Table of Contents
Know your customer checks the party you sell to. Know your supplier checks the party you buy from. The method is the same. The risks are not. KYC asks whether your buyer is real, who controls them, whether they can pay, and what they will do with the goods. KYS asks whether your vendor exists, whether it can deliver, and what sits behind it in the supply chain.
Most companies run one of these properly and the other badly. Sales pushes customers through onboarding because revenue depends on it. Procurement often opens a vendor account on a phone call and a bank detail form. That gap is where the losses happen.
Both checks use the same building blocks: identity, ownership, sanctions screening, a risk rating, a review date. The evidence you collect differs, the legal exposure differs, and the people who own each file sit in different departments.
What know your customer covers
KYC started in banking. A bank identifies the account holder, understands the purpose of the relationship, then monitors activity against that understanding. The Financial Action Task Force recommendations pushed customer due diligence into national law across most trading jurisdictions. Trading companies inherited a version of it. When you sell goods across a border, your customer file has to answer four questions.
- Who is this legal entity, and does the registry confirm it?
- Who owns and controls it, down to the natural persons?
- Is the entity or any owner on a restricted list, and does any sanctions nexus apply?
- Where are the goods going and what will they be used for?
That fourth question is the one banks do not ask and exporters must. A bank cares about the money. An exporter also has to care about the item, the destination and the end use, because export control law attaches liability to all three. That makes trade KYC wider than banking KYC, even though it borrowed the name.
The commercial layer sits on top. Credit limit, payment terms, trade references. Compliance and credit are separate assessments, and a customer can pass one and fail the other.
What know your supplier covers
Know your supplier, sometimes written KYS, points the same discipline at your inbound side. Vendors, contract manufacturers, component suppliers, raw material traders, logistics providers you pay.
The core questions change shape:
- Is the supplier a real operating business with the capacity it claims, or a broker sitting in front of someone else?
- Who owns it, and does any owner create a sanctions problem for your payments?
- Where do the goods and inputs actually originate?
- What are the labour conditions at the production site?
- Is the supplier financially able to keep delivering for the life of the contract?
Two of those have no equivalent on the customer side. Origin and labour conditions only exist as risks when you are buying. They are also the two that generate the most painful outcomes, because a detained shipment at the border costs you the goods, the freight and the delivery date all at once.
The differences side by side
The table below is the short version. Each row is a genuine point of divergence, not a restatement.
| Dimension | Know your customer | Know your supplier |
|---|---|---|
| Core question | Who are we selling to and what happens to the goods after delivery? | Who are we buying from and where did the goods really come from? |
| Direction of money | Money flows in. Credit risk is yours. | Money flows out. Payment fraud risk is yours. |
| Primary legal exposure | Sanctions, export controls, end use and diversion | Customs declarations, origin claims, forced labour import bans |
| Evidence unique to this side | End user statement, purchase order rationale, technical specification of the item | Factory audit, origin declaration, bill of materials, labour policy |
| Screening scope | Buyer, consignee, end user, freight forwarder, bank | Vendor, its parent, its subcontractors, its bank |
| Typical trigger for review | New destination, new item class, order size jump, change of consignee | New production site, change of bank details, ownership change, price collapse |
| Usual owner in the business | Sales operations with compliance sign off | Procurement with compliance and quality sign off |
| What failure looks like | Goods reach a prohibited end user. Enforcement action follows. | Shipment detained at import. Payment sent to a fraudster. |
Documents you collect on each side
Common to both
Certificate of incorporation or the registry extract. Registered address and trading address. Company registration number, checked against the registry rather than copied from a letterhead. Ownership chart with named beneficial owners. Identification for the people who sign. Tax or VAT number where the jurisdiction issues one.
Customer side only
An end use and end user statement for controlled items. A description of the customer’s own business that explains why they need this product. Resale or re-export intentions, in writing. Consignee and delivery address where they differ from the buyer. Bank details for incoming payment, checked against the buyer’s own jurisdiction rather than a third country.
Supplier side only
Production site address and ownership of that site. Bill of materials or input list for the goods you buy. Origin declaration and the supporting evidence behind it, which matters if you intend to claim preference under a trade agreement. Labour and recruitment policy, plus the name of any labour agent used. Quality certifications. Subcontractor list, because the party you contract with is often not the party that makes the product. Understanding how origin is determined under the applicable rules is what turns a supplier declaration into something you can defend at an audit.
Keep both files under the same retention rule. Customs and export authorities expect to see the record that supported a decision, not a memory of it. The same discipline you apply to record keeping for screening results should cover the whole due diligence file, including the version of a document you relied on and the date you checked it.
Risks that sit only on the supplier side
Forced labour and the burden of proof
Several importing jurisdictions now block goods made with forced labour, and the practical effect is a shift in who has to prove what. Customs does not have to show the goods are tainted. The importer has to show a traceable chain back to the raw input. That means purchase orders, production records, payroll records and transport documents from tiers you may never have contracted with.
No customer-side check produces anything like that evidence burden. If you buy cotton, polysilicon, seafood or minerals from a region under scrutiny, traceability has to be built into the supplier file from day one. Collecting it after a detention is close to impossible.
Origin fraud and transshipment
A supplier can relabel goods, ship them through a third country and sell them to you as locally produced. You declare that origin to customs. You carry the liability for the false declaration, not the supplier. Watch for a supplier whose stated capacity does not match your order volume, or one whose invoice origin differs from the mill or factory certificates behind it.
Payment diversion fraud
This is the quiet one. Someone compromises an email account and sends a bank detail change on what looks like supplier letterhead. Finance pays. The money is gone. The control is simple. Verify bank changes by voice call to a number already on file, never a number in the request, and record the verification against the vendor master.
Risks that sit only on the customer side
Diversion and end use
Your buyer may be clean and the ultimate recipient may not be. Diversion happens through resellers, freight forwarders and transshipment hubs. The buyer who asks you to ship to an address in a different country from the one on the purchase order is telling you something. So is the buyer who declines installation support, pays a premium above market, or refuses to name the end user. Learning to read the red flags of sanctions evasion is a customer-side skill, and the same patterns rarely show up in procurement.
Technology transfer without a shipment
Sharing controlled technical data with a foreign national can itself be a controlled export in some regimes, even when nothing crosses a border. That includes a design file sent to a customer’s engineer, or access to a server. A deemed export can happen during a pre-sales technical discussion, before any contract exists. Procurement almost never faces this.
Credit and the order pattern
A new customer whose first order is unusually large, who accepts your price without negotiation and wants fast shipment is a credit risk and a compliance risk at once. Treat that pattern as one signal reviewed by two teams.
Where the two checks overlap
Sanctions screening is the shared engine. The same restricted party lists apply to a vendor and a buyer. You cannot pay a designated supplier any more than you can sell to a designated customer, and in most regimes the prohibition on dealing covers both directions of value.
Ownership analysis is shared too. Designation reaches through corporate structures, and several regimes treat an entity as blocked when designated persons hold ownership above a set proportion, whether directly or in aggregate. The 50 percent rule applies to the supplier you pay exactly as it applies to the customer you invoice. A name check alone will miss it.
Practically, that means one screening process feeding two workflows. You can run a denied party screening check on a vendor, a buyer, a bank and a forwarder using the same list set and the same match rules. What differs afterwards is who reviews the hit and what evidence resolves it.
Triggers, review cycles and who signs
Point in time checks fail because lists move and companies change hands. Both sides need a periodic cycle and an event driven one.
- Rescreen every counterparty when the underlying lists update, not on a calendar alone.
- Re-run supplier diligence on a change of ownership, a change of production site, or a bank detail change.
- Re-run customer diligence on a new destination country, a new product class, a change of consignee, or a sudden jump in order value.
- Set a fixed review date by risk tier, with the highest tier reviewed most often.
Guidance on how often to screen suppliers and customers is worth reading before you set the cycle, because picking an interval without a rationale is the finding an auditor writes up first.
On sign off, keep the approver separate from the person with the commercial incentive. A salesperson should not approve their own customer. A buyer should not approve their own vendor.
Running both under one framework
One policy, two annexes. The policy sets the risk tiers, the escalation path, the retention period and the screening standard. Annex A lists the customer evidence by tier. Annex B lists the supplier evidence by tier. Both reference the same screening step and the same records rule.
Use one counterparty record per legal entity, flagged with the roles it plays. Companies that are both customer and supplier are common, and holding two disconnected files for the same entity produces contradictory risk ratings. Rate the entity once. Apply the role specific evidence on top.
Small teams can start with Globalior’s free screening tool and a shared spreadsheet, then move to a system once volume justifies it. The order matters. Write the decision rules first. Buy software to execute rules you already have, not to invent them for you.
If you want a second opinion on how your customer and supplier files are structured, get in touch with the Globalior team and we will walk through it with you.
Key takeaways
- KYC examines the party you sell to; KYS examines the party you buy from, and the evidence required differs even though the method is shared.
- Origin evidence, labour conditions and traceability are supplier-side requirements with no customer-side equivalent.
- End use, diversion and controlled technology transfer are customer-side requirements that rarely appear in procurement.
- Sanctions screening and beneficial ownership analysis apply identically in both directions, because paying a designated party is prohibited just as selling to one is.
- Bank detail changes on the supplier side should be verified by voice call to a number already held on file, and the verification recorded.
- Both files need event driven triggers as well as a periodic review date, with the trigger list written into the policy.
- One risk rating per legal entity, with role specific evidence layered on top, avoids contradictory decisions for counterparties that both buy and sell.
Frequently asked questions
Is know your supplier a legal requirement?
There is usually no single law called know your supplier. The obligation arrives indirectly. Sanctions law prohibits dealing with designated parties in either direction. Customs law makes the importer responsible for the accuracy of origin and valuation. Forced labour import rules place the evidential burden on the importer. Together those produce a supplier diligence duty, even without a statute using that name.
Is KYS the same as KYB?
No. Know your business is the identity and ownership verification step applied to any corporate counterparty. Know your supplier uses that verification as its foundation and adds supply chain specific checks: production capacity, origin, labour practices, subcontractors and financial ability to keep delivering. KYB answers whether the company is real. KYS answers whether you should buy from it.
Do I need to screen suppliers against sanctions lists if I never export?
Yes. Sanctions prohibitions generally cover any dealing with a designated person, including sending them money. A purely domestic importer still pays foreign vendors, and a payment to a blocked party is a violation regardless of whether goods leave the country. The free denied party screening tool covers vendor names as readily as customer names.
Who should own supplier due diligence, procurement or compliance?
Procurement collects and maintains the file because it owns the relationship. Compliance sets the standard, reviews the screening hits and approves high risk vendors. Splitting it that way keeps the person negotiating price out of the approval decision. In very small teams where one person does both, have a director countersign vendors above a defined risk tier.
How far down the supply chain do I have to look?
As far as your risk justifies. For a low risk commodity from a stable jurisdiction, the direct supplier is usually enough. For goods where forced labour or origin fraud is a known issue, you need visibility to the production site and often to the raw input. Ask for the subcontractor list at onboarding. Suppliers who refuse are telling you where to look.
Can one system handle both customer and supplier KYC?
The screening and identity layer can be shared, and should be. The evidence checklists, the questionnaires and the review workflows need to stay separate, because a supplier questionnaire that asks about end use is wasted and a customer questionnaire that asks about labour agents is wasted. Shared engine, separate forms.