The CRS standard intentionally borrows the controlling-persons concept from AML/KYC rather than inventing its own. That is helpful in principle, because the data already exists, and challenging in practice, because the two regimes use the same words for slightly different purposes.
Apply the AML cascade
Start with ownership: any natural person owning more than 25% (or the local threshold) is a controlling person. If no person meets the ownership test, move to the control test, then to the senior managing official fallback. The cascade matters, and shortcutting it is what produces gaps.
Trusts and similar arrangements
For trusts, the controlling persons include the settlor, the trustees, the protector (if any), the beneficiaries and any other natural person exercising ultimate effective control. Each role is reported separately, with the correct CRS controlling-person type code.
Reportable, then report
A controlling person is reportable when the entity is a Passive NFE (or an Investment Entity in a non-participating jurisdiction) and the controlling person is resident in a reportable jurisdiction. Test each leg independently; do not collapse them.
