KYC / KYB / CDD / EDD:
The Onboarding Dilemma

The acronyms are easy. The decisions are not.

Every compliance professional can recite the definitions. KYC verifies the individual. KYB verifies the business. CDD assesses the risk. EDD goes deeper when it needs to. Simple enough on paper.

What nobody tells you is what happens when a new customer walks in and the answer is not obvious. Is this sole trader a KYC case or a KYB case? Does this charity with cash donations need SDD or EDD? Who exactly is the "beneficial owner" of a sovereign wealth fund?

These are the dilemmas that separate a functional compliance programme from one that creates regulatory exposure. This guide walks through six real-world archetypes — each with a decision point where the wrong call carries consequences. At each stop, you will make the call yourself before seeing the correct answer and the reasoning behind it.

James is a 34-year-old freelance graphic designer. He wants to open a business current account at your fintech. He is a British citizen, has a UK passport, and has been operating under his own name for three years. No limited company. No employees. No offshore connections.

On paper, James is a straightforward KYC case. Identity check: passport plus selfie. Risk assessment: low. Sanctions and PEP check: clear. SDD applies. Onboarding time: four minutes. Done.

But then the system flags something: James has no fixed address. He moved out of his flat six months ago and has been staying with various friends. His passport shows an address that no longer matches anything verifiable. He cannot provide a utility bill or bank statement at his current location.

What does KYC actually require for address verification?

Under the UK Money Laundering Regulations 2017, firms must verify identity — name and date of birth — from a reliable, independent source. Address is a customer identification requirement under most firms' CIP policies, but the regulation does not specify that address must be verified through a utility bill. The important distinction is between identifying someone and verifying their current residential address.

Alternative address verification methods that satisfy the risk-based approach include: credit reference agency checks (Experian, Equifax, TransUnion), electoral roll search, HMRC correspondence, or a declaration supported by a professional (solicitor, accountant, employer). For genuinely nomadic individuals, some firms will accept a care-of address at a trusted third party with appropriate documentation.

Sarah runs a plumbing business. She trades as "Sarah Williams Plumbing" — not a limited company, not an LLP, just her own name with the word Plumbing appended. Her annual turnover is £180,000. She employs two part-time assistants paid through payroll. She has a business bank account, a VAT number, and a website.

Does Sarah require KYC or KYB? This is one of the most misapplied questions in onboarding. The answer determines whether you need company registration documents, beneficial ownership analysis, and a separate entity risk rating — or whether a passport and utility bill will do.

The legal entity test

The determining factor is not how the business looks from the outside — it is whether a separate legal entity exists. A sole trader, regardless of trading name, employees, turnover, or VAT registration, is a natural person operating under their own name. There is no separate legal entity. There are no directors. There are no shareholders. There is no company number.

This means: KYC applies, not KYB. You verify Sarah as an individual. You assess her personal risk profile. You run PEP and sanctions checks on Sarah Williams the person. The trading name is commercially relevant but legally irrelevant to your onboarding framework.

However — and this is where firms frequently make errors — you should also understand the nature of the business activity for your CDD risk assessment. A sole trader turning over £180,000 in cash-intensive plumbing work warrants a different risk profile than a sole trader who invoices six corporate clients electronically. The KYC process is the same. The risk rating is not.

Meridian Creative Ltd is a two-year-old marketing agency based in Bristol. Incorporated at Companies House, registered for VAT, two directors who are also the only shareholders. Turnover £450,000. All revenue from UK-based corporate clients. No cash. Clean adverse media. No PEP connections.

This is the textbook KYB case. But "textbook" does not mean "skip the steps." Many onboarding failures happen precisely here — with the cases that look clean — because analysts apply shortcuts that leave documentation gaps.

The KYB checklist for a clean UK Ltd company

Even for a straightforward SME, your KYB file should contain all of the following before the account is opened:

• Certificate of Incorporation (Companies House verification is acceptable as a primary source)
• Confirmation of current registered address and trading address if different
• Memorandum and Articles of Association (or confirmation of model articles)
• Full register of directors — verified against Companies House PSC register
• UBO identification: all individuals with more than 25% ownership or control
• KYC on each UBO individually: identity document, PEP check, sanctions check, adverse media search
• Nature of business and expected transaction profile documented
• Source of funds: where is the business revenue coming from?

Greystone Holdings Ltd presents for onboarding at your payment institution. UK-registered. The application says it is a property investment vehicle. Turnover: £12 million last year. The applying director is a Mr. Okafor based in Lagos, who holds a power of attorney to act on behalf of the company.

The shareholder register shows one shareholder: Greystone Capital S.A., registered in Luxembourg. That entity is owned by a trust registered in the British Virgin Islands. The trustee is a corporate trustee. The named beneficiaries of the trust are "members of the Okafor family" — unspecified.

Why this structure demands EDD before anything else

Four red flags activate EDD simultaneously here. First: a high-risk jurisdiction in the ownership chain (BVI is on the FATF and OFSI monitoring list for corporate opacity). Second: an unidentified beneficiary class — "family members" is not a UBO. Third: a power of attorney arrangement, which creates a control layer that bypasses normal governance. Fourth: the business activity (property investment) is a known typology for layered money laundering.

EDD in this context means: requesting the trust deed, identifying every named beneficiary, running full KYC on each natural person in the Okafor family who benefits from the trust, obtaining an intelligence report on the Okafor family from a specialist provider, verifying source of wealth for the £12 million property portfolio, and obtaining senior management approval before the account is opened — regardless of how straightforward the directors present the arrangement.

Helping Hands UK is a registered charity. Charity Commission registration: confirmed. Purpose: humanitarian aid to conflict zones in the Middle East and North Africa. They want to open an account to receive donations and send funds to partner organisations in Lebanon, Jordan, and Libya.

Charities are legal entities. They require KYB. But the KYB framework for a charity looks materially different from a Ltd company — because the governance structure, the source of funds, and the destination of funds are all categorically different. And the sector carries elevated financial crime risk that regulators have documented extensively.

Why charities are not low-risk by default

The FATF Typologies Report and the Charity Commission's own guidance make this explicit: the charity sector is actively exploited for terrorist financing, not because charities are complicit, but because the features that make charities legitimate — public trust, cash donations, international remittance, informal governance — also make them attractive to those seeking to move funds through them without detection.

Three specific risk factors activate EDD triggers here. One: the fund destination includes Libya, which is a FATF-identified jurisdiction with significant financial crime risk. Two: the funding model relies on anonymous cash donations, which cannot be source-of-funds verified. Three: the partner organisations in the destination countries require their own due diligence as downstream recipients of your customer's funds.

Who is the UBO of a charity?

This is a question that trips up many onboarding teams. Charities do not have shareholders. They do not have beneficial owners in the corporate sense. Under UK MLRs, for charities and other non-profit legal arrangements, the equivalent obligation is to identify the senior managing officials — the trustees — and verify their identities individually. Each trustee requires a KYC check. The charity's governing documents must be reviewed. And the nature of the charitable purpose must be assessed for financial crime risk, not just accepted at face value because a Charity Commission number exists.

Gulf National Infrastructure Fund (GNIF) is a sovereign wealth fund established by a Gulf state government. It is looking to open a relationship with your institution for UK real estate acquisition. The fund manages $340 billion in assets. It is wholly owned by the government. The government is wholly controlled by a ruling family whose members hold all key positions of state.

This is the most complex onboarding case in financial services. And it is one that many institutions get wrong — either by over-complicating it into paralysis, or by under-applying EDD because "it's a government entity, how risky can it be?"

The UBO problem that has no clean answer

Sovereign entities and state-owned enterprises present a structural problem in the FATF framework: it was built to trace ownership back to natural persons, but the natural person behind a government is either a head of state (always a PEP), a ruling family (multiple PEPs), or the population of the country (not a practical verification target). The framework breaks down at the top of the chain.

FATF guidance acknowledges this. For sovereign wealth funds and state-owned entities, the applicable approach is to: identify the entity's mandate and legal basis, identify the senior managing officials (fund directors, board members, controlling ministers), subject each to PEP screening as a matter of course, assess the jurisdiction risk of the home country, and apply EDD based on the combination of PEP exposure and jurisdiction risk — not to attempt to "solve" the beneficial ownership question by identifying the head of state as a UBO.

SDD for listed governments — when it applies

There is one scenario where SDD applies to government-related entities: when the entity itself is a publicly listed company on a regulated exchange in a FATF-compliant jurisdiction, or when the entity is a regulated financial institution subject to equivalent AML obligations. A sovereign wealth fund that is not listed and operates in a jurisdiction with elevated FATF risk does not qualify for SDD. The SDD carve-out for government bodies applies to the government itself as a counterparty in low-risk, transparent transactional relationships — not to sovereign funds managing hundreds of billions in global investments.

The dilemma is always the same. The facts change.

Across six archetypes — from a freelancer with no fixed address to a sovereign wealth fund controlling hundreds of billions — the core challenge never changes: you must identify who you are really dealing with, understand what risk they present, and apply a proportionate response that your documentation can defend.

KYC, KYB, CDD, SDD, and EDD are not competing frameworks. They are layers of the same obligation applied at different depths. The skill is knowing which layer applies, when to go deeper, and when going deeper would be disproportionate to the risk.

The practitioners who get this right are not the ones who memorise the definitions. They are the ones who understand that the definitions exist to serve a purpose: keeping financial crime out of the system, one onboarding decision at a time.