Table of Contents
A KYC questionnaire for B2B customers is the form you send a new business counterparty to collect its legal identity, ownership, control, banking and activity data before you trade. A working version runs to roughly 35 to 50 fields across six blocks. Every answer on it is a claim by the customer, not evidence. Verification is a separate step.
Most downloadable templates are written for banks. They ask for shareholder registers and source of funds, then stop. An exporter, a forwarder or a distributor needs more. You also need to know what the goods are, where they end up, who uses them, and which parties touch the shipment in between.
What a B2B KYC questionnaire actually collects
The questionnaire has one job. It puts the customer on record, in writing, about facts you will later test against independent sources. That is what makes a discrepancy meaningful. If the customer says its registered address is in Rotterdam and the registry says Limassol, you have something to act on.
Keep field design in mind from the start. Closed fields with fixed options can be read by a machine. Free text cannot. Country of incorporation should be a dropdown of ISO country names, not a text box that produces “Holland”, “NL”, “The Netherlands” and “netherlands” across four customer files. Bad field design is a common reason screening systems miss matches later.
Ask only what you will use. A field nobody reads still creates a retention obligation and a data protection question. If you cannot name the decision a question feeds, cut it.
The six blocks of a working questionnaire
Block 1: legal identity
Full legal name exactly as registered. Any trading names or former names. Legal form (private limited company, public company, partnership, branch, sole trader). Country of incorporation. Company registration number. Tax identification number or VAT number, which is a different number from the registration number and is issued by a different authority. Registered office address. Principal place of business, if it differs. Date of incorporation. Website and corporate email domain.
Capture the registered address and the operating address as two separate fields. A mismatch is not automatically a problem, since many groups register at their accountant’s office. You cannot spot the pattern if you only captured one address.
Block 2: ownership and control
Full ownership chain up to natural persons. Name, nationality, date of birth and percentage held for each beneficial owner above the threshold in your policy, commonly 25 percent. Any shareholder with control by other means, such as a veto right or a shareholders’ agreement. Parent company and immediate subsidiaries. Whether any state body holds an interest. Directors and their nationalities. Authorised signatories and their signing limits.
Percentages matter for sanctions as well as for anti money laundering. Several regimes treat an entity as restricted when sanctioned parties own it above a set proportion, even when the entity appears on no list. Collect percentages, not a yes or no. See our explainer on the 50 percent rule in sanctions screening.
Block 3: sanctions, regulatory and adverse history
Four direct questions. Is the company, any owner, any director or any affiliate currently designated under any sanctions programme? Does the company have operations, offices, agents or customers in comprehensively sanctioned territories? Has it been subject to a regulatory investigation, licence revocation, denial order or enforcement penalty in the past five years? Is any owner, director or immediate family member a politically exposed person?
Take the answers, then ignore them as evidence. Nobody self declares a designation. You still ask, because a false answer here is a contract breach and a clean exit route. The real check is to run a denied party screening check on every name the form produced, owners and directors included.
Block 4: banking and payment
Account holder name, bank name, bank country, IBAN or account number, SWIFT or BIC. Ask explicitly whether the account holder name differs from the legal entity name, and if so, why. Ask whether any payment will be made by a third party on the customer’s behalf.
Bank country is the field people skip. A Chilean importer paying from a Latvian account is a question worth asking, not a refusal. Late changes to bank details are a recurring evasion and fraud pattern.
Block 5: business activity
Industry and main activity in the customer’s own words. Years trading. Approximate annual turnover band. Number of employees. Main markets sold into. Whether the company is regulated, and by whom. Whether it has its own written anti money laundering or trade compliance procedure.
Turnover bands beat exact figures. A customer reporting turnover under one million that then orders three million of goods has handed you a contradiction you can see without an audit.
Block 6: the trade questions most templates miss
If you move physical goods or technology, identity alone will not protect you. Add these ten.
- Is the customer the end user of the goods, a distributor, a reseller, an agent, or a freight intermediary buying on someone else’s instruction?
- If not the end user, who is, and in which country? Name and address.
- What is the stated end use of the goods? Ask for a sentence, not a tick box.
