KYC / KYB / CDD / EDD:
The Onboarding Dilemma

The acronyms are easy. The decisions are not.

Every compliance professional can recite the definitions. KYC verifies the individual. KYB verifies the business. CDD assesses the risk. EDD goes deeper when it needs to. Simple enough on paper.

What nobody tells you is what happens when a new customer walks in and the answer is not obvious. Is this sole trader a KYC case or a KYB case? Does this charity with cash donations need SDD or EDD? Who exactly is the "beneficial owner" of a sovereign wealth fund?

These are the dilemmas that separate a functional compliance programme from one that creates regulatory exposure. This guide walks through six real-world archetypes, each with a decision point where the wrong call carries consequences. At each stop, you will make the call yourself before seeing the correct answer and the reasoning behind it.

James is a 34-year-old freelance graphic designer. He wants to open a business current account at your fintech. He is a British citizen, has a UK passport, and has been operating under his own name for three years. No limited company. No employees. No offshore connections.

On paper, James is a straightforward KYC case. Identity check: passport plus selfie. Risk assessment: low. Sanctions and PEP check: clear. SDD applies. Onboarding time: four minutes. Done.

But then the system flags something: James has no fixed address. He moved out of his flat six months ago and has been staying with various friends. His passport shows an address that no longer matches anything verifiable. He cannot provide a utility bill or bank statement at his current location.

What does KYC actually require for address verification?

Under the UK Money Laundering Regulations 2017, Regulation 28 requires firms to identify the customer and verify that identity from a reliable, independent source, applying a risk-based, proportionate standard. It doesn't itself enumerate a fixed set of data points or a fixed verification method for any of them, name, date of birth, and residential address are the standard identifying particulars firms typically collect as a matter of practice, address included, but the regulation does not specify that address must be verified through a utility bill specifically. The important distinction is between identifying someone and choosing a proportionate method of verifying their current residential address.

Alternative address verification methods that satisfy the risk-based approach include: credit reference agency checks (Experian, Equifax, TransUnion), electoral roll search, HMRC correspondence, or a declaration supported by a professional (solicitor, accountant, employer). For genuinely nomadic individuals, some firms will accept a care-of address at a trusted third party with appropriate documentation.

Sarah runs a plumbing business. She trades as "Sarah Williams Plumbing", not a limited company, not an LLP, just her own name with the word Plumbing appended. Her annual turnover is £180,000. She employs two part-time assistants paid through payroll. She has a business bank account, a VAT number, and a website.

Does Sarah require KYC or KYB? This is one of the most misapplied questions in onboarding. The answer determines whether you need company registration documents, beneficial ownership analysis, and a separate entity risk rating, or whether a passport and utility bill will do.

The legal entity test

The determining factor is not how the business looks from the outside: it is whether a separate legal entity exists. A sole trader, regardless of trading name, employees, turnover, or VAT registration, is a natural person operating under their own name. There is no separate legal entity. There are no directors. There are no shareholders. There is no company number.

This means: KYC applies, not KYB. You verify Sarah as an individual. You assess her personal risk profile. You run PEP and sanctions checks on Sarah Williams the person. The trading name is commercially relevant but legally irrelevant to your onboarding framework.

However, and this is where firms frequently make errors, you should also understand the nature of the business activity for your CDD risk assessment. A sole trader turning over £180,000 in cash-intensive plumbing work warrants a different risk profile than a sole trader who invoices six corporate clients electronically. The KYC process is the same. The risk rating is not.

Meridian Creative Ltd is a two-year-old marketing agency based in Bristol. Incorporated at Companies House, registered for VAT, two directors who are also the only shareholders. Turnover £450,000. All revenue from UK-based corporate clients. No cash. Clean adverse media. No PEP connections.

This is the textbook KYB case. But "textbook" does not mean "skip the steps." Many onboarding failures happen precisely here, with the cases that look clean, because analysts apply shortcuts that leave documentation gaps.

The KYB checklist for a clean UK Ltd company

Even for a straightforward SME, your KYB file should contain all of the following before the account is opened:

• Certificate of Incorporation (Companies House verification is acceptable as a primary source)
• Confirmation of current registered address and trading address if different
• Memorandum and Articles of Association (or confirmation of model articles)
• Full register of directors, verified against Companies House PSC register
• UBO identification: all individuals who own or control more than 25% of shares or voting rights, or who separately exercise ultimate control over management (MLR 2017 Reg 5, two distinct limbs, not a blended test)
• KYC on each UBO individually: identity document, PEP check, sanctions check, adverse media search
• Nature of business and expected transaction profile documented
• Source of funds: where is the business revenue coming from?

Greystone Holdings Ltd presents for onboarding at your payment institution. UK-registered. The application says it is a property investment vehicle. Turnover: £12 million last year. The applying director is a Mr. Okafor based in Lagos, who holds a power of attorney to act on behalf of the company.

The shareholder register shows one shareholder: Greystone Capital S.A., registered in Luxembourg. That entity is owned by a trust registered in the British Virgin Islands. The trustee is a corporate trustee. The named beneficiaries of the trust are "members of the Okafor family", unspecified.

Why this structure demands EDD before anything else

Several red flags contribute to an EDD requirement here. First: a high-risk jurisdiction in the ownership chain (BVI is on the FATF list of jurisdictions under increased monitoring, one contributing risk factor here, not an automatic EDD trigger on its own). Second: an unidentified beneficiary class, "family members" is not a UBO. Third: a power of attorney arrangement, which creates a control layer that bypasses normal governance. Fourth: the business activity (property investment) is a known typology for layered money laundering.

