Table of Contents
The KYC documents required for corporate customers fall into four groups: proof the entity legally exists, proof of its registered and operating address, proof of who owns and controls it, and proof that the person signing on its behalf is authorised to do so. Every other document you collect hangs off one of those four.
The exact list changes with the entity type. A private limited company, a listed company, a partnership and a branch of a foreign parent all produce different paperwork, because different registries issue different things.
Most onboarding files stall for one reason. The document that arrived does not prove what the compliance team needed proved. A utility bill in a director’s name says nothing about where the company operates. A shareholder list typed into a Word file proves nothing at all.
What a corporate KYC file has to prove
Work backwards from the four claims before you ask for anything. Each document you request should close one of them.
- This legal person exists, under this exact name, in this country, and is in good standing.
- It can be reached and found at a real address, and someone is actually there.
- These named humans own it or control it, including through any companies sitting in between.
- This named human is allowed to bind the company to the contract you are about to sign.
A fifth claim applies once you trade: none of the parties sits on a restricted party list. That one is not a document. It is a check you run against the names the documents give you, and run again later.
The core document set every corporate customer provides
Proof the entity exists
Ask for the certificate of incorporation, then ask for something better: a current extract from the commercial register, dated within the last few months. The certificate proves the company was born. The extract proves it is still alive, still holds that name, and has not been struck off.
Collect the constitutional documents too. Depending on the country these are the memorandum and articles of association, the articles of incorporation and bylaws, the operating agreement, or the constitution. They tell you what the company may do and how decisions get made. Add the tax registration number and, where the activity is licensed, the trading or sector licence.
Proof of address
The registered office comes free with the register extract. Treat it with suspicion. In many jurisdictions the registered office is the corporate services agent’s address, shared with hundreds of other companies, and tells you nothing about where the business operates.
Collect the operating address separately, evidenced by something a third party issued: a signed lease, a utility bill in the company name, a bank statement header, or a property tax notice. If that address hosts a large number of other companies, note it and ask why.
Proof of signing authority
This is the group most often collected badly. You need a board resolution or mandate naming the authorised signatories and stating what they may sign for, plus identity and address evidence for each named person. If someone signs under a power of attorney, take the power of attorney itself and check it has not expired and covers the transaction type.
Specimen signatures matter more than people expect. Without one, you cannot tell later whether a signature on a contract amendment came from the authorised person or from someone else in the office.
KYC documents by entity type
The table below sets out what to ask for by entity type. Names of documents vary by country. Ask for the local equivalent rather than the exact title, and record which local document you accepted as the equivalent.
| Entity type | Existence and standing | Ownership and control | Authority to act |
|---|---|---|---|
| Private limited company | Certificate of incorporation, current register extract, articles, tax number | Shareholder register, share certificates, group structure chart, UBO declaration plus ID for each UBO | Board resolution, list of directors, ID and address proof for signatories, specimen signatures |
| Listed company | Register extract, exchange listing confirmation, latest annual report | Usually reduced. Identify substantial shareholders disclosed to the exchange and any controller above the local threshold | Board or committee authority, signatory list, ID for signatories |
| Partnership or LLP | Partnership registration certificate, partnership deed or LLP agreement, tax number | Full list of partners with capital and profit shares, ID for partners above the ownership threshold and for all managing partners | Partners’ resolution or the deed clause granting authority, specimen signatures |
| Sole trader | Business name registration, trade licence, tax number | Not applicable. The owner is the customer | Owner ID, proof of residential address, any employee mandate |
| Branch or representative office | Local branch registration plus the full document set for the foreign parent | Ownership traced through the parent, not the branch. Branch has no shareholders of its own | Parent board resolution appointing the branch manager, plus local mandate and manager ID |
| Trust or foundation | Trust deed or charter, registration where the country registers trusts, tax number | Settlor, trustees, protector, named beneficiaries and any class of beneficiaries, plus ID for each identified person | Trustee resolution, evidence the deed permits the transaction, trustee ID |
| Government body or state owned enterprise | Founding statute, decree or incorporation document, budget or ministry linkage | Identify the controlling ministry or agency and screen it. Treat senior officials as potential PEPs | Delegation of authority, procurement mandate, official ID for signatories |
Ownership and control documents in detail
Tracing ownership through layers
A shareholder register that names another company is not an answer. It is the first step of a chain. You keep pulling register extracts at each level until you reach a natural person, a listed company, or a government body.
