Corporate KYC (Know Your Customer) is the core of every reliable onboarding program. It helps compliance teams determine who owns a business and how it operates before taking on any risk.
Documents help, but they don’t tell the full story. Public records only go so far, and many companies look clean on paper even when there’s something behind the scenes that needs attention.
Financial institutions rely on corporate KYC before opening business accounts or moving large sums of money. Marketplaces and B2B platforms rely on it during merchant or vendor onboarding. A clear picture of the customer helps protect businesses from potential fraud and long-term compliance problems.
This article breaks down how corporate KYC works from the first check to the final decision. We’ll explain the key differences between individual KYC and corporate KYC and when corporate KYC is required. We’ll also explore how open-source intelligence (OSINT) tools like ShadowDragon Horizon™ strengthen each step of the process.
What is Corporate KYC?
Corporate KYC, also known as KYB (Know Your Business), is the process of confirming that a business is legitimate and that the people behind it are who they claim to be. Compliance teams confirm the company’s legal status and verify its ownership and control. Throughout the process, teams look for signs that the business may pose financial or regulatory risk.
Banks and other financial institutions rely on corporate KYC to open merchant accounts or approve large transactions. Likewise, marketplaces and B2B platforms need to understand who their business customers are before engaging in business activities.
Corporate KYC helps teams understand the business’s structure and its typical activities. It also provides compliance teams with a clearer view of the owners who might influence how that business operates. Corporate KYC enables compliance teams to detect potential risks early and build an auditable record of why the business was approved or denied.
Corporate KYC vs. Individual KYC
In both corporate KYC and individual KYC, compliance teams aim to understand who they’re dealing with and the potential risks they introduce to their company. The difference lies in the verification steps involved and the overall complexity of the process.
Individual KYC has a narrow scope, focusing on a single individual. Compliance teams verify their identification and check for sanctions or adverse media associated with their name.
Corporate KYC is much broader in scope, covering an entire organization. Compliance teams confirm the company’s existence and review its registration and legal status. Teams also look into who owns the company and who controls it.
In corporate KYC, compliance teams also investigate ultimate beneficial owners (UBOs). A UBO is an individual who owns or controls a business or who receives benefits from its operation.
Compliance teams also look for ties to politically exposed persons (PEPs). A PEP is an individual who holds a public-facing position, such as a government representative or a senior judge, and may be at higher risk of corruption due to their perceived influence or power.
Compliance teams should also determine whether the business operates across borders and understand the full scope of its operations. Each of these steps adds more complexity.
More documents are required for corporate KYC. Compliance teams review documents such as:
- Business formation documents
- Business licenses
- Organizational charts
- Tax filings
- Financial statements
- IDs for all controlling persons
- Shareholder registries
- Lease agreements
- Filings from foreign jurisdictions
- Litigation records (if applicable)
Due to the additional steps and complexity, corporate KYC is a more thorough investigative process than simple identity verification.
When Corporate KYC is Required
Corporate KYC comes into play when you need a clear view of a business before trusting it with money or access. Common use cases include:
- Opening a business account
- Moving large sums or sending funds across borders
- Onboarding business clients in high-risk industries (such as crypto exchanges or companies that import or export products)
- Merchant onboarding
- Lending or credit underwriting
- Vendor and supplier onboarding
Corporate KYC continues after onboarding. Compliance teams conduct periodic reviews or handle renewals. Corporate KYC can also be triggered by changes, such as new ownership or adverse media related to the business.
The Corporate KYC Workflow
1. Pre-Screening
Pre-screenings give compliance teams a quick read on the business before conducting deeper investigations and help with early fraud detection. This step includes confirming the company name and conducting a basic identity match.
Teams may also run a sanctions check and PEP (individuals who hold public-facing roles and may have a higher risk of corruption due to their perceived power or influence) screening check on the business and any listed owners.
At this stage, compliance teams assign an early risk score to the business, which helps determine if the case remains in standard customer due diligence (CDD) or requires enhanced due diligence (EDD). Cases that often require EDD include:
- High-risk industries
- Cross-border activities
- Unclear ownership
An early OSINT scan helps compliance teams detect potential issues before investing significant time investigating the case. ShadowDragon Horizon™ surfaces business data from publicly available sources. This can reveal thin-file businesses or inconsistencies between what the customer claims and real-world information, saving time and guiding the rest of the investigation.
2. Data Collection
Data collection begins once the case passes the pre-screening process. Teams gather verification documents through a secure portal (such as a virtual data room, or VDR) and obtain official registry data, which relies on clean KYC integration to keep information aligned. If there are any gaps in information, the customer may be asked to fill out a short questionnaire.