Proportionate EDD measures here, scaled to the risk under Regulation 33, could include: requesting the trust deed, identifying the class of beneficiaries and any individual with a fixed or vested interest (MLR 2017 Reg 6 permits identifying a beneficiary class where individuals are not yet determined, alongside the trust's controllers, it does not require naming every discretionary beneficiary as a substitute UBO), running KYC on the identified beneficiaries and controllers of the trust, considering a specialist intelligence report on the Okafor family where the risk profile warrants it, verifying source of wealth for the £12 million property portfolio, and obtaining senior management approval before the account is opened. This is not a fixed statutory checklist, it is what proportionate EDD looks like for a structure with this risk profile.

Helping Hands UK is a registered charity. Charity Commission registration: confirmed. Purpose: humanitarian aid to conflict zones in the Middle East and North Africa. They want to open an account to receive donations and send funds to partner organisations in Lebanon, Jordan, and Libya.

Charities are legal entities. They require KYB. But the KYB framework for a charity looks materially different from a Ltd company, because the governance structure, the source of funds, and the destination of funds are all categorically different. And the sector carries elevated financial crime risk that regulators have documented extensively.

Why charities are not low-risk by default

The FATF Typologies Report and the Charity Commission's own guidance make this explicit: the charity sector is actively exploited for terrorist financing, not because charities are complicit, but because the features that make charities legitimate, public trust, cash donations, international remittance, informal governance, also make them attractive to those seeking to move funds through them without detection.

Three specific risk factors activate EDD triggers here. One: the fund destinations include Lebanon, a jurisdiction FATF currently lists as under increased monitoring, and Libya, a conflict-affected jurisdiction with weak institutional oversight even though it is not currently on the FATF list itself, both raise the destination-country risk profile. Two: the funding model relies on anonymous cash donations, a heightened risk factor for source-of-funds verification, not an automatic bar to verification. Three: the partner organisations in the destination countries require their own due diligence as downstream recipients of your customer's funds.

Who is the UBO of a charity?

This is a question that trips up many onboarding teams. Charities do not have shareholders. They do not have beneficial owners in the corporate sense, and the trustees are not a substitute UBO class in the way a >25% shareholder is. Under UK MLRs, for charities and other non-profit legal arrangements, the applicable obligation is to identify the senior managing officials, which in practice means the trustees, and verify their identities individually. The charity's governing documents must be reviewed. And the nature of the charitable purpose must be assessed for financial crime risk, not just accepted at face value because a Charity Commission number exists.

Gulf National Infrastructure Fund (GNIF) is a sovereign wealth fund established by a Gulf state government. It is looking to open a relationship with your institution for UK real estate acquisition. The fund manages $340 billion in assets. It is wholly owned by the government. The government is wholly controlled by a ruling family whose members hold all key positions of state.

This is the most complex onboarding case in financial services. And it is one that many institutions get wrong, either by over-complicating it into paralysis, or by under-applying EDD because "it's a government entity, how risky can it be?"

The UBO problem that has no clean answer

Sovereign entities and state-owned enterprises present a structural problem in the FATF framework: it was built to trace ownership back to natural persons, but the natural person behind a government is either a head of state (always a PEP), a ruling family (multiple PEPs), or the population of the country (not a practical verification target). The framework breaks down at the top of the chain.

FATF guidance acknowledges this. For sovereign wealth funds and state-owned entities, the applicable approach is to: identify the entity's mandate and legal basis, identify the senior managing officials (fund directors, board members, controlling ministers), subject each to PEP screening as a matter of course, assess the jurisdiction risk of the home country, and apply EDD based on the combination of PEP exposure and jurisdiction risk, not to attempt to "solve" the beneficial ownership question by identifying the head of state as a UBO.

SDD for listed governments: when it applies

Under Regulation 37(3), being a public administration or publicly owned enterprise, a listed company on a regulated market, or a regulated and supervised financial institution, is a lower-risk factor to weigh in the SDD determination, not an automatic simplified-due-diligence class. A sovereign wealth fund that is not itself listed or regulated, and that operates in connection with a jurisdiction carrying elevated risk, does not present the lower-risk profile Regulation 37(3) is pointing to, so the risk-based case for SDD is weak here regardless of the entity being government-owned. SDD can never cure an unresolved identity or beneficial-ownership verification requirement, it only ever adjusts how much verification effort is proportionate once identification itself is sound.

The dilemma is always the same. The facts change.

Across six archetypes, from a freelancer with no fixed address to a sovereign wealth fund controlling hundreds of billions, the core challenge never changes: you must identify who you are really dealing with, understand what risk they present, and apply a proportionate response that your documentation can defend.

KYC, KYB, CDD, SDD, and EDD are not competing frameworks. They are layers of the same obligation applied at different depths. The skill is knowing which layer applies, when to go deeper, and when going deeper would be disproportionate to the risk.

The practitioners who get this right are not the ones who memorise the definitions. They are the ones who understand that the definitions exist to serve a purpose: keeping financial crime out of the system, one onboarding decision at a time.

Related topics

• Synthetic Identity and Device-Network Fraud, the identity verification failure mode that due diligence at onboarding exists to catch.
• The UBO Investigation Handbook, the practical investigative technique behind this guide's own beneficial ownership steps, nominee directors, unreliable register data, and trust beneficiaries.