Most frameworks use a 25 percent ownership threshold as the starting point for identifying a beneficial owner, and several countries apply a lower figure for higher risk sectors. Multiply the percentages down the chain. Someone holding 40 percent of a company that holds 60 percent of your customer holds 24 percent indirectly, which sits under the usual threshold but close enough to write down.
Ownership is only half of it. Control can exist with no shares at all, through a right to appoint directors, a golden share, a shareholders’ agreement, or a loan agreement that hands over veto rights. Ask for the shareholders’ agreement where one exists. It is the document that most often reveals who really decides things.
Sanctions ownership rules work differently from KYC ownership rules, and the difference catches people out. Aggregated ownership by sanctioned parties can taint an entity that is not itself listed. The mechanics of that sit in the 50 percent rule in sanctions screening, and your ownership chart is the input that makes the rule usable.
When ownership is opaque
Bearer shares, nominee shareholders and jurisdictions with no public register all produce the same problem. You cannot see through the structure with documents alone.
Options, in rough order of strength: a certificate from the registered agent or company secretary confirming the beneficial owners, a signed declaration from each nominee disclosing who they hold for, audited accounts with a related party note, a legal opinion from local counsel, and a bank reference from a regulated institution. Take more than one. Record which you accepted and why, because that judgement is what an auditor will test.
Document quality rules that decide whether a file passes
Certified copies, apostille and legalisation
A plain scan is acceptable for low risk customers in many programmes. Above that, you want a certified true copy: a notary, lawyer, accountant or regulated bank signs and dates the copy, states they have seen the original, and gives their own name and capacity.
For cross border files, an apostille under the Hague Apostille Convention authenticates the official who signed the document, and is accepted between countries party to that convention. Where one country is not a party, the route is consular legalisation, which sends the document through the foreign ministry and then the embassy. It is slower. Build it into the onboarding timeline.
Translation
A document in a language nobody on the team reads has not been verified, whatever the file says. Ask for a certified translation that carries the translator’s name, signature and a statement of accuracy, and keep the original alongside it. Names should be transliterated consistently, and the original script should be retained too, because that is what you feed into screening.
How recent a document must be
Set a rule per document type and apply it. Common practice is that register extracts, address evidence and ownership confirmations should be dated within the last three months, identity documents must be unexpired at the point of acceptance, and financial statements should be the most recent audited year with management accounts covering the gap. Your own regulator may set different periods. Write yours into the procedure so onboarding staff are not deciding case by case.
When the registry does not issue what you asked for
This happens constantly and it is not automatically a red flag. Some countries do not publish shareholder information. Some issue a single registration document and never a dated extract. Some have no concept of a certificate of good standing.
The fix is a documented substitution rule. Decide in advance what you will accept instead, record the substitution in the file, and note the residual gap. A file that says “no public shareholder register in this jurisdiction, relied on registered agent certificate dated 12 March, residual risk accepted by the compliance manager” is defensible. A file with a blank field is not.
Extra documents for higher risk corporate customers
Enhanced due diligence adds documents rather than repeating the same ones more loudly. The usual additions:
- Audited financial statements covering two or three years rather than the latest year alone.
- Evidence of source of funds for the transaction, and source of wealth for the beneficial owners where the amounts are large.
- Signed declarations on politically exposed person status for directors and UBOs.
- Copies of the underlying commercial contracts, so the stated business model can be checked against actual trade.
- End user statements and end use descriptions where the goods are controlled or dual use.
- An adverse media and litigation search, saved as a dated PDF rather than described in a note.
- A site visit report or a third party verification report where the customer sits in a higher risk country.
Turning the documents into screening inputs
Documents are raw material. The value appears when the names inside them get checked. Pull out and screen the registered legal name, all trading and former names, the original script version of the name, the registration number, both addresses, each director, each signatory, and each beneficial owner you identified.
