Ownership structure report when the group is registered outside the EU – supply risk

When your counterparty – a supplier, a franchisor, a platform operator – belongs to a group incorporated outside the European Union, standard EU-based registry checks become only the first step in a longer verification sequence. The absence of a harmonised beneficial ownership register, the patchwork quality of corporate registries across non-EU jurisdictions. Additionally. The structural invisibility of intermediate holding layers in offshore centres mean that a reliable ownership structure report must combine local registry extracts, cross-border corporate filings, sanctions screening data, and documented residual limitations. This page explains the order of steps we follow, the sources we consult, and – critically – what we cannot verify, so that the risk picture you receive is honest rather than artificially complete.

Why non-EU group structures create elevated supply risk

Supply risk in this context refers to the possibility that a contractual counterparty. most often encountered in procurement, franchise, licence. Alternatively. Platform service relationships. is ultimately controlled by a person or entity whose identity, sanction status. Alternatively, financial stability cannot be confirmed with the same certainty that EU-regulated registers provide. Two structural features compound that risk when the parent group sits outside the EU.

Absence of mandatory beneficial ownership disclosure. EU member states are required under successive Anti-Money Laundering Directives to maintain central registers of beneficial owners for legal entities incorporated in their territory. Most non-EU jurisdictions do not have an equivalent obligation, or enforce it selectively. Cayman Islands, British Virgin Islands, and similar offshore centres historically published no public beneficial ownership data at all, and while international pressure has produced some progress, effective public access remains limited and inconsistent. A group headquartered in, say, the Gulf region, Central Asia. Alternatively. South-East Asia may have no statutory obligation to disclose who ultimately controls it beyond the immediate registered shareholder. This is often itself another holding company.

Layered intermediate structures. Multi-jurisdictional corporate groups commonly place the operating entity that contracts with EU buyers two, three, or more tiers below the true economic owner. Each intermediate layer may be registered in a different jurisdiction with its own (often weaker) disclosure rules. Reconstructing the full chain requires extracting corporate filings from each relevant registry. Additionally, several of those registries offer limited English-language access. Charge fees in local currency, require notarised requests. Alternatively, impose waiting periods measured in weeks rather than hours.

The verification sequence: step by step

Step 1 – EU footprint audit. The logical starting point is always any EU-registered entity within the group. If the non-EU parent has a branch, subsidiary, or registered agent in Portugal, another member state, or the EEA, that entity will appear in the relevant national business registry. For Portugal, the Registo Comercial (held by the Instituto dos Registos e do Notariado) is publicly searchable and provides registered capital, statutory purpose, administrator appointments, and shareholder data for Portuguese entities. Equivalent registries exist in every EU member state. Additionally. In many cases the data is accessible via the EU Business Registers Interconnection System (BRIS). This links national commercial registers and allows cross-border lookup of company documents. This step is fast and reliable for the EU layer; the limitation is that the EU entity's shareholder entry will often list nothing more than the direct parent company incorporated abroad.

Step 2 – Direct non-EU registry query. The registry in the jurisdiction of incorporation of the immediate parent is queried next. The quality of the data returned varies enormously. Some non-EU registries – Singapore's ACRA, Australia's ASIC, Canada's SEDAR/provincial registries, Japan's Legal Affairs Bureau – are reasonably complete and accessible in English. Others – common in parts of the Middle East, sub-Saharan Africa. Alternatively, Central Asia – provide minimal digitised data. Require in-country lawyers to submit physical requests. Alternatively, release documents only in the local administrative language requiring certified translation. Where the registry is accessible, we extract the certificate of incorporation, current shareholder list, director appointments, and any filed annual returns that identify ultimate holding entities. Where it is not accessible within the project timeframe, this limitation is explicitly documented in the report.

Step 3 – Offshore holding identification. A very large proportion of cross-border groups use one or more entities in low-disclosure jurisdictions – British Virgin Islands. Cayman Islands, Bermuda, Marshall Islands, Panama, Seychelles. Additionally, others – as intermediate holding vehicles. For these jurisdictions, publicly available corporate information is typically limited to the entity name, registration number, registered agent, and registered office address. Beneficial ownership information is maintained by local registered agents under private statutory registers that are accessible only to regulators and, in limited circumstances, to the entity itself. We document the existence of these layers, their names and registration numbers where obtainable from filings made elsewhere (for example, in exchange filings, credit rating reports. Alternatively. EU subsidiary filings that name the parent chain). Additionally, we state explicitly that the identity of the ultimate natural person(s) behind the offshore layer cannot be verified from public sources.

