Knowing your customer, verifying a business, evaluating a supplier, monitoring transactions: these processes are similar, but they do not address the same needs or, depending on the situation, the same regulatory requirements.
KYC, or Know Your Customer, refers to customer due diligence. KYB, or Know Your Business, commonly refers to the process of verifying and understanding a company, particularly its structure and representatives. KYS, or Know Your Supplier, extends due diligence to third parties, including suppliers and subcontractors. KYT, or Know Your Transaction, focuses on the monitoring of transactions.
In addition to these procedures, screening and filtering controls are also in place. Their scope depends on the applicable requirements: identifying individuals exposed to certain risks, detecting sanctions or asset-freezing measures, filtering financial flows, or monitoring transactions.
At AP Solutions IO, we view these various controls as complementary: the goal is not to simply stack building blocks, but to connect our understanding of the third party, its risk level, and what is actually happening throughout the relationship.
KYC, KYB, KYS, and KYT: Four Complementary Processes
The most useful distinction is to consider what is being analyzed and why.
| Approach | What is it about? | When does it occur? | Main Objective |
| KYC – Know Your Customer | The customer, whether an individual or a legal entity | Establishing a Relationship and Throughout Its Duration | Identify, understand, and update the customer profile |
| KYB – Know Your Business | The Company and Its Structure | Establishing Contact and Reviews | Verify the company, its representatives, and its oversight structure |
| KYS – Know Your Supplier | Suppliers, subcontractors, and certain partners | Classification and Reviews Based on Risk | Assess the risks associated with the supplier relationship |
| KYT – Know Your Transaction | Operations | During the relationship | Detect unusual or inconsistent transactions |
| Screening / Filtering | People, entities, or flows, depending on the audit | Based on the defined obligations and events | Detect Sensitive Matches |
Knowing a third party is not limited to their identity
KYC, KYB, and KYS are all based on a "know your counterparty" approach, but their underlying principles and scope are not the same.
With regard to AML-CFT, regulated professionals must, in particular, identify their client and, where applicable, the client’s beneficial owner, collect information about the business relationship, and keep that information up to date throughout the duration of the relationship.
The intensity of the due diligence process then depends on the level of risk. Our guide on customer due diligence levels AML-CFT allows you to apply these controls within this graduated approach.
Keep an eye on how things change over the course of the relationship
KYT answers another question: Are the observed operations consistent with our current understanding of the relationship?
The Monetary and Financial Code does not establish an obligation known as “KYT.” Instead, it requires the relevant professionals to exercise constant vigilance and carefully review transactions, ensuring that they are consistent with their understanding of the business relationship.
This integration is central to AP Solutions IO: AP Scoring enables the assessment and adjustment of risk levels, whileAP Monitoring aligns this insight with actual operational data.
What is the difference between KYC and KYB?
KYC refers to the "know your customer" process. It can apply to both individuals and legal entities.
When a customer is a company, the process involves, among other things, verifying the company’s existence, its representatives, and its beneficial owner. The term “KYB” is used to more specifically refer to the work performed on the company and its structure.
KYC is an ongoing process
Understanding the customer doesn't end when the relationship begins.
Information regarding the nature and purpose of the relationship must be collected and kept up to date throughout the duration of the relationship. New information, a change in the level of risk, or a significant change may therefore lead to a review of the file.
It is more accurate to view KYC as a cycle of continuous learning and updating rather than as a simple initial verification.
The KYB Deepens Understanding of the Legal Entity
KYB pays particular attention to the company’s structure: legal status, representatives, executives, Beneficial Owners , and, when necessary, the ownership structure.
The term is not used in the Monetary and Financial Code as a standalone requirement. It primarily describes an operational method for verifying legal entities.
With AP Solutions IO, the information obtained from the screening process can be used to feed into the risk assessment performed by AP Scoring, in order to update the rating when relevant factors change.
What is KYS, or "Know Your Supplier"?
KYS, or "Know Your Supplier," refers to understanding suppliers, subcontractors, and other third parties in the supply chain.
Its purpose is, in particular, to identify risks related to corruption, international sanctions, the country of exposure, the third party’s reputation, or other risks defined by the organization.
KYS is not automatically subject to the AML-CFT
This distinction is essential. Not all of a company’s suppliers are automatically subject to the due diligence requirements applicable to customers under the “ AML-CFT.”
A KYS approach, on the other hand, can address an anti-corruption program, a sanctions or export control policy, contractual obligations, or an internal risk assessment.
The level of oversight must therefore be tailored to the specific relationship in question: country of establishment, sector, contract value, presence of intermediaries, exposure to sanctions, or other relevant factors.
Our article on supplier due diligence and KYS explains this approach in detail.
This is another area in which AP Solutions IO operates: our KYC-KYS tools make it possible to monitor various categories of third parties without assuming that they are all subject to the same regulatory framework.
