KYB: Onboarding Business Customers Under Regulation 28

When a company, partnership or other legal entity asks to become a client, the checks you run are often called "know your business", or KYB. That label is industry shorthand rather than a legal term. In the UK, the rules sit in regulation 28 of the Money Laundering Regulations 2017, which sets out what a firm must do when its customer is a body corporate. This guide walks through those requirements step by step, using the text of the regulation on legislation.gov.uk and the testing guidance in HMRC's Economic Crime Supervision Handbook (page ECSH33328, shown as updated on 20 October 2026).

It builds on our wider guides to customer due diligence and KYC and to ultimate beneficial ownership. It is general information, not legal advice, so check the current regulations and your supervisor's guidance for your own firm.

What regulation 28 covers

Regulation 28 applies when a firm has to apply customer due diligence under regulation 27. For a company customer, it asks you to do five things: identify and verify the company itself, understand who runs it, understand how it is owned and controlled, identify and verify its beneficial owners, and check that the person instructing you is allowed to act for it. The extent of each measure should reflect your risk assessment and the risk in the individual case (regulation 28(12)), and you must be able to show your supervisor that what you did was appropriate to the risk (regulation 28(16)).

Step 1: Identify and verify the company itself

Under regulation 28(3)(a) you must obtain and verify the company's name, its company or other registration number, and the address of its registered office. If its principal place of business is somewhere else, you must obtain and verify that address too. HMRC's handbook gives a useful warning about the evidence: a credit reference check might confirm the name, address and number, but it may not tell you who the directors or beneficial owners are. Check each required item against something, and keep a note of what you used.

Step 2: Understand the law, constitution and management

Regulation 28(3)(b) asks for reasonable measures to determine and verify three further things: the law the company is subject to, its constitution, and the full names of its board (or equivalent management body) and of the senior persons responsible for its operations. These measures do not apply to a company listed on a regulated market (regulation 28(5)). Where a customer relies on that exemption, HMRC says it looks for records showing the listing was confirmed at onboarding and at other points, because a company's status can change.

HMRC's page does not say you must verify the identity of every director. It does expect reasonable measures for the board and the senior people running operations, so a risk-based approach to how far you go is open to you, as long as you can explain it.

Step 3: Understand ownership and control

Where the customer is a legal person, trust, company, foundation or similar arrangement, regulation 28(3A) requires reasonable measures to understand its ownership and control structure. For complex or opaque structures, HMRC says it checks that the firm understood why the structure is used and what evidence supports that understanding, and that a structure diagram can help. If a client cannot explain a layered chain of companies in plain terms, that is itself a finding worth recording. Our guide to nominee directors, shell companies and complex structures covers the warning signs in more detail.

Step 4: Identify and verify the beneficial owners

Where the customer is owned or controlled by another person, regulation 28(4) requires you to identify the beneficial owner and take reasonable measures to verify that person's identity. If the owner is itself a legal entity or arrangement, you must also understand its ownership and control structure.

Two points matter in practice. First, relying only on information filed with a company registrar does not satisfy the requirement (regulation 28(9)). The register is a useful starting point, not the end of the check. Second, HMRC says it checks whether you assessed each person's ownership, voting or control rights against the definition in regulation 5, and whether the person actually exercises those rights in their own name or under the instruction or agreement of an undisclosed third party.

If you cannot identify the beneficial owner

Regulation 28(6) to (8) allows a fallback. Only if you have exhausted all possible means of identifying the beneficial owner, and have not found one or cannot confirm the person you identified, may you treat the senior person responsible for managing the body corporate as its beneficial owner. In that case you must keep written records of your efforts, take reasonable measures to verify the senior manager's identity, and record the steps taken and any difficulties.

HMRC's handbook adds that a firm may ask the customer for information under regulation 43, must keep written records of all steps, and that its inspectors check whether the firm went ahead with the work anyway and, if so, whether approval was sought and from whom. The fallback is not a shortcut. Treat it as a flag for senior review.

Step 5: Check who is instructing you

Regulation 28(10) requires you to verify that any person acting on the customer's behalf is authorised to do so, to identify that person, and to verify their identity using a reliable source independent of both that person and the customer. HMRC notes that where a firm has verified a lead contact rather than every senior person, it checks that the firm also verified the contact's authority.

Keeping the file current

The handbook also points to ongoing duties. Where a business relationship exists, HMRC says it checks that the firm reports beneficial ownership discrepancies as required by regulation 30A, and ongoing monitoring applies to existing and former relationships. Re-checking a client's ownership when something changes, such as a new shareholder, a change of control or a change in the type of work you do for them, is a sensible trigger. That is our suggestion rather than a requirement stated in the regulation.

Did the 2026 amendments change regulation 28?

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (S.I. 2026/621) were made on 9 June 2026. According to the text on legislation.gov.uk, the instrument does not amend regulation 28; it adds cross-references to it in a new regulation 30ZA. Other changes include a new rule for pooled accounts and replacing "high-risk third country" with "FATF call for action country". Because the consolidated text of the 2017 regulations may lag behind amendments, always check the current version before relying on a quotation.

A practical onboarding checklist (our suggestion)

The following is not a regulatory list. It is one way to organise the regulation 28 steps into a file that a supervisor could follow:

• Record the company name, number, registered office and principal place of business, and the evidence used for each.
• Record the governing law, constitution and the names of the board and senior operational managers.
• Save a structure chart showing every layer between the customer and the people at the top.
• Name each beneficial owner, the basis on which they qualify, and how you verified them.
• Note who instructs you, how you confirmed their authority, and how you verified their identity.
• Write down the risk rating and why the level of checking was proportionate.

If you want to build your knowledge of these controls in a structured way, Learnsignal's CPD courses include compliance topics for finance professionals.

Frequently asked questions

Is a Companies House search enough to onboard a company?

No. Regulation 28(9) says that relying solely on information filed with a company registrar does not satisfy the beneficial owner requirement. Use the register as one input and corroborate it.

Do I have to verify every director?

HMRC's handbook does not require verification of every director's identity, but it does require reasonable measures for the board and for the senior people responsible for operations. How far you go should follow your risk assessment.

What if the structure is too complicated to understand?

Regulation 28(3A) requires reasonable measures to understand the ownership and control structure. If you cannot do so, treat it as a risk indicator, escalate it, and record what you did and what you could not establish.