KYB and AML glossary

KYC is the check on a person; KYB is the check on a business and on the people behind it. EU law uses neither term: it requires customer due diligence on every customer, and where the customer is a legal entity that work includes identifying the beneficial owners and understanding the ownership and control structure (Article 20(1)(b) AMLR). In practice KYB is KYC plus the ownership chain, because a business customer’s risk sits with the natural persons at the end of it.

Source: AMLR

A beneficial owner is the natural person who ultimately owns or controls a legal entity or a legal arrangement (Article 2(1)(28) AMLR). From 10 July 2027 the test has two limbs: a person who has, directly or indirectly, an ownership interest in the entity, and a person who controls it, directly or indirectly, through an ownership interest or via other means (Article 51 AMLR). The acronym UBO, for ultimate beneficial owner, means the same thing and appears nowhere in the Regulation.

Source: AMLRWhat changes in 2027How Covenance traces ownership

From 10 July 2027, an ownership interest means direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest in a company, including rights to a share of profits, other internal resources or the liquidation balance (Article 52(1) AMLR). Indirect ownership is calculated by multiplying the holdings of the intermediate entities along each chain and adding the results across chains, and all shareholdings on every level are taken into account. Two nuances matter. The directive in force until then treats a shareholding of 25% plus one share, or an ownership interest of more than 25%, as an indication of ownership rather than as a definition (Article 3(6)(a)(i) of Directive (EU) 2015/849), and the Commission may set a lower threshold for higher-risk categories of company, capped at 15%, after assessing those risks by 10 July 2029 (Article 52(2) AMLR).

Sources: AMLR, Directive (EU) 2015/849What changes in 2027

Control via other means is control of a company that does not come from the size of a shareholding. It always includes the majority of the voting rights, the right to appoint or remove a majority of the board or equivalent body, relevant veto or decision rights attached to a share, and decisions on distributing profit or shifting assets (Article 53(3) AMLR). It may also arise from formal or informal agreements, from relationships between family members, or from nominee arrangements (Article 53(4) AMLR). It is identified independently of and in parallel to any ownership interest, so a company can have beneficial owners on both limbs at once (Article 51 AMLR).

Source: AMLR

A politically exposed person is a natural person who is or has been entrusted with prominent public functions, including heads of state and government, ministers, members of parliament, members of supreme and constitutional courts, members of courts of auditors or central bank boards, ambassadors, high-ranking armed forces officers and heads of regional and local authorities above 50,000 inhabitants (Article 2(1)(34) AMLR). Each Member State publishes and keeps up to date a list of the exact functions that qualify in its own law, and the Commission publishes a single consolidated list in the Official Journal (Article 43 AMLR). The status is not a finding of wrongdoing: it requires senior management approval, measures to establish the source of wealth and funds, and enhanced ongoing monitoring (Article 42 AMLR). It continues to apply for at least 12 months after the person leaves the function, and for longer while the risk lasts (Article 45 AMLR).

Source: AMLRHow Covenance presents screening findings

RCA stands for relatives and close associates: the people around a politically exposed person who attract the same measures. A family member is a spouse or a partner in a registered partnership, civil union or similar arrangement, a child and that child’s spouse or equivalent partner, a parent, and for heads of state and equivalent functions a sibling (Article 2(1)(35) AMLR). A person known to be a close associate is someone with joint beneficial ownership of entities or other close business relations with a politically exposed person, or the sole beneficial owner of an entity known to have been set up for such a person’s de facto benefit (Article 2(1)(36) AMLR). The politically exposed person measures apply to both groups (Article 46 AMLR).

Source: AMLR

Sanctions screening is the check that a customer and the people behind it are not subject to targeted financial sanctions. It is one of the customer due diligence measures: for a legal entity, the firm must also check whether sanctioned persons control it, or hold more than 50% of its proprietary rights or a majority interest in it, individually or collectively (Article 20(1)(d) AMLR). The check is repeated at a frequency matched to the risk, and credit and financial institutions repeat it on every new designation (Article 26(4) AMLR). Screening produces possible matches for a person to assess; a possible match is not a finding until somebody confirms it against the published list.

