KYC, KYB, AML and supplier verification: which checks does your business actually need?

Most businesses meet these terms in the wrong order. A client asks for KYC, a bank asks about KYB, an auditor asks what AML screening was run, and a colleague in procurement asks who verified the supplier. By the time anybody sits down to choose, the words have arrived as a list of things to buy rather than as answers to different questions.

They are not interchangeable, and that is the useful thing to know. Each one establishes a different fact about a different kind of party, and the combination your business needs follows from the relationship in front of you rather than from the term you happened to hear first.

See how UMNIII Verify combines the checks you choose into one request

---

Why the terms get confused

The confusion is not carelessness. It is built into how these things are described, and there are four reasons for it worth separating.

• They sit at different levels. KYC and KYB are names for a process you run on a party. Sanctions and PEP screening is a check that usually happens inside that process. Asking whether you need KYC or AML is a little like asking whether you need an interview or a reference: one of them normally contains the other.
• Two of them are about who, one is about what is reported, and one is about a transaction. Identity and company checks establish who you are dealing with. Screening reports what certain data sources say about a person. Supply verification asks whether a particular purchase makes commercial sense. Those are three different kinds of question and no single check answers more than one of them.
• Supplier verification is usually a workflow rather than one standalone check. It can combine company and identity checks, screening, supplier-specific evidence and questions about the commercial relationship or transaction. Presented in a list beside KYC, KYB and AML screening it looks like a fourth thing to choose between, which is why businesses ask which one to pick when the real answer is usually several of them, arranged for a particular kind of counterparty.
• Collecting a document is a method, not a check. Forms and document requests appear in the same list because they are sold alongside the rest, but they are the means of asking rather than a source of independent confirmation. More on that below, because it is where most of the misunderstanding lives.

---

What each one actually is

Plain definitions, written against what UMNIII Verify does today rather than against the general category.

• KYC is checking an individual, as part of onboarding you are running. In Verify that is a government-issued document checked for authenticity, matched against a live selfie, with liveness confirming a real person is present. It establishes that the person in front of you holds that document and is present. It says nothing about the company they sign for.
• KYB is checking the company, and the business information the records hold. A registry lookup where the information is available, returning details such as the legal name, registration number, company type, status, incorporation date, registered address and tax number. Officers, shareholders and beneficial owners come back where the jurisdiction and the available records provide them. Coverage varies by jurisdiction, so the ones that matter to you are worth confirming before you buy.
• AML screening is sanctions, watchlist and politically exposed person data. Verify screens the person and returns the possible matches with the match and source information available in the result. Two things follow from that and both matter: a possible match is a record that resembles the person you screened and needs review, not a finding about them; and a screening reflects what was returned on the day it ran, so it records what was checked rather than certifying that somebody is clear.
• Adverse-media screening is an additional search, available on the enhanced option. It covers news and media reporting associated with financial crime, including money laundering and embezzlement; violent crime; terrorism; narcotics and drug trafficking; fraud and deceptive practices; and regulatory violations. It is one input into enhanced due diligence, not proof that no adverse information exists.
• Ongoing monitoring is what keeps a screening from going stale. Add it to someone already screened and they are re-screened across a twelve-month term, your team can check the current position whenever you need it, it is priced per monitored person rather than as a platform-wide subscription, and it stops automatically when the paid term ends.
• UK residential records confirm an address, in the UK only. Verify can confirm a UK residential address against a records source as part of the same request. It is the only records check of its kind in the product today, which is worth knowing before you assume an equivalent exists for another country.
• Structured forms and document requests are how you ask for everything else. Ready-made question sets, your own custom forms, and forms published by the Verify community, plus document requests, all saved as reusable templates. This is where the licence, the board resolution, the ownership chart and the commercial explanation come from.

Supplier verification, and the UAE case in particular

Supplier verification is the same work aimed at a counterparty you buy from rather than a client you take on. Most of it is assembled from the checks above: the company, the people who sign for it, screening where your policy calls for it, and a set of questions the records cannot answer.

The UAE has a specific version of this. Federal Tax Authority Decision No. 13 of 2026 has applied since 1 October 2026, and it sets out documented verification expected of taxable businesses in relation to their suppliers and the supplies they receive, before input tax is deducted. The two halves are distinct and the distinction is the part people miss. Verification of the supplier is about who you are dealing with, and it applies when you first deal with them and again on continued dealings where that supplier has not been verified in the previous twelve months, which is a rolling window rather than a fixed annual date. Verification of the supply is about the transaction: whether there is a genuine commercial reason for it, whether the payment route can be explained, whether the price sits within a sensible range, and whether the goods or services fall within what the supplier is licensed to do.

In Verify the second half is form work rather than an automated check. Risk questions, commercial rationale and payment explanations are collected as structured answers against the same case as the supplier's own record. It is also worth being plain about the limits: Verify does not confirm a UAE trade licence, a UAE place of business or a supplier's banking arrangements for you, and it does not file or submit anything to the Federal Tax Authority or any other destination system on your behalf.

