The KYB Incentive Trap
Know Your Business and customer due diligence: how operating incentives distort compliance effort, what UK enforcement reveals, and how UK and EU requirements inform better control design.
Regulatory position as at 24 October 2026
$206bn estimated annual financial crime compliance cost worldwide in the 2023 study (LexisNexis Risk Solutions) [1] | 70% of surveyed firms reporting client losses from inefficient onboarding, up from 48% in 2023 (Fenergo, 2025) [2] | $3.8bn in global AML, KYC, sanctions and CDD penalties in 2025 (Fenergo, 2026) [3] |
Executive summary
Know Your Business (KYB) is the ongoing application of customer due diligence (CDD) to business customers. It establishes who they are, what they do, who controls them and whether their activity fits the relationship. This paper argues that incentives favouring speed and completed checks divert effort from that understanding, creating friction for straightforward customers while leaving complex risks under-investigated. The FCA documented this mechanism in its 2025 Final Notice to Monzo.
Verification is a component of KYB. Identity assurance must be accompanied by an understanding of relationship purpose, ownership and control, actual business activity and changes in risk over time.
Speed metrics, vendor scores and reliance on calendar reviews can encourage teams to equate completed checks with sufficient understanding. Firms may then lose legitimate customers to friction while carrying complex relationships they have not adequately assessed.
The UK cases reviewed here reveal failures across verification, customer understanding, monitoring and response. They show why identity checks alone cannot deliver an effective control framework.
Material risk can lie at group level, beyond an entity-level check. Similar evidence gaps arise in supplier and third-party risk, although the legal obligations differ.
Closing the gap requires proportionate depth, traceable evidence, documented reasoning and monitoring that links material changes to action. Management measures must reward these outcomes alongside speed.
1 Where verification ends
This paper uses business verification narrowly to mean establishing identity and recorded attributes from reliable sources: legal name, registration number, status, jurisdiction, addresses, officers and disclosed ownership. Initial sanctions, politically exposed person (PEP) and adverse media screening commonly accompanies these checks. Together they form the initial verification and screening layer of KYB; they do not establish that the wider relationship is understood.
Registry data reflects information filed under each jurisdiction’s disclosure rules. Operational changes may not prompt an immediate filing: a business moving from software services into payment aggregation, or trading in a new jurisdiction, may retain the same recorded attributes. Registry verification therefore provides limited evidence about current commercial activity.
FATF Recommendation 10 sets four CDD measures: identify and verify the customer; identify and take reasonable measures to verify the beneficial owner and understand ownership and control; understand relationship purpose and intended nature; and conduct ongoing due diligence, including transaction scrutiny [4]. UK MLR Regulation 28 implements these requirements [5]. The EU AML Regulation generally applies from 10 July 2027. AMLA’s final draft CDD RTS, announced on 1 October 2026, have been submitted to the Commission for adoption [6]. EBA [7] and JMLSG [8] guidance supports implementation. Verification is part of this continuing discipline. Our paper The Proportionality Test analyses AMLA’s final draft CDD RTS and what changed from the consultation version [9].
The third measure is easily left at the gate: the FCA's April 2026 review of CDD practice found firms recording no details of the purpose and intended nature of business relationships to support ongoing monitoring [10].
Figure 1. Initial verification and screening within KYB. Ownership thresholds vary by jurisdiction; external intelligence supports the wider monitoring framework.
2 The operating model incentive trap
Experienced compliance leaders know the difference between checking identity and understanding a relationship. Yet operating models reward the checks that are easiest to count, while investigation requires evidence, judgement and time. Three pressures reinforce one another.
Speed metrics. Where turnaround dominates performance measures, teams have an incentive to minimise information gathering. The FCA identified this mechanism at Monzo: paragraph 4.41 of the Final Notice links limited onboarding information and assessment to minimising friction so that customers could be onboarded at speed, and paragraph 4.65 records that the firm placed significant emphasis on a streamlined customer experience, with limited initial information gathered and evaluated as a result [14].
Vendor scores. Registry, screening and ownership tools are valuable, but a score or “KYB complete” status can be mistaken for a relationship assessment. The firm remains responsible for interpreting the evidence against its customer’s purpose, expected activity and risk profile. A provider may not have that relationship context.
Calendar reviews. Periodic refreshes are necessary, but reliance on them alone leaves gaps when businesses acquire subsidiaries, change owners or enter new markets between reviews. Event triggers complement scheduled reviews and any applicable refresh requirements.