- Will the goods be re-exported, re-sold or transferred out of the country of delivery? To where?
- Final destination country and final delivery address, if different from the billing address.
- Which ports, transhipment points or land borders will the shipment cross?
- Which freight forwarder, customs broker or carrier will the customer appoint? Name and country.
- Who is the importer of record in the destination country?
- Will the goods be incorporated into another product, and if so, what?
- Does the customer hold any import licence, end user certificate or authorisation required in its country? Reference number and expiry.
Questions 7 and 8 are the ones people regret skipping. Intermediaries appear on restricted party lists in their own right, which is the argument for denied party screening of freight forwarders alongside your direct customer. Question 3 is the highest value question on the form. A vague end use answer such as “general industrial purposes” for a controlled item tells you more than any sanctions field will.
Question block, evidence and what a gap costs you
Every block should map to a document that settles it. Answers no document can settle are still collected, but treated as declarations and scored rather than verified.
| Question block | What you are testing | Evidence that settles it | Exposure if the block is blank |
|---|---|---|---|
| Legal identity | The entity exists and is the one you are contracting with | Certificate of incorporation, current registry extract, good standing certificate | Contract with a dissolved or non existent entity, no route to recover |
| Ownership and control | Who benefits and who can direct the company | Shareholder register, group structure chart, passport copies for owners | Ownership sanctions rules missed, hidden designated party behind the entity |
| Sanctions and history | Designation status and prior enforcement | Screening results against government lists, signed declaration | Dealing with a restricted party, penalties and blocked payments |
| Banking and payment | Money moves between the parties on the contract | Bank confirmation letter or headed bank statement showing name and account | Payment diversion fraud, third party payments you cannot explain |
| Business activity | The order size and product fit the business | Filed accounts, licence, website and trade references | Shell or front company passes as an operating buyer |
| Trade block | Where the goods end up and who uses them | End user statement, import licence, purchase order, delivery address proof | Diversion, unlicensed re-export, controlled item reaching a barred end use |
Scoring the answers so the file reaches a decision
A questionnaire that produces a folder and no rating has failed. Score it. A simple additive model works and is easy to defend in an audit because the arithmetic is visible.
Assign points per factor. For example: country of incorporation on your own higher risk list, 3 points. Final destination on that list, 3 points. Customer is an intermediary rather than an end user, 2 points. Any beneficial owner not identified to a natural person, 4 points. Politically exposed person in the ownership or on the board, 3 points. Goods are controlled or dual use, 3 points. Third party payment requested, 2 points. Company incorporated within the last 12 months, 2 points. Registered and operating addresses in different countries, 1 point.
Then band the total. Nought to 3 is standard diligence. Four to 8 is elevated and needs a second reviewer. Nine or more goes to enhanced diligence with named sign off. Set one or two automatic overrides that ignore the score entirely: an unresolved screening match, or a beneficial owner you cannot identify, sends the file to the highest tier regardless of the arithmetic.
Write the weights down in a policy document before you apply them. A model invented afterwards to justify a decision already made will not survive review. Our guide to sanctions screening in customer onboarding shows where each check sits in the sequence.
Verify before you file
Hold one rule above the others. No answer is accepted as evidence of itself. The customer says the registration number is 09410808. You confirm that number in the registry of the country named and check that the company name attached to it matches, character for character, allowing for legal suffixes.
Screen every name the form produced, separately. The company, each trading name and former name, each director, each beneficial owner, the end user and the freight forwarder. A free denied party screening tool makes this affordable at the volume a small exporter actually has, and Globalior’s is available from the denied party screening page without a subscription.
Expect false hits on common surnames and transliterated names. Do not clear them by instinct. Use secondary identifiers from the questionnaire, which is why date of birth and nationality are on the form at all. Our walkthrough covers how to resolve a false positive in denied party screening.
Record the outcome next to each name, with the date, the list version and the reviewer. Screening you cannot evidence is screening you did not do, which is the point of record keeping for denied party screening.
When the customer stalls or refuses
Separate two situations that look alike. A customer that cannot answer is different from one that will not.
Cannot answer is common and often innocent. A family business may not hold a formal shareholder register. A branch cannot produce its own certificