Skip to main content
SONAR
Sign In

What should a KYB checklist for onboarding a vendor, partner or reseller include?

A practical KYB (know your business) checklist confirms five things before you sign: the company exists and is active in its national register, you know who runs and owns it, neither the company nor its directors and owners are on a sanctions list, any politically exposed persons or adverse press are understood, and its tax and contact details match the registry. Record each check with its source and the date you ran it, so you can show what you knew when you signed.

Last reviewed:

How to check it manually

  1. Collect identifiers from the counterparty: exact legal name, country of registration, registration number, VAT number, website and registered address.
  2. Pull the record from the official national register (for example Companies House in the UK) and confirm the name, number, status, legal form, incorporation date and registered address match what you were given.
  3. List the directors and the beneficial owners. Use the register where it publishes them (the UK PSC register does); otherwise ask the company for an ownership chart down to the natural persons and corroborate each layer.
  4. Validate the VAT number: VIES for EU numbers, the HMRC service for UK numbers. Compare the returned name with the registry name.
  5. Screen the company and every director and owner against the sanctions lists that apply to you, such as OFAC SDN, the EU consolidated list, the UN Security Council list and the UK Sanctions List. Check whether sanctioned persons own the company.
  6. Screen the directors and owners for politically exposed person (PEP) status.
  7. Search the ICIJ Offshore Leaks Database and adverse media (fraud, sanctions, enforcement, insolvency) for the company and its people.
  8. Check official insolvency notices (for example The Gazette in the UK or BODACC in France) and, if the company says it is regulated, the regulator’s register (for example the FCA Register).
  9. Cross-check the details that will matter in practice: website domain, address, and that the bank account holder is the same legal entity. If the company has an LEI, check it in GLEIF.
  10. Record the outcome, the sources and the date, decide, and set a date to screen again before renewals, large payments or a change of ownership.

What it tells you

  • Whether the legal entity exists, under which number, and whether the register shows it as active.
  • Who is on record as running and owning it, as far as the register publishes this.
  • Whether the company or its people appear on the sanctions and PEP sources you searched, on the day you searched them.
  • Whether there is public reporting or official notices you should read before signing.

What it doesn’t tell you

  • Financial health or creditworthiness: KYB is not a credit check.
  • Whether documents the counterparty sent you are genuine, or whether the person you deal with is authorised to act for the company.
  • Beneficial owners in countries whose registers don’t publish them.
  • Anything that happens after the check: ownership, sanctions lists and company status change.
  • Whether you meet a legal AML obligation, if you have one. Regulated firms follow their own customer due diligence rules.

How SONAR automates it

SONAR runs this checklist in one report in about three minutes: registry record, directors and owners where SONAR’s collector for that register returns them (today the UK, Estonia, Poland, France and Brazil), VIES VAT validation when you give a VAT number, 8 sanctions lists, PEP, the ICIJ Offshore Leaks Database and 10 years of adverse media.

Each check returns PASS, REVIEW, FLAG or NOT RUN. A check that could not run caps the headline verdict at REVIEW, so a failed screen never reads as clear.

SONAR is a due-diligence tool for checking vendors, partners, resellers and suppliers. It compiles public-record data. It is not a regulated AML / KYC provider, does not verify identity documents, and is not legal advice.

You can try it on 2 companies a month for free, no card needed; every report includes a receipt for each source it used.

Read the methodology · Screen a company free

Frequently asked questions

What is the difference between KYB and KYC?

KYC (know your customer) verifies the identity of individuals. KYB (know your business) verifies a business: that it is registered and active, who controls and owns it, and whether it or those people appear on sanctions, PEP or other risk sources.

Is KYB legally required when onboarding a supplier?

It depends on your sector and country. Banks, payment firms and other obliged entities have customer due diligence duties under anti-money-laundering law. Sanctions laws, however, apply to everyone under their jurisdiction, so dealing with a sanctioned supplier can be unlawful even for a company that is not regulated.

How often should I re-check a vendor?

There is no single rule for non-regulated companies. Sanctions lists change often, so re-screen before renewals and large payments, when ownership or management changes, and on a schedule that fits the risk of the relationship.

What documents should I ask the counterparty for?

Usually the registration number (so you can pull the official record yourself), the VAT number, an ownership chart or declaration down to the natural persons, and a document showing the bank account belongs to the company. Prefer records you can fetch from the official source over copies sent to you.

Official sources

Run these checks on a company you’re about to sign

Registry record, owners, sanctions, PEP, ICIJ Offshore Leaks and adverse media in one report, with a receipt for every source. 2 free reports a month, no card.

Screen a company free