We have written about Decision No. 13 of 2026 in full, and there is more detail on how supplier verification works in UMNIII Verify.

Collecting a document is not the same as verifying it

This is the single most common misreading, and it is worth stating directly. Collecting and evidencing an item is not the same as validating it. A document you add to a request is stored and evidenced, not automatically validated.

A trade licence that arrives through a document request proves that somebody sent you a trade licence. Whether every statement inside it is accurate is a separate question, and answering it usually means going to the body that issued it. The same applies to a certificate, a bank letter, a board resolution or a reference. That is not an argument against collecting them, because the alternative is not collecting them. It is an argument against recording them as though the collecting had settled anything.

---

What an incomplete combination costs

Choosing badly rarely produces an obvious failure. It produces a set of smaller problems that are easy to live with individually and expensive together.

• Evidence gaps. The work was done and the proof of it was not kept, or was kept somewhere that does not connect it to the party it concerns. A file with a gap looks exactly like a complete one until somebody goes through it.
• Duplicated work. The same company checked twice because two colleagues used two methods, or a document collected again because nobody could find the first copy.
• Late discoveries. The awkward fact that turns up at signing rather than at intake, because the question that would have surfaced it was not on the list.
• Inconsistent onboarding. Two parties of the same type treated differently, and no record of why. The variation is usually accidental, which is harder to defend than a deliberate one.
• Unnecessary checks. Running everything on everybody is a real cost, in money and in the time of the person being asked. It also buries the cases that genuinely needed attention among the ones that did not.
• Missing checks. The mirror image, and the harder one to notice, because nothing in the file says what was never asked for.
• Operational delays. Each round trip to the counterparty adds days. The difference between asking for everything at once and discovering a sixth requirement a week later is usually the whole of the delay.

None of this means a business that picks the right combination is compliant. Choosing well makes the work consistent and the record defensible, which is a narrower claim and a more useful one. What your obligations are, and what discharges them, is a question for your own adviser.

---

A simple way to decide

Four questions, in this order. The combination falls out of the answers rather than being chosen directly.

• What is the relationship? An individual, a company, a company and the people behind it, or a supplier and the transactions you will run with them. This decides which party you are checking, which is the question most often skipped.
• What do you need to know before you proceed? Write it as facts rather than as products. "That the person signing is a director of the company" is a fact. "KYB" is a product that may or may not answer it in the jurisdiction you care about.
• What is the risk? Risk helps determine which checks are proportionate and how far the follow-up should go, subject to any legal and policy minimums that apply. It may move you from standard screening to the enhanced option, or support monitoring a relationship for twelve months rather than screening it once.
• What obligations apply to you? Sector, jurisdiction and your own written policy. This is the question to take to a qualified adviser rather than to a product page, including this one.

Against those answers, here is what each check does and does not establish.

Read down the third column rather than the second. The second tells you what you are buying; the third tells you what is still your firm's work afterwards, and that is the column that decides whether a combination is actually complete.

---

How UMNIII Verify helps

Verify's contribution is that the combination is a single decision taken once per party type, rather than several tools bought separately and joined up by hand afterwards.

• The checks you select, per request. Identity verification, AML screening, business verification and UK residential records, chosen for the party in front of you rather than applied to everyone. They run against the same request, so results arrive on one record rather than in separate tools and inboxes.
• The questions and documents in the same request. Ready-made question sets, your own custom forms, and forms published by the Verify community, plus document requests, all saved as reusable templates. The things no check can answer travel with the things a check can.
• One list per type of party. Composed once as a template, so two counterparties of the same kind get the same request and a variation is a decision rather than an accident.
• The record stays together. Work lives in a shared Workspace with members, roles and shared credits, so the request, its responses, its documents and its results are one case with one history.
• One file at the end. One branded evidence pack per request, carrying the request history, the results and the available evidence, with individual documents, form-response PDFs and AML reports available separately.

What it does not do is choose for you. Verify supports your firm's process and evidences it: it does not decide which checks your obligations require, it does not tell you whether to accept a client or a supplier, and it does not replace professional judgement or legal and compliance advice. Nor does running the right combination make a business compliant. It makes the work consistent and the record complete, which is a different and more modest claim.

Where a check cannot confirm something, Verify is still where you request it, hold the response and keep it with the rest of the case, so nobody has to work out later which part was verified and which part was simply supplied.

---

Where to start

Take the party type you onboard most often and write two lists side by side: the facts you need to establish before proceeding, and the checks and questions you currently run. Most firms find a few items on the first list that nothing on the second actually answers, and one or two on the second that answer nothing on the first. That gap, in both directions, is the work.

See how UMNIII Verify handles structured requests, or read more on KYB and company verification and AML and adverse-media screening.

For the operational side of the same problem, we have written about why email and messaging threads cannot hold a verification workflow.

---

This article is general information about verification terminology and process. It is not legal, tax or compliance advice, it is not a statement of what any particular business is required to do, and nothing in it says that any one combination of checks satisfies an obligation. Which checks apply to your firm depends on your sector, your jurisdiction and your own risk policy, and those should be confirmed with a qualified adviser.