An individual customer is identified with an identity document. A corporate customer is not: behind a company name there are directors, shareholders, chains of shareholdings and, ultimately, one or more natural persons who control it. This is where the distinction between KYC and KYB comes from, and understanding the differences between KYC and KYB is the first step toward customer due diligence that can withstand an inspection, today under Legislative Decree 231/2007 and from July 10, 2027 under Regulation (EU) 2024/1624 (AMLR).
KYC and KYB: the definitions
KYC (Know Your Customer) refers to the set of checks through which an obliged entity identifies and verifies its individual customer, assesses their risk profile and monitors them over time. KYB (Know Your Business) applies the same principle to customers that are legal persons: companies, entities, trusts and similar arrangements.
Neither Italian nor European legislation uses these acronyms: they speak of customer due diligence. Article 18 of Legislative Decree 231/2007 breaks it down into four activities: identification and verification of the customer, identification and verification of the beneficial owner, collection of information on the purpose and nature of the relationship, and ongoing monitoring. KYC and KYB are therefore two ways of applying the same obligations to customers of different kinds.
The differences between KYC and KYB in practice
Article 22 of the AMLR makes the distinction very concrete, because it lists separately the information to be collected for natural persons and for legal persons.
- Who is identified. In KYC the customer is the person to be verified. In KYB you need to identify the entity, its legal representatives, those acting on its behalf and the beneficial owners.
- What data. For a natural person: first names and surnames, place and date of birth, nationalities, residence, tax code where available. For a legal person: name and legal form, registered office and principal place of business if different, country of incorporation, names of the legal representatives and, where available, registration number, tax code and LEI, as well as the names of any nominee shareholders or nominee directors.
- How verification works. In KYC through an identity document or electronic identification with a "substantial" or "high" assurance level. In KYB through company register extracts, articles of incorporation, official registers and, for the beneficial owner, consultation of the central beneficial ownership registers.
- Where the risk lies. In KYC the risk is mainly linked to false identities, political exposure (PEPs) and sanctions lists. In KYB what weighs most is the complexity of the structure, the jurisdictions involved, the use of nominees and the consistency between declared business and actual operations.
The heart of KYB: tracing the beneficial owner
The most demanding part of KYB is not the company register extract of the corporate customer, but the reconstruction of the chain of control up to the natural persons who own or control the entity. Under the AMLR the ownership criterion is set at a threshold of 25% or more of the shares, voting rights or other ownership interest, to be assessed at every level of the chain, alongside the criterion of control exercised through other means.
The beneficial ownership register is a support, not a substitute for verification: the obliged entity must consult it and, if it finds discrepancies with what emerged from its own review, is required to report them. To go deeper into the method, we have written a guide on how to reconstruct the chain of control and the beneficial owner.
What remains in common: risk and monitoring
KYC and KYB share the underlying logic of the risk-based approach. In both cases the intensity of the measures (simplified, standard or enhanced) depends on the customer's profile, and in both cases screening does not stop at onboarding. In KYB, however, screening for sanctions, PEPs and adverse media must be extended to all connected persons: directors, legal representatives and beneficial owners. An entity can be clean on paper and have a controlling shareholder designated on a sanctions list.
Ongoing monitoring also changes shape: for a natural person what matters most is transactional behavior, while for a company you also need to catch changes in shareholders, directors, registered office or corporate purpose, which can change the risk profile from one day to the next. The regulatory technical standards on customer due diligence, which we discussed in the article on the AMLA RTS, will further detail these requirements.
Best practices: what to do now
- Separate the workflows. Distinct procedures, checklists and data requirements for natural persons and legal persons, aligned with the list in Article 22 of the AMLR.
- Official sources first. Company register, equivalent foreign registers and the beneficial ownership register, with evidence of the date and source of every piece of data collected.
- Map the structure. Represent the chain of control graphically and document the reasons why you identify (or exclude) the beneficial owners.
- Extended screening. Check sanctions, PEPs and adverse media on the entity and on all connected persons, not just on the direct customer.
- Monitoring of corporate events. Set up alerts on changes in shareholders, officers and registered office to update the risk profile without waiting for the periodic review to fall due.
- Audit trail. Keep a file that makes the checks performed and the decisions taken traceable.
How AegisX helps you
We turn compliance into a strategic advantage by automating the most burdensome parts of KYB. With Lensis you reconstruct the chain of control and identify the beneficial owners starting from official company data. With Monitus you run AML screening on sanctions, PEPs and adverse media for customers, directors and beneficial owners, with an AI engine that reduces false positives and keeps a record of every check.
Want to see how to set up a single KYC and KYB process that is traceable and ready for the AMLR? Contact us for a demo.
This article is for informational purposes only and does not constitute legal or compliance advice.