Then screen the parties who never appear in the KYC pack but do appear on the shipment: the consignee, the notify party, the forwarder, the vessel and the ultimate end user. You can run a denied party screening check on each of those names in the same pass, and it costs nothing to include them.
Screening at onboarding is a snapshot. Lists change, and a customer cleared in January can be listed in June, so the names need rescreening on a schedule and whenever the file changes. The practical sequencing of that sits in sanctions screening in customer onboarding.
Keeping the documents, and refreshing them
Retention periods are set by the regulator that supervises you, and five years after the end of the relationship is a widely used figure across AML frameworks. Export control record keeping runs on its own clock and can be longer. Take the longest applicable period and use it for the whole file.
Keep more than the document. Keep who collected it, who reviewed it, the date, the version of the policy applied, and the screening result at the time. That metadata is what turns a folder of PDFs into an audit trail that survives an examination. The same expectations apply to screening evidence, covered in record keeping for denied party screening.
Refresh on a risk based cycle, and refresh immediately on a trigger: a change of ownership, a change of registered name or address, a new signatory, a move into a new market, or a screening hit. Triggers catch the changes that a periodic review would otherwise miss by months.
Key takeaways
- Corporate KYC documents prove four things: legal existence, address, ownership and control, and signing authority.
- A current register extract is stronger evidence than a certificate of incorporation, because it shows the company is still in good standing.
- The registered office is often a corporate agent’s address, so collect separate evidence of the operating address.
- Ownership is traced by multiplying percentages down the chain until you reach a natural person, a listed company or a state body.
- Control can exist without shares, through appointment rights, veto rights or a shareholders’ agreement.
- Where a registry does not issue a document, record the substitute you accepted and the residual gap rather than leaving the field blank.
- Every name pulled from the documents should be screened, including directors, signatories, beneficial owners and the shipment parties.
Frequently asked questions
What are the basic KYC documents required for corporate customers?
A certificate of incorporation or registration, a current extract from the company register, the constitutional documents, a tax registration number, evidence of the operating address, a shareholder register or ownership chart, identity and address documents for beneficial owners and directors, and a board resolution naming the authorised signatories with their identity documents attached.
Are scanned copies enough, or do documents need certifying?
It depends on the customer’s risk rating and your own policy. Plain scans are widely accepted for low risk domestic customers. For higher risk or cross border files, ask for certified true copies signed and dated by a notary, lawyer, accountant or regulated bank. Where documents come from another country, an apostille or consular legalisation may also be needed.
What is the 25 percent beneficial ownership threshold?
It is the level of ownership at which many AML frameworks require a natural person behind a company to be identified as a beneficial owner. Some jurisdictions set a lower figure for higher risk sectors. The threshold is a floor, not a ceiling. If someone below it clearly controls the company, identify them anyway and note why.
How recent does a company register extract need to be?
Most programmes require an extract dated within the last three months at the point of acceptance, because that is what makes it evidence of current standing rather than history. Set the rule in your procedure and apply it consistently. If a registry only issues extracts annually, record that limitation and use a substitute such as a registered agent certificate.
What KYC documents do you need from a branch of a foreign company?
A branch is not a separate legal person, so you collect the local branch registration and the full document set for the foreign parent. Ownership is traced through the parent. Authority comes from a parent board resolution appointing the branch manager, plus any local mandate. Screen both the parent and the branch, and the parent’s beneficial owners.
Do listed companies need the same KYC documents?
Usually less. A company listed on a recognised exchange is subject to disclosure rules, so many frameworks allow reduced ownership verification. You still confirm the listing, take the register extract and annual report, identify substantial shareholders disclosed to the exchange, and verify the signatories. Reduced diligence never means no diligence, and screening still applies in full.
Getting the file right the first time
Collecting documents and screening names are two halves of the same onboarding job, and the second half is easier to automate. Globalior’s free screening tool lets you check company names, directors and beneficial owners against restricted party lists as soon as the documents land, and the free denied party screening tool keeps a record of each check for the file. If you want a second opinion on your onboarding document set or your screening process, get in touch with the Globalior team.