When I worked in compliance at a large NBFI, our in-house rule was that a shareholder had to hold at least 20% of the company before a due diligence enquiry into his background was necessary. It sounds reasonable, does it not? Here's why that, or any hard-and-fast rule on minimums of stock ownership is fatally flawed:

• At our firm, the sales staff quickly responded by notifying the clients of our 20% rule. Thereafter, I began to see corporations coming in as new investors, where the maximum percentage of ownership was 19% or less on a number of individuals. I immediately threw out the 20% rule, in favour of a risk-based approach, relying upon (1) the jurisdiction of incorporation (2) the country of residence of the shareholders (3) the amount sought to be invested, and (4) the age of the company, and whether it was truly operational, with a footprint, or merely a shell . The company later reduced the minimum to 15%, but that does not solve the problem.
  

• If one sticks to this proffered 25% rule, what does one do with a 15 or 20% shareholder which is itself a corporation? Will not it be ignored?
  

• Structuring of share ownership by dividing majority ownership of a company amongst several family members, with emphasis upon using grown children of married female relatives, who therefore have different last names, easily defeats any policy of minimums.
  

• If the true beneficial owner reduces his percentage of company ownership to a small number, but uses fronts who have no skeletons in their closets to hold the balance, you never get to the minority shareholder who is the true threat.

• Remember, whenever you set up an arbitrary rule in compliance, money launderer and other financial criminals will find a way around it if they either become aware of it, or deduce it from your actions.

Hopefully, the above examples will deter you from implementing firm rules on just what constitutes sufficient ownership in a company to warrant due diligence investigation of the shareholder.

A final note: Keep your proprietary compliance policies and procedures secure.  This means that you only release details of your programme to regulators and law enforcement, upon written request. All others should be denied; you can never tell where they may end up. If you receive a subpoena, take it to outside bank counsel experienced in civil litigation, to ascertain whether it can, or should, be resisted.