Direct answer: A supplier beneficial-owner (UBO) and control-person due-diligence page is not "check the shareholder list on the business licence". The page should state: who the beneficial owner is (the natural person who ultimately owns or controls the supplier, or enjoys its ultimate benefits); the identification tests (directly or indirectly holding 25% or more of the equity, shares or partnership interests; if not, enjoying 25% or more of the income or voting rights; if not, exercising actual control alone or jointly; if none, the person responsible for day-to-day management); which entities must file (companies, partnerships and foreign-company branches; sole proprietors are excluded); when to file/update (on establishment; within 30 days of a change or loss of the exemption commitment; existing entities by 1 November 2025); what to collect (name, nationality, ID, equity/income/voting percentages, control method, start/end dates); how to verify (registry, ownership chart, declaration, ID, cross-checks); red flags (nominee, shell, frequent changes, high-risk jurisdictions); how this links to bank-account changes, sanctions/PEP screening, related-party/conflict checks; contract declaration/update/audit/termination clauses; and the public boundary. The Beneficial Owner Information Measures (PBC and SAMR Order [2024] No. 3) have applied since 1 November 2024; the Anti-Money Laundering Law, revised on 8 November 2024 and effective 1 January 2025, requires legal persons and unincorporated organisations in Article 19 to keep and update beneficial-owner information and submit/update it truthfully to the registration authority, and Article 60 sets correction orders and fines of up to RMB 50,000 for refusal to correct failures/false information/late updates. This article is current to 2026-11-11 and is a summary of public rules and page method, not legal/AML/compliance advice; the registration authority, regulator and company policies control.
This article is for procurement, supply-chain, legal, compliance, finance, internal audit and website teams at equipment, electronics, automotive-parts, medical-device, hardware, chemical, packaging and export manufacturers in Changzhou and nearby. It covers how to write and accept a supplier UBO/control-person due-diligence page. The usual gap is "shareholders on the licence only, no ultimate natural person, filing treated as no-risk, no nominee/shell check, no update, account change by seal only, no sanctions/PEP screening, no related-party identification, no contract declaration duty", ending with a page that only says "supplier qualification complete, background clear", while fraud/sanctions/related-party/regulatory inquiries still disagree.
UBO is the "ultimate natural person", not the shareholder list; 25% equity/income/voting rights, actual control and day-to-day manager form a fallback chain; filing is not a no-risk certificate — nominees/shells/frequent changes/high-risk jurisdictions still need checks; account changes, sanctions/PEP, related parties and contract declarations must be read together.
How does this page relate to supplier onboarding/AVL, master data/account change, sanctions screening, related parties and contract signing?
The UBO/control page answers "who ultimately owns/controls the supplier, how to identify, verify and update"; the onboarding/AVL page answers "qualification, capacity, audit questionnaire, EHS, confidentiality"; the master-data/account-change page answers "name, tax ID, bank, callback, effective date"; the debarment/sanctions page answers "list sources, frequency, hit handling"; the related-party/conflict page answers "employee relatives, shareholding, recusal"; the contract-signing page answers "entity, authority, seal, e-signature". The UBO page is the main page for "ultimate ownership/control" and cannot be replaced by onboarding or account-change pages.
Common breaks: licence only; legal representative as the only UBO; no multi-layer look-through; no nominee/acting-in-concert check; no update; account change by seal only; no sanctions/PEP screening; no related-party identification; no contract declaration/update duty; treating filing as a "no-risk certificate". The page separates "identification—collection—verification—red flags—account—screening—contract" so procurement/legal/compliance/finance/audit share one vocabulary.
| Page | Question it answers | Key content | Cannot replace |
|---|---|---|---|
| UBO/control | Who ultimately owns/controls, how to verify | 25%/control/filing/update | Onboarding qualification |
| Onboarding/AVL | Qualification/capacity/audit/EHS | Questionnaire, certificates, audit | Ultimate ownership |
| Master data/account change | Name/tax ID/bank/callback | Change, verification, effective date | Control |
| Debarment/sanctions | Lists/frequency/hits | Lists, screening, review | Ownership look-through |
| Related party/conflict | Employee relatives/shareholding/recusal | Declaration, approval, recusal | Supplier UBO |
| Contract signing | Entity/authority/seal/e-signature | Authority chain, seal | Control due diligence |
Page relationships are editorial; the registration authority, regulator and company policies control.