Source: AMLRHow Covenance presents screening findings

Adverse media screening is the search for published reporting that suggests a customer, or a person behind it, is involved in financial crime or other relevant wrongdoing. EU law does not name the practice. It is one way of obtaining the additional information on a customer and its beneficial owners that enhanced due diligence calls for (Article 34(4)(a) AMLR), and of taking account of other indicators of higher risk alongside the listed factors (Article 34(3) AMLR). Because the source is reporting rather than a register, an adverse media hit is a prompt to look further, not a conclusion.

Source: AMLR

Customer due diligence is the set of measures a regulated firm must apply to a customer, set out from 10 July 2027 in one directly applicable article (Article 20(1) AMLR). It covers identifying and verifying the customer, identifying the beneficial owners and taking reasonable measures to verify their identity so that the firm understands the ownership and control structure, understanding the purpose of the relationship and the nature of the customer’s business, checking targeted financial sanctions, determining whether anyone involved is a politically exposed person, and monitoring the relationship as it runs. The firm sets the extent of each measure from an individual risk analysis, and must be able to demonstrate to its supervisor at any time that the extent was appropriate to the risks identified (Article 20(2) and (4) AMLR).

Source: AMLRWhat changes in 2027

Simplified due diligence is a reduced set of measures a firm may apply where the relationship or transaction presents a low degree of risk (Article 33(1) AMLR). The permitted simplifications are listed: verifying identity after the relationship is established where the lower risk justifies it and in any case within 60 days, reducing how often customer information is updated, reducing the information collected about the purpose of the relationship, and reducing the frequency or degree of transaction scrutiny. Simplified measures must stop where there is doubt about the information given, where the lower-risk factors are no longer present, or where there is any suspicion of money laundering or of an attempt to evade sanctions (Article 33(5) AMLR).

Source: AMLR

Enhanced due diligence is the additional work a firm must do where the risk is higher, both in the cases the Regulation names and in cases the firm identifies in its own risk analysis (Article 34(1) AMLR). The measures may include additional information on the customer, its beneficial owners, and the source of funds and wealth, senior management approval for establishing or continuing the relationship, enhanced monitoring, and requiring the first payment through an account in the customer’s own name (Article 34(4) AMLR). A firm must also examine the origin, destination and purpose of any transaction that is complex, unusually large, conducted in an unusual pattern, or without an apparent economic or lawful purpose (Article 34(2) AMLR).

Source: AMLR

Ongoing monitoring is the duty to keep watching a business relationship after onboarding, so that transactions stay consistent with what the firm knows about the customer, its business and its risk profile (Article 26(1) AMLR). Customer documents, data and information have to be kept up to date, and from 10 July 2027 the period between updates may not exceed one year for higher-risk customers and five years for every other customer (Article 26(2) AMLR). A review is also required when the customer’s relevant circumstances change or the firm becomes aware of a relevant fact about them (Article 26(3) AMLR). Vendors often call this perpetual KYC, or pKYC; the obligation is the one in Article 26.

Source: AMLRMonitoring in Covenance

Four-eyes approval means a second person has to approve a decision that a first person proposed. The phrase is industry usage rather than law, but the Regulation requires senior management approval before establishing or continuing a relationship with a politically exposed person (Article 42(1)(a) AMLR), and lists senior management approval among the enhanced due diligence measures generally (Article 34(4)(e) AMLR). In an onboarding system the control is only real if the person who proposed a decision cannot approve it themselves.

Source: AMLRHow decisions are recorded in Covenance

A shell company is a company with no real activity behind it, used to hold assets or to put distance between an owner and a transaction. The AMLR does not define the term. It names the facts instead: a customer that is a legal entity created in a jurisdiction where it has no real economic activity, substantial economic presence or apparent economic rationale is a higher-risk factor, as is any entity owned directly or indirectly by such an entity (Annex III, point (1)(h) and (i) AMLR). Nominee shareholders or shares in bearer form, and an ownership structure that looks unusual or excessively complex for the business, are higher-risk factors in the same list (Annex III, point (1)(d) and (f) AMLR). A related term that is defined, shell institution, applies to correspondent relationships rather than to customers generally (Article 2(1)(23) AMLR).

Source: AMLR

A nominee is a person who holds shares or a directorship on somebody else’s instructions. From 10 July 2027 nominee shareholders and nominee directors must hold adequate, accurate and up-to-date information on their nominator and on the nominator’s beneficial owners, and disclose it, with their own nominee status, to the company, which reports it to the central register and to firms performing due diligence (Article 66 AMLR). The information a firm must obtain about a legal entity customer includes the names of anyone holding shares or a directorship in nominee form and a reference to that status (Article 22(1)(b)(iv) AMLR). A formal nominee arrangement is defined as a contract or equivalent arrangement under which a nominator issues instructions to a nominee to act on their behalf (Article 53(4) AMLR).

Source: AMLR

A beneficial-ownership register is the central register each Member State keeps of the beneficial owners of the legal entities created in its territory (Article 10(1) AMLD6). It holds the beneficial ownership information, any statement that no beneficial owner could be determined, and information on nominee arrangements, in machine-readable form, and the national registers are interconnected through the European Central Platform (Article 10(19) AMLD6). Access is not public. Firms performing customer due diligence get timely access (Article 11(3) AMLD6), and persons who can demonstrate a legitimate interest get a defined subset of the data (Article 12 AMLD6), a structure that follows the Court of Justice’s judgment of 22 November 2022 that general public access was invalid. Consulting the register is itself part of verifying beneficial ownership, in addition to the other means a firm uses (Article 22(7) AMLR).

Sources: AMLD6, AMLR, Joined Cases C-37/20 and C-601/20The registers Covenance reads

An obliged entity is a business that EU anti-money-laundering law applies to, listed in Article 3 AMLR. The list covers credit and financial institutions, crypto-asset service providers, auditors, external accountants and tax advisers, notaries and other independent legal professionals in defined activities, trust or company service providers, estate agents, traders in high-value goods and gambling services, and from 10 July 2029 football agents and professional football clubs (Article 3, point (3)(n) and (o), read with Article 90 AMLR). Whether a firm is an obliged entity decides whether the rest of the Regulation binds it, and it also decides what the firm may read from a beneficial-ownership register.

Source: AMLR

AMLR is Regulation (EU) 2024/1624, the EU anti-money-laundering regulation. It applies directly in every Member State from 10 July 2027, and from 10 July 2029 to football agents and professional football clubs (Article 90 AMLR). It takes the obligations that bind firms out of the fourth anti-money-laundering directive and puts them in a regulation, so those rules stop being 27 national transpositions and become one text.

Source: AMLRRead the guide

AMLD6 is Directive (EU) 2024/1640, the directive beside the AMLR that tells Member States what to put in place: beneficial-ownership registers and the rules for access to them, bank account registers, single access points to real estate information, financial intelligence units and supervision. Member States must transpose it by 10 July 2027, with earlier deadlines of 10 July 2025 for Article 74 and 10 July 2026 for Articles 11, 12, 13 and 15, and a later one of 10 July 2029 for Article 18 (Article 78 AMLD6). Articles 11 to 15 are the register access rules, which is why they fall due a year before the rest.

Source: AMLD6Read the guide

AMLA is the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, established by Regulation (EU) 2024/1620, with its seat in Frankfurt am Main (Article 4 of that Regulation). The Regulation applies from 1 July 2025, with a named list of articles applying from 26 June 2024 and Article 103 from 31 December 2025 (Article 108). AMLA will directly supervise a selected group of high-risk, cross-border financial institutions: it commences the first selection by 1 July 2027, concludes it within six months, publishes the list, and begins direct supervision six months after that publication (Article 13(4)).

Sources: AMLA Regulation, AMLA, About AMLARead the guide