On September 15, 2026, Bangladesh's Financial Intelligence Unit told every brokerage house, merchant bank, portfolio manager, and securities custodian in its capital markets the same thing: knowing your customer's name is no longer the compliance bar. The directive requires these firms to stand up a Central Compliance Unit led by a named Chief Anti-Money-Laundering Compliance Officer — and, in the clause that matters most, to establish whether any influential person is among the beneficial owners associated with capital-market-related institutions.
Read narrowly, that is a Bangladesh capital-markets story. Read for what it actually signals, it is a preview of where AML and third-party due diligence are heading everywhere: past the registered entity, past the account holder's declared identity, and down into the layer of ownership and control that entity verification was never built to see. This piece walks through that directive, the wider regulatory picture it sits inside — one where the EU and the US are, on the surface, moving in opposite directions — and the ownership-tracing framework that closes the gap regardless of which government registry a firm happens to be relying on.
Most vendor and customer due diligence stops at the entity. See how an AI-powered vendor and third-party intelligence platform traces ownership, PEP exposure, and sanctions risk as one connected picture — not three separate checks.
Explore the TPRM PlatformThe BFIU Signal, and Why It Travels Beyond Bangladesh
BFIU's September directive is specific and operational, not aspirational. Capital-market intermediaries must appoint branch-level compliance officers, collect customer information from reliable primary sources — national ID, passport, birth registration — screen customers against UN and government sanctions lists, monitor transactions on an ongoing basis, file suspicious-activity reports through the GoAML system, run compliance self-assessments every six months, and retain records for five years after a relationship ends. Buried inside that list is the requirement that separates this directive from a standard KYC refresh: firms must actively determine whether an influential person — Bangladesh's term for a politically exposed person — sits among the beneficial owners tied to a capital-market institution, not merely whether the customer discloses one.
Why now, and why capital markets specifically? Brokerage and merchant-bank accounts are an efficient laundering vehicle precisely because they move value quickly and, historically, have drawn less beneficial-ownership scrutiny than direct banking relationships. A regulator closing that gap is not inventing a new risk — it is catching capital markets up to a standard that banking AML programs have applied for years, and that other capital-market regulators, from the EU to Gulf and Southeast Asian markets, are converging on at a similar pace. For any enterprise operating across jurisdictions, or transacting with intermediaries who do, the practical takeaway is the same regardless of geography: a customer or vendor's registered entity name is the beginning of due diligence, not the end of it.
Why Entity Identity Stops Short of the Actual Risk
Entity-level verification — confirming a company is legally registered, in good standing, and holds a valid tax identifier — is necessary and still frequently skipped. But it answers a narrower question than most compliance and procurement teams assume it does. It confirms the company exists. It says nothing about who actually owns or controls it, and control is where laundering risk, sanctions exposure, and undisclosed conflicts of interest actually live. A shell entity, a nominee shareholder structure, or a chain of holding companies registered across two or three jurisdictions can pass entity verification with a clean result while concealing exactly the person a beneficial-ownership check exists to find.
That is the distinction global standard-setters have built into the frameworks banks and regulated entities already operate under. FATF's recommendations on beneficial ownership treat identifying the natural person behind a legal entity as a distinct, mandatory control — separate from, and in addition to, standard customer identification. The reasoning is straightforward: sanctions lists and adverse-media checks are only as effective as the name entered into them, and if the name entered is a holding company rather than the individual actually controlling it, a real match never has the chance to fire.
Politically exposed persons — the influential persons in BFIU's language — add a second, distinct layer that sanctions screening alone does not cover. A PEP is not a sanctioned individual; holding or having held a prominent public office is not wrongdoing, and PEP status triggers enhanced scrutiny rather than an automatic block. But that position creates elevated exposure to bribery, corruption, and undue influence over the relationship — exposure that is invisible to a sanctions screen and invisible to entity verification, and visible only once a firm has actually traced who the beneficial owners are and checked each one against PEP and influential-person data specifically.
Crest's agentic AI layer connects entity verification, ownership tracing, PEP and sanctions screening, and adverse-media monitoring into one continuously refreshed risk picture — so a change three ownership layers deep surfaces the same week it happens, not at next year's review.
Three Regulators, Three Directions — One Underlying Signal
Set BFIU's directive alongside what the EU and the US did with beneficial ownership in the same twelve months, and a more interesting pattern appears than "regulation is tightening everywhere." It is not tightening everywhere, uniformly — it is fragmenting, and that fragmentation is itself the reason continuous, firm-level ownership intelligence matters more than reliance on any single government database.
The European Commission's new Anti-Money Laundering Regulation moves the beneficial-ownership threshold from "more than 25%" to "25% or more" — a small-sounding wording change that brings individuals holding exactly a quarter of an entity into scope for the first time — and gives the Commission discretion to lower that threshold to 15% for higher-risk structures. The regulation becomes fully applicable across all EU member states on July 10, 2027, backed by a new EU-level supervisor, AMLA, and centralized beneficial-ownership registers due to come online between 2027 and 2029. Read in isolation, this is Europe tightening.