How are beneficial owners identified, and which entities must file?
Under Article 6 of the Beneficial Owner Information Measures, a natural person is a beneficial owner if: they ultimately own, directly or indirectly, 25% or more of the equity, shares or partnership interests; if not, they ultimately enjoy 25% or more of the income or voting rights; if not, they alone or jointly exercise actual control (including through agreements or close relations, deciding the appointment of the legal representative/directors/supervisors/senior managers/executive partner, major business decisions, financial receipts and payments, or long-term control of important assets/main funds). If none applies, the person responsible for day-to-day management is filed as the beneficial owner. State-owned sole/controlled companies file the legal representative; foreign-company branches also include the branch's senior managers. Filing entities are companies, partnerships and foreign-company branches (sole proprietors excluded); entities with registered capital/contributions of no more than RMB 10 million, all shareholders/partners natural persons and no other control/benefit may be exempt after commitment.
Acceptance checks: 25% equity; 25% income/voting; actual control; day-to-day manager; state-owned/foreign branch; exemption; look-through layers; acting in concert/nominee. Common gaps: legal representative only; no look-through; 25% as the only test; ignoring income/voting; ignoring actual control; misusing the exemption.
| Test | What to write | Evidence | Common gap |
|---|---|---|---|
| 25% equity/partnership | Direct/indirect, look-through | Ownership chart | Direct shareholders only |
| 25% income/voting | Agreements/articles/partnership deed | Agreement | Equity only |
| Actual control | Agreement/relatives/concert/human-financial | Declaration/evidence | Not identified |
| Day-to-day manager | Fallback if none applies | Appointment | Omitted |
| State-owned/foreign branch | Legal representative/senior manager | Registration/articles | Treated as ordinary |
| Exemption | ≤RMB 10m/all natural/no other control | Commitment | Misused |
| Look-through/nominee | Layers/nominee/concert | Chart/declaration | No look-through |
Tests summarised from Articles 2, 3, 6, 7 and 8 of the Beneficial Owner Information Measures; the registration authority and regulator control.
What should be collected and how should it be verified?
At minimum collect: the supplier's UBO declaration (name, nationality, ID type/number/validity, habitual residence/work address, contact); the type of beneficial-ownership relationship (equity/income/voting/actual control/day-to-day management) and start/end dates; equity/income/voting percentages; control method (agreement, relatives, concerted action, human/financial control); an ownership chart going through to the ultimate natural persons; registry filing/query records; authorised representative and signature specimen; update contact. Verify against the business licence/articles/partnership deed/registry filing; for multi-layer or offshore structures require registration documents, shareholder registers and UBO declarations; for high-risk cases require notarisation/legalisation/lawyer due diligence; if the declaration and filing differ, hold onboarding/payment and require an explanation. Inaccurate filing may lead to a correction order and, on refusal, a fine of up to RMB 50,000 (Measures Art. 14; AML Law Art. 60).
Acceptance checks: declaration; relationship type; percentages; control method; ownership chart; registry query; ID; authority; cross-check; discrepancy handling. Common gaps: one form only; no chart; no percentages; no control method; no registry query; no ID check; no discrepancy handling.
| Material | What to write | Evidence | Common gap |
|---|---|---|---|
| UBO declaration | Name/nationality/ID/address/contact | Declaration | One person only |
| Relationship type | Equity/income/voting/control/day-to-day | Declaration | No classification |
| Percentages | Equity/income/voting | Chart | No percentage |
| Control method | Agreement/relatives/concert/human-financial | Agreement/statement | No explanation |
| Ownership chart | Through to natural persons | Chart | First layer only |
| Registry query | Filing/query record | Screenshot/receipt | No query |
| ID/authority | ID/authorisation/signature | Copy | No authority |
| Discrepancy | Explanation/review | Record | No handling |
The material list is editorial; the registration authority, regulatory requirements and company due-diligence policy control.
