The 15 questions to ask a KYC/KYB vendor before signing

In short: a KYC/KYB tender is won on the questions asked before signing, not on the brochure. Fifteen questions are enough to separate vendors, spread across six themes: data, fraud detection, compliance, AI, security and hosting, and the commercial model. For each, there is a good answer, and there are answers that should raise a red flag.

‍

Whether you are formalising a full RFP or simply preparing for a demo, this checklist turns a sales pitch into a verifiable commitment. It complements our guides on choosing a KYB solution and choosing a KYC solution, criterion by criterion.

‍

Data (questions 1 to 3)

‍

1. Which sources do you query on my main market, and with what historical depth? The good answer is precise: named official company registers (e.g. Companies House in the UK, the Handelsregister in Germany, France's Infogreffe), quantified historical depth (for example balance sheets compared against the full filing history on your market). Be wary if the answer is a number of countries.

‍

2. Is the data queried in real time or in batches? Company data that is three months old can hide a recent change of management, precisely the signal that matters.

‍

3. What happens when a source is unavailable? What you are looking for: controlled, flagged degradation, never a silently incomplete score.

‍

Fraud detection (questions 4 to 6)

‍

4. Show me your output on a reactivated shell company. The decisive test in KYB: balance sheets filed in bulk, a recent change of management, a mass registered address. A tool that rates it as a healthy company fails at the essential.

‍

5. Do you detect multiple applications across your clients, and do you pool confirmed fraud cases? The network effect is a major differentiator: a fraudster blocked at one player tries again elsewhere within the same month.

‍

6. What is your observed false positive rate on a portfolio comparable to mine? Demand a figure and a reference, not an adjective. Every good customer refused is lost revenue.

‍

Compliance (questions 7 and 8)

‍

7. How do you cover the requirements of the AMLD6 package, applicable in July 2027? Expect specifics: continuous identification of beneficial owners, sanctions and PEP screening, exportable audit trail. The timeline and obligations are detailed in our article on the AMLD6 regulation.

‍

8. If the regulator audits a two-year-old file, what can I produce? The good answer: the entire decision, including the data consulted, the model version, the reasons and the timestamp, in a few clicks.

‍

AI (questions 9 and 10)

‍

9. For this score, give me the exact list of signals that explain it. Explainable AI returns its reasons, decision by decision. A black box is indefensible in an audit as much as in front of the customer, and the AI Act makes it a requirement for scoring.

‍

10. Can the analyst override the score, and is that decision logged? The score guides, the human decides on ambiguous cases: this is both good operational practice and a regulatory expectation.

‍

Security and hosting (questions 11 and 12)

‍

11. Where is the data hosted and processed, and through which entities does it pass? For KYC/KYB data (personal data, directors, beneficial owners), hosting in the EU with no transfer outside the Union simplifies your GDPR compliance, and it is becoming a knockout criterion in most banking tenders.

‍

12. Which security certifications, and what incident history? ISO 27001 or equivalent, and a transparent answer about past incidents, is worth more than an unverifiable "zero incidents".

‍

The commercial model (questions 13 to 15)

‍

13. What exactly does a billed "verification" cover, and do you charge for failed checks? Scopes vary fourfold. Also check that re-reading a result from the history does not trigger a new billable analysis.

‍

14. What is your observed automation rate, and what volume will my analysts have to handle? The biggest cost item of a KYC/KYB solution is human: the automation rate drives the real cost, not the unit price.

‍

15. If I add IBAN verification or creditworthiness scoring tomorrow, how many additional contracts and integrations? The answer tells you everything about the architecture: a module to activate under the same contract, or a new six-month procurement project.

‍

How to read the answers

‍

Three cross-cutting warning signs: answers in numbers of countries rather than data depth, "market average" metrics never tied to a client reference, and the inability to run a demonstration on your own cases. Conversely, a vendor willing to test a shell company, a fake document and an ambiguous file live generally has nothing to hide.

‍

The fastest way to run through this checklist is still to put it to the test in real conditions: schedule a demo and bring your trickiest cases.

‍

FAQ

‍

What is an RFP for a KYC/KYB solution?

‍

An RFP (Request for Proposal) is a formalised tender: the company describes its identity and business verification needs, and vendors respond point by point. Even without a formal RFP, a structured question grid makes it possible to compare solutions objectively.

‍

How long should you allow to choose a KYC/KYB solution?

‍

Four to twelve weeks depending on governance: scoping the needs, demos on real cases, a technical test (POC) on a sample of files, compliance and security validation, negotiation. The POC on your own files is the step that separates vendors best.

‍

Should you test the solution before signing?

‍

Yes, systematically, and on your real cases: known fraudulent files, ambiguous cases, forged documents. A vendor that refuses a test in real conditions is a red flag in itself.