KYB Compliance UK: Guidelines for Corporate Due Diligence

HM Treasury’s 2025 National Risk Assessment states that over £100 billion is laundered every year through the UK or through UK corporate structures. For compliance teams at banks, fintechs, and payment institutions, that figure sits at the center of the UK risk picture for KYB compliance. Verifying individual customers has a defined workflow. Corporate clients, with layered ownership, nominee directors, and overseas shareholders, are consistently where that workflow breaks down. The Financial Conduct Authority (FCA) made this explicit in its 2024 multi-firm customer due diligence review: firms get corporate checks wrong more often than individual ones.

The guide covers what UK KYB compliance actually requires today, from the Money Laundering Regulations 2017 through to the Companies House changes that took effect in November 2025.

What is Know Your Business in the UK?

Know Your Business (KYB) in the UK is the process through which regulated firms verify the identity, ownership, and risk profile of corporate clients before establishing a business relationship or completing a qualifying transaction. Where KYC focuses on natural persons, KYB focuses on legal entities. These include limited companies, partnerships, trusts, and other structures that can obscure who actually controls the flow of funds.

The process sits inside the UK’s wider anti-money laundering (AML) framework. UK Money Laundering Regulations KYB obligations attach at the point of onboarding and continue through the life of the relationship via ongoing monitoring. Any regulated business within the scope of the Money Laundering, Terrorist Financing, and Transfer of Funds Regulations 2017, from banks and payment institutions to accountants, solicitors, and estate agents, must carry out customer due diligence (CDD) on corporate clients.

One practical distinction from KYC matters here. Corporate structures can be deliberately built to pass document checks while concealing beneficial ownership. KYB is specifically designed to trace through those structures.

What regulations govern KYB in the UK?

UK KYB compliance sits at the intersection of three regulatory instruments. Each addresses a different dimension of the verification problem, and together they define what FCA KYB requirements actually ask of supervised firms.

Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017

The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLR 2017) form the primary legal basis for KYB in the UK. They require regulated firms to verify corporate clients’ identities and identify all ultimate beneficial owners (UBOs) above the 25% ownership threshold, understand the purpose and nature of the business relationship, and apply ongoing monitoring proportionate to risk. MLR 2017 was updated in 2019 and again in 2022 following the Financial Action Task Force (FATF) evaluation of the UK’s AML regime.

The FCA’s supervisory role in KYB compliance

The FCA supervises financial services firms for AML compliance and sets the practical standard against which KYB processes are judged. FCA KYB requirements extend beyond a literal reading of MLR 2017. Firms must also follow the FCA’s Financial Crime Guide. AML enforcement penalties have escalated sharply across regulated sectors, according to HM Treasury’s annual AML/CTF supervision reports.

Economic Crime and Corporate Transparency Act 2023

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) expanded Companies House’s powers substantially. From November 2025, mandatory identity verification applies to all company directors and Persons with Significant Control (PSC), making registry data more reliable as a KYB input than it was before.

The PSC Register and Beneficial Ownership checks in the UK

The Persons with Significant Control (PSC) register, held at Companies House, is the UK’s public record of who owns or controls each registered company. Compliance teams use it as the standard starting point for any beneficial ownership UK PSC check. Since 2016, UK companies have been legally required to identify their PSCs and report changes within 14 days of confirming them.

What counts as a PSC?

A person qualifies as a PSC under UK law if they own more than 25% of shares or voting rights, have the right to appoint or remove the majority of directors, or exercise significant influence or control over the company. UK UBO verification PSC register checks must identify every individual meeting any of those thresholds. Where ownership is held through a chain of entities rather than directly, firms must trace the full chain to reach the natural persons at the top.

What changed in November 2025

The ECCTA 2023 introduced mandatory identity verification for directors and PSCs. From 18 November 2025, new registrations require verification before Companies House accepts the filing. For KYB teams, Companies House KYB UK data now carries a higher baseline of accuracy. That said, a verified PSC is not a risk-cleared PSC. Your firm still needs to screen every UBO for sanctions, politically exposed persons (PEP) status, and adverse media.

What documents are required for UK corporate customer due diligence?

Documentation failures are where UK corporate customer due diligence most commonly breaks down in FCA reviews. The problem is usually not wrong documents but incomplete ones. Firms verify the entity’s legal name and registration number but stop short of UBO identification, or they collect UBO information without verifying it against an independent source.

Entity-level documents

The certificate of incorporation, the Companies House registration number, confirmation of the registered address, and the most recent confirmation statement form the baseline. For entities not registered in the UK, equivalent documents from the home jurisdiction apply.

Ownership documents

A current PSC register extract from Companies House is the starting point. Where that extract is more than three months old, or the structure involves layers of holding companies, independent evidence of beneficial ownership is also required.

Director and UBO identity

Photo ID and proof of address for every UBO above the 25% threshold. Where ownership passes through a chain of legal entities, the full chain must be mapped and the natural persons at the top independently verified.

When does enhanced due diligence apply to UK businesses?

Standard CDD covers most corporate clients. Enhanced due diligence (EDD) applies when the risk profile of the relationship requires deeper scrutiny. MLR 2017 makes EDD mandatory in specific circumstances, and the FCA expects firms to apply it in others based on their own risk assessment framework.

Mandatory EDD triggers under MLR 2017

The regulations require EDD for relationships involving customers from high-risk third countries designated by HM Treasury as of February 2026, relationships where a PEP or their close associate controls or benefits from the entity, transactions with no apparent legitimate purpose, and non-face-to-face relationships where the remote setup elevates risk.

FCA expectations on enhanced due diligence UK businesses

The FCA’s 2024 CDD review found that stronger firms applied EDD proactively to complex corporate structures, even without a mandatory MLR 2017 trigger. The FCA’s guidance on EDD for high-risk customers identifies source of funds and source of wealth documentation, more frequent AML screening, and senior management sign-off as the expected measures for elevated-risk corporate relationships.

KYB for fintech firms in the UK

KYB fintech UK obligations run alongside FCA authorization. Payment institutions, e-money institutions, and registered cryptoasset businesses all fall within MLR 2017’s scope. They face the same UK AML business verification requirements as banks, without necessarily having the compliance infrastructure banks have built over decades. For many, a managed KYB as a Service model reduces that infrastructure gap without requiring a full in-house build.

Merchant and PSP onboarding

The highest KYB volume for most fintech firms sits in merchant and payment service provider (PSP) onboarding. Each merchant in a payments flow is a corporate client needing KYB verification before receiving funds. FCA KYB requirements apply regardless of merchant size.

Post-Brexit regulatory divergence

After Brexit, the UK’s AML framework diverged from the EU’s. HM Treasury published proposals for UK-specific MLR 2017 amendments in September 2025, meaning UK firms must track FCA and HMRC guidance independently of European updates. The UK no longer automatically adopts EU Anti-Money Laundering Directives, including 6AMLD.

How Shufti handles UK corporate KYB checks

Corporate KYB checks in the UK stall for one of two reasons. Either the firm is pulling entity data from Companies House manually and cross-referencing against sanctions lists in separate steps, or UBO identification is left to an analyst to complete ad hoc. Both approaches are slow and produce audit trails that rarely hold up under FCA scrutiny.

Shufti’s Know Your Business verification connects Companies House registry lookups, UBO traversal, and business AML screening in a single automated workflow. Director and UBO identity verification runs across 240+ countries, and the AML layer screens against 3,500+ global watchlists, including UK-designated sanctions regimes, with data refreshed every 15 minutes. The result is a consistent, auditable KYB record for each corporate client.

See how Shufti’s automated KYB workflow fits your compliance stack. Book a demo.