Does KYT replace KYC?
No. Know Your Customer (KYC) and transaction monitoring serve two different purposes.
KYC is used to establish and update the customer profile. KYT then monitors transactions to identify behavior that appears atypical or inconsistent with that profile.
KYT in Practice
Transactional monitoring can look for different signals depending on the activity:
- unusual amounts or frequencies;
- splitting of operations;
- sudden changes in flow;
- unusual geographic exposure;
- movements that are inconsistent with the expected profile;
- other scenarios identified based on risk mapping.
The effectiveness of this monitoring depends directly on the information available beforehand.
AP Monitoring, developed by AP Solutions IO, allows you to configure various scenarios and correlate transactions with data fromAP Scan or AP Scoring. This combination makes it possible to view a transaction within the context of the customer rather than examining it in isolation.
Our guide to KYT and Transaction Monitoring explores this concept in greater depth.
Is screening a separate building block?
Screening is more of a cross-sectional assessment, the scope of which varies depending on the population and the risk involved.
It can be used, for example, to check for matches with sanctions, asset freezes, “ PEP ” databases, or other relevant data.
However, we should avoid grouping all these checks under a single legal obligation: anti- PEP, financial sanctions, asset freezes, reputational risk, and certain supplier due diligence procedures are not necessarily based on the same legal provisions or the same processing procedures.
AP Scan for people, AP Filter for traffic
This distinction is directly reflected in the architecture ofAP Solutions IO.
AP Scan automates the screening of persons of interest when establishing new business relationships and for existing portfolios. In particular, the solution enables companies to address sanctions, asset freezes, and PEP, with automated portfolio re-screening.
AP Filter, for its part, is designed to screen for international sanctions and embargoes on financial flows, supporting various types of transactional data.
We distinguish between these uses because a customer, a supplier, and a financial flow are not managed using the same data or at the same time.
Where are the main blind spots?
Problems often arise when the various controls are designed separately.
Insufficient understanding of a company's structure
For a corporation, simply knowing its corporate name does not always make it possible to understand who actually controls it.
When applicable requirements mandate the identification of the beneficial owner, the system must allow for tracing the chain of ownership back to identify the relevant individual(s).
This information can then be used to inform risk screening and assessment.
Suppliers Audited Without a Risk-Based Approach
The opposite extreme also exists: applying exactly the same controls to all suppliers, regardless of their exposure.
An effective KYS approach therefore begins by defining which risk needs to be controlled and why the third party falls within the scope.
This approach prevents supplier due diligence from becoming a one-size-fits-all formality that is of little practical use.
Data that is never updated
An initial assessment isn't enough to manage a relationship that's evolving.
A client may change its beneficial owner, executive, business activity, or geographic exposure. An individual may also appear on a relevant registry at a later date.
The frequency of reviews should be determined based on risk, but certain events should also trigger an early reassessment.
Our guide to the risk-based approach AML-CFT explains the rationale for tailoring controls to the specific profile.
How can KYC, KYB, KYS, and KYT be integrated into a coherent framework?
Good architecture isn't about systematically deploying every component. It's about determining which populations need to be monitored, which risks need to be addressed, when, and using what data.
Starting with Risk and Relationships
A business that primarily serves individual customers will not have the same organizational structure as a group with an international network of suppliers.
Similarly, a company without significant cash flows does not necessarily have the same KYT requirements as an institution that processes several thousand transactions daily.
The system should focus onactual exposure rather than striving for technological comprehensiveness.
Link each control to the correct event
Triggers may include:
- establishing a relationship;
- the registration of a supplier;
- a change in the beneficial owner;
- a significant change in profile;
- a periodical;
- an unusual transaction or behavior;
- a change to a standard that requires a new audit.
Each event must be linked to a rule, a data point, and a processing procedure.
How does AP Solutions IO bring these different aspects together?
AP Solutions IO is a French RegTech company specializing in compliance solutions— AML-CFT, KYC-KYS-KYT, anti-corruption, and export control.
Our suite combines AP Scan for screening, AP Scoring for dynamic risk assessment, AP Monitoring for operational oversight, and AP Filter for sanctions and embargo screening.
These solutions can work together : the information detected by AP Scan can enhance the scoring, whileAP Monitoring can correlate transactions with existing customer data.
Our Glass Box Augmented Intelligence approach adds a common requirement to these various components: the results must remain traceable and explainable so that compliance teams can understand the factors that led to an alert or a change in risk.
The value of an integrated platform, therefore, lies not simply in bringing together multiple products. For AP Solutions IO, it is primarily about linking third-party information, their risk levels, and observed operations without losing traceability between these different stages.
To identify the building blocks that are truly useful for your business and the target audiences to which they should be applied, you can explore the full range of solutions from AP Solutions IO.
