Automating KYB: business verification without the manual pack

KYB proves that a business is what it claims to be and then works out who ultimately controls it. Automating it means resolving one applicant across company registries, extracting owners and directors from documents that follow no common format, walking the ownership chain to the natural people behind it, then scoring the result. It is a pipeline, not a form.

The manual version is a pack. An analyst pulls the registry extract, opens the certificate of incorporation, reads a shareholder register, cross-checks names against sanctions and PEP lists, and assembles a file that a second person signs off. Little of that clock goes to judgement. Most of it goes to copying identifiers between systems, retyping a shareholding table from a scanned PDF, and reconciling a company name that the registry, the applicant and the bank statement each spell differently. That copying is where automation earns its place, and it is also where a wrong number does real damage, because a missed 30 percent owner is a compliance failure, not a typo.

Resolving the business first

Before you can verify anything you have to know which company you are looking at. The applicant gives you a name, maybe a registration number, an address, and a country. None of those is reliable on its own. Names are entered by hand and drift. Registration numbers follow different formats per jurisdiction and get transcribed wrong. Addresses are often the accountant’s office, shared by hundreds of shell entities.

So the first stage is entity resolution against authoritative sources: the national business register, the LEI system, and whatever supplementary registries cover the jurisdictions you onboard. The mechanics matter.

• Block on strong keys first. A registration number plus country, or an LEI, gives you a near-certain match and skips fuzzy scoring entirely.
• When you fall back to name and address matching, normalise legal suffixes (GmbH, Ltd, S.A.) and score candidates rather than accepting the top hit. A close-but-wrong match is worse than no match, because it silently attaches the wrong ownership tree.
• Record which source you resolved against and when. Registry data changes, and a decision made in March against a stale extract needs to be reconstructable in an audit later.

The output of this stage is a canonical entity: one company, with the registry identifiers, incorporation date, status and registered address you trust, and a pointer to the source record. Everything downstream hangs off it.

Extraction from documents nobody standardises

Registries give you the skeleton. The flesh comes from documents the applicant uploads, and those are the hard part. A shareholder register from one jurisdiction is a clean table; from another it is a scanned photocopy with handwritten annotations. Articles of association bury ownership in prose. Certificates of incorporation, board resolutions, trust deeds, and passport pages all arrive as PDFs or images with no schema between them.

We treat extraction as a typed problem with a required evidence trail, not free-text summarisation. Each field the model pulls, a shareholder name, a percentage, a director appointment date, carries a citation back to the page and region it came from. That does two things. It lets a reviewer check a figure in seconds instead of reopening the source, and it gives you something to build eval sets against.

The evals are not optional. You assemble a labelled set of real document types per jurisdiction and measure field-level precision and recall. The failure that hurts is rarely a garbled address; it is a shareholding read as 2.5 percent when the document says 25 percent, or an owner on page four that the extractor never surfaced. Percentages, dates and identifiers get tighter validation than descriptive fields, and anything the model is unsure of routes to a human rather than flowing through silently.

Walking ownership to the UBOs

Ultimate beneficial ownership is where KYB stops being data entry. The regulation you are usually anchored to in the EU is the Anti-Money Laundering Directive framework, which sets a beneficial owner as a natural person holding, directly or indirectly, more than 25 percent of shares or voting rights, or otherwise exercising control. The word that makes it hard is indirectly.

Ownership is a graph. A person owns 60 percent of Holding A, which owns 50 percent of the operating company. That person’s effective stake is 30 percent, over the threshold, even though they hold nothing directly. Layer in a second holding company, a foreign parent, and a trust, and the graph has cycles, missing edges, and nodes in registries you cannot read programmatically.

The pipeline builds that graph from the resolved entity outward, expanding each corporate shareholder into its own ownership until it bottoms out at natural persons or hits a wall. Effective ownership is the sum over all paths to a person of the product of the percentages along each path. A person reachable through two branches gets both counted. Where a branch dead-ends at a foreign entity you cannot expand, you do not guess. You mark it unresolved, and that gap is itself a risk signal, not a rounding error.

Scoring, and where to stop the machine

The screening and scoring step consumes the resolved entity, the extracted attributes and the UBO list. Each identified person and the company itself get matched against sanctions, PEP and adverse-media sources. Do that matching with the identifiers you now hold, date of birth, jurisdiction, registry number, rather than names alone, or your false-positive budget evaporates on the first common surname.

The risk score is a function over concrete features, and you should be able to name every one of them: unresolved ownership branches, jurisdiction of incorporation and of each UBO, company age against the registry, mismatch between claimed and registered address, document quality flags, screening hits and their match confidence, and structural patterns like a director who appears across dozens of freshly incorporated entities. Keep the model interpretable enough that a reviewer sees why a case scored where it did, and keep the features in a store you can audit and monitor for drift as the mix of applicants shifts.

Then decide where straight-through processing ends. A clean applicant with a matched registry record, a shallow ownership tree fully resolved to natural persons, and no screening hits can auto-approve. A foreign layer, a nominee shareholder, an unreadable document, or a screening near-match should route to a human with the evidence already assembled. The payoff shows up in the review queue: an analyst opens a file where resolution, extraction and scoring are already done, every figure carrying a citation back to its source.