Which red flags require enhanced due diligence?
Red flags include: multi-layer ownership into offshore/high-risk jurisdictions; shareholders who are nominees/retirees/unrelated third parties; UBO differing from the legal representative/authorised signatory/payee; registered address differing from operations/warehouse/factory; newly established/no employees/no social insurance/no capacity but receiving large orders; frequent changes of shareholders/legal representative/accounts; refusal to provide UBO/chart/ID; missing translation/notarisation; UBO who is a PEP/sanctioned/debarred/under investigation; supplier connected to employees/customers/public officials by relatives/shareholding/positions; requests to pay a third party/personal/third-country account; multiple suppliers at the same address/phone/email. Red flags are not conclusions; escalate through additional materials, on-site/video verification, third-party due diligence, legal advice, or hold onboarding/payment.
Acceptance checks: offshore/high-risk; nominee; UBO vs signatory/payee; address; new/no employees; frequent changes; refusal; PEP/sanctions/debarment; connections; payment anomalies; multiple entities at one address. Common gaps: red flag as conclusion; no escalation; supplier questions only; no records.
| Red flag | What to write | Evidence | Common gap |
|---|---|---|---|
| Offshore/high-risk | Layers/country/sanctions risk | Chart | No look-through |
| Nominee | Nominee agreement/relationship/funds | Declaration/evidence | Treated as real |
| UBO/signatory/payee mismatch | Authority/payee relationship | Authority/callback | Seal only |
| Address/operations mismatch | Registered/operating/factory/warehouse | Site/photos | Licence only |
| New/no employees/no capacity | Age/social insurance/capacity | Reports/site | No check |
| Frequent changes | Shareholder/legal rep/account history | Registry record | No tracking |
| Refusal | Missing/late/contradictory | Correspondence | Keep paying |
| PEP/sanctions/debarment | List/hit/review | Screening record | No screening |
| Connections/same address | Relatives/shareholding/multiple entities | Declaration/query | Not identified |
The red-flag list is editorial; company risk appetite, list sources and regulatory requirements control, and a red flag is not a finding of illegality.
How should bank-account changes link to the UBO?
The UBO is not the account signatory, and the signatory is not necessarily the UBO. Account changes should at least: verify the applicant/authority/seal; check the new account name matches the supplier entity; check whether the UBO/actual controller changed; call back an existing contact (not the phone on the application); dual review; cross-check contract/invoice/order; raise approval for third-party/personal/third-country accounts; hold payment before the change takes effect; keep records. High-risk cases (new account, cross-border, UBO change, simultaneous address/phone change, urgent request) require escalation. UBO due diligence answers "who ultimately owns/controls"; account verification answers "who gets the money"; neither replaces the other.
Acceptance checks: applicant; authority/seal; account name; UBO change; callback; dual review; cross-check; third-party/personal accounts; effective date; records. Common gaps: seal only; no callback; personal account; UBO change ignored; urgency bypass.
| Step | What to write | Evidence | Common gap |
|---|---|---|---|
| Applicant | Name/authority/seal | Application/authority | Seal only |
| Account name | Match supplier entity | Bank proof | Third-party account |
| UBO change | Trigger re-due-diligence | Declaration/registry | Ignored |
| Callback | Existing contact/phone | Callback record | No callback |
| Dual/cross-check | Dual review/contract/invoice/order | Approval | One person |
| High risk | New/cross-border/urgent | Escalation | Urgency bypass |
| Effective/records | Hold payment/effective date | System log | Pay first |
Account verification is editorial; the bank, company policies and anti-fraud requirements control.
How should sanctions, PEP and related-party screening work?