Step 4 – Exchange and regulatory filings. If any entity in the group is publicly listed on a stock exchange – including non-EU exchanges such as the New York Stock Exchange, NASDAQ, Hong Kong Stock Exchange. Alternatively. London Stock Exchange – annual reports, 20-F filings, prospectuses. Additionally, regulatory disclosure statements often contain the most complete description of the group's ownership structure that exists anywhere in public domain. These documents are produced for investor protection purposes and typically include a chart or narrative description of the corporate chain, percentage shareholdings, and identification of controlling shareholders above a disclosure threshold. They are not infallible – they describe the structure as of the filing date, which may be months or years old – but they provide a verified baseline. We cross-reference these filings against current registry data to identify structural changes post-filing.

Step 5 – Sanctions and watchlist screening. All identified entities and named individuals are screened against consolidated sanctions databases. This includes the EU Consolidated List. The OFAC Specially Designated Nationals list, the UK HM Treasury Financial Sanctions Targets list. Additionally, the UN Security Council Consolidated List. This step identifies designated entities and individuals within the group structure, flags jurisdictions subject to sectoral or comprehensive sanctions programmes, and notes any prior enforcement actions or debarment decisions available from public sources. Sanctions screening is always a point-in-time result: the absence of a hit on a given date does not guarantee the same result at a later date.

Step 6 – Adverse media and reputational signal review. Structured searches of major English-language and. There, applicable, local-language news databases, court record portals where publicly searchable. Additionally. Anti-corruption monitoring resources (such as the OCCRP Aleph database of leaked corporate records. This has been used to expose offshore structures in numerous jurisdictions) are conducted to identify adverse signals not reflected in formal registry entries. Findings are reported with source attribution and an assessment of evidential weight – the difference between a verified court judgment and an unsubstantiated allegation matters and is stated.

What the report covers and what it does not

What the report delivers. The report reconstructs the ownership chain to the maximum depth achievable from legally accessible public and semi-public sources, documents each source used. Assigns a confidence rating to each layer of the chain (verified / partially verified / inferred from filings / unknown), flags sanctions exposure and adverse signals. Additionally, identifies the specific gaps that remain despite good-faith multi-source effort. This gives a procurement officer, a general counsel, or a transaction lawyer a precise view of what is known, what is probable, and what is structurally unverifiable. the right foundation for a risk-proportionate contractual response.

What the report cannot deliver. No report of this kind can confirm the identity of a beneficial owner who is concealed behind a nominee shareholder arrangement or a private trust structure in a non-cooperative jurisdiction. Because that information simply does not exist in any public registry. The report will say so plainly. Similarly, we cannot verify the completeness of private statutory registers maintained by offshore registered agents; we can only note their existence and the rules governing them. Where a jurisdiction operates a register that requires local legal representation to access. Additionally. The project timeline or scope does not accommodate a full in-country enquiry, the report documents the gap and the mechanism by which it could be filled if required.

Residual limitations by jurisdiction type

Classic offshore jurisdictions (BVI, Cayman, Panama, Seychelles). Public data is structurally limited. Corporate existence and registered agent identity are usually confirmable; shareholder and beneficial owner data are not accessible from public sources. The existence of a private statutory register can be stated but its contents cannot be quoted without the entity's cooperation.

Gulf Cooperation Council states. Registry accessibility varies significantly by emirate and by company type in the UAE, and by kingdom and company category in Saudi Arabia. Free zone entities often have different disclosure rules from onshore entities. Arabic-language official documents require certified translation. Some registries have improved online access; others require in-country notarised requests. The report will specify the registry consulted and the access mechanism used.

CIS and Central Asian jurisdictions. Russia's Federal Tax Service unified registry (EGRUL) has historically provided shareholder data online in Russian, but access from EU-based IP addresses has been intermittent following sanctions-related technical measures. Registries in Kazakhstan, Uzbekistan, and similar states are partially digitalised; data quality and English-language accessibility are variable. Local intermediaries are often required for reliable document retrieval.

