Onboard companies without getting stuck: corporate documents, the ownership chain up to the beneficial owner, authorized signatories and their powers, foreign companies and periodic recertification of your portfolio.
Is corporate onboarding getting stuck? Free KYB assessment
Tell us which structures are holding you back and we will tell you what to request, what to check and how far you need to go.
KYB does not fail for lack of data; it fails for lack of method. Six building blocks so that onboarding a company stops being a negotiation between the analyst and the sales team.
We write the full workflow: which documents are required for each type of company, how they are verified at source, how the ownership structure is reconstructed, who approves and what goes on file. One consistent method, not a different standard for each analyst.
Beyond identification: the company’s real business activity, the purpose of the relationship, consistency between the declared business and the expected activity, the source of funds, and a risk rating with a rationale that can still be understood months later.
The concept, the criteria and when you move from ownership to effective control. The conceptual foundation on which the whole KYB process rests.
Foreign parent companies, fiduciary arrangements and multi-tier vehicles: how to document the ultimate beneficial owner when the local register does not help.
What to add when the structure, the sector or the jurisdiction raises the risk, and who authorizes taking on the customer.
Onboarding has a shelf life. We set the review frequency by risk, the review triggers and the evidence that each review took place.
Four different entities, the same bottleneck: the corporate customer wants to start operating now and the file will not close.
“A customer brought us a structure with a parent company abroad and three intermediate companies. Each analyst asked for different documents, and the file went round in circles for weeks without anyone making a decision.”
“Our onboarding for sole proprietors takes minutes. With companies it breaks down: we ask for deeds by email, someone looks at them and there is no record of what was checked.”
“We have thousands of sellers onboarded as companies. The problem is not new onboarding: it is that nobody has looked again at the ones that joined years ago.”
“The investor is a vehicle, the vehicle belongs to another vehicle, and the beneficial owner depends on a shareholders’ agreement nobody had shown us. We needed a set of criteria, not case-by-case decisions.”
They show up in almost every review we carry out, and they have nothing to do with how sophisticated the tool is: they have to do with where you decide to stop.
Stopping at the customer’s declaration: asking for a signed statement on who the beneficial owner is and filing it away is not verification. It only documents that you asked. The rules require you to verify, using reliable and independent documents or sources.
Stopping at the first level of the chain: if your customer’s shareholder is another company, the file is not closed. Indirect ownership is calculated upward until natural persons are identified, not until the analyst gets tired.
Treating onboarding as permanent: directors change, powers of attorney are revoked, shares are transferred and the business changes. Without risk-based recertification, the customer record describes a company that no longer exists.
| Corporate scenario | Where it gets stuck | How to resolve it |
|---|---|---|
| Chain of companies | Ownership is diluted across several levels and no shareholder reaches the regulatory threshold on its own. | Calculating indirect ownership level by level until the entire share capital is covered, and analyzing effective control if ownership does not settle the question. |
| Foreign parent company | The commercial register in the home country does not offer the same information, and the documents arrive in another language and format. | Official documents from the home country, translation and legalization where applicable, and cross-checking against independent sources before accepting the structure. |
| Opaque jurisdiction | There is no useful public register of shareholders and the customer provides only a signed declaration. | Enhanced measures, additional documentary requirements and a reasoned decision by the competent body on whether or not to open the relationship. |
We review your KYB procedure, set out which documents are required for each type of company, define how far up the ownership chain you need to go and put the criteria in writing so the file does not depend on who happens to be on duty. First consultation free of charge and reply within 24 h.
KYB (know your business) is the verification of a customer that is a legal entity. Traditional KYC resolves an individual identity; KYB has to resolve three things at once: what the company is, who ultimately controls it and who is authorized to act on its behalf.
From a regulatory standpoint, they are not two separate regimes: both are due diligence under Law 10/2010. The difference is operational, and it is huge, because a company can have shareholders that are themselves companies, authorized signatories with limited powers and documents that expire. That is where onboarding gets stuck.