At minimum: include the UBO/actual controller/legal representative/authorised signatory in screening; define list sources (UN, OFAC, EU, UK, China export-control/unreliable-entity/debarred lists, etc.) and scope; screen at onboarding, on change and periodically (e.g. quarterly/semi-annual/annual by risk); handle hits (same-name/false-positive/ID/address/date-of-birth review; true hit = hold/exit/report); escalate PEP/foreign-official/international-organisation senior managers and their close associates; identify related-party transactions (employee/relative shareholding/positions, common control, fund flows); keep screening records and conclusions. Screening is not once-and-done: UBO/equity/address/business changes must trigger re-screening.
Acceptance checks: scope; list sources; frequency; hit handling; PEP; related parties; records; re-screen triggers. Common gaps: company name only; no UBO; incomplete lists; no periodic review; no hit review; no related-party identification.
| Item | What to write | Evidence | Common gap |
|---|---|---|---|
| Scope | Company/UBO/legal rep/signatory | List | Company only |
| List sources | UN/OFAC/EU/UK/China lists | Source/version | Incomplete |
| Frequency | Onboarding/change/periodic | Calendar | Once only |
| Hit handling | Same-name/false/true hit | Review record | No review |
| PEP | Officials/IO/close associates | Screening/approval | No screen |
| Related party | Relatives/shareholding/common control/funds | Declaration | Not identified |
| Re-screen trigger | UBO/equity/address/business change | Record | No re-screen |
Screening methods are editorial; list sources, regulatory requirements and company compliance policy control.
How should contract and ongoing monitoring be written?
Contract at minimum: the supplier declares that UBO information is true, complete and promptly updated; changes in UBO/control/equity/address/account are notified in writing within an agreed number of days; cooperation with ownership charts/ID/registry information; the buyer/its auditor may verify on reasonable notice; breach or refusal may lead to payment hold/termination/indemnity/blacklisting; flow-down to subcontractors/agents/intermediaries; sanctions/PEP/debarment representations and warranties; data protection/privacy (UBO data are personal information; scope/purpose/retention/sharing must comply); ongoing monitoring (periodic review, change triggers, list updates, unusual transactions). Clauses must be enforceable, not just "we comply".
Acceptance checks: declaration/warranty; change notice; cooperation; audit right; breach consequences; flow-down; sanctions/PEP; personal information; ongoing monitoring. Common gaps: warranty only; no notice; no audit; no termination; no flow-down; no privacy protection.
| Clause | What to write | Evidence | Common gap |
|---|---|---|---|
| Declaration/warranty | True/complete/prompt update | Contract | One sentence |
| Change notice | UBO/equity/address/account | Contract | No notice |
| Cooperation | Chart/ID/registry | Contract | No cooperation |
| Audit right | Scope/notice/confidentiality | Contract | No audit |
| Breach | Hold/terminate/indemnify/blacklist | Contract | No consequence |
| Flow-down | Subcontractors/agents/intermediaries | Contract | No flow-down |
| Sanctions/PEP | Representation/warranty/exit | Contract | Not written |
| Personal information | Scope/purpose/retention/sharing | Privacy notice | Over-collection |
Contract terms are editorial; the contract, personal-information rules and applicable law control.
How should the website page be written, and what must not be published?
Suggested sections: (1) why UBO due diligence (AML/fraud/sanctions/related parties); (2) identification tests (25%/income/voting/actual control/day-to-day); (3) materials and verification; (4) red flags and escalation; (5) account change/sanctions/PEP/related-party links; (6) contract declaration/update/audit clauses; (7) contact window and update date. The public page explains "method, standards, process, boundary" and does not publish specific supplier UBO names/IDs/percentages/charts, accounts, sanctions hits, related-party links, contracts/prices or customer names. The English page should use consistent terms (beneficial owner, actual controller, 25% equity/income/voting rights, control, UBO declaration, sanctions/PEP screening, account change, ongoing monitoring) and state the cut-off date. Do not describe "filed" as "no risk", or UBO due diligence as "all background checks complete".
The page should let procurement/legal/compliance/finance/audit judge "who the ultimate natural person is, whether the materials are sufficient, how red flags escalate, whether the account can change, and whether re-screening is needed", while protecting personal information and supplier trade secrets.
Go-live acceptance checklist
Ten checks: identification tests; filing/update; materials/chart; registry verification; red flags/escalation; account change; sanctions/PEP; related parties; contract clauses; public boundary. Each needs evidence and a review date. The pass standard is not "a UBO form is collected", but that procurement/legal/compliance/finance/audit can judge ultimate ownership, material authenticity, red-flag handling, account risk and ongoing monitoring.
Before go-live, run a tabletop exercise on a real (redacted) supplier: onboarding → UBO declaration → ownership chart → registry query → red flags → account change → sanctions/PEP → contract, simulating "nominee", "multi-layer offshore", "UBO and payee mismatch" and "refusal to provide materials", to see whether the page and process work.
| Check | Pass standard | Evidence | If failed |
|---|---|---|---|
| Identification | 25%/income/voting/control/day-to-day | Declaration/chart | Add identification |
| Filing/update | Establishment/30 days/existing | Registry record | Add filing |
| Materials/chart | Look-through/percentages/control | File | Add materials |
| Registry check | Query/cross-check | Screenshot/receipt | Add check |
| Red flags/escalation | List/escalation/records | Record | Add escalation |
| Account change | Entity/callback/dual/effective | Approval | Hold payment |
| Sanctions/PEP | Scope/lists/frequency/hits | Screening record | Add screening |
| Related parties | Identify/declare/recuse | Declaration | Add declaration |
| Contract | Declaration/notice/audit/exit | Contract | Add clause |
| Public boundary | No names/IDs/percentages | Page | Take down |
The acceptance list is editorial; the law, regulatory requirements and company policies control.
Who should read it, who should not, and what decisions does it support?
For procurement, supply-chain, legal, compliance, finance, internal audit and website teams at equipment, electronics, automotive-parts, medical-device, hardware, chemical, packaging and export manufacturers in Changzhou and nearby; also for companies handling "licence only, no UBO look-through, nominee/shell, account change, sanctions/PEP, related parties". Not for teams without supplier management/AML needs, or that want one page to replace legal/compliance/due-diligence conclusions.
Read it if: building a UBO page; legal representative only; no look-through; no registry check; no update; account by seal only; no sanctions/PEP; no contract declaration. Not suitable if: treating filing as no-risk; treating UBO as the shareholder list; treating the account signatory as UBO; treating the page as a due-diligence conclusion. Supports: identification, materials, verification, red flags, account, screening, contract and public-boundary self-checks.
FAQ
What is the difference between UBO, shareholder, legal representative and actual controller?
A UBO is the natural person who ultimately owns or controls the supplier, or enjoys its ultimate benefits; a shareholder may be a company/partnership; the legal representative is the registered representative; the actual controller is the person able to actually direct the company's conduct. A UBO must be traced to a natural person and may or may not be the shareholder/legal representative/actual controller. Identification follows the 25% equity/partnership, 25% income/voting, actual control and day-to-day manager chain; the business licence alone is not enough.
Must every supplier file UBO information?
Companies, partnerships and foreign-company branches must file; sole proprietors are excluded. Entities with registered capital/contributions of no more than RMB 10 million, all shareholders/partners natural persons and no other control/benefit may be exempt after commitment. But "exempt" is not "no due diligence": procurement still identifies actual control, nominees, related parties, sanctions/PEP and account risk; the registration authority/regulator controls.
If the supplier says it has filed, is due diligence still needed?
Yes. Filing is a legal duty, not a no-risk certificate. Procurement should check whether the filing matches the declaration/chart/ID, look through multi-layer equity, identify nominees/concerted action/actual control, check shells/new entities/no employees/high-risk jurisdictions/frequent changes, screen sanctions/PEP/debarment, and verify the account against the UBO/signatory. Inaccurate filing may lead to a correction order and, on refusal, a fine of up to RMB 50,000.
UBO information is personal information; how should it be collected?
Collect only the minimum relevant to the due-diligence purpose (name, nationality, ID, percentages/control method), inform the purpose, scope, retention and sharing, restrict access, and retain/delete under the company's personal-information policy; assess the legality of external provision/cross-border transfer. The public page must not disclose specific UBO names/IDs/percentages/charts. The Personal Information Protection Law and company privacy policy control.
Should the UBO be re-checked when the bank account changes?
Yes, trigger a review for changes in account name/bank/payee, UBO/equity/legal representative/address, cross-border/third-party/personal accounts or urgent changes. Account verification should use callback to an existing contact (not the application phone), dual review, cross-check with contract/invoice/order and hold payment before the change takes effect; UBO due diligence cannot replace account verification, or vice versa.
Who and how often should sanctions/PEP screening cover?
At least the supplier entity, UBO/actual controller, legal representative and authorised signatory; list sources depend on the applicable jurisdictions (UN, OFAC, EU, UK, China export-control/unreliable-entity/debarred lists, etc.); screen at onboarding, on change and periodically by risk (e.g. quarterly/semi-annual/annual); review hits by same name/ID/address/date of birth, and hold/exit/report a true hit. List sources and frequency follow the company compliance policy and regulatory requirements.
Should the website publish supplier UBOs, ownership charts and screening results?
Usually not specific UBO names/IDs/percentages/charts, accounts, sanctions/PEP hits, related-party links, contracts/prices or customer names; it can publish the due-diligence method, identification tests, material list, red-flag/escalation process, account-change/screening/contract requirements, contact window and update date. The goal is to let suppliers/customers understand the method, not to disclose personal or commercially sensitive information.
One-sentence takeaway
The supplier UBO/control-person due-diligence page on a Changzhou manufacturer's website is not "check the business licence"; it is about turning the 25% equity/income/voting tests, actual control, day-to-day manager, filing/30-day updates, materials/charts, registry verification, red-flag escalation, account changes, sanctions/PEP, related parties and contract clauses into a checkable list, so procurement/legal/compliance/finance/audit can judge who ultimately owns/controls, whether the materials are sufficient, how risk escalates and whether the account can change.
Research method and limitations
This article is a summary of public rules and page method, not legal/AML/compliance/due-diligence advice. It uses no unpublished supplier UBO names/IDs/percentages/charts, accounts, sanctions hits, related-party links, contracts/prices or customer names; the tables and acceptance items are editorial and not legal/due-diligence conclusions. The Beneficial Owner Information Measures (PBC and SAMR Order [2024] No. 3), the Anti-Money Laundering Law (2024 revision), the Personal Information Protection Law and MOF Internal Control Application Guideline No. 7 (Procurement) are public sources; the registration authority, regulator, company policies and applicable law control. This article does not decide whether any specific supplier/UBO is compliant, and does not promise "zero risk"; companies should conduct due diligence item by item based on ownership, business, jurisdiction and risk appetite.
Sources and basis
Current to 2026-11-11; the official pages below control.
- Beneficial Owner Information Measures (PBC and SAMR Order [2024] No. 3; effective 1 November 2024): People's Bank of China. Filing entities/exemption (Arts. 2, 3), 25% equity/income/voting/actual control (Art. 6), state-owned/foreign branches (Arts. 7, 8), establishment/30-day update (Arts. 9, 10), information fields (Art. 11), penalties (Art. 14), existing entities (Art. 16); used for identification, filing and updates.
- Anti-Money Laundering Law of the PRC (revised 8 November 2024; effective 1 January 2025): The State Council of China. Article 19 beneficial-owner information management/retention/update/submission; Article 60 penalties for failure/false/inaccurate/late filing; used for legal duties and consequences.
- MOF Internal Control Application Guideline No. 7 — Procurement (Cai Kuai [2010] No. 11): Linyi Finance Bureau. Supplier selection, evaluation, contracts, acceptance, payment and records; used for onboarding/due diligence/segregation of duties.
- Personal Information Protection Law of the PRC: National People's Congress. Minimum necessity, notice/consent, retention/sharing/cross-border transfer; used for UBO personal-information protection.