A Practical Guide to KYB Due Diligence, CDD, and EDD

Onboarding corporate customers carries risks beyond a simple registry check. A registered business can still hide sanctioned individuals, high-risk UBOs, nominee shareholders, shell activity, or complex ownership structures. Without proper KYB due diligence and structured business due diligence processes, firms face financial crime exposure, penalties, and reputational damage.

KYB due diligence confirms a company’s identity and structure. Corporate CDD assesses the overall relationship risk. Enhanced due diligence adds deeper checks when higher-risk indicators appear, such as complex ownership or high-risk jurisdictions. The UNODC estimates that 2–5% of global GDP is laundered each year, underscoring the need for strong AML controls.

This guide shows how to build an effective KYB due diligence process within a broader business due diligence framework. It covers verifying documents, identifying UBOs, conducting AML screening, and assigning risk scores. 

What Is KYB Due Diligence?

KYB due diligence is a business verification process that goes beyond a simple company registry check to build a clear risk profile of a corporate customer. As a core part of business due diligence and corporate CDD, it involves confirming the company’s legal existence, validating its registered details, and verifying its addresses and operational status. The process also examines business activities, identifies directors, shareholders, and ultimate beneficial owners (UBOs), and clarifies the purpose of the relationship.

In addition, it includes AML screening, sanctions checks, and risk assessment to determine whether standard corporate CDD or enhanced due diligence (EDD) is needed. While registry checks are important, they often do not reveal complex ownership structures or hidden risks, making deeper investigation necessary.

What Is Customer Due Diligence for a Business?

Customer Due Diligence (CDD) for a business is the standard process used during corporate onboarding to verify a company’s identity, ownership, and risk profile. It is a key part of KYB due diligence and broader business due diligence practices, helping organisations understand who they are dealing with before starting a relationship. Corporate CDD includes collecting and verifying company details, identifying directors and ultimate beneficial owners (UBOs), and assessing whether the business operates legitimately. 

In practice, corporate CDD answers key questions for risk assessment. Teams check if the company is genuine, what it does, where it operates, and who owns or controls it. They also confirm authorised representatives and the purpose of the relationship. By reviewing expected activity and screening for sanctions, PEPs, and adverse media, organisations can decide if standard corporate CDD is enough or if enhanced due diligence (EDD) is needed.

What Is Enhanced Due Diligence?

Enhanced Due Diligence (EDD) is a deeper level of customer checks used when a business relationship carries higher financial crime risk. It involves more detailed investigation into ownership, UBOs, transactions, geography, and overall risk within the broader scope of business due diligence.

EDD builds on standard corporate CDD by adding extra verification, documentation, and monitoring. It is typically required for high-risk cases, such as complex ownership, PEP involvement, or exposure to high-risk jurisdictions.

KYB vs CDD vs EDD

Understand how KYB due diligence, corporate CDD, and enhanced due diligence work together to strengthen corporate onboarding and business due diligence frameworks.

Explore the key differences between KYB verification, customer due diligence for companies, and business EDD to build a risk-based compliance framework.

KYB due diligence establishes the corporate identity, corporate CDD establishes the overall risk profile, and EDD investigates higher-risk relationships in greater depth within a business due diligence framework.

A Step-by-Step KYB Due Diligence Process

Build a clear, risk-based KYB due diligence workflow that strengthens compliance and accelerates corporate onboarding within a broader business due diligence strategy.

Follow these practical steps to streamline business verification, UBO identification, AML screening, and ongoing due diligence aligned with corporate CDD requirements.

Step 1: Collect Basic Business Information

The KYB due diligence process begins with collecting accurate and structured business information through a standardized onboarding form. Using structured data fields ensures consistency, reduces manual errors, and enables automated validation, screening, and risk scoring. This approach is essential for efficient business due diligence and supports scalable corporate CDD workflows.

Collect key details such as the legal name, registration number, incorporation jurisdiction, legal structure, registered and trading addresses, website, business activity, expected account activity, countries served, regulatory status, and the purpose of the relationship.

Step 2: Verify the Company Through Reliable Sources

Once the initial data is collected, the next step in business due diligence is to verify the company using reliable and independent sources. This includes confirming that the company exists, is active, has not been dissolved or liquidated, and is using a valid registration number. It is also important to ensure that registry information matches the submitted data and that the company holds any required licences for its operations.

Verification should involve checking official company registries, regulatory databases, and other trusted sources. However, a successful registry match does not automatically indicate that the company is low risk. KYB due diligence requires a broader assessment, including ownership structure, business activity, and potential financial crime risks, to build a complete corporate risk profile.

Step 3: Collect and Validate Corporate Documents

Collecting and validating corporate documents is a critical part of KYB compliance and business CDD. These documents provide supporting evidence for the company’s legal existence, ownership structure, governance, and operational legitimacy. Each document should be reviewed for authenticity, consistency, and alignment with the information provided during onboarding.

Before collecting enhanced due diligence documents, it is helpful to understand what each item is intended to verify. 

Document requirements should be proportionate to the customer’s risk level, jurisdiction, and business model. Lower-risk entities may require fewer documents, while higher-risk or complex corporate structures may require enhanced documentation as part of EDD.

Step 4: Identify the UBOs

Identifying Ultimate Beneficial Owners (UBOs) is a critical part of KYB due diligence and business CDD, as it reveals the natural persons who ultimately own or control a legal entity. This process goes beyond surface-level ownership and requires a structured approach to uncover hidden or indirect control. Start by identifying direct shareholders and calculating ownership percentages, then trace each corporate shareholder through every ownership layer until the natural persons at the end of the chain are identified. This helps ensure transparency in complex ownership structures.

In addition to shareholding, consider voting rights, control mechanisms, and individuals exercising influence through agreements or informal arrangements. Where applicable, apply the senior managing official test in line with jurisdictional requirements. It is important to document the methodology, sources, and evidence used throughout the process.

Step 5: Verify UBO Identity

Once UBOs are identified, the next step in KYB verification is to confirm their identity using reliable and independent sources. This step is essential for AML compliance and helps mitigate risks related to fraud, sanctions evasion, and money laundering. For each UBO, collect and verify key personal details such as full legal name, date of birth, nationality, residential address, and identity documents. Additionally, confirm their ownership percentage, method of control, and relationship to the company to ensure consistency with the ownership structure.

Verification methods may include document verification, biometric checks, liveness detection, and database cross-referencing. Address verification and independent documentary evidence further strengthen the validation process. These measures are particularly important in enhanced due diligence (EDD) scenarios, where higher-risk profiles demand more rigorous identity checks.

Step 6: Screen the Company and Connected Parties

Screening is a vital step in KYB due diligence and AML screening, aimed at identifying potential exposure to sanctions, politically exposed persons (PEPs), and adverse media. All relevant entities and individuals connected to the business must be screened, including the legal entity, trading and former names, parent and subsidiary companies, directors, shareholders, UBOs, authorised signatories, and senior management. T

Screening should cover global sanctions lists, PEP databases, watchlists, adverse media sources, and records of regulatory enforcement or disqualifications. Effective screening relies on robust matching logic that accounts for name variations, transliteration, aliases, and date-of-birth data. Human review is essential to assess potential matches and distinguish false positives from genuine risks. Integrating automated screening tools with manual oversight enhances accuracy and supports a risk-based approach to business due diligence.

Step 7: Assess the Customer Risk

Assessing customer risk is a critical stage in the KYB due diligence process, where compliance teams evaluate multiple risk dimensions to build a comprehensive risk profile. This includes analysing entity risk, ownership risk, geographic exposure, industry classification, product usage, delivery channels, transaction patterns, regulatory standing, screening outcomes, and behavioural indicators.

A structured risk scoring model helps standardise this evaluation, but it should not replace expert judgement. Compliance professionals must interpret risk signals in context, especially when dealing with complex ownership structures or cross-border operations. Effective business risk assessment combines automated scoring with human oversight to ensure accurate, defensible KYB compliance decisions.

Step 8: Apply CDD or Escalate to EDD

Once the customer risk assessment is complete, organisations must determine the appropriate level of due diligence, standard Customer Due Diligence (CDD) or Enhanced Due Diligence (EDD). Lower-risk customers may proceed through standard onboarding, while higher-risk profiles, such as those involving high-risk jurisdictions, PEP exposure, or complex ownership, require escalation to EDD for deeper investigation.