The basic set is stable: deed of incorporation and current articles of association, the company’s registry details, tax identification, proof that the directors currently hold office, the shareholder structure, and the power of attorney or other document that sets out the signatory’s powers.
From there, the volume depends on risk: annual accounts, sector licenses, contracts that explain the business or source-of-funds documents. What matters is not the list itself but that it is written into your procedure by customer type and risk level. If each analyst improvises, there is no way to defend why one customer was asked for more than another.
Level by level and in writing. You start from the customer’s share capital, identify each shareholder and, when a shareholder is another company, repeat the exercise for that company. The holding of a natural person two or three levels up is obtained by multiplying the percentages along the chain, and you keep going until you can see whether anyone reaches the threshold set by the rules.
Two practical rules: draw the structure chart and keep it on file, and do not close the analysis until the entire share capital is covered. If ownership does not give a clear result, the analysis moves to effective control: shareholders’ agreements, veto rights or the power to appoint directors. The concept is explained in beneficial ownership.
This is the case that blocks the most files. When there is no reliable register of shareholders, you cannot simply accept what the customer declares, nor can you automatically close the door. What you need to do is apply enhanced measures: more documentation, more cross-checking against independent sources and a reasoned onboarding decision, approved at the level set by your procedure.
You should also check the jurisdiction against the FATF lists and keep a record of that check. And accept an uncomfortable conclusion: if you cannot establish who controls the company, the right answer may be not to open the relationship.
With the document that sets out those powers, not with a business card. You need to verify three things: that the power of attorney exists and is registered where registration is required, that it has not been revoked, and that the powers cover the specific act to be carried out.
This point is often neglected. We see files with a very broad power of attorney scanned years ago and no check since, and also contracts signed by an attorney-in-fact whose powers did not extend to that transaction. Set out in your procedure who checks that powers are still in force, against which source, and how often the check is repeated for active customers.
There is no universal frequency: it is set according to risk and must be justified. What must be in writing is the criterion—which customers are reviewed more often and why—and the triggers that require a review before the scheduled date: a change of directors or shareholders, a structural change, a change of business activity, appearing on lists, activity inconsistent with the profile, or adverse media.
Recertification does not mean asking for everything again. It means checking what has changed, updating what is needed and recording that the review took place, even if the result is that nothing had changed. We cover this in ongoing due diligence.
The signatory and the natural persons the rules require you to identify must be identified using a valid method, and if they will not attend in person, that method is usually remote identification. That is where KYB ends and a different discipline begins.
This page covers the structure: what the company is, who controls it and who can bind it. The formal validity of remote onboarding of natural persons—video methods, evidence and audit of the procedure—is covered in remote video identification. In corporate onboarding, you need both pieces to fit together.
It is a useful source and you should consult it, but it does not replace your own analysis. The Central Register of Beneficial Ownership (Registro Central de Titularidades Reales), created by Royal Decree 609/2023 of July 11, centralizes the beneficial ownership information that has been declared, and its value for you is mainly as a cross-check: if what the customer declares does not match what is registered, you have an issue to clarify and document.
What you cannot do is replace the file with a register search. The obligation to identify and verify the beneficial owner remains yours, using the sources and documents that are reliable in each case.
These are two different things and should not be confused. A beneficial owner who is a politically exposed person does not rule out the relationship: it triggers enhanced measures, approval at a senior level, inquiries into the source of wealth and enhanced monitoring.
A match against international financial sanctions lists is a different matter: it requires immediate action under the applicable regime, and there is no room for commercial judgment. That is why screening is carried out not only on the company but also on its directors, authorized signatories and beneficial owners, and is repeated periodically.
This is the process we implement: first the criteria are set, then they are applied equally to all customers, and finally they are kept up to date. Whatever is not written down gets argued over every week.
We define which documents are required for each type of customer—Spanish company, foreign parent company, regulated entity, investment vehicle—and what is accepted as a reliable source. Without this table, the file depends on whoever handles the request.
We reconstruct the ownership chain until natural persons are identified, document effective control when ownership is not enough, and verify the signatory’s powers of attorney and authority. All with a structure chart and evidence on file.
