Business verification has become an increasingly important line of defence against financial crime, yet the complexity of modern corporate structures is exposing weaknesses in how firms establish who they are really doing business with.
Fragmented data, opaque ownership arrangements and increasingly sophisticated fraud techniques are making it harder to distinguish legitimate businesses from those concealing illicit activity.
As regulatory expectations tighten and criminals find new ways to exploit gaps in corporate identity checks, the limitations of traditional Know Your Business processes are becoming harder to ignore. RegTech providers are now looking to close these gaps through richer data, automated verification and more continuous monitoring.
A first key question to ask is how can firms establish who ultimately owns or controls a business when corporate structures span multiple jurisdictions?
According to Bhavin Shah, CEO of Sherlocq, knowing who you are really doing business with remains one of the hardest problems in compliance.
He explained, “A business can pass onboarding checks while the people who ultimately own or control it remain difficult to identify and that picture can change after the checks are complete.”
Verifying a business can look straightforward, as a company has a registration number, filed documents and a registered address. However, KYB is often more complicated than verifying an individual: ownership may run through several companies, nominees or legal arrangements, sometimes across jurisdictions, making it difficult to establish who ultimately owns or controls the business.
“A firm may verify the immediate shareholder and still have an incomplete picture of the person at the end of the chain. The blind spots are not just at the edges of the process. They can sit at its centre: in the ownership information available, the time between reviews, and the links that are difficult to spot across separate records,” said Shah.
Shah went on to say that the central challenge is beneficial ownership. This includes identifying the natural person who ultimately owns or controls a company. “In practice, that person may sit behind layers of holding companies, nominee shareholders, trusts or foundations spread across several jurisdictions. Each layer may be lawful in itself, but together they can make the ownership chain difficult to follow.”
Cross-border structures make this harder for two reasons. First, jurisdictions can apply different rules for identifying and disclosing beneficial owners, including ownership thresholds, indirect holdings and the treatment of trusts or similar vehicles. As a result, Shah details, information disclosed in one market may not be available or may be captured differently in another.
Secondly, the Sherlocq CEO quips, the quality and accessibility of ownership information vary. Registers, filing requirements and access arrangements differ, and information may be incomplete or out of date. Firms therefore have to piece together a picture from sources with different levels of reliability and under different rules.
He added, “The practical consequence is that a firm may complete the checks required in each jurisdiction and still lack a clear group-wide view of who it is dealing with. Completing the process is not the same as resolving the ownership question. That gap between procedural completion and genuine understanding is a central blind spot.
A firm can satisfy every local rule and still not know who it is ultimately doing business with. Procedural completeness is not the same as knowing.”
RelyComply, meanwhile, said that knowing who you do business with used to mean checking a company registration number. However, in a more connected financial world, that’s no longer enough.
The firm said, “Criminal networks exploit complex corporate structures, cross-border ownership and fast-changing business relationships to hide what they’re doing. Closing those gaps takes a smarter approach to KYB verification. RegTech powered by AI and advanced data analysis, offers a way forward.
Moving beyond point-in-time
How can firms move beyond point-in-time KYB checks to identify changes in ownership, control and business risk?
For Shah, the second blind spot to watch out for is time, stating that KYB checks are often most intensive at onboarding, with subsequent reviews scheduled at set intervals.
He said, “But ownership and control can change in between. Shares may change hands, directors may be replaced, or a business may be acquired. A customer assessed as lower risk at onboarding can therefore present a different risk profile before the next review particularly if the change does not trigger a fresh assessment.”
While periodic reviews remain important, a calendar alone cannot capture every material change.
“An ownership change, new adverse media or a sanctions designation affecting a connected party may warrant attention as soon as it is identified, rather than at the next scheduled review. The practical challenge is building a process that can detect relevant events, assess their significance and route them for timely review,” said Shah.
This is a change in operating model as much as a technology choice. The customer profile, Shah said, needs to be treated as information that can become outdated, not as a record that remains reliable because it was accurate on the day it was filed. Firms need clear triggers, ownership of follow-up and a way to document how new information affects the risk assessment.
For RelyComply, traditional Know Your Business (KYB) checks leave significant blind spots because they can struggle to establish a complete picture of corporate ownership, particularly when businesses operate across multiple jurisdictions. Fragmented registries, inconsistent corporate records and complex ownership structures make it difficult for compliance teams to identify the individuals ultimately controlling an entity.
Modern RegTech can help address this by bringing together information from company registries, corporate documents and other trusted data sources. AI-powered data extraction converts complex documents into structured information, while entity resolution identifies when different records refer to the same company or individual, even when names, spellings or company identifiers differ. As RelyComply explains, “compliance teams can map ownership chains, spot overlapping directorships and investigate relationships they might otherwise miss.”
This is particularly important for international businesses, where differences between jurisdictions can make manual verification slow and unreliable. Automated ownership analysis allows investigators to follow the chain of control through multiple corporate layers, while highlighting where further evidence is needed. However, technology should not replace professional judgement. “Uncertain matches and incomplete records still need proper investigation,” the company notes.
