FATF Recommendation 24 and 25 Explained: The Standard Behind Every UBO Law

Every jurisdiction post on this blog eventually says some version of the same sentence: this country is “FATF compliant,” or it just exited the “FATF grey list.” Read across enough of them and a pattern breaks. The UK runs a public register. Panama runs a private one. The Isle of Man runs neither, in the conventional sense — it runs a database fed by a company officer. All three claim to satisfy the same standard. All three are right.

That is not a coincidence, and it is not regulatory laxity. FATF Recommendation 24 and Recommendation 25 — the Financial Action Task Force’s two standards covering beneficial ownership of legal persons and legal arrangements — were written as outcome-based rules. They specify what a country’s authorities must be able to obtain. They do not specify the one mechanism that gets them there. A beneficial owner, or ultimate beneficial owner (UBO), is the natural person who ultimately owns or controls an entity or arrangement, however many layers sit in between; FATF’s standard is the reason every country on earth is now expected to be able to name that person, and the reason so few of their mechanisms for doing so look alike.

01Everyone cites the standard. Almost nobody quotes it.

Search “FATF compliant beneficial ownership” and the phrase shows up in central-bank circulars, correspondent-banking questionnaires, and onboarding forms at verification vendors worldwide. It functions as a stamp: this country’s regime is legitimate. But FATF itself does not issue compliance stamps for individual laws. It issues 40 Recommendations — the global AML/CFT (combating the financing of terrorism) standard, first published in 1990 and periodically revised — and then grades each of its roughly 200 member and cooperating jurisdictions against them through mutual evaluations.

Two of those 40 Recommendations do the beneficial-ownership work: Recommendation 24 covers legal persons (companies, foundations, and similar entities); Recommendation 25 covers legal arrangements (trusts and functionally equivalent structures). Neither Recommendation is a register requirement in the way it is usually described. Both are read-access requirements, with the mechanism left to the country.

02What Recommendation 24 actually requires

Recommendation 24 requires countries to identify, assess and mitigate the money-laundering and terrorist-financing risks of legal persons, and then to ensure that competent authorities — law enforcement, supervisors, financial intelligence units, tax authorities — can obtain, or have access to, beneficial ownership and control information that is adequate, accurate and up-to-date, and can get it in a timely manner. That four-word test — adequate, accurate, up-to-date, timely — is the actual bar. It is repeated almost verbatim across FATF’s guidance and its 2022 Interpretive Note revisions.

Three details matter more than the headline:

1. “Beneficial owner” has one legal meaning across the whole standard. It is the natural person who ultimately owns or controls a legal person, whether that control is direct, indirect through ownership layers, or exercised through other means such as informal arrangements. A registered shareholder is a legal owner. Only a flesh-and-blood person who ultimately benefits from or directs the entity is a beneficial owner. Conflating the two is the single most common error in beneficial-ownership reporting, on either side of the register.

2. Coverage extends beyond domestic entities. The 2022 revision requires countries to cover foreign-created companies that have a “sufficient link” to the country — a deliberately undefined term FATF leaves each jurisdiction to interpret against its own risk profile.

3. Nominee arrangements are named explicitly. Countries must apply at least one of three sanctioned mechanisms to nominee shareholders and nominee directors: a transparency requirement (the nominee discloses their nominee status and the nominator’s identity to a register or alternative mechanism), a licensing requirement (nominee services can only be offered by a licensed provider that records the same information), or an outright prohibition of nominee arrangements. Under either of the first two, the nominee and the person actually instructing them become identifiable — closing a gap that had let nominee structures function as a beneficial-ownership shortcut.

03What Recommendation 25 actually requires

Recommendation 25 does for trusts and equivalent legal arrangements what Recommendation 24 does for companies, with one structural difference: a trust has no shareholders to disclose. It has a settlor, one or more trustees, and beneficiaries or classes of beneficiaries, plus anyone else who holds effective control.

The February 2023 revision brought R.25’s requirements broadly into line with R.24’s, after years in which trusts were the visibly softer half of the standard. Trustees, or persons holding an equivalent position in a functionally similar arrangement, must now obtain and hold basic information on the arrangement and adequate, accurate and up-to-date beneficial-ownership information — covering the settlor, the trustee(s), any protector, the beneficiaries or classes of beneficiaries, and any other natural person exercising ultimate effective control. That information must be available to competent authorities within the same timely-access standard as R.24.

For KYB (know-your-business) and identity-verification teams, this matters because a trust sitting above a corporate shareholder used to be a dead end in a lot of jurisdictions. Under the revised R.25, it increasingly is not supposed to be.

04The three sanctioned approaches, and why “multi-pronged” is the operative word

This is the part the “FATF compliant” shorthand skips entirely. The Interpretive Note to Recommendation 24 does not tell countries to build a register. It tells them to run a mandatory company-obtained-information requirement alongside a register or an alternative mechanism, topped up with existing-mechanism sources where risk warrants it, because FATF’s own analysis found that relying on a single source of beneficial-ownership data is consistently less reliable than triangulating several:

Approach A — Register. A public authority (a registry, a regulator, or an equivalent body) holds beneficial-ownership data centrally. FATF’s 2022 revision pushes hard toward this model — its own research found registries deliver the fastest, most reliable authority access — but stops short of mandating that the register be public. “Public authority holds it” and “the public can see it” are two different design choices, and the standard only compels the first.

Approach B — Company-obtained information. Every legal person must itself obtain and hold adequate, accurate beneficial-ownership information, and keep it current. Unlike the register prong, this one is not optional or substitutable. It is the floor under every other approach: even a country with a excellent central register still requires companies to keep their own records, so that a registry failure or a data gap doesn’t leave authorities with nothing.

Approach C — Existing mechanisms. Countries may draw on beneficial-ownership data already collected elsewhere: customer due diligence records held by banks and DNFBPs (designated non-financial businesses and professions, such as law firms, accountants, and company formation agents), information held by other competent authorities, or disclosure obligations for companies listed on a stock exchange.

A country can be a model FATF performer with a fully public register, a closed one, or effectively no dedicated register at all — provided the combination of mechanisms it runs actually delivers timely, adequate, accurate, up-to-date information to its authorities. That is the entire test.

05Why FATF wrote an outcome, not a blueprint — and what that costs verifiers

FATF could have written Recommendation 24 as “every country shall maintain a public central register of beneficial ownership.” It didn’t, and the omission is deliberate rather than diplomatic cowardice. Three reasons show up consistently in FATF’s own consultation record.

First, legal systems differ too much for one mechanism to fit all of them. Common-law trust jurisdictions, civil-law company registries, and federal systems with state-level incorporation (the United States being the clearest case) don’t share a single administrative layer that a uniform register mandate could plug into. Second, FATF’s own 2019 best-practices report on beneficial ownership found that countries using several complementary sources caught more discrepancies than countries relying on one, even a well-built one — which is the empirical basis for the multi-pronged requirement rather than a single-register mandate. Third, a hard mandate for public registers ran into sustained resistance during the 2022 consultation from jurisdictions citing privacy law and proportionality concerns, and FATF’s final text reflects that compromise: it pushes strongly toward centralization and access, but leaves the public/non-public choice, and the register/alternative-mechanism choice, to national risk assessment.

The cost of that flexibility lands squarely on verifiers, not on FATF’s evaluators. A mutual evaluation asks whether a country’s authorities can get timely, accurate data. It does not ask whether a bank’s onboarding team, a KYB platform, or a due-diligence analyst outside that country’s borders can get the same thing. Two countries can both score well on Recommendation 24 while one hands an outside verifier a downloadable public register and the other hands them nothing they can reach without a formal request through a domestic authority. “FATF compliant” is a statement about government access. It is not a statement about your access.

06One requirement, two mechanisms: the UK and the Isle of Man

Two jurisdictions already covered on this blog make the divergence concrete, because both satisfy the same register prong of Recommendation 24 through mechanisms that could not look more different.

The United Kingdom’s People with Significant Control (PSC) register, run by Companies House, is fully public. Any company incorporated in the UK files its own PSC data directly, and anyone — a competitor, a journalist, a bank, a verification platform — can search it for free. The trade-off is verification depth: for most of the register’s life, Companies House recorded what companies told it without independently confirming it was true, and identity-verification duties are only now being phased in under the Economic Crime and Corporate Transparency Act. The UK’s design optimizes for reach.

The Isle of Man’s Database of Beneficial Ownership, created under its Beneficial Ownership Act 2017, inverts that trade-off. Every company must designate a nominated officer, who must take reasonable steps to determine the true ownership and control structure, verify what they find, and only then submit it to the central Database. The Database itself is not public: access is limited to nominated officers checking their own company, the Isle of Man’s authorities, law enforcement through formal channels, and, since December 2024, obliged entities running customer due diligence. The Isle of Man’s design optimizes for verified accuracy, at the direct cost of open access.

Neither country is cutting a corner. Both are picking a point on the same access-versus-verification trade-off that Recommendation 24 leaves open by design. A verifier working across both jurisdictions has to know that going in, because pulling data from one tells you almost nothing about how to get equivalent data from the other.

07Which approach, where: a cross-jurisdiction view

Zoom out across the jurisdictions already covered on this blog and the same three-approach menu keeps reappearing in different combinations.

Read down that table and “FATF-sanctioned” stops looking like a single design and starts looking like a menu with real consequences for anyone outside the country trying to order from it.