South and South-East Asia. Singapore (ACRA) and Hong Kong (CR) are among the most accessible and reliable non-EU registries. India's MCA21 system provides searchable corporate data but beneficial ownership filings are less consistently populated. Indonesia, Vietnam, and several other ASEAN states have limited digital registry infrastructure and English-language access.

Americas (non-US). Brazilian corporate data is accessible through Receita Federal and JUCESP/equivalent state boards, though some beneficial ownership filings are recent in practice. Cayman and BVI are offshore centres discussed above. US entities are accessible through SEC EDGAR for listed companies and through state-level Secretary of State registries for private companies – quality ranges from complete (Delaware) to minimal (Wyoming for LLCs).

How the report informs contractual and procurement decisions

The primary use case for this report in a supply context is pre-contracting due diligence: before signing a material supply agreement, a distribution or franchise contract. Alternatively, a platform access agreement with an entity whose parent group is registered outside the EU. The buyer needs to know who ultimately controls the supplier and whether any part of that structure creates a legal, reputational. Alternatively, operational risk that should be reflected in the contract terms.

Specific contractual responses that the report commonly informs include: change of control clauses that allow termination if ownership shifts to a sanctioned or otherwise prohibited party. information rights clauses requiring the supplier to notify the buyer of material ownership changes. representations and warranties regarding the absence of sanctions exposure. and. In higher-risk profiles, escrow or payment holdback mechanisms tied to the completion of satisfactory ongoing due diligence.

The report is also used in the context of existing supply relationships where a change event. a merger, a news report. A sanctions designation affecting an affiliated entity. Alternatively, simply the passage of time. prompts a need to refresh the ownership picture. In that context, the report serves as an updated baseline rather than an initial one, and the methodology adjusts to focus on changes since the previous verification date.

Tier overview

Reports are structured in three tiers reflecting scope and depth of multi-jurisdictional enquiry. The table below describes what each tier covers and what falls outside its scope.

Methodological transparency and limitations statement

Every report produced by Ferraz & Whitmore for a non-EU group structure includes a dedicated limitations section as a standard component – not an optional appendix. This section identifies, for each tier of the group's corporate chain, the registry consulted, the data retrieved, the date of retrieval. And. where information could not be obtained. the specific structural or jurisdictional reason why not. Additionally, the mechanism that would be required to fill the gap. This approach is not a hedging exercise; it reflects the epistemic reality of multi-jurisdictional corporate intelligence work. A report that claims complete verification of an offshore holding structure without explaining how that verification was achieved should itself be treated as a risk signal.

Where a gap in ownership visibility is material. for example. There. The ultimate controlling shareholder cannot be identified behind an offshore layer. the report states this as a finding requiring a risk management decision rather than an incidental annotation. The buyer then has documented grounds for requiring the supplier to produce its own private statutory register or a notarised beneficial ownership declaration as a condition of contract execution. Alternatively. Alternatively to accept the residual risk with eyes open.

Next steps

To commission a report or to discuss which tier is appropriate for the structure you are examining, contact us at info@ferrazwhitmore.com or use the enquiry form at ferrazwhitmore.com/contacts/. Please include, where available, the name of the EU-registered contracting entity, the name and jurisdiction of the immediate non-EU parent, and any information you already hold about intermediate holding layers. This allows us to scope the work accurately and advise on the likely depth of public data available before the engagement begins.

For related analytical context on cross-border corporate structures and supply chain governance from a Portuguese and EU law perspective, see the resources available in the Analytics section of this site.

Disclaimer: This page is provided for informational purposes only and does not constitute legal advice or a legal opinion. The methodologies described reflect general practice in cross-border corporate due diligence and are subject to change as registry access conditions, sanctions frameworks, and disclosure obligations evolve across jurisdictions. Engagement of Ferraz & Whitmore for a specific matter is governed by a separate written engagement agreement. Nothing on this page creates an attorney-client relationship. Ferraz & Whitmore is registered with the Ordem dos Advogados, Lisbon, Portugal.