Understanding Beneficial Ownership

Beneficial ownership refers to the individuals who ultimately own or control a company or asset. Knowing the beneficial ownership of a company or asset is critical for businesses and financial institutions to identify and mitigate potential risks such as money laundering, fraud, and terrorism financing. In some cases, it is not enough to identify only the beneficial owner of a primary entity - Cadmium Pay is also required to collect beneficial ownership information for secondary or parent entities.

This article explains the beneficial ownership information requirements according to the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) guidance.

This article will review:

• Why we collect beneficial ownership information
• The beneficial ownership mandate
• Beneficial ownership: core elements
• Variants and exceptions
• Updating beneficial owner information
• Beneficial ownership information matrix

Why We Collect Beneficial Ownership Information

Collecting beneficial ownership information for parent entities helps Cadmium Pay understand the ownership structures and control of primary entities, identifying ultimate controllers and potential funding sources. This is crucial for multi-layered ownership, where it helps surface risks such as money laundering.

Compliance with legal requirements is also essential, and failure to comply can lead to severe penalties. Collecting this information mitigates risk, supports compliance, and provides a comprehensive understanding of ownership.

The Beneficial Ownership Mandate

FinCEN’s regulations under the Bank Secrecy Act clarify and strengthen customer due diligence requirements for financial institutions, a crucial step in enhancing the integrity of financial systems. Although Cadmium Pay does not fall under these regulations, its Sponsor Banks are subject to them. These banks have proactively adopted the Customer Due Diligence (CDD) Rule before creating merchant accounts, ensuring they maintain compliance with the latest standards.

The CDD Rule, which amends Bank Secrecy Act regulations, promotes financial transparency to prevent the misuse of financial systems by criminals and illicit actors. By clarifying and reinforcing the due diligence obligations for U.S. banks, mutual funds, and securities brokers, the CDD Rule creates a more secure financial environment. Institutions covered by these regulations must identify and verify the beneficial owners of legal entity customers opening accounts. This combats money laundering and financial crime by vetting those who ultimately control these entities.

The CDD Rule has four requirements. Covered financial institutions must establish and maintain written policies and procedures that are reasonably designed to:

1. Identify and verify the identity of customers.
2. Identify and verify the identity of the beneficial owners of companies opening accounts.
3. Understand the nature and purpose of customer relationships to develop customer risk profiles.
4. Conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

To collect beneficial ownership information, financial institutions are required to identify and verify the identity of any individual who owns 25% or more of a legal entity, and any individual who exercises control over that legal entity. This method is called the two-prong approach.

Beneficial Ownership: Core Elements

Beneficial ownership consists of two key components: the ownership prong and the control prong. With a few limited exceptions outlined in the Variants and exceptions section below, Cadmium Pay is required to conduct due diligence on both of the following types of individuals linked to merchant accounts.

Beneficial Owner(s) (“Ownership Prong”)

An ownership prong is an individual who, directly or indirectly, holds 25% or more of the equity interests in a merchant — whether through a contract, arrangement, understanding, relationship, or other means. These individuals must be identified as ownership prongs. Doing so may require a thorough examination of multiple layers of legal entities to identify each individual who meets these criteria. Ownership prongs are commonly referred to as owners for short.

At a minimum, the following information about the individual or individuals must be collected, verified, and screened:

1. Legal name
2. Date of birth
3. Address (residential or business street address)
4. Social Security Number (SSN)
   • For non-U.S. persons without an SSN or Individual Taxpayer Identification Number (ITIN): their foreign passport number and country of issuance, or similar identification.

Individual with Significant Responsibility (“Control Prong”)

A control prong is an individual with significant responsibility for managing the merchant, or significant responsibility to enter the company into a contract with Cadmium Pay, such as an executive officer or senior manager. A control prong is commonly referred to as a controlling authority for clarity.

For example: a Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Managing Member, General Partner, President, Vice President, Treasurer, or any other individual who regularly performs similar functions. These individuals with significant responsibility for the merchant must be identified as a control prong.

At a minimum, the following information about the individual must be collected, verified, and screened:

1. Legal name
2. Date of birth
3. Address (residential or business street address)
4. SSN
   • For non-U.S. persons without an SSN or ITIN: their foreign passport number and country of issuance, or similar identification.
5. Title

Signing Authorities

A signing authority can be either an owner or a controlling authority within a company who has the legal power to sign contracts and other binding documents on behalf of the merchant. These individuals are typically executives or senior managers entrusted with making significant decisions. Identifying those with signing authority is crucial for ensuring that only authorized personnel can enter into agreements, which reduces the risk of unauthorized transactions and maintains the integrity of the company’s operations.

While signing authorities designate the power to execute specific actions, the control prong is about overarching management and decision-making within the organization. An individual can hold both roles, but they serve different purposes in terms of beneficial ownership compliance.

Variants and Exceptions

The following types of merchants are subject to alternative requirements, as described below:

• Sole proprietors
• Nonprofits
• Excluded legal entities
  • This includes government entities, certain publicly traded corporations, and financial institutions.

Sole Proprietors

The following information about the sole proprietor must be collected, verified, and screened against the Office of Foreign Assets Control (OFAC) sanctions and watchlists, and the Mastercard Member Alert to Control High-risk Merchants (MATCH) list:

1. Legal name
2. Date of birth
3. Residential address
4. SSN
   • For non-U.S. persons without an SSN or ITIN: their foreign passport number and country of issuance, or similar identification.

Nonprofits

Nonprofit corporations or similar entities — such as charitable, not-for-profit, nonstock, or public benefit corporations that have filed organizational documents with the appropriate state authority — are excluded from the specific ownership prong requirements.

1. Legal name
2. Date of birth
3. Address (residential or business street address)
4. Social Security Number (SSN)
   • For non-U.S. persons without an SSN or ITIN: their foreign passport number and country of issuance, or similar identification.

Excluded Legal Entities

Certain legal entities that are subject to significant regulatory oversight are excluded from both the ownership prong and the control prong requirements. Excluded legal entities include:

1. U.S. government entities.
2. U.S. publicly traded corporations and their wholly owned subsidiaries listed on the New York, American, or NASDAQ stock exchanges.
3. Regulated U.S. financial institutions, including their holding companies.
4. U.S. state-regulated insurance companies.
5. Public accounting firms registered under Section 102 of the Sarbanes-Oxley Act.

Updating Beneficial Owner Information

Cadmium Pay is required to maintain risk-based processes and procedures for updating beneficial owner information. At a minimum, beneficial owner information must be updated, or investigated and confirmed current, in the event of any of the following risk triggers:

1. A change of ownership prong.
2. A change of control prong.
3. A change to the merchant’s business legal name, tax ID, or legal entity incorporation status.
4. An indication that a presumed sole proprietor is, in reality, not a sole proprietor. This may include the presence of additional parties exercising control over the merchant account, findings from public domain reviews, or an increase in payment card transaction volume.

Beneficial Ownership Information Matrix

Use the matrix below to determine which individuals require information collection, and which data elements are required, based on the merchant’s entity or business type.