KYC and KYB under AML6: what changes at onboarding

In short: AML6 (the 2024 AML package, driven by the AMLR regulation) harmonises Know Your Customer (KYC) and Know Your Business (KYB) obligations across the entire European Union. It becomes applicable on 10 July 2027. In practice, onboarding is no longer just an identity check at the start of the relationship: it becomes a continuous, risk-based process that reaches all the way to beneficial owners and leaves a complete audit trail. To meet this requirement without driving customers away, automation becomes unavoidable.

‍

What KYC and KYB mean

‍

KYC (Know Your Customer) refers to all obligations to know and verify a customer who is a natural person: identifying the person, verifying their identity against reliable sources and understanding the nature of the business relationship.

‍

KYB (Know Your Business) applies the same logic to a customer that is a legal entity: identifying the company, verifying its legal existence and situation, then reaching all the way up to the natural persons who genuinely control it.

‍

Under AML6, these two dimensions are no longer boxes to tick when opening an account. They form a due diligence foundation that the obliged entity must maintain throughout the relationship. To go further, read our complete KYC guide and our complete KYB guide.

‍

What AML6 strengthens

‍

The AMLR regulation clarifies and tightens due diligence obligations. Four requirements shape the new onboarding.

‍

Customer identity

‍

Identification and verification of identity remain the starting point. AML6 expects reliable and independent sources, consistent coverage across all member states and documented evidence quality. The identity check must withstand both document fraud and impersonation.

‍

Beneficial owners

‍

This is one of the most demanding aspects of KYB. The entity must identify beneficial owners, meaning the natural persons who own or control the company, at the threshold of 25% or more of ownership. You must trace the ownership chain up to the ultimate natural persons, including when holding companies are layered in between. Interconnected national registers (the BORIS system) make this cross-checking work easier at European scale. Our article on AML6 details the overall framework.

‍

Continuous verification

‍

The most profound change is the shift from a one-off check to continuous verification. Verifying a customer at the start of the relationship is no longer enough: information must be updated according to the level of risk, throughout the relationship. A change in shareholding, a new address, an entry on a sanctions list or a change in activity must trigger a reassessment.

‍

Traceability

‍

AML6 requires rigorous documentation and a usable audit trail. Every due diligence decision must be justifiable: which data was collected, which checks were carried out, on which criteria the relationship was accepted, refused or monitored. It is this traceability that authorities, including the future AMLA, will examine in the event of an inspection.

‍

The risk-based approach

‍

AML6 confirms and strengthens the risk-based approach. Not all business relationships are equal: the level of due diligence must be proportionate to the risk each customer represents.

Enhanced due diligence applies in particular to high-risk customers, to politically exposed persons (PEPs) and their close associates, as well as to relationships involving high-risk countries. Conversely, a low-risk customer can be subject to simplified measures, which avoids needlessly weighing down the journey.

‍

Getting the balance right requires risk scoring capable of classifying files in real time, triggering additional checks only when necessary and tracing the decision logic.

‍

The challenge: compliance without friction

‍

The operational challenge is clear: reconciling compliance and customer experience. Multiplying supporting documents and control steps protects on paper, but drives conversion rates down. An onboarding process that is too heavy leads to abandonment, especially among legitimate customers, precisely the ones you want to keep.

‍

The answer is not to check less, but to check better: ask for the right document, at the right time, from the right customer. That is exactly what the risk-based approach enables when it is automated rather than manual.

‍

How to industrialise

‍

At scale, manual processing does not hold up: neither the turnaround times, nor the consistency of decisions, nor the traceability required by AML6. Automation is the only answer at scale. A few principles for industrialising onboarding:

• Verify identity automatically, with document fraud detection and data consistency checks.
• Automate KYB: verifying legal existence, company situation and tracing beneficial owners through registers, up to the natural persons. The company and manager trust score (KYB) synthesises these signals into a decision.
• Screen continuously against sanctions lists and PEP statuses, with automatic reassessment as the relationship evolves.
• Apply dynamic risk scoring that adjusts due diligence file by file.
• Keep a complete audit trail, timestamped and usable, ready for an AMLA inspection.

A process equipped this way returns a decision in seconds, while documenting every step.

‍

In conclusion

‍

AML6 turns KYC and KYB into a continuous, risk-based and fully traceable process, with systematic tracing all the way to beneficial owners. The 10 July 2027 deadline leaves little room to rethink processes that are still manual. The entities that get ahead will be those that have industrialised their onboarding: robust compliance, controlled friction and an audit that is always ready.

‍

Sources: European Union 2024 AML package (AMLR / AML6 regulation), regulation establishing AMLA, provisions on interconnected beneficial ownership registers (BORIS).

‍