The KYB, or Know Your Business, refers to the due diligence procedures applied to businesses and other legal entities. It serves to confirm their legal existence, identify their representatives and Beneficial Owners, understand their business activities, and assess the risks associated with the relationship.
KYB is not the same as KYC. Know Your Customer applies to both individuals and legal entities. The term KYB emphasizes controls specific to legal entities. At AP Solutions IO, this distinction matters because verifying a company requires cross-referencing multiple sources and tracing its chain of ownership.
What should you check on a KYB?
A KYB procedure may include verifying the company name, registration number, legal form, address, business activity, legal representatives, and Beneficial Owners.
Depending on the applicable framework and the level of risk, the organization may also seek to exposure to international sanctions, identify any politically exposed persons among the relevant individuals, and analyze adverse information from reliable sources.
The scope of the KYB depends on the nature of the relationship, the industry, the countries involved, the amounts involved, and the applicable obligations.
KYB, KYC, and KYS: How Do They Fit Together?
The KYC, or Know Your Customer, refers to customer due diligence. When the customer is a business, the procedure already includes checks on the legal entity, its representatives, and its beneficial owner.
The KYB refers more specifically to the method used to audit a company. It can apply to a client company, a partner, an intermediary, or a supplier, but the basis and scope of the due diligence vary depending on the relationship.
The KYS, or Know Your Supplier, focuses its analysis on suppliers and subcontractors. It can cover risks related to corruption, international sanctions, fraud, reputation, or dependency within the supply chain.
These steps make it possible to determine which entity the organization is dealing with, but their legal bases and consequences are not the same.
Is the KYB a legal requirement?
The Monetary and Financial Code does not use the term “KYB” as a standalone requirement. However, professionals subject to AML-CFT regulations AML-CFT identify their corporate clients, verify their existence, identify their representatives, and determine their beneficial owners.
For suppliers and partners, audits may be based on other frameworks. Article 17 of the Sapin II Act provides that the companies concerned must assess their customers, first-tier suppliers, and intermediaries in light of the corruption risk map.
The duty of care serves a different purpose, related in particular to serious violations of human rights, health, safety, and the environment. A third-party due diligence policy must therefore begin with a question: What risk and what obligation are we seeking to address?
Why does auditing a company require more investigation?
The identity of a legal entity is not limited to its corporate name and registration number. A company may be owned by several entities registered in different jurisdictions. Its official officers are not necessarily the individuals who exercise actual control.
A complex structure is not inherently suspicious. It becomes a risk factor when it does not correspond to the company’s stated business activity, prevents the identification of the individuals who control the company, or involves sensitive territories without a clear justification.
The Approach Glass Box advocated by AP Solutions IO addresses this challenge: teams must understand the criteria that triggered an alert and be able to reconstruct the analysis without relying on an opaque result.
What information should be checked?
Verify the company's legal status and its representatives
The first step is to confirm that the company exists and is authorized to engage in the declared business activity. The checks may cover the company’s registration, legal form, principal office, corporate purpose, officers, and the authority of those who bind the company.
The documents collected must be consistent with the official records. Any significant discrepancies must be explained and documented.
Identify the beneficial owner
For a company, the beneficial owner is, in particular, the individual who directly or indirectly holds more than 25% of the capital or voting rights, or who exercises control by other means.
The analysis must trace the entire chain of ownership and take into account voting rights, agreements, appointment powers, and other control mechanisms.
Official records are a useful source of information, but they are no substitute for risk-based due diligence. The data in these records must be cross-checked against articles of incorporation, ownership structures, and, if necessary, additional sources.
It is also important to distinguish between a company’s beneficial owner and the recipient of a wire transfer. The Beneficiary Verification (VoP), compares the account holder’s name with the provided IBAN to secure a payment. It does not identify the individuals who control a company.
Monitor sanctions, PEP adverse information
The review may include checking whether the company appears on a sanctions list and screening Beneficial Owners, representatives, officers, or agents.
PEP status PEP an individual and triggers specific due diligence measures in the situations provided for by the regulations. Adverse information, for its part, constitutes a factor in the analysis. It does not automatically result in the same consequences as a sanction or PEP status.