The other major weakness in traditional KYB is its reliance on point-in-time verification. A business may pass its initial checks, but subsequent ownership transfers, changes in directors, sanctions designations or adverse media can fundamentally alter its risk profile. As RelyComply points out, “if firms only reassess customers at fixed intervals, important changes can slip through between reviews.”
Continuous monitoring and event-triggered reviews offer a way forward. RegTech platforms can reassess corporate information and screen relevant parties against updated risk data, alerting compliance teams when a material change requires attention.
Combined with dynamic risk assessments, this allows firms to prioritise investigations according to the level of risk involved, rather than treating every business relationship in the same way. The shift is towards a more responsive approach to KYB, where verification becomes an ongoing process rather than a box-ticking exercise at onboarding.
Uncovering hidden relationships
Can AI and entity-resolution technology uncover hidden relationships between businesses, beneficial owners and financial crime networks?
According to Shah, this is where entity resolution and AI may help, although their roles should be distinguished.
He said, “The challenge is often not reading one document; it is connecting information across sources that were not designed to work together. The same person may appear under different name formats or transliterations in different records. A company may appear in filings that do not refer to one another. Entity resolution helps identify when records may relate to the same person or business and connect those records for further assessment.”
If such tools are used well, these tools can help surface links that a single check may miss. For example, a shared director or address across apparently unrelated companies, a connection to an entity already flagged for review, or an ownership chain that leads to a sanctioned person.
“These links can give investigators a clearer starting point, but they need to be assessed in context; a shared address or name, on its own, does not establish wrongdoing,” explained Shah.
He went on, “Two limitations matter. First, these techniques depend on the quality and coverage of the underlying data. If ownership records are missing, outdated or inaccurate, a model cannot reliably fill the gaps by itself. Second, a detected connection is a lead, not a conclusion. Investigators still need to determine whether the relationship is meaningful, whether the information is current and what action if any is justified. The value of the technology is in helping teams find and organise relevant information, not replacing their judgment.”
In the view of RelyComply, AI and entity resolution can reveal connections between businesses, beneficial owners, politically exposed persons and sanctioned individuals. Add network analysis, and investigators can spot shared ownership, recurring intermediaries and potentially suspicious relationships across multiple entities.
The firm said, “The aim isn’t to generate more alerts. It’s to connect the right information, cut unnecessary false positives and give analysts the context they need to make informed decisions. Getting this right still depends on reliable data, explainable processes and human oversight.”
What closing the blind spots requires
Taken together, these challenges point to three practical shifts, believes Shah.
He explains, “First, assess beneficial ownership across the full chain and across jurisdictions, rather than treating each local check as a complete answer. Second, define how material changes will be detected, reviewed and recorded between scheduled reviews. Third, use AI and entity resolution to connect relevant information while keeping human assessment, clear escalation paths and an audit trail at the centre of the process.”
However, none of this makes business verification simple. Shah said it can move KYB beyond a box ticked at onboarding towards an assessment that is revisited as ownership, relationships and risk change. “The objective is not to claim certainty where the data cannot support it; it is to make the limits of what is known clearer and to act when new information changes the picture.”
The ultimate challenge
For Chaitanya Sarda, CEO and co-founder of AiPrise, the biggest challenge in business verification is not establishing whether a company exists, but identifying who ultimately owns and controls it. This becomes particularly difficult when corporate structures span multiple jurisdictions, each with its own registries, reporting requirements and update schedules.
A merchant registered in Singapore, for example, might be owned by a Cayman Islands holding company and have a director based in London, leaving compliance teams to reconcile information across three separate jurisdictions.
“The discipline is to pull from every primary source available, treat a gap as a risk signal rather than a pass, and follow the ownership chain until you reach a natural person or can document why you cannot,” Sarda explains. While around three quarters of countries now have a live corporate registry, with others moving towards digitisation, greater data availability alone does not eliminate the challenge. Firms must be able to connect information across sources and identify where gaps in ownership transparency could conceal risk.
A second weakness lies in the timing of verification. Many Know Your Business (KYB) programmes remain heavily focused on initial onboarding, followed by periodic reviews that can leave firms unaware of significant changes in the interim. Ownership can change, directors can resign and previously legitimate businesses can be acquired by entities carrying greater risk. As Sarda argues, “Verification has to run on a continuous basis”, with changes in control, corporate status or risk identified as they occur and escalated to reviewers with the necessary context to act.
Artificial intelligence offers a way to address these challenges at scale by connecting information across hundreds of data sources, linking directors, addresses and filing agents to reveal relationships that a single registry search might miss. However, Sarda believes the quality of the underlying data must remain central to the equation. “The best data paired with the best AI is what wins here, and the AI must show its work.”
Complex corporate structures will still require human judgement, while compliance teams need decisions they can explain and defend to auditors, regulators and sponsor banks. Without that transparency, greater automation risks creating another blind spot rather than closing the existing ones.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
