Know Your Customer in International Trade Explained

Table of Contents

Know your customer in international trade means proving who your counterparty is, who owns and controls it, what it will do with the goods, and where those goods finally come to rest. The phrase was borrowed from banking. The trade version asks more questions, because an exporter can break export control law on a deal where the money is entirely clean.

A bank builds a customer file to answer one question. Is this money what the customer says it is. An exporter builds a file to answer that, plus three others. What are the goods. Who ends up using them. Does the shipment need a licence.

Most of the confusion in this area comes from one mistake. Firms run a bank-shaped process against a trade-shaped risk, then wonder why an order to a plausible-looking buyer turns into an enforcement problem two years later.

Where the term came from, and why trade needed its own version

KYC began as banking supervision. The United States built the early architecture through the Bank Secrecy Act, then sharpened it after 2001 with the USA PATRIOT Act. Section 326 of that Act produced the Customer Identification Program rule, which forces a bank to collect and verify a defined set of identifying data before opening an account. FinCEN later added a customer due diligence rule requiring banks to identify beneficial owners behind legal entity customers, using a 25 percent equity threshold plus a single control person.

Europe went the same way through a series of anti-money laundering directives, transposed into national law by member states. The Financial Action Task Force sits above both systems. Its 40 Recommendations are the reference text national regulators keep pointing back to, and the reason a KYC file in Singapore looks broadly like one in Germany.

None of that was written for exporters. It was written for deposit-taking institutions. The trade world adopted the language anyway, for a practical reason: export control and sanctions regimes impose duties on the shipper, not only on the shipper’s bank. The US Export Administration Regulations contain explicit know your customer guidance and a list of red flag indicators exporters are expected to watch for.

So trade KYC is a hybrid. It inherits identity and ownership work from AML. It adds goods, end use, end user and destination from export control. Our overview of what trade compliance covers sets out where customer diligence sits among the other controls.

What sits inside a trade KYC file

Think of the file as four blocks. Each block has its own evidence, its own owner and its own failure mode.

Block one: legal identity

The exact registered name, the registration number, the registered address, the country of incorporation and the date of incorporation. The evidence is a registry extract or a certificate of incorporation, not a line on a purchase order. Trading names go in a separate field. Trading under one name and registering under another is normal. Never establishing the registered name is a gap.

Block two: ownership and control

Shareholders, percentages, intermediate holding companies, and the natural persons at the top. Also the directors, and whoever actually signs. Control and ownership differ. A minority shareholder with a veto or a board appointment right controls the company in a way a 30 percent passive holder does not. Record both.

Block three: goods and end use

This block does not exist in a bank file. You need the product description, the classification under the relevant control list, the stated end use in the customer’s own words, and the identity of the ultimate consignee if that differs from your buyer. US exporters will recognise the Statement by Ultimate Consignee and Purchaser, BIS Form BIS-711, as one formal way to capture this. End user statements from the customer’s letterhead do similar work in other jurisdictions.

Block four: the physical route

Ship-to address, country of ultimate destination, any transhipment point, the forwarder, the carrier and the notify party. A route that passes through a known diversion hub, or a ship-to address in a country nobody mentioned during negotiation, is information you only have because you captured it. The table below shows how the four blocks compare with what a bank would hold.

Question the file must answer	Bank KYC	Trade KYC	Usual evidence in a trade file
Who is the legal entity?	Yes	Yes	Registry extract or certificate of incorporation
Who owns and controls it?	Yes	Yes	Register of members, ownership chart, signed owner declaration
Is any party on a restricted list?	Yes	Yes	Dated screening record naming the lists and versions used
Where does the money come from?	Yes	Sometimes	Bank reference, filed accounts, trade credit report
What are the goods, technically?	No	Yes	Specification sheet and a written classification decision
Who is the end user and what is the end use?	No	Yes	End user statement, ultimate consignee details, order narrative
Where do the goods physically travel?	Rarely	Yes	Ship-to address, routing, forwarder and notify party records
Is a licence required?	No	Yes	Licence determination note, or the licence itself

Who owns the file inside a trading company

This is where most programmes quietly break. Sales meets the customer first, so sales collects the information. Sales is also paid on closed orders. Asking the same person to gather the evidence and to judge it creates a conflict you can predict in advance.

A workable split looks like this.

Sales collects. They request documents, chase the customer and fill the intake form. They do not decide.
Compliance assesses. They read the evidence, run the list checks, set the risk tier and record the reasoning.
Finance verifies payment identity. Bank account name against legal entity name, and any third party payer explained in writing.
Logistics confirms the route at booking, and flags any change of ship-to address or consignee against what the file says.
A named approver signs off elevated and high risk customers. One person, identified in the policy, not a committee that never meets.

In a company of ten people, three of those roles may be the same person. That is acceptable if the policy says so and the record shows which hat was worn at each step. What is not acceptable is nobody owning the decision.

The parties you never contract with

Bank KYC stops at the account holder. Trade KYC cannot, because a single shipment can involve eight or nine named parties and export control rules attach to several of them. On a normal export you will see the purchaser, the intermediate consignee, the ultimate consignee, the end user, the freight forwarder, the carrier, the notify party, the destination customs broker and the paying bank. You have a contract with perhaps two of them.

The practical rule is simple. Any party named on the transport document, the invoice or the customer’s instructions goes into the screening run. That includes the notify party, which is often skipped because it feels administrative. It is frequently the most informative name on the document, since it tells you who is waiting for the cargo.

Screening is one step inside KYC, not a replacement for it

A clean list result tells you that the names you submitted are not on the lists you checked, on the day you checked. That is useful and it is narrow. It says nothing about whether the buyer exists, whether the address is a mailbox, or whether the end use statement is honest.

Run the check properly and it becomes a real control. Screen the full legal name and any known aliases, screen the owners and the directors, screen the addresses, and screen again at booking. You can run a denied party screening check on every named party before you quote, and repeat it before the goods move. Keep the output. A screenshot with a date beats a memory of a clear result.

Where a hit is obviously the wrong person, resolve it and write down why. Date of birth, registration number, country and address are the identifiers that make a dismissal defensible later.

Ownership, control and the aggregation trap

Screening a company name is not enough when the company itself is clean but its owners are not. US sanctions apply an ownership rule under which an entity owned 50 percent or more, directly or indirectly, in the aggregate, by one or more blocked persons is treated as blocked itself. The entity does not have to appear on any list for the prohibition to bite.

Aggregate is the word that catches people out. Two designated persons holding 30 percent each get you to 60 percent between them. Neither holding alone reaches the threshold. Our explainer on the 50 percent rule works through how this stacks across layers of holding companies.

Control matters separately. Some regimes reach entities that a designated person controls even below the ownership threshold. If your customer’s board contains a person you cannot identify, treat that as an open item, not a formality.

When the file gets refreshed

A KYC file is a snapshot and it ages. Two mechanisms keep it current, and you need both. The first is a periodic cycle set by risk tier. High risk customers get reviewed most often, low risk least often. The second is event driven, and it is the one that catches real problems. Refresh out of cycle when any of the following happens.

The customer changes its registered name, its ownership or its directors.
A new ship-to address, consignee or forwarder appears on an order.
The order pattern changes sharply in volume, value or product mix.
The buyer asks to pay from a third party account or from a different country.
The destination country’s status changes under a sanctions or export control programme.
A screening run produces a hit that was not there before.

List membership changes without warning, which is why screening frequency is a separate question from review frequency. Our guidance on how often to screen suppliers and customers sets out sensible intervals for each.

Evidence that survives an audit

An auditor will not ask whether you have a policy. They will pick three customer files and follow each one from first contact to last shipment. What they look for is boring and specific.

Dates. When was the document collected, when was the check run, when was the decision made.
Named people. Who assessed, who approved, who overrode.
Reasoning. One or two sentences explaining the risk tier, in plain language.
Source. Where each document came from, and whether it was obtained from the customer or from an independent register.
Consistency. The name on the invoice matches the name in the file, and the ship-to matches the destination on the export declaration.

Retention periods vary by jurisdiction and by the rule that applies. Export records and customs records often have their own periods, separate from AML retention. Keep the longest applicable period and store the file so it can be produced quickly. Advice on record keeping for screening covers the format and retrieval expectations that tend to cause problems.

The warning signs a trade KYC file is meant to surface

Identity work has a point. It exists so the odd detail has somewhere to land. A buyer who cannot describe what the product does, who declines installation or servicing on complex equipment, or who asks for unusual routing, is showing you something. None of these is proof. Each one should move the file up a tier, trigger a written question to the customer, and send you back to the free denied party screening tool to re-check every name on the order.

The catalogue of sanctions evasion red flags lists the patterns that recur most often in diversion cases. Read it alongside your intake form and you will see which fields you are missing. If you are starting from nothing, check the parties you already deal with. Globalior’s free screening tool tests a name against the main published lists without an account, which is enough to tell you whether your existing book has an obvious problem in it.

Key takeaways

Trade KYC covers identity, ownership, goods, end use and route. Bank KYC covers only the first two in any depth.
Export control and sanctions duties fall on the exporter directly, so a bank clearing the payment does not discharge your obligation.
Screening is one control inside KYC. A clean list result does not verify that the buyer or the stated end use is genuine.
US sanctions treat an entity as blocked when designated persons own 50 percent or more of it in aggregate, even if the entity is not itself listed.
Every named party on the transport and commercial documents belongs in the screening run, including the notify party and the intermediate consignee.
Collection and assessment should sit with different people, because the person paid on the order should not be the person judging the evidence.
Files need both a periodic review cycle and an event driven trigger list, since ownership and list membership change between reviews.

Frequently asked questions

Is KYC a legal requirement for exporters, or just good practice?

It depends on which duty you mean. The formal KYC rules written for banks generally do not apply to a manufacturer or trader. The export control and sanctions duties do apply, and they require you to know your customer, the end user and the end use well enough to avoid a prohibited transaction. In practice that produces a KYC obligation with a different legal source and a similar shape.

What is the difference between KYC and denied party screening?

Screening compares names against published restriction lists. KYC is the wider file that establishes identity, ownership, business rationale, end use and destination. Screening is one step inside KYC, usually run several times across the life of a customer relationship. You can pass screening and still fail KYC, for example when the buyer is real but the stated end use is implausible.

Do I need KYC on a customer that only buys uncontrolled goods?

Yes, at a reduced level. Sanctions restrictions attach to persons and to destinations, not only to controlled items. Selling an unlisted commodity to a designated party is still prohibited. For low risk uncontrolled sales the file can be thin, but identity, ownership and a screening record should always be present.

How far down the chain do I have to look?

You are expected to identify the ultimate consignee and the end user, and to act on information suggesting the goods will move beyond them. You are not expected to audit every downstream buyer of a distributor. The duty is driven by knowledge and by warning signs. Once you have reason to suspect diversion, the duty to investigate becomes concrete.

Can KYC be outsourced to a broker or forwarder?

Tasks can be outsourced. Liability stays with you. A forwarder can screen parties and collect documents under contract, but the exporter remains responsible for the decision to ship. If you use a provider, keep copies of their output in your own file and test a sample of their work each year.

If you want a second opinion on how your customer files are built, or help setting the tiers and triggers, get in touch with the Globalior team and we will look at what you have.