The commercial cost runs in both directions. Fenergo’s 2025 survey of 600 senior decision-makers found 70% of firms reporting client losses from inefficient onboarding, up from 48% in 2023 [2]. That supports the importance of friction, without proving its causes. The mechanism is that uniform checks burden simple relationships while insufficient investigation leaves complex ones exposed. Losses and remediation then intensify cost pressure. The same allocation problem merits attention in lending, trade finance, private banking and procurement.
Figure 2. The operating model incentive trap: how misallocated effort creates customer friction and unmanaged exposure.
3 What KYB must deliver under CDD
Four practical questions help translate CDD obligations into an evidence-based KYB file.
3.1 What does the business do, and why this relationship?
The assessment should establish what the customer sells, to whom, how it earns money and why it needs the proposed service. The SIC code is a starting point: a registered travel agency operating mainly as a remittance business carries the risk of that actual activity. Websites, licences, customer evidence and sector data help establish the trading footprint. Record expected transaction volumes, counterparties and geographies so monitoring can test them. Nationwide illustrates the importance of actual use: it knew some personal accounts were used for business but lacked adequate processes for the resulting risks [11].
3.2 Who owns and controls it?
Ownership thresholds are jurisdiction-specific; control must also be assessed. Nominees, family arrangements and holding layers can obscure who exercises it. UK MLR Regulation 28(9) expressly prevents firms from meeting beneficial-owner requirements solely through registrar information [5]. FATF Recommendation 24 requires countries to combine company information with a registry or an effective alternative mechanism, supplemented as necessary [12]. Annual reports, audited accounts, governance disclosures, regulatory filings and LEI data can help corroborate complex structures; unresolved gaps must remain explicit.
From CleverChain casework: risk at group level
In CleverChain’s investigation, a UK waste management subsidiary had no identified sanctions, adverse media or regulatory findings of its own. Mapping its ownership through three countries revealed a European parent group whose founder had been indicted for corruption and bid-rigging, and which had settled a multi-million-euro judicial agreement with national prosecutors. These findings emerged through group-level research and screening. They warranted assessment of the group’s influence and relevance to the subsidiary; they did not establish wrongdoing by the subsidiary. The practical lesson is to document how connected-entity evidence affects the customer assessment.
3.3 Has its behaviour changed?
Many of the useful signals appear after onboarding, in how a company files, who controls it, where it operates and how it is reported. Five typologies are especially relevant for legal persons:
Identity and control drift: name changes, re-registrations and turnover of persons with significant control, especially when they coincide with an enforcement event.
Substance against shell: headcount, premises, assets and licences that do not match the declared activity, or a virtual-office registration shared with unrelated higher-risk companies.
Declared against observed model: a SIC code, website, group materials and hiring pattern that describe different businesses.
Footprint drift: filing, hiring or registering trade marks in jurisdictions the customer did not declare, particularly those on FATF lists.
Group and financial trajectory: enforcement, monitorships or investigations at parent level; qualified audits, frequent auditor changes, court judgments and credit downgrades.
These signals require context. They do not by themselves establish wrongdoing by the customer; the file should explain their relevance and the response.
3.4 Is the assessment still current?
Ongoing due diligence includes keeping customer information current and scrutinising transactions [4]. The FCA’s 2026 review found unclear procedures for event-driven reviews [10]. Ownership changes, adverse developments or divergent activity should prompt proportionate review alongside periodic refreshes. FinCEN’s February 2026 order permits covered institutions to identify and verify beneficial owners at initial account opening, when reliability is in doubt, and as needed under risk-based ongoing CDD. At such a risk-based review, prior information may be reused with recorded customer confirmation; confirmation is not required at every additional account opening [13]. Monzo demonstrates why this matters: missing onboarding information weakened transaction monitoring [14].
4 The evidence: UK enforcement
These selected cases illustrate failures across identity verification, understanding customer activity, ongoing monitoring and response. They support a broader control framework and they do not establish that verification was adequate in every case or that one operating-model weakness explains every penalty.
Case | Penalty | Year | What the court or regulator found |
NatWest (Fowler Oldfield) | £264.8m (criminal fine) | 2021 | Guilty pleas to three offences under the MLR 2007, all concerning ongoing monitoring, including failing to set it on a risk-sensitive basis [15] |
Barclays Bank PLC (Stunt & Co) | £39.3m | 2025 | Too little information gathered at onboarding, inadequate ongoing monitoring, and no proper response to trigger events including police raids and court orders [16] |
Monzo | £21.1m | 2025 | Incomplete beneficial-owner/PSC verification, inadequate CDD refresh procedures and insufficient onboarding information to support monitoring [14] |
Nationwide | £44.1m | 2025 | Ineffective systems for keeping due diligence and risk assessments up to date; business activity through personal accounts [11] |
Barclays Bank UK PLC (WealthTek) | £3.1m | 2025 | Client money account opened without checking the FCA register, which showed WealthTek could not hold client money [16] |
WealthTek involved a missing authorisation check; Monzo also had beneficial-owner verification failures. Nationwide concerned personal accounts, including unauthorised business use, rather than conventional legal-person KYB. NatWest and Barclays’ Stunt & Co case show how failures to scrutinise activity and act on warning signs can persist after onboarding.
Case study: Fowler Oldfield
NatWest initially understood that Fowler Oldfield would not handle cash through the bank. Approximately £365m was subsequently deposited over the relationship, including around £264m in cash. Staff raised suspicions without an appropriate response, while automated monitoring misclassified some cash deposits as cheques [15]. The failures therefore involved internal data, escalation and transaction scrutiny, as well as customer understanding. Barclays’ customer Stunt & Co received £46.8m from Fowler Oldfield in just over a year; Barclays failed to respond properly to subsequent warning events [16]. A current KYB profile should inform expected activity and the investigation of deviations; external research must connect to those operational controls.
5 Beyond banks: supplier and third-party risk
Procurement and supply chain teams face a related evidence problem. Registration and creditworthiness provide a baseline, but may reveal little about a supplier’s actual activity, control or changing exposure. Where onboarding prioritises speed and annual reviews rely on self-certified questionnaires, independent evidence can be missing. The control-design lesson transfers, although AML and supplier due-diligence duties have different scopes.
The EU Corporate Sustainability Due Diligence Directive, as amended by Directive (EU) 2026/470, introduces risk-based duties to identify and address human rights and environmental impacts, with national measures applying from 26 July 2029. The main EU-company thresholds are more than 5,000 employees and EUR 1.5bn worldwide net turnover; for non-EU companies, the principal test is more than EUR 1.5bn EU turnover [17]. UK Modern Slavery Act section 54 instead imposes an annual transparency obligation on qualifying organisations and permits a statement that no steps were taken [18]. Reliable supplier evidence supports meaningful reporting, but the two regimes do not impose equivalent duties.
6 From verification to understanding: control design
Effective KYB depends on how evidence is produced, assessed and kept current. Four principles help firms connect verification with relationship understanding.
Proportionate depth. Customer risk, segment and jurisdiction should determine investigation depth within applicable legal requirements. Payment intermediaries, cash-intensive businesses, complex ownership and higher-risk jurisdictions may require wider research and more frequent review than a lower-risk domestic SME. FATF’s February 2025 amendments require countries to allow and encourage simplified measures in lower-risk situations [20]. Measure turnaround by risk segment alongside evidence completeness, rework and time to act on material triggers.
Traceable evidence and entity resolution. Each finding should identify its source, date and method of access. Entity resolution establishes whether records across registries, languages and transliterations concern the same entity. Assess source reliability, distinguish corroborated facts from allegations or inferences, and record unresolved conflicts. A citation makes a claim traceable; corroboration and review determine whether it is dependable.
Documented reasoning. A KYB investigation should produce a risk narrative: what was found, from which sources, what it means, which mitigants or escalations followed, and why the rating is what it is. A file that records its reasoning can be defended when a supervisor or internal auditor samples it; a score with no reasoning or analyst review behind it is hard to defend.
Monitoring that tests materiality. Event-driven reviews should complement periodic refreshes. Changes in ownership, activity, counterparties or reputation require a documented assessment of their effect on risk and controls, followed by proportionate action. External intelligence must connect with internal account data: expected volumes, transaction types, geographies and counterparties should inform monitoring, with discrepancies feeding back into CDD. Assign responsibility for investigating and closing triggers; a cited report alone cannot resolve an alert or replace transaction monitoring. Responses may include no further action, targeted verification, enhanced due diligence (EDD), escalation or exit.
CleverChain’s illustrative maturity framework describes capabilities and limitations and it is not a validated scoring model or a substitute for jurisdiction-specific requirements.
Level | What it looks like | Capability and limitation |
1 Registry verification | Registry existence and basic company details | Establishes recorded identity; limited activity context |
2 Verification and UBO | Adds beneficial ownership extraction and basic screening | Adds ownership evidence; control may need further investigation |
3 Verification and screening stack | Adds sanctions, PEP and adverse media checks with rule-based scoring | Flags potential exposure; relevance requires assessment |
4 Contextual KYB | Activity intelligence, control and network mapping, behavioural signals and evidence-based decisions | Supports evidenced decisions; gaps and uncertainty need review |
5 Continuous KYB | Event-driven updates linked to customer data and transaction monitoring, alongside periodic reviews | Supports timely reassessment; coverage and response need assurance |
7 Applying the principles with VERA
VERA, CleverChain’s autonomous due diligence agent, validates registry data, researches activity, maps ownership and control, and screens findings in context. Its time-stamped, cited reports include an evidence-gap checklist; event-driven monitoring re-assesses changes in ownership, activity or reputation [21]. These outputs support the firm’s CDD, monitoring and escalation decisions; accountability remains with the firm. Through the partnership with Experian announced in December 2025, CleverChain’s due diligence reports are available to Experian clients [19].
More at cleverchain.ai/autonomous-ai-due-diligence-agent.
References
[1] LexisNexis Risk Solutions, True Cost of Financial Crime Compliance Study: Global Report, press release, 26 September 2023.
[2] Fenergo, Financial Crime Industry Trends 2025; survey of 600 senior decision-makers in the UK, US and Singapore, conducted August 2025; announcement 7 October 2025. Fenergo research announcement
[3] Fenergo, "Global financial regulatory penalties fall by 18% in 2025 as enforcement shifts from US to EMEA and APAC", 13 January 2026. https://www.fenergo.com/newsroom/global-financial-regulatory-penalties-fall-by-18-in-2025-as-enforcement-shifts-from-us-to-emea-and-apac
[4] FATF, International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation (The FATF Recommendations), Recommendation 10 and Interpretive Note, as updated.
https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html
[5] Money Laundering Regulations 2017 (SI 2017/692), as amended: Regulation 28, particularly (2)–(4), (9) and (11).
[6] Regulation (EU) 2024/1624, Articles 20, 26 and 90; AMLA, final draft CDD RTS under Article 28(1), report dated 30 September 2026, announced 1 October 2026 and submitted to the Commission.
[7] EBA ML/TF Risk Factors Guidelines (EBA/GL/2021/02), amended by EBA/GL/2023/03 and EBA/GL/2024/01; the crypto-asset amendments apply from 30 December 2024.
[8] JMLSG, Guidance for the UK financial sector, Part I. June 2025 revisions have HMT approval; February and September 2026 revisions are listed as awaiting approval at the review date.
JMLSG revisions and approval status
[9] CleverChain, The Proportionality Test: Turning AMLA’s CDD RTS from Data Burden into Audit-Ready Intelligence, first published 12 June 2026, updated 19 October 2026 to reflect AMLA’s final draft RTS dated 30 September 2026.
[10] FCA, Firms’ customer due diligence processes and controls: our findings, 8 April 2026; policies and procedures, CDD processes and monitoring/audit.
[11] FCA, "FCA fines Nationwide £44m for failings in financial crime controls", 12 December 2025 (fine £44,078,500).
https://fca.org.uk/news/press-releases/fca-fines-nationwide-44m-failings-financial-crime-controls
[12] FATF, Recommendation 24 (revised March 2022); Guidance on Beneficial Ownership of Legal Persons, March 2023, paragraphs 46–48 on the multi-pronged approach.
[13] FinCEN, Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening, FIN-2026-R001, 13 February 2026, pp. 8–9; 31 CFR 1010.230.
[14] FCA, Final Notice to Monzo Bank Limited, 7 July 2025 (fine £21,091,300), especially paragraphs 4.36–4.41 on CDD, verification, reviews and onboarding friction, and paragraph 4.65 on the emphasis on a streamlined customer experience.
[15] FCA, NatWest fined £264.8 million for anti-money laundering failures, 13 December 2021, with links to the sentencing remarks and agreed statement of facts.
FCA case summary and court documents
[16] FCA, Final Notices dated 14 July 2025: Barclays Bank PLC (£39,314,700) and Barclays Bank UK PLC (£3,093,600).
Stunt & Co notice · WealthTek notice
[17] Directive (EU) 2024/1760, as amended by Directives (EU) 2025/794 and 2026/470; European Commission overview of scope and application from 26 July 2029.
[18] Modern Slavery Act 2015, section 54, particularly subsections (1)–(4) on annual statements and disclosure where no steps were taken.
[19] CleverChain, "Experian and CleverChain partner to deliver AI-powered global due diligence to combat financial crime", press release, 3 December 2025. https://cleverchain.ai/press-release/experian-and-cleverchain-partner-to-deliver-ai-powered-global-due-diligence-to-combat-financial-crime
[20] FATF, "Updating the FATF Standards to promote financial inclusion", amendments to Recommendation 1 and Interpretive Notes 1, 10 and 15, 25 February 2025.
[21] CleverChain, VERA: autonomous AI due diligence agent, product page. https://cleverchain.ai/autonomous-ai-due-diligence-agent
© 2026 CleverChain Limited. All rights reserved. This paper is for information only and does not constitute legal or regulatory advice.