The US moved the other way on paper. FinCEN's rule — issued as an interim final rule in March 2025 and made permanent in 2026 — removed the requirement for domestic US companies and their US-person beneficial owners to report ownership information to FinCEN's central Beneficial Ownership Information registry, narrowing that specific reporting obligation to foreign entities registered to do business in the US. Read in isolation, this looks like Washington loosening.
The two are less contradictory than they first appear. What the US narrowed was a specific federal registry-reporting requirement for small businesses — it did not touch the independent obligation banks, brokers, and other regulated entities already carry under existing customer due diligence rules to identify the beneficial owners of their own customers and counterparties. A registry can shrink in scope while the underlying due-diligence obligation on regulated firms stays exactly where it was, or grows, as it did in Bangladesh and the EU in the same window. Taken together, the three moves point at the same conclusion from three different angles: no single national registry is a complete, current, or permanently available source of beneficial-ownership truth, which means the firms actually carrying AML and third-party risk obligations cannot outsource that verification to whichever government database happens to still be maintaining it.
What the Divergence Actually Means for a Compliance or Risk Team
- Don't design a program around one jurisdiction's registry. BFIU tightened, the EU is tightening further from 2027, and the US narrowed a specific federal filing requirement in the same period — a program built to lean on any single registry inherits that registry's next policy change.
- The underlying due-diligence obligation on regulated firms hasn't loosened anywhere. Even where a public registry narrows, a bank, broker, or regulated counterparty's own duty to identify beneficial owners of its customers and vendors is unchanged or expanding.
- PEP and influential-person screening is now an explicit, named requirement in at least one major capital-markets jurisdiction, not an implied best practice — and it is unlikely to stay confined to Bangladesh.
- Ownership thresholds are moving down, not up — the EU's 25%-or-more standard, with discretion to fall to 15%, catches more individuals than the prior "more than 25%" test.
The Eight-Link Ownership Chain
The practical response to a fragmenting registry landscape is not a bigger spreadsheet — it is a repeatable chain that traces every customer, vendor, or counterparty relationship from the entity itself through to a documented decision, using the same eight links every time regardless of which jurisdiction's registry happens to be available or current.
Verify the Customer or Entity
Confirm legal registration, status, and registered directors using authoritative corporate registries — the starting point, not the finish line.
Map the Directors
Identify current and recently resigned directors, and check each for disqualifications, related directorships, and prior regulatory history.
Trace the Beneficial Owner (UBO)
Follow the ownership chain through any intermediate holding entities to the natural person or persons who ultimately own or control the entity.
Screen for PEP or Influential-Person Status
Check every beneficial owner, director, and known close associate against PEP and influential-person data — not only the customer's own declared status.
Screen for Sanctions Exposure
Run every beneficial owner, director, and the entity itself against current sanctions lists, and re-run the screen on every list update, not only at onboarding.
Check Adverse Media
Search structured and open-source coverage for beneficial owners and directors, surfacing allegations or enforcement actions no official list has caught up to yet.
Assess Relationship Risk
Combine entity, ownership, PEP, sanctions, and adverse-media findings into one weighted relationship risk rating, rather than isolated pass/fail checks.
Route to Approval or Enhanced Due Diligence
Send low-risk relationships through standard approval and flagged relationships into a documented EDD workflow, with a named owner and an auditable decision trail.
Two failure points show up repeatedly once firms try to run this chain manually across a large customer or vendor base. The first is stopping at link three: many programs verify a beneficial owner's identity once and never re-screen that specific individual again, even as sanctions lists, PEP registers, and adverse-media coverage all change weekly. The second is treating each link as an isolated check performed by a different team on a different schedule, so that a PEP flag raised by compliance never reaches the procurement team onboarding the same entity as a vendor six months later. KPMG's research on the future of due diligence makes a related point: the firms extracting real value from due diligence are the ones treating it as one connected, continuously updated intelligence layer, not a sequence of point-in-time approvals scattered across departments.
Continuous, Not Once
This piece sits alongside two related angles already covered on ownership and control risk, and it is worth being explicit about how it differs from both. Beneficial Ownership Verification: The Missing Layer in Vendor Due Diligence made the foundational case for why ownership tracing belongs in vendor onboarding at all. Your Supplier Isn't Sanctioned. Its Ultimate Controller Might Be. focused specifically on sanctions exposure hiding behind a UBO. This piece is about the layer both of those still leave largely unaddressed: PEP and influential-person exposure specifically, and — more importantly — the shift from a one-time ownership check to a continuously monitored one, which is what BFIU's directive, the EU's incoming registers, and the general direction of AML supervision globally are all converging on.