Screening of the company, directors, authorized signatories and beneficial owners; a reasoned onboarding decision at the appropriate level; and a risk-based review schedule with triggers that require an earlier look.
If you prefer to delegate it, see our AML and KYC service and our business due diligence service, where KYB fits into the AML/CFT framework.
The 10 elements of an AML/CFT system you can defend before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before an inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These terms structure the conversation between the business and compliance teams. When every area uses them with the same meaning, files stop bouncing back and forth.
The set of checks on a customer that is a legal entity: the company’s existence and details, its business activity, ownership structure and representation.
The natural person or persons who ultimately own or control the company. The concept is explained on our beneficial ownership page.
The percentage a person holds in the customer through one or more interposed companies, obtained by multiplying the stakes along the chain.
The ability to direct the company by means other than ownership: shareholders’ agreements, veto rights, the power to appoint directors or financial dependence.
A representation of every corporate level between the customer and the natural persons at the end of the structure.
A person empowered to act on behalf of the company within the scope of the power of attorney granted and for as long as it remains in force.
Registry certificates, powers of attorney and appointments that reflect the situation on a specific date and may have changed since.
Periodic review of the corporate customer’s information, at a frequency set by its risk level and with extraordinary triggers.
A register created by Royal Decree 609/2023 of July 11 that centralizes the beneficial ownership information declared by legal entities.
Existence, identifying details, registered address and current officers, evidenced with reliable documents, not with the customer’s website.
Deed and articles of association, registry certificate or extract, tax identification and proof of the directors’ appointment.
Full reconstruction of the chain of shareholders up to natural persons, including intermediate corporate levels.
Dated structure chart, calculation of indirect holdings and supporting documents for each level.
Identification and verification of the beneficial owner, with an effective control analysis when ownership does not provide an answer.
Beneficial owner record, identity document, reasoned analysis and cross-check against independent sources.
Checking that the signatory is entitled to sign and that their powers cover the specific act.
Power of attorney or equivalent document, check that it is in force, and identification of the individual signatory.
Periodic review proportionate to risk and a documented response to corporate changes or alerts.
Recertification schedule, review log, screening results and an audit trail of the decisions taken.
If you recognize two or more in your operations, the problem is not resources: it is procedure.
Verifying a company rarely ends with the company itself. Jurisdictions that require additional measures, lists that must be screened and persons who require specific treatment all come into play. These pages cover those ramifications so you do not discover them halfway through an urgent onboarding.
When, in addition to verifying the customer, you need to analyze the company in depth: encumbrances, litigation, contracts and contingencies.
What it means when a jurisdiction in the structure is subject to increased monitoring, and how to document the check.
Screening of the company, directors, authorized signatories and beneficial owners, and what to do in the event of a true match.
Specific treatment when the beneficial owner or an authorized signatory is a PEP: approval, source of wealth and monitoring.
If you need to put the whole system in order and not just onboarding, start with anti-money laundering, review your AML manual and check how it fits with the ongoing due diligence of your portfolio.
Send us a real case you have stuck—an ownership chain, a foreign parent company—and we will tell you how to close that file.
Last updated: August 4, 2026
Onboarding a company as a customer is due diligence under Law 10/2010 of April 28 and its implementing regulation, Royal Decree 304/2014, exactly as it is when onboarding an individual. The difference is that here it is not enough to know who is in front of you: you have to reconstruct what the company is, who controls it and who can bind it. This page does not define the beneficial owner again—you will find that in beneficial ownership and UBO. Here we deal with the process, from the first document request to the recertification of a portfolio you already have.
The first KYB mistake is not having the list in writing. When each analyst decides what to request, two identical customers receive different treatment and neither file can be defended. The base package is fairly stable: deed of incorporation and current articles of association, registry information proving the company’s existence and details, tax identification, proof that the directors currently hold office, the shareholder structure and the document that sets out the powers of the person who will sign.
