Know your business: proving a company exists and who stands behind it

The German Money Laundering Act, the GwG, treats a legal entity as a contracting party whose identity has to be established before the relationship starts, the same duty that applies to a natural person but with different data. For a company that means the name, the legal form, the registration number, the address of the seat and the names of the legal representatives, verified from a source the law accepts, typically an extract from the commercial register or a comparable register, or from a reliable commercial directory.

Then the duty goes further than it does for a person: the obliged entity has to establish whether the contracting party has a beneficial owner and, if so, identify them. That second step is where KYB stops being a document check. KYC in Germany covers the natural-person side, anti-money laundering in Germany the wider frame, and BaFin is the German supervisor for both.

Section 3 GwG sets out who counts. For a company that is not listed, a beneficial owner is a natural person who directly or indirectly holds more than 25 percent of the capital shares or controls more than 25 percent of the voting rights. That is the arithmetic part, and it is the part software handles.

The same provision adds a third route that software does not handle: control exercised in a comparable manner, which reaches a natural person who can exert dominant influence over the entity, directly or indirectly, with the standard taken from the Commercial Code's definition of controlling influence. For trusts and foundations the definition extends to a person with dominant influence over the management of the assets or the distribution of income. The practical point is that a person with no shares at all can be the beneficial owner, through a voting agreement, a veto right or a financing arrangement, and no percentage calculation will surface them. That is why the two-pronged test exists and why the control prong needs a human reading the documents.

Germany maintains a central register of beneficial owners, the Transparenzregister. Under Section 20 GwG, private legal entities and registered partnerships have to obtain, keep and report the beneficial owner information to the register electronically and without delay, and the beneficial owners themselves have to supply their entity with what it needs and report changes immediately.

The part that catches banks out is Section 23a GwG. An obliged entity that consults the register has to file a discrepancy report with the register-keeping body where entries are missing, where individual details about the beneficial owners differ from what it found, or where it identified different beneficial owners altogether. Supervisory authorities and the Financial Intelligence Unit report likewise. The register operator has to provide a clearly visible mechanism on the website for submitting them and has to examine reports promptly, with the power to ask the reporting party or the entity for clarification. So a discrepancy is not an internal note: it is an outbound filing, and a KYB process has to have a path for it.

When the shareholder of your customer is itself a company, nothing has been resolved yet, because a beneficial owner is a natural person by definition. The chain has to be walked upward until natural persons appear, and the percentages multiply along the way, so a 40 percent holding in a company that holds 50 percent of your customer comes out at 20 percent and falls below the threshold for the shareholding route, which is exactly when the control question becomes the one that matters.

The step sequence described in Binderr's account of KYB for banks runs legal existence, registry extract, ownership chain, control structure, screening, and the chain walk is the step that consumes the time. Structures spanning several jurisdictions, nominee arrangements and registers of varying quality are the normal case, not the exception, and the EU anti-money laundering package addresses complex structures directly. Screening the names you find is a separate control, covered by sanctions compliance in Germany.

It is worth stating twice, because it is where files fail review. Unit21's description of know your business sets out the two-prong test, ownership percentage and control, and the data to collect per owner. The control prong is the one a questionnaire misses, since the person it catches does not appear in a shareholder list.

In practice you find them in the documents around the structure: the shareholders' agreement, the articles, the financing contracts, the board appointments. That is work for someone who reads, and it is the part that cannot be automated away, however good the registry integration is. RegTech in Germany covers the tooling that handles the parts that can be.

A company's ownership changes without any obligation to inform its bank. A share transfer, a new holding structure, a death in a family business: the file you verified two years ago now describes a company that no longer exists in that shape, and nothing in your systems has changed. Fourthline's glossary entry on KYB makes that staleness the distinguishing feature against KYC, where a person's identity at least stays the same person.

Ongoing monitoring is the answer, and it is a duty and not a nicety: the obliged entity has to keep the information current over the life of the relationship. What that means operationally is a review cycle driven by risk, plus triggers that force a re-check when something observable changes, and a watch on the register entries of the entities you depend on. The EU anti-money laundering package and BaFin both treat monitoring as a continuous duty, not a periodic one.

The duties are the same ones, and they come from the AML rules and not from MiCA, which governs authorization and conduct and adds no separate verification method. A crypto-asset service provider onboarding a company customer therefore establishes legal existence, beneficial ownership and authority exactly as a bank does.

What differs is the typical customer. Structures are younger, more often cross-border, more often hold assets in forms a registry extract does not mention, and a corporate customer whose business is itself crypto brings its own transfer-side duties. The CASP license covers the authorization and crypto AML the transfer rules.

Every layer in an ownership chain is a legal entity that needs a stable name, and a 20-character code does that job better than a company name in four spellings. The Legal Entity Identifier covers the code, who issues it and why a lapsed record causes trouble downstream.

The verifiable form of the identifier reaches into this page's third question. Role credentials bind a named person to the entity, which is the "who may act for it" problem that a registry extract answers only as of the date it was pulled.

Establishing that a business customer is a real legal entity, identifying the natural persons who ultimately own or control it, and confirming that the person acting is authorized to. In Germany the duty comes from the GwG, and the evidence is a register extract or comparable source plus the documents needed to resolve the ownership and control structure.

The customer. KYC identifies a natural person against a document. KYB identifies a legal entity, then has to reach through it to the natural persons behind it and to the person authorized to act. The second difference is time: a person's identity stays stable, while a company's ownership can change without notice, so a KYB file goes out of date on its own.

Under Section 3 GwG, a natural person holding more than 25 percent of the capital shares or controlling more than 25 percent of the voting rights of a non-listed company is a beneficial owner. It is one of two routes: the same provision also captures a person exercising control in a comparable manner, who may hold no shares at all.

When it consults the Transparenzregister and finds that required entries are missing, that individual details about the beneficial owners differ from its own findings, or that it identified different beneficial owners. Section 23a GwG directs the report to the register-keeping body, which has to examine it promptly and may ask for clarification.