Know your business customer and its beneficial owners.

Why businesses need their own checks

When the customer is a company, a partnership, a trust or another organisation, the usual identity checks are not enough. A business has no face and no date of birth. It acts through people, and it can be owned through layers of other businesses that hide who really benefits.

That is exactly why criminals use them. Studies of real cases bear this out. A World Bank and UNODC review of 150 grand corruption cases (The Puppet Masters, 2011) found that the great majority of them used companies, trusts, foundations or similar structures to hide who owned the assets; companies alone were used in 128 of the 150 cases. A 2018 FATF and Egmont Group study of 106 cases found shell companies at the centre of schemes to disguise beneficial ownership, often alongside nominees and professional intermediaries.

Know your business (KYB) is customer due diligence applied to organisations. It answers four questions:

• Does the business exist, and is it what it claims to be?
• Who can act for it, and with what authority?
• Who ultimately owns or controls it: its beneficial owners?
• What does it do, and does its activity make sense for that business?

The FATF standards (Recommendation 10) require these checks: identifying and verifying the customer, understanding its ownership and control structure, and identifying and taking reasonable measures to verify its beneficial owners. In Kenya, the customer due diligence duties sit in the Proceeds of Crime and Anti-Money Laundering Act, 2009 and its 2023 Regulations, and the duties of companies and limited liability partnerships to record their beneficial owners sit in the Companies Act, 2015 and the Limited Liability Partnership Act, 2011.

Confirming the business exists

Start with official records, not only documents the customer supplies.

• The company registry. In Kenya, companies, limited liability partnerships, partnerships and business names are registered with the Business Registration Service (BRS), set up under the Business Registration Service Act, 2015. A registry search confirms that the entity exists, its registration number, its registered office and its status, such as whether it is active, struck off or dissolved. For a private limited company, the current directors and shareholders are shown on an official search certificate, commonly called a CR12, requested through the BRS service on eCitizen. Check the date it was issued: a CR12 shows the position on that date only. Copies supplied by customers can be forged, so where you can, obtain or confirm the search through BRS yourself.
• Constitutional documents: the certificate of incorporation or registration, and the articles of association, partnership deed, trust deed or constitution that set out how the organisation is run.
• Licences where the activity needs one, such as a banking, money-remittance, insurance or pharmacy licence, checked with the regulator that issues it.
• Tax registration, such as a KRA PIN.
• A real presence: a trading address that matches the business, a website and contact details that fit, and evidence of actual trading.

Compare what you find. The name, registration number and directors should be the same in the registry, the documents and the application. A company registered last month that claims years of trading history, or a registered office that is a mailbox shared by hundreds of companies, needs explaining.

A registered business name does not create a separate legal person: check the individual owner or partners as customers themselves.

Different organisations need different evidence. A trust, a charity, a cooperative, a government body and a foreign company each have their own registers and documents. Know which apply before you ask the customer.

Who can act for it

A business acts through people: directors, partners, trustees, officials, and staff or agents given authority to operate an account or sign contracts.

For each business customer, establish:

• Who the directors or equivalent officers are, from the registry, and check them as individuals against sanctions and politically exposed persons lists.
• Who is authorised to act in this relationship, and on what authority. For a company, this is usually a board resolution or mandate naming the authorised signatories and their limits; for a partnership or trust, the partnership deed, the trust deed or a trustees' resolution.
• The identity of each authorised person, verified as you would any individual customer.

Watch for warning signs:

• Authority given to someone with no visible role in the business.
• A person acting who is not named anywhere in the company's records.
• The same individuals appearing as directors or signatories of many unrelated companies, which can indicate nominee arrangements.
• Pressure to open the account quickly without the usual documents.

Keep the authority current. When directors or signatories change, the mandate must change too, and people who have left must lose access.

Tracing the real owners

The beneficial owner is always a natural person: the human being who ultimately owns or controls the customer, or on whose behalf it acts. Tracing them means following ownership through every layer until you reach people.

Companies. Follow the shareholding through each parent company. Look at ownership, at voting rights and at control by other means, such as the right to appoint or remove the board. In Kenya, the beneficial ownership rules for the company register treat a person as a beneficial owner if, among other tests, they hold at least 10% of the shares or voting rights, or can appoint or remove a majority of the board.

Trusts. A trust has no single owner. The FATF standards expect the people behind a trust to be identified: the settlor, the trustee or trustees, the beneficiaries or class of beneficiaries, any protector, and anyone else who exercises ultimate effective control.

Nominees. A nominee shareholder or director holds a position on behalf of someone else. Nominee arrangements are not always illegal, but they are a classic way to hide the real owner. Ask who the nominator is. In Kenya, nominee shareholders and directors must disclose their status and their nominator to the company, which records them (nominee shareholders in the register of members, nominee directors in a register of nominee directors). Ask to see those records where they are relevant to your checks.

Registers help but do not decide. Kenyan companies and limited liability partnerships must keep a register of their beneficial owners and lodge it with the Registrar, and many countries now keep central registers. A register records what the company declared. Compare it with what you have found, and where they differ, find out why. The FATF standards treat reporting discrepancies to the register as one way countries can keep registers accurate. In Kenya, the Beneficial Ownership Regulations let a company or a beneficial owner report a material discrepancy to the Registrar; ask the customer to correct its filing, and check whether your own sector rules add a reporting duty for you. If a discrepancy suggests concealment, consider whether a suspicious transaction report is needed.

Check each beneficial owner against sanctions and politically exposed persons lists, as you do for directors. And remember that the company register's 10% test sets what the company must record; your own customer due diligence rules may require you to look further. Listed companies subject to disclosure rules, and foreign companies, can be handled differently, so check the specific rules before applying the standard approach.

If, after reasonable effort, no natural person can be identified as owner or controller, record the person holding the position of senior managing official, and record why no owner was found. An ownership chain that nobody can or will explain is itself a reason for enhanced due diligence, or for declining the relationship.

What it does, and keeping it current

Knowing who a business is only helps if you also know what it does.

• Nature and purpose: the business's sector, products, main customers and suppliers, and the countries it trades with.
• Expected activity: the volumes, values and types of transactions that would be normal for it. This becomes the baseline for monitoring.
• Source of funds for the relationship, and for higher-risk customers the source of wealth of the beneficial owners.
• Risk rating: combine the ownership, the sector, the countries involved and the products used into an overall rating that sets how deep the checks go and how often they are repeated.

Businesses change faster than people do. Owners sell, directors change, activities move into new sectors or countries. Keep the picture current:

• Periodic reviews, more often for higher-risk customers.
• Trigger events: a change of owner, director or signatory; activity that does not fit the expected profile; new countries; adverse media; a sanctions or PEP match on any connected person.
• Records of what you found and why you decided what you did, kept for at least as long as the law requires; in Kenya, at least seven years.

Good KYB protects both sides. It keeps criminals out, and it lets genuine businesses open accounts and trade without being treated as suspects.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.