On top of that base, you build in layers. If the customer operates in a regulated sector, the relevant license or registration number. If the risk is high, annual accounts, contracts explaining the business flow or documents on the source of funds. If it is an investment vehicle, the documents of the vehicle and of its manager. What matters is not that the list is long, but that it is predefined by customer type and risk level in your procedure, and that there is a clear rule on what is accepted as a reliable source: a registry certificate is not the same as a PDF sent by the customer itself. That distinction, in writing, is what later holds the file together.
This is the real work of KYB. If your customer’s shareholder is another company, the file is not closed: you have to go up one more level, and another, until you reach natural persons. The holding of someone several levels up is obtained by multiplying the percentages of each link in the chain, and only then can you check whether anyone reaches the ownership threshold set by the rules.
Three recommendations that save weeks. First: draw the full structure chart and keep a dated copy on file; a one-page diagram heads off much of the internal debate and is usually the first piece of evidence requested. Second: do not close the analysis until the entire share capital is covered, including small holdings that sometimes hide the next level. Third: when ownership does not give a clear result—highly dispersed capital, cross-holdings, agreements between shareholders—the analysis shifts to effective control: who appoints the directors, who has veto rights, who finances the structure. That analysis must be reasoned in writing, because it is precisely the part an external reviewer will want to understand. The practical consequence of not doing so is simple: a declared but unverified beneficial owner is not a verified beneficial owner.
As soon as the structure extends beyond Spain, KYB changes in nature. Commercial registers do not offer the same information in every country, documents arrive in another language and format, and things we take for granted here—such as shareholders being listed in a public register—no longer hold. The operational answer is to require official documents from the home country, translation and legalization or apostille where applicable, and cross-checking against independent sources before accepting the structure. You should also set out in writing which countries fall within your risk appetite and which require enhanced approval, because deciding with the file already on the table always ends in a commercial decision disguised as a compliance decision.
When the jurisdiction is subject to increased monitoring, the bar goes up. You need to apply enhanced measures, check the structure against the FATF lists and the international financial sanctions lists, and escalate the onboarding decision to the level set by your procedure. And you have to accept the uncomfortable outcome: if you cannot establish who controls the company, not opening the relationship is a perfectly defensible decision, whereas opening it “because sales insists” is not. On the European horizon, the AML package—Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and the AMLA authority—is moving forward in phased application and will harmonize these criteria across Member States.
A file can have the structure perfectly resolved and still fail at the last hurdle: the person who signs the contract. Verifying representation involves three different checks that are often collapsed into one. First, that the power of attorney or equivalent document exists and is registered where registration is required. Second, that it is still in force: powers of attorney are revoked and directors leave office, and a copy scanned years ago does not prove today’s situation. Third, that the powers are sufficient for the specific act to be carried out, not for any act imaginable.
On top of that comes the identification of that natural person, which is a separate obligation. If the signatory will not come to a branch, the remote channel comes into play, with its own formal requirements. It is common to see entities with flawless corporate KYB and identification of the attorney-in-fact handled by email, which leaves the file weak on the side that is easiest to spot. Define in your procedure who checks that powers of attorney are in force, against which source, how often that check is repeated for active customers, and what happens when the usual signatory of a company that has been doing business with you for years changes.
Onboarding is a snapshot of the day it was done. After a while, the directors may have changed, the shares may have been transferred, the business may have changed and the signatory’s power of attorney may have been revoked. That is why ongoing due diligence is not an extra: it is the part of the system that stops your customer base from becoming an archive of old photos.
A recertification scheme that works has three components. A review frequency by risk level, set and justified by the entity—there is no universal rule; there is a criterion that you define and defend. Extraordinary triggers that require a review without waiting for the scheduled one: a change of shareholders or directors, a structural change, a change of business activity, a screening match, activity inconsistent with the declared profile, or adverse media. And evidence of the review, even when the result is that nothing has changed: a review that leaves no trace, for practical purposes, did not happen. Add one governance detail that makes a difference in an inspection: who is responsible for keeping the portfolio up to date and to whom they report. Without an owner, recertification always loses out to customer acquisition.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .