UK firms urged to tighten business checks

For most UK firms, Know Your Business (KYB) checks start with a single free resource: the Companies House register. It serves as the initial step when onboarding a new corporate client, vendor, or partner. But relying only on this public database can create significant gaps, particularly when regulators require proof of how risk decisions were made.

Why a Companies House search falls short

The register provides basic details, including a company’s existence, incorporation date, directors, and people with significant control (PSCs). Recent reforms have strengthened identity verification, yet the data still depends on what companies voluntarily file. This means it may lack completeness, accuracy, or relevance to a firm’s specific risk assessment needs.

Under the Money Laundering Regulations 2017, regulated firms must perform customer due diligence (CDD) before establishing a business relationship. The requirement goes beyond matching a company number to a name. Firms must verify who ultimately owns and controls the entity, screen those individuals, and assess risk using information that extends beyond a single public filing.

The 25% threshold for identifying PSCs appears simple—until firms attempt to apply it. Control can stem from voting rights, director appointment powers, or other forms of influence, not just share ownership. This often requires reviewing shareholder agreements or governance documents that aren’t publicly available.

Complex ownership structures create verification challenges

When a shareholder is another corporate entity, tracing the ultimate beneficial owner (UBO) may involve following an ownership chain across multiple jurisdictions. Trusts introduce additional complexity. Settlors, trustees, protectors, and beneficiaries may not appear in public records, forcing firms to request extra documentation or consult multiple sources.

Verification isn’t limited to the business itself. Firms must confirm the identities of individuals behind the entity—beneficial owners, controllers, and others—before a risk assessment can be finalized.

A client considered low-risk can suddenly become high-risk if a new controlling shareholder has ties to a sanctioned jurisdiction. Such changes only become visible with continuous monitoring, which regulators now expect. The Financial Conduct Authority (FCA) imposed a £29 million fine on Starling Bank in 2024 for weaknesses in its sanctions screening and high-risk customer controls. The case highlighted the dangers of incomplete or outdated due diligence processes.

For regulated firms with an ongoing business relationship, ongoing monitoring is a regulatory requirement, not simply a best practice. Firms may need to keep business and beneficial ownership information up to date and identify changes that could alter the risk associated with a relationship.