KYB in practice: from entity identity to beneficial ownership

When the customer is a person, identification has a natural stopping point: there is one human being, and once you have established and verified who they are, that part of the file is answered. Due diligence itself does not stop — ongoing monitoring applies to every customer, for as long as the relationship lasts — but the identification question has a definite answer.

When the customer is a company, a trust or a structure, even the identification question does not resolve in one step. Treating the entity as if it were a large individual is where entity onboarding goes wrong.

The law does not separate the two jobs by name. It defines customer due diligence once, and the definition is wider than identity: identifying and verifying the customer or beneficial owner — natural person, legal person or legal arrangement — understanding the purpose and intended nature of the business relationship, and understanding the nature of the customer's business and its ownership and control structure, with ongoing monitoring inside the definition rather than added afterwards.

Read that against an entity and four distinct tasks fall out of a single sentence.

One: identifying the entity is not enough

The entity is the customer. You identify and verify it as such — name, legal form, memorandum of association, tax registration number, registered address, articles, and the names of the people in senior management — and you verify that whoever is acting for it is authorised to do so, identifying them too.

Beneficial ownership is an additional identification requirement layered on top, not a substitute for it. The beneficial owner is the natural person who owns or exercises ultimate effective control over the customer, or on whose behalf transactions are conducted — including a person exercising that control over a legal person or arrangement directly, through a chain of ownership or control, or by any other indirect means.

The regulations set out how to get there, in order. First, the natural person who holds, alone or jointly, an actual controlling ownership interest of 25% or more. If there is doubt about who that is, or doubt that the holder is really the beneficial owner, or if no natural person controls through ownership at all, then the natural person who exercises legal or actual control by any other means, direct or indirect. And if no natural person is identified either way, the person holding a senior-management position.

That third step is a statutory fallback, not a shortcut around the first two. Recording a managing director as beneficial owner because the first two steps were hard can make a file look complete when it is not.

"Any other indirect means" is the phrase that defeats a percentage-only approach, and the regulations name concrete instances of it. A nominee shareholder exercises voting rights, or receives dividends, on the instructions of a nominator — and is expressly not the beneficial owner by virtue of holding in that capacity. A nominee director performs management functions on a nominator's instructions and is likewise not the beneficial owner. In each case, the file must look through the nominee arrangement to the nominator and continue until the natural person who meets the beneficial-owner test is identified. In a trust, a protector may hold powers over administration without owning anything at all.

Two: control and ownership are different questions

Ownership leaves a documentary trail by design — registers, share certificates, articles of association. Control need not. An entity can have a clean cap table and still be directed by someone who appears nowhere on it. The definition puts the two side by side deliberately — owns or exercises ultimate effective control — and the cascade in the regulations only reaches the control limb once the ownership limb has been tried and found wanting. A file that answers only the first has answered half the question.

For legal arrangements the question changes shape again. There, the regulations ask for the trustee, the settlor, the protector, and the beneficiaries or classes of beneficiaries together with the powers granted to them — plus any other natural person exercising ultimate effective control, and the beneficial owner of any legal person that is itself a party to the arrangement.

Three: the structure needs a reason

Because the definition requires the purpose of the relationship and the nature of the business, a structure that cannot be explained is a due diligence gap rather than a curiosity. Layering across jurisdictions may be entirely ordinary — tax, succession, investor requirements, regulatory separation. What matters is whether the explanation exists, whether it matches what you can observe, and whether it is written down.

A useful discipline: if you could not explain the structure's purpose to a supervisor in two sentences without opening the file, you have not finished the work.

Four: it does not stop at onboarding

Ongoing monitoring is inside the definition of due diligence, and the regulations give it content: scrutinise transactions through the life of the relationship for consistency with what you know of the customer and the risk they present, including the source of funds where necessary, and keep the documents and data obtained during due diligence current — with particular emphasis on records for high-risk customers.

For entities this carries further than for individuals, because entities change shape quietly. Directors are replaced, shares transfer, a dormant subsidiary becomes the trading entity. None of that generates an alert unless someone is looking. The regulations also require due diligence where there is any doubt about the accuracy or adequacy of identification data obtained earlier — which is the hook for revisiting a file that no longer looks right.

What this means for the file

A complete entity file answers four questions in writing: who owns it, who controls it, why it is structured this way, and what you expect it to do.

The regulations also draw two bright lines worth restating: no dealing with shell banks in any manner, including opening accounts for them or accepting funds or deposits from them; and no opening or maintaining anonymous accounts, or accounts held under obviously fictitious names.

Where a chain cannot be resolved, the regulations do not leave the choice open. Financial institutions, DNFBPs and virtual asset service providers are prohibited from establishing or continuing a business relationship, or executing a transaction, where they are unable to apply customer due diligence measures — and must consider filing a suspicious transaction report to the Unit whenever necessary. There is a related provision for the case where applying due diligence would itself tip the customer off: you may refrain, but you must then file a report stating why.

So the question is not whether to accept with enhanced measures or decline. It is whether you can apply due diligence at all. If you can, the relationship proceeds on measures matched to the risk. If you cannot, the relationship does not proceed, and you consider a report.

What is left to you is the record. An unresolved ownership question should be written down as such, with the steps taken, the point at which they stopped, and the conclusion reached — rather than left as a blank field in an otherwise complete file. That much is our own position rather than a statutory requirement, but it is the difference between a decision a supervisor can follow and a gap nobody noticed.

The detail sits in the Executive Regulations, Cabinet Resolution No. (134) of 2025, which came into force in December 2025. Verification may be deferred, but only where risk is low, only if completed as soon as possible, only where the deferral is necessary so as not to disrupt normal business, and only with effective measures controlling the risk in the meantime. Where the customer or its controlling owner is a listed company subject to disclosure requirements that already ensure sufficient transparency, you may be able to stop short of identifying shareholders. And existing relationships are not exempt: due diligence has to be applied to customers already on the book when the regulations came into force, at times appropriate to materiality and risk. Read all of it against your own sector and supervisor.