More than half of UK regulated firms are struggling to verify who ultimately owns or controls the businesses they deal with, according to new research from SmartSearch, exposing a fundamental weakness in the UK's defences against financial crime.
SmartSearch's 2026 Compliance Report, based on a Censuswide survey of 1,000 senior decision-makers across UK financial services, property, legal and accountancy sectors, found that 52% of firms report difficulty verifying ultimate beneficial ownership. The requirement, sometimes described as knowing your customer's customer, obliges firms to look past the company name on a contract and identify the individual who ultimately owns or controls it.
The report warns that this individual is often deliberately hard to find, with layered holding companies, nominee arrangements and overseas entities allowing them to sit several steps removed from the entity a firm actually contracts with. As a result, a person subject to international sanctions or connected to organised crime can pass through onboarding undetected, leaving the firm exposed to the consequences of a relationship it never knowingly entered.
The research also found that 54% of identity verification checks across these sectors are still carried out manually, meaning the first line of defence for most regulated firms is a human being reviewing documents, at a time when the financial crime targeting them has become significantly more sophisticated and harder to detect by sight.
A new generation of threats
Asked to name their single greatest compliance challenge, one in four respondents (24%) cited the abuse of digital identity and certified ID processes, with the systems introduced to make verification faster and more secure now being manipulated by fraudsters to gain the credibility those systems were designed to provide.
A further 22% cited synthetic identity fraud and the exploitation of personally identifiable information, in which criminals combine real, compromised personal data with fabricated details to construct entirely fictitious individuals capable of passing standard verification checks. The two threats feed each other: a convincing synthetic identity is precisely what allows a fraudster to abuse a digital ID system, and a compromised digital ID system gives that fabricated identity an official seal of approval. AI has made this significantly easier to carry out at scale, with fraudsters now able to generate thousands of convincing false identities and embed them into legitimate business relationships faster than any human review can keep pace with.
Cryptocurrency-related money laundering was identified as the greatest compliance challenge by 19% of respondents, as firms increasingly encounter clients whose wealth originates in digital assets. Criminal funds can be passed through wallets and exchanges in jurisdictions with little oversight before being cashed out as apparently clean capital, leaving a conveyancer or accountant for example handling a property purchase or investment with nothing to verify beyond the final transaction.
Financing of terrorism was named by 13% of respondents as their greatest compliance challenge, a threat that carries direct criminal exposure under the Terrorism Act, which makes it an offence for a business to become involved in an arrangement that makes funds available for terrorist purposes, regardless of whether it knew the end use.
Phil Cotter, CEO at SmartSearch, said: "Identity is the foundation every business relationship is built on, but criminals are now exploiting the gaps between who a company says it is and who actually controls it. A firm that cannot credibly establish ultimate beneficial ownership is not just carrying a compliance risk; they are leaving the door open to sanctioned individuals, bad actors and the proceeds of organised crime.”
“Those risks are becoming harder to spot because criminals are no longer just forging documents. They are manufacturing synthetic identities, manipulating digital verification processes and hiding behind complex ownership structures, all designed to defeat checks that rely on what can be seen on the surface. Firms still relying on manual processes are bringing paper to a digital fight, and the ability to verify identities and beneficial ownership quickly, accurately and at scale is now what separates the businesses criminals target from the ones they avoid.”
Regulatory pressures are tightening
Firms that struggle with beneficial ownership checks will soon find the requirements getting stricter. Amendments to the Money Laundering Regulations, expected later this year, will require firms to identify and verify the individuals who ultimately own or control the entities they do business with, making it harder for criminals to hide behind complex corporate structures. ECCTA Phase IV enforcement is simultaneously tightening the rules around overseas entities operating in the UK at the same time, closing the loopholes that have historically allowed foreign ownership to obscure the true source of funds.
The consequences of falling short have also escalated under the Failure to Prevent Fraud offence, which means organisations that cannot demonstrate reasonable fraud prevention procedures face corporate criminal liability, and senior individuals risk personal liability where fraud is committed by an employee or agent for the organisation's benefit.
The research suggests that commercial risks of getting verification wrong are just as serious. Eighty-seven percent of respondents said they would stop working with a brand following a confirmed instance of money laundering, fraud or a non-compliance breach. Seventy-seven percent described the reputational risk of association with a major fraud scandal as a significant concern for their organisation, so most firms see the danger clearly even as their verification processes leave them exposed to it.
The commercial cost of getting it wrong
The research also suggests that the commercial risks of getting verification wrong are just as serious as the regulatory ones. Almost nine in ten (87%) of respondents said they would stop working with a brand following a confirmed instance of money laundering, fraud or a non-compliance breach. Over three quarters of firms polled (77%) also described the reputational risk of being associated with a major fraud scandal as a significant concern for their organisation, so most firms see the danger clearly even as their verification processes leave them exposed to it.
Cotter added: "Firms are entering an era where weak verification carries real consequences. If you can't prove who ultimately owns or controls the businesses you deal with, you are leaving yourself exposed to prosecution, reputational damage and commercial fallout. Compliance cannot be a one-off event. The businesses doing this well are continuously monitoring, with a clear audit trail of every step they took to identify and mitigate compliance and fraud risks. The firms gambling on outdated processes to catch modern fraud threats are risking their company, their clients and their directors' liberty.”