08What “FATF grey-listed” actually measures — and doesn’t

The grey list is a different FATF process entirely, and conflating it with Recommendation 24/25 compliance is the second most common error in this space. Formally, it’s the outcome of FATF’s International Co-operation Review Group (ICRG): a public list of jurisdictions under “increased monitoring” because they have strategic deficiencies in their AML/CFT regimes and have committed, in writing, to an action plan to fix them within a set timeframe. Beneficial ownership weaknesses are a frequent driver of grey-listing, but so are terrorist-financing controls, sanctions implementation, and a dozen other technical areas unrelated to who owns a company.

A country can score poorly on Recommendation 24 specifically without being grey-listed, if its overall risk profile and other technical scores keep it off the ICRG’s radar. A country can also exit the grey list, as several posts on this blog have covered, while its beneficial-ownership regime remains a work in progress on paper — the exit criterion is the action plan being substantially complete, not every Recommendation scoring “compliant.” Turkey’s 2024 grey-list exit is a case in point: it followed specific, named reforms, Recommendation 24 among them, rather than a wholesale beneficial-ownership overhaul.

09How a country’s Recommendation 24/25 score actually gets set

FATF assesses each jurisdiction twice over in a mutual evaluation, and the distinction between the two assessments explains why “the law looks good on paper” and “FATF says it works” are not the same claim.

1. Technical compliance rates whether the country’s laws and regulations contain what Recommendation 24 and 25 require, on a four-point scale from Compliant down to Non-Compliant. This is a paper check: does the statute say the right things.

2. Effectiveness, assessed separately under Immediate Outcome 5 (IO.5) of FATF’s evaluation methodology, asks whether beneficial-ownership information is actually available to authorities in practice, and whether they use it. A country can pass the technical-compliance check with a well-drafted law and still score low on IO.5 if the register is unpopulated, the data is stale, or nobody queries it. This split is exactly why “the law transposes FATF’s standard” and “the standard works here” need to be checked independently, not inferred from each other.

10What the public record actually yields, even where the standard is fully met

Even in jurisdictions running a technically compliant multi-pronged approach, “adequate, accurate, up-to-date” access for authorities does not automatically translate into a named natural person showing up in the parts of the record an outside verifier can reach. Zavia’s dataset (live query, run September 30, 2026), drawn from a stratified sample of 250 companies across ten countries — the United States, New Zealand, the United Kingdom, the Netherlands, Germany, Italy, Singapore, Spain, France and Ireland — illustrates the gap between the standard’s promise and what actually surfaces:

This replaces a fixed, single-snapshot figure from an earlier version of this piece. The direction holds — most jurisdictions still don’t surface a usable shareholder list — but the live numbers land lower on non-disclosure (60% vs. an earlier 86%) and higher on multi-entity structure (72% vs. 26.5%), reflecting both a different, more internationally weighted sample and a live group-structure query that captures parent and subsidiary relationships the earlier snapshot didn’t measure the same way. The natural-person figure also carries a caveat: for large or listed companies, the same data field sometimes tags institutional asset managers — not individuals — as “natural persons,” so 16% is best read as a ceiling rather than a clean count.

None of this is a failure of Recommendation 24 or 25 on their own terms — the standard governs what a country’s authorities can obtain, not what a bank in a different country can scrape off a public web page. But it is the reason “the jurisdiction is FATF compliant” cannot be read as “the beneficial owner is one search away.”

11What this means for a KYB or onboarding team, in practice

Reading a country’s Recommendation 24/25 posture correctly, before you build a verification workflow around it, comes down to four checks.

1. Identify which of the three approaches is primary. Don’t assume “register” by default — confirm whether the jurisdiction’s primary mechanism is a public register, a restricted one, a company-held record, or a reliance on existing AML data from regulated entities.

2. Separate technical compliance from effectiveness. A Recommendation 24 rating of “Compliant” describes the law. Check whether the same jurisdiction’s Immediate Outcome 5 rating describes a register that is actually populated and used.

3. Check who is allowed to query the mechanism, not just whether it exists. A closed database that only nominated officers and domestic authorities can reach, like the Isle of Man’s, requires a different verification path than an open register, even though both satisfy the same Recommendation.

4. Do not treat grey-list status as a beneficial-ownership score. Grey-listing and delisting turn on a country’s overall ICRG action plan, which may or may not center on Recommendation 24 or 25. Check the specific technical-compliance rating for the Recommendation you care about, separately.

12Glossary

13Frequently asked questions

For how Recommendation 25 applies specifically to trusts, see Who Is the Beneficial Owner of a Trust?. For the nominee-disclosure option INR.24 describes, see Nominee Directors and Nominee Shareholders. For the ownership-aggregation mechanics this standard underlies, see Sanctions Screening and Beneficial Ownership.