Compliance teams should also incorporate OSINT at this stage. For instance, teams can check the business’s website domain registration history to determine how long it’s been active online, and they can examine public profiles to see how the business presents itself.
These checks give compliance teams a sense of whether the business is engaged in legitimate business activities or if it’s potentially a shell company. All of these findings help to shape the next steps in the review.
3. Verification and Validation
After collecting the core data, the verification process begins. Compliance teams match the business against official registries and confirm the authenticity of the documents.
Teams also review the identities of UBOs and directors, screening each name for sanctions and searching for adverse media related to the people or the company.
OSINT helps compliance teams cross-check the information, determining whether the public activity aligns with the customer’s claims and surfacing any litigation history, undisclosed relationships or older media hits that may impact risk.
Digital mapping helps compliance teams see how the business connects to other entities. Shell companies are often revealed when the corporate data doesn’t match public behavior. This step often reveals findings that raise questions, such as hidden owners.
4. Risk Assessment
Risk assessment pulls everything together, combining automated scoring with manual review. Compliance teams assess risk factors such as:
- Industry risk
- Jurisdiction risk
- Ownership
- Day-to-day operations
Any of these factors can move the case into enhanced due diligence.
OSINT enrichment adds context, forming a clearer picture. ShadowDragon Horizon™ helps compliance teams see hidden connections and older associations that don’t appear in basic filings.
OSINT also surfaces real-world behavior that static documents don’t show. This information gives compliance teams a more realistic view of the business before approving the relationship.
5. Enhanced Due Diligence (EDD) if Required
EDD comes in when the first round of checks raises concerns. It involves gathering more detail to understand the business and the people behind it.
Some cases call for a site visit to confirm the business operates where it claims to operate, with real staff and legitimate activity. Compliance teams also conduct a deeper investigation of the source of funds and run additional identity checks on UBOs and directors.
During EDD, teams may expand the adverse media search and review anything that raises questions. Open-source intelligence plays a significant role in the EDD process. ShadowDragon Horizon™ enables compliance teams to look beyond the paperwork, identifying potential issues such as:
- Offshore setups
- Opaque ownership
- High-risk industries
- Thin documentation
- PEP ties (individuals with public-facing roles who have perceived power or influence that create a higher risk of corruption)
- Cross-border networks
Behavioral and relational intelligence helps compliance teams determine who is connected to whom, uncovering affiliates the customer didn’t mention and identifying signs of shell company behavior. Teams get a clearer sense of whether the business’s claims hold up under pressure.
6. Decisioning
Decisioning starts once the review is complete. Teams decide whether to approve or reject the case. They may ask for more information if anything is still unclear.
Some teams rely on automated rules to guide these decisions. Other teams let the system flag the case and then move it to a compliance officer for sign-off.
OSINT findings help support the final decision. ShadowDragon Horizon™ adds context and evidence to an audit trail, providing clear documentation of how and why a specific decision was reached. The audit trail documents the signals that shaped the risk rating and demonstrates that the decision was made based on real evidence.
7. Ongoing Monitoring
Ongoing monitoring ensures that the relationship remains safe after onboarding. This includes:
- Running continuous sanctions and PEP checks (politically exposed persons, or those in public-facing roles that have a higher risk of corruption due to their perceived power or influence)
- Monitoring for transaction patterns that don’t fit the business profile
- Scheduling periodic reviews based on the risk tier
Automated alerts notify compliance teams of changes in corporate status or ownership, often prompting KYC remediation when the risk profile shifts.
Horizon™ Monitor adds real-time OSINT enrichment, surfacing adverse media as it appears and revealing changes in leadership or linked entities. It also reveals breach data linked to executives and sudden shifts in digital behavior that may indicate an emerging risk.
Final Thoughts
Corporate KYC gives companies a realistic picture of who they’re doing business with. It confirms that the customer’s business is legitimate and who owns it and controls it. Compliance teams gain an understanding of how the business operates in the real world. Each step in the corporate KYC process helps teams detect risks before they become problems.
OSINT provides real value by enabling compliance teams to investigate beyond surface-level documents. ShadowDragon Horizon™ plays a role in every stage, surfacing public signals that basic filings miss and showing how people and entities are connected in the real world. Horizon™ Monitor supports ongoing monitoring after onboarding, alerting compliance teams of changes and emerging information that they may otherwise overlook.
These tools help compliance teams make decisions backed by evidence rather than assumptions. They also help teams build cleaner audit trails and cut down on repeat reviews.
Corporate KYC is an ongoing responsibility. Contact us for a demo to learn how ShadowDragon Horizon™ gives teams the intelligence they need to understand risks and stay ahead of changes as they happen.