This decision impacts several onboarding outcomes, including whether additional documentation is needed, if senior management approval is required, or if restrictions should be applied to the account. In some cases, the risk may exceed the organisation’s risk appetite, leading to rejection. The KYB onboarding process must clearly define these escalation pathways to ensure consistent and compliant decision-making.

Navigating Common KYB Due Diligence Challenges

Uncover the key obstacles in KYB due diligence, from complex ownership structures to incomplete data, and learn how to manage business verification, UBO identification, and AML compliance effectively

Incomplete Registry Data

Problem: In KYB due diligence, incomplete registry data can limit visibility into shareholders, directors, and beneficial ownership, making it difficult to perform accurate business verification and AML risk assessment.

Solution: Strengthen business due diligence by combining company registry checks with customer declarations, corporate documents, independent databases, and additional KYB verification sources to build a more complete ownership and risk profile.

Complex Ownership Structures

Problem: Complex ownership structures involving multiple legal entities, cross-border layers, or nominee arrangements can obscure ultimate beneficial owners (UBOs), complicating UBO identification and increasing AML risk.

Solution: Apply ownership structure mapping, percentage calculations, and control analysis to trace beneficial ownership, and use escalation rules within KYB and CDD processes to address unresolved ownership risks.

Outdated Customer Information

Problem: Outdated customer information can undermine KYB compliance, as static onboarding data may no longer reflect current ownership, management, or business activities, leading to inaccurate risk assessments.

Solution: Implement ongoing due diligence through periodic reviews and event-driven monitoring, supported by registry updates and AML screening alerts, to maintain accurate and up-to-date customer profiles.

Screening False Positives

Problem: AML screening processes often generate false positives due to common names, inconsistent data quality, transliteration issues, and weak matching logic, increasing manual workload and slowing KYB onboarding.

Solution: Improve screening accuracy by using multiple identifiers, configurable matching thresholds, and structured review workflows, while documenting false-positive decisions to support audit trails and compliance consistency.

Excessive Document Requests

Problem: Excessive document requests during KYB onboarding can create friction, increase customer abandonment, and reduce efficiency without significantly improving business due diligence outcomes.

Solution: Use risk-based KYB workflows with dynamic document requirements tailored to entity type, jurisdiction, ownership complexity, and customer risk level to streamline onboarding while maintaining compliance.

Inconsistent EDD Decisions

Problem: Inconsistent enhanced due diligence (EDD) decisions can arise when analysts interpret risk factors differently, leading to uneven application of KYB and AML controls.

Solution: Standardise EDD processes by defining clear escalation triggers, approval levels, EDD templates, and quality assurance procedures to ensure consistent and defensible business due diligence decisions.

When to Reject a Business Relationship

A business relationship should be rejected when KYB due diligence, business CDD, or enhanced due diligence (EDD) reveal risks that cannot be adequately mitigated. This includes cases where the company cannot be reliably verified, UBOs cannot be identified, or there is evidence of sanctions exposure, serious adverse media, or suspicious ownership. 

Rejection may also be appropriate if required documentation is missing, information is inconsistent, or the source of funds cannot be established. Compliance teams should also consider declining relationships that fall outside their risk appetite or show signs of shell company activity or financial crime risk.

Common reasons include:

• The company cannot be reliably identified
• The UBO cannot be determined or verified
• Information is false, inconsistent, or misleading
• Sanctions prohibit the relationship
• Source of funds or wealth cannot be established
• Financial crime risks cannot be mitigated
• The customer refuses required information
• The activity falls outside risk appetite
• The purpose of the relationship is unclear or unreasonable

If CDD cannot be completed, firms must not proceed. Decisions should be documented, and legal obligations such as SARs and tipping-off rules must be considered.

Bottom Line

KYB due diligence requires more than confirming a company exists. Teams must understand ownership, control, and business activity to assess risk effectively.

CDD establishes the baseline risk profile, while EDD adds deeper checks for higher-risk cases such as complex ownership, high-risk jurisdictions, or PEP exposure.

A strong KYB framework combines verification, risk-based decisions, and ongoing monitoring to support compliance and reduce onboarding friction. Binderr Compliance helps streamline this process with integrated tools for verification, risk assessment, and continuous monitoring.

FAQs - Business CDD and EDD