At AP Solutions IO, the challenge is to classify each result according to its nature, and then retaining the elements that explain the decision made.
How do you vet suppliers and partners?
Not all suppliers are automatically subject to the due diligence obligations applicable to customers under AML-CFT regulations. However, verifying them may be part of an anti-corruption program, a sanctions policy, contractual obligations, or an internal risk assessment.
The level of oversight may take into account the country, the sector, the contract amount, intermediaries, and the third party’s access to sensitive assets.
Our guide to due diligence and KYS explains how to organize supplier information and secure the supply chain based on the risks involved.
Does a KYB need to be replaced?
A company may change its executive, beneficial owner, business activity, or country of exposure. The data must therefore be updated at a frequency commensurate with the risk and as soon as a significant event occurs.
A significant change in capital structure, a new sanction, a reputational alert, or transactions inconsistent with the known profile may trigger an early review. A stable company may be subject to reviews at longer intervals than a complex international structure.
The frequency of inspections should therefore not be the same for all legal entities.
Automate KYB with AP Scan
Manual processing becomes difficult when an organization has to monitor several thousand legal entities and regularly repeat the checks.
AP Scan, the screening solution developed by AP Solutions IO, checks individuals and legal entities for sanctions, asset freezes, PEP their close associates, Beneficial Owners reputational risks.
The solution enables screening at the outset of the relationship, followed by daily re-screening of the portfolio. Its matching logic accounts for certain spelling variations. Actions are tracked, documented, and exportable, which facilitates the justification of due diligence procedures.
AP Scan operates in SaaS mode or via API and can be integrated with existing management systems. The solution is hosted in France.
AP Scan automates the detection and escalation of alerts, while the organization remains responsible for assessing them and making the final decision.
Prioritize Reviews with AP Scoring
Not all business relationships require the same frequency of monitoring. A rating system allows you to prioritize cases based on the third party’s characteristics, geographic factors, products used, distribution channels, and screening results.
AP Scoring analyzes customer and transaction data to assign an AML-CFT risk level. The score changes over time, and its history helps explain the changes that have occurred.
For relationships subject to AML-CFT regulations, this development helps to tailor due diligence procedures and the frequency of reviews.
As part of a broader policy for monitoring partners or suppliers, the prioritization criteria must be configured based on the risks covered, the available data, and internal procedures.
Incorporate KYB into the ongoing monitoring of third parties
An effective system defines the third parties subject to audit, the data collected, the frequency of reviews, and the necessary validations.
Technology does not replace human analysis or the organization’s responsibility. It makes it possible to process more cases, identify changes, and maintain a consistent audit trail.
With AP Scan and AP Scoring, AP Solutions IO helps teams automate screening, standardize scoring, and focus their attention on the highest-risk cases.
KYB FAQ
What is the difference between KYC and KYB?
KYC covers customer due diligence for both individuals and legal entities. KYB focuses on verifications specific to businesses: legal existence, representatives, business activities, ownership structure, and Beneficial Owners.
Is the KYB mandatory for all AML-CFT entities AML-CFT
KYB is not a standalone requirement. However, entities subject to the KYB requirement must verify corporate customers and their Beneficial Owners the applicable due diligence rules.
How do you identify a company’s beneficial owner?
It is necessary to analyze the chain of ownership, voting rights, and means of control all the way down to the individuals involved. Official records must be supplemented by documents and due diligence measures commensurate with the risk.
What is the difference between KYB and KYS?
KYB refers to the due diligence procedures applied to a legal entity. KYS incorporates some of these procedures within the specific context of supplier and supply chain assessment.
Does a KYB need to be renewed after the business relationship begins?
The information must be updated based on the level of risk and as soon as a significant change occurs. A change in management, beneficial owner, business activity, or geographic exposure may warrant a new review.
What tools can be used to automate KYB?
AP Scan automates the screening of legal entities and associated individuals. AP Scoring assigns a dynamic rating to relationships within its scope. Final decisions and approvals remain the responsibility of the organization.
