership structures increase the chance of incomplete due diligence because every intermediary can change the legal, tax, and reporting picture. A company may appear simple at first glance, but the effective ownership path can become complex across jurisdictions, share classes, voting rights, or contractual control rights. That complexity is exactly what makes indirect ownership hard to misread and easy to miss.
Indirect ownership also creates ambiguity when legal ownership and control do not move together. Someone may hold a minority economic interest while still exerting decisive influence through voting arrangements, board rights, or other governance mechanisms. For analysts, the practical challenge is separating nominal shareholding from the control path that matters for compliance and risk decisions.
How indirect ownership is traced
Tracing indirect ownership starts with a complete ownership map: the onboarded entity, every intermediate entity, and the percentage or control interest at each layer. Analysts then test where control actually flows, including whether any intermediary is itself controlled by another entity or person. The goal is not just to draw a structure, but to establish who stands behind it.
That work usually depends on corroborating sources, not a single document. Corporate filings, shareholder registers, constitutional documents, registers of beneficial ownership, and customer-provided declarations can each reveal part of the chain. Where the structure is cross-border or opaque, the analysis often becomes iterative, because one layer may only make sense after the layer above it is understood.
Why indirect ownership matters for governance and control
Indirect ownership affects who must be screened, approved, escalated, or reported in a governance workflow. If the wrong person is treated as the owner, an organisation can understate exposure to sanctions, corruption, tax, or reputational risk. It can also misclassify control, which weakens the integrity of ownership-based decisions across onboarding and periodic review.
It also matters operationally because indirect ownership can change over time without an obvious public signal. A change in an intermediate holding entity may alter beneficial ownership, control rights, or disclosure obligations even when the operating company looks unchanged. Good governance therefore treats ownership tracing as an ongoing control, not a one-time paperwork exercise.
Risk and Threat Considerations
Indirect ownership creates concealment risk because intermediary entities can obscure who really controls an organisation. That can weaken sanctions screening, anti-corruption checks, source-of-funds review, and beneficial ownership transparency, especially where the ownership chain crosses jurisdictions or uses nominee structures.
Failure mechanism: The control path is broken when analysts rely on first-layer ownership, incomplete disclosures, or outdated corporate records, allowing the ultimate controller to remain hidden behind multiple entities.
Impact: An organisation may onboard the wrong counterparty, miss a prohibited or high-risk relationship, or make governance decisions on an inaccurate picture of who ultimately owns or controls the entity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST SP 800-63 set the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Ownership tracing depends on understanding counterparties and control relationships. |
| Recommendation — Map ownership chains into your organizational context records and update them when control changes. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Beneficial-owner and counterparty records need controlled lifecycle updates and review. |
| Recommendation — Establish ownership record maintenance and periodic review procedures for onboarding and monitoring. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | Indirect ownership analysis depends on an accurate inventory of entities and relationships. |
| Recommendation — Keep entity and ownership records current so layered control can be traced reliably. | ||
| NIST SP 800-63 | Digital Identity Guidelines | Identity proofing concepts inform how organisations corroborate who is behind an entity. |
| Recommendation — Use strong identity assurance where entity control must be attributed to a real person. | ||
| GDPR | Data protection by design and by default | When ownership tracing processes handle personal data, privacy-by-design matters to collection and retention. |
| Recommendation — Minimise and protect personal data collected during beneficial ownership investigations. | ||
Practitioner Guidance
Why practitioners should care: Indirect ownership should be treated as a control-tracing problem, not just a data-collection problem. The practical question is whether the evidence set is strong enough to support a defensible beneficial ownership conclusion, especially when control is spread across several entities or jurisdictions.
Common misunderstanding: A common error is assuming that a low visible shareholding means low influence. In ownership analysis, voting control, shareholder agreements, and intermediary control can matter as much as percentage ownership, so the first visible layer is rarely the full answer.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org