AML Verification in Practice: From Identity Checks to Ownership and Adverse Media

There is a difference between running checks and completing a verification. Most programmes do the former: an identity check here, a sanctions screen there, an ownership search when someone asks. Fewer can show the latter, a single documented decision that a reviewer can follow from the first identity document to the final risk rating. Asked what is AML verification, many teams would describe the AML checks they run. This article describes the sequence instead: identity and entity resolution, ownership and control, screening and adverse media, and how the three stages combine into one decision and one record.

Stage One: Identity and Entity Resolution

The first stage answers a narrow question: is this person or entity who they claim to be, and which one exactly. For an individual, identity verification confirms name, date of birth and address against reliable documents or data. For a corporate customer, entity resolution confirms the legal name, registration number, registered office, legal form and any trading names, and establishes that the entity applying is the one on the register rather than a similarly named company two jurisdictions away.

Disambiguation is the substance of this stage. Common names, transliterated names, group companies sharing a brand and dormant entities all produce candidates that look alike. Resolving them first means fixing the identifiers later stages will use: registration number rather than name, date of birth alongside name, registered rather than correspondence address.

Weak resolution here multiplies work everywhere else. A sanctions screen on an unresolved name returns every match for that name, and an analyst then dispositions near-misses that a resolved identifier would have excluded. The KYC process depends on this stage more than any other, and the article on advanced KYC workflows in Nexis Diligence+ covers the entity work in more depth.

What lands in the file: the resolved identifiers, the documents or data they were verified against, the date, and any candidate entities that were considered and excluded, with the reason.

Stage Two: Ownership and Control

For corporate customers the second stage walks the structure to the natural persons behind it. The ultimate beneficial owner test under the UK's money laundering regulations looks for individuals who ultimately own or control more than 25 percent of the shares or voting rights, or who otherwise exercise control over the management of the company. Where no such individual can be identified, the regulations fall back to the senior managing officials.

Applying the test means following each layer. A customer owned by a holding company is owned, for these purposes, by whoever owns the holding company, and so on up the chain to a natural person or a listed or regulated entity. Each layer is recorded as mapped: the entity, its jurisdiction, its owners and the percentage held, so that the structure can be re-read later without repeating the work. Registry data such as the persons with significant control register is the starting point, not the end: it records what the company filed, not what is independently confirmed.

Certain patterns escalate the stage rather than closing it. Opaque layers where ownership passes through a jurisdiction with no public register. Nominee shareholders or directors standing in for an undisclosed principal. Trusts or foundations holding shares without an obvious controller. Ownership resting in a high-risk jurisdiction. Each of these is a documented trigger for deeper inquiry, and each is a reason the beneficial ownership stage feeds the risk rating directly. As thresholds and registers change, this is also the stage firms revisit most when responding to new anti-money laundering regulations.

What lands in the file: the mapped structure to the identified UBOs, the test applied at each layer, the sources used, and any escalation triggers met.

Stage Three: Screening and Adverse Media

With the parties resolved and the owners identified, the third stage screens each of them. Sanctions screening runs the resolved names and identifiers against the lists in scope, typically the UK, OFAC, EU and UN lists, and PEP checks identify whether any party holds or has held a prominent public function, or is a family member or close associate of someone who does. Because the names were resolved in stage one, the matches that remain deserve attention.

Adverse media screening belongs in this standard pass, not only in enhanced due diligence. Lists record designations and public roles. Reporting records conduct: investigations, litigation, regulatory action, allegations, and the relationships that connect a clean party to a problematic one. A party can be absent from every list and still be the subject of coverage that changes the risk rating, and finding that at onboarding is cheaper than finding it later.

Disposition discipline closes the stage. Every hit is resolved as a match or a non-match with a recorded reason: date of birth mismatch, different jurisdiction, a namesake, or a confirmed match with the implications noted. A hit that is cleared without a reason is not cleared, it is deferred to whoever reads the file next.

What lands in the file: the lists and sources screened, the date, every hit and its disposition, and the material adverse findings carried forward to the decision.

One Decision, One Record

The three stages exist to inform one onboarding decision, and the risk rating is where they meet. Identity resolution establishes who the parties are. Ownership mapping establishes who stands behind them. Screening and adverse media establish what is known about each. The decision to onboard, decline or escalate follows from that rating and the firm's appetite.

The record is what makes that decision defensible. A reviewer, an auditor, or whoever holds the role of the MLRO at sign-off should be able to read the file and see how the conclusion was reached: which identifiers were fixed, which owners were found, which hits were reviewed, and why the rating landed where it did.

Verifications commonly break at three points. Results sit in different tools, so identity, ownership and screening outputs are never assembled into one view. The reasoning lives in the analyst's head, so a cleared hit or a stopped ownership chain has no written justification. The rating is set once and never revisited, so the file describes a customer as they were at onboarding rather than as they are. Each is a handoff failure rather than a depth failure, fixed by process before tooling.

Running the Sequence in Nexis Diligence+

Nexis Diligence+ carries stages two and three in one workflow. A single entity search runs across company and ownership data, global sanctions and PEP lists and licensed adverse media at the same time, so the owners identified in the ownership stage are screened where they were found, rather than re-keyed into a separate screening tool. Where a structure needs to be walked across jurisdictions, the Entity Search API supports the network and ownership mapping behind it.

The output is a documented report: the entity searched, the sources in scope, the ownership structure as mapped, each hit and its disposition, and the adverse media findings, dated and exportable. That report slots into the verification file alongside the identity evidence from stage one, and it is what a reviewer opens when testing whether anti-money laundering controls were applied as written. Because the same search runs the same way for every analyst, the compliance check becomes consistent across the team. The August article on licensed international adverse media behind screening covers the content layer; Nexis Diligence+ is where an analyst applies that content inside a documented check.

Standardise AML Verification with Nexis Diligence+

Final Thoughts

Consistency is the real prize in AML verification. Depth on one difficult file matters less than a sequence any analyst can run the same way, producing a record any reviewer can follow. The three stages above, each ending with what lands in the file, are that sequence.

The research and screening stages consolidate cleanly into Diligence+, which gives the middle of the sequence one environment and one report. What remains is procedure: write the stages down in order, name what each must leave in the file, and test completed verifications against it. A programme that passes has moved from running checks to completing verifications, and the customer due diligence file will show it.