Designing verification systems: A sample implementation checklist for beneficial ownership data

Introduction

Open Ownership (OO) has previously set out the principles and concepts that underpin beneficial ownership data verification systems. There is no one-size-fits-all solution, and the right verification system for a particular disclosure regime will depend on the specific local context and level of ambition.

This document provides a suggested tasklist for implementing a very wide range of verification mechanisms. Not all mechanisms may be necessary, relevant or feasible in all jurisdictions, nor does this checklist comprehensively cover all possible verification mechanisms. It is intended to help implementers think-through and consider a wide range of verification approaches, and potential associated tasks.

Furthermore, there is scope for additional iterative improvements to verification systems beyond those mentioned below. OO’s data analysis tools, for example, can assist with conducting meta-analyses of data and helping to identify common data quality issues that may then be addressed via reforms to regulations, software or data collections systems.

Tasks

Preparatory tasks

Verification at the point of submission

Form and system design

Guidance and checks

Verification after submission

Preparatory tasks

1. Assess overall aims for verification systems, including the desired level of data assurance sought by different user groups. Understanding data needs, together with the extent of available resources and capacity, will inform the scale of ambition for verification plans.

2. Decide how beneficial ownership data will be structured within the main register, for example, by using the Beneficial Ownership Data Standard. Structured data is a key requirement for enabling the subsequent introduction of automated checks on specific fields of data.

3. Decide on whom the legal obligation for submitting accurate data will fall e.g. company officers / beneficial owners, notaries, lawyers or other independent intermediaries (see verification briefing, pp 5-6 for the comparative advantages of the different approaches).

4. For individuals submitting beneficial ownership information, consider how to verify that the person is authorised to submit the information and licensed, in the case of notaries, lawyers etc. Different systems and supporting evidence may be required for foreign and domestic nationals/entities.

5. Develop guidance for regulated entities, registrars and any third parties involved in submitting or checking BO information on how to determine and calculate beneficial ownership, including when ownership or control is exercised indirectly.

6. Consider how verification mechanisms will work in tandem with the sanctions regime, including by helping to identify potentially incorrect, fraudulent, or incomplete submissions.

7. Ensure that the registrar or other relevant authority has the legal mandate to query and remove information, investigate suspected discrepancies and issue administrative fines in cases of non-compliance or submission of incorrect information.

8. Prepare for the introduction of a system of automated cross-checks of beneficial ownership data by:

• Conducting an audit of the data schemas used by other relevant existing state registers (e.g. tax, national ID systems etc) and seeing which fields overlap, and could theoretically be cross-referenced, with beneficial ownership data fields.
• Evaluating the feasibility of such checks by assessing the technical and legal infrastructure in place that would facilitate inter-agency data sharing.
• Addressing any obstacles to data sharing between government agencies, including by advancing legal reforms, for those registries that will be included in the verification system.

Verification at the point of submission

Form and system design

1. When designing systems for collecting and storing beneficial ownership data, restrict data entry options for certain fields so that data conforms to expected format and patterns (see also beneficial ownership form design guidance). For example:

• Restrict characters entered into the personal ID number, email address and phone number fields to the relevant format.
• Only allow a date to be entered to the birth field and ensure it falls within expected ranges (e.g. not a 5 year old beneficial owner or a 200 year old one).
• Prevent the total ownership shares in a given company from exceeding 100%.
• Ensure addresses conform to possible values using national address registers where available (i.e. street name and number exist and match postcode).

2. Auto-complete and pre-fill fields in the declaration form wherever possible.

3. Provide selection lists rather than free-text entry where relevant, for example:

• For the list of countries where a beneficial owner or company address is registered, or for their nationality and tax residency fields.
• For explaining the means by which an individual exercises their ownership or control over a given legal entity.
• For the legal form of the declaring entity e.g. limited liability company, publicly listed company, etc
• For countries without universal ID cards, the type of personal ID supplied e.g. passport, driving license, tax or national insurance numbers.
• For a list of reasons why the declaring entity is not submitting its beneficial ownership information e.g. it is exempt for the reasons listed under local legislation.

4. For domestic beneficial owners, ensure the information reflects values that actually exist and are real by cross-checking against authoritative systems and other government registers wherever possible. For example:

• Cross-check company numbers with the company registry.
• Compare against national ID numbers to check that the person is real and has the same DOB.
• Check the state address register/civil register/electoral roll to verify address and check the person isn’t deceased.

Guidance and checks

1. Produce guidance for notaries, lawyers, bankers, auditors and/or registrars on the manual checks they should apply when entering information (including whether they need to have hard copy access to proof of address; passports, share certificates, articles of association etc).

2. If submissions and the accompanying supporting evidence are to be checked manually by state registrars, arrange capacity building programmes for these officials to ensure checks are carried out consistently and to a high standard.

Verification after submission

1. Ensure data in the register is frequently checked. This could include via mechanisms such as:

• Making data available to the public.
• Creating a mechanism that enables users to report inaccuracies or discrepancies identified in published BO data. Note: this is a legal requirement for obligated entities in some jurisdictions.
• Performing periodic manual checks on a sample of submissions, mainly prioritising high-risk submissions complemented by some random checks.

2. Ensure information suspected of being incorrect is investigated. This could include:

• Using a risk-based approach to triage follow up on suspected discrepancies and errors reported by users. Where incorrect information is identified, the state agency in charge of the register would then prompt the declaring company to update or correct its entry within a defined timeframe, or face sanctions.
• Develop and maintain a system of red-flagging BO submissions for potential further review, even where these are not otherwise reported as suspicious by users. This could include, for example, examining entities which report no beneficial owner or where a large number of companies have the same registered address.
• Update this red-flagging system periodically, using evidence of previous cases of wrongdoing within the country and emerging trends to inform the underlying risk analysis. Where sufficient resources exist, consider the introduction of machine learning software to assist with this.

3. Ensure data is kept up to date. This should include by:

• Introducing legal requirements for declaring entities to update beneficial ownership information soon after any changes in ownership structure.
• Enforcing sanctions in cases of non-compliance to ensure information is kept up-to-date.