Agentic AI is what makes that continuity operationally realistic rather than aspirational. A standing agent can hold the full eight-link chain open for every active customer and vendor relationship simultaneously — re-screening beneficial owners, directors, and known associates against sanctions and PEP data on every list update, monitoring adverse-media sources continuously rather than on a review cycle, and flagging the moment an existing beneficial owner is newly appointed to public office, a nominee arrangement changes, or a new designation appears — then routing that flag straight into an evidence request or an enhanced-due-diligence workflow instead of waiting for a human analyst to notice it during next year's periodic review. What does not change is who decides what a flagged change means for the relationship: escalation, enhanced due diligence, or exit remains a named compliance or risk owner's call, informed by a complete and current picture rather than a snapshot that was already stale by the time anyone looked at it again.
That combination — a connected ownership chain and a monitoring layer that never stops watching it — is the practical answer to a fragmenting registry landscape. It does not matter whether a given jurisdiction's central registry expands, narrows, or lags behind reality for a stretch, because the firm's own verification does not depend on that registry being complete or current in the first place.
Crest Perspective
The gap between KYC at onboarding and AML in practice is fundamentally a data freshness problem. A beneficial ownership structure verified at vendor onboarding can change materially within months — through ownership transfers, newly sanctioned individuals acquiring stakes, or politically exposed persons entering the structure. Treating beneficial ownership as a point-in-time check rather than a continuous monitoring signal is the core compliance exposure in most third-party programmes today.
Frequently Asked Questions
Beneficial ownership verification identifies the natural person or persons who ultimately own or control a legal entity, directly or through a chain of intermediate holding structures, rather than stopping at the entity's registered name, tax identifier, or corporate filing. Entity-level verification confirms that a company legally exists and is in good standing; it says nothing about who actually stands behind it. A shell company, a nominee shareholder arrangement, or a layered holding structure can pass entity verification cleanly while concealing a sanctioned individual, a politically exposed person, or an undisclosed related party at the ownership layer. Global AML frameworks, including FATF's recommendations, treat beneficial ownership identification as a distinct, mandatory control precisely because entity identity and ultimate control are not the same fact.
On September 15, 2026, BFIU directed brokerage houses, merchant banks, portfolio managers, and other capital-market intermediaries to establish a Central Compliance Unit led by a Chief Anti-Money-Laundering Compliance Officer, and to establish whether any influential person is among the beneficial owners associated with capital-market-related institutions, alongside standard customer due diligence, sanctions-list screening, and suspicious-transaction reporting through the GoAML system. The directive matters well beyond Bangladesh because it is a clean, current example of a global pattern: AML supervisors are no longer satisfied with confirming who a customer or counterparty says it is; they are requiring firms to trace who influential, politically exposed, or otherwise high-risk individuals are behind the ownership structure, as a standing obligation rather than a one-time onboarding step.
The EU's new Anti-Money Laundering Regulation tightens beneficial-ownership identification, moving the ownership threshold from "more than 25%" to "25% or more," with discretion to lower it to 15% for high-risk structures, and standing up a centralized supervisor (AMLA) and beneficial-ownership registers due online between 2027 and 2029. The US moved differently: FinCEN's rule, finalized as permanent in 2026, removed the requirement for domestic US companies and US-person beneficial owners to report ownership information to FinCEN's central registry, narrowing that specific reporting obligation to foreign entities registered to do business in the US. The two are less contradictory than they look — the US narrowed a specific federal registry-reporting requirement, but banks, brokers, and other regulated US entities remain independently obligated under existing customer due diligence rules to identify beneficial owners of their own customers and counterparties. Together, the moves confirm that no single government registry can be relied on as a complete, current source of beneficial-ownership truth.
A politically exposed person (PEP) — what BFIU's directive terms an influential person — is an individual who holds or has held a prominent public function, or their close family members and known associates, a category built on the position someone occupies, not on any wrongdoing. Sanctions screening checks a name against government or multilateral lists of specifically designated individuals; it is a binary match. PEP screening is a risk-based judgment: a PEP is not prohibited from being a beneficial owner, but their position creates elevated exposure to bribery, corruption, and undue influence, which triggers enhanced due diligence rather than an automatic block. A comprehensive program screens for both, because a beneficial owner can be a PEP without being sanctioned, sanctioned without being a publicly known PEP, or undisclosed as either until someone actually looks past the entity's registered name.
A one-time UBO check confirms who owned and controlled an entity on the day it was performed, typically at onboarding or the next periodic review — often a year or more later. Ownership structures change continuously: shares transfer, nominee arrangements restructure, a beneficial owner is newly appointed to public office and becomes a PEP, or an existing owner appears in a new sanctions designation or adverse-media report. Continuous, AI-driven monitoring re-screens the full ownership chain against sanctions lists, PEP databases, and adverse-media sources on an ongoing basis, surfacing a change the moment it occurs rather than at the next audit cycle. The compliance decision of what to do with a flagged change still sits with a named risk owner; what changes is how quickly that owner learns there is a decision to make.