Traditional AML programmes were built around individual screening — onboarding checks, sanctions screening, ongoing monitoring of a named person. That model no longer matches how risk actually flows today: through corporate structures, partnerships, subsidiaries, trusts, and complex ownership chains, particularly in partner ecosystems and merchant onboarding, where the entity signing a contract and the person actually controlling the money aren't always the same thing.
Why does KYB matter as much as individual screening now?
Because business onboarding genuinely involves several interconnected elements that individual screening alone doesn't capture: the legal entity signing the contract, the individuals who actually own and control it, its directors and signatories, trading names and related entities, and any subsidiaries or group structure sitting behind it. KYB is how a business connects those dots so the resulting risk assessment is actually grounded in the real ownership picture, not just the name on the paperwork.
What does AUSTRAC's own guidance actually say about this?
Australia's reformed AML/CTF regime treats customer due diligence as an ongoing lifecycle obligation, not a single onboarding gate — and AUSTRAC's guidance explicitly calls out identifying ownership and control structures and beneficial owners as part of initial customer due diligence, not an optional layer added on top of it. FATF has moved in the same direction globally, tightening expectations around what counts as "adequate, accurate and up-to-date" beneficial ownership information and how it needs to be verified — corporate vehicles remain a common way to obscure who's actually controlling funds, which is exactly the gap this tightening is meant to close.
Why does manual KYB tend to fail operationally, even with good intentions?
Because it produces one of two bad outcomes in practice: teams shortcut the process to keep onboarding fast, or proper implementation becomes the operational bottleneck that slows the business down. Neither is acceptable to a regulator — AUSTRAC has been explicit that it rejects tactical responses that technically meet an obligation while actually reducing the effectiveness of the underlying AML/CTF controls. A KYB process that survives real operational pressure needs to be designed for scale from the outset, not bolted onto a manual process under time pressure.
How should KYB actually be operationalised without drowning the team in admin?
Four things matter most. Start with structure — multi-department or multi-entity organisations need multi-organisation screening capability with differentiated settings matching each unit's actual risk profile, not one uniform process applied regardless of fit. Use role-based access — clear permissions and defined roles keep KYB decision-making consistent and genuinely accountable. Build evidence capture into the workflow — due diligence decisions, notes, and risk assessments recorded against matched profiles as they happen, not reconstructed from memory after the fact. And scale with batch screening and ongoing monitoring — a business portfolio grows over time, and batch screening combined with daily monitoring for ownership or risk-affecting changes is what actually keeps pace with that growth, rather than manual review that gets slower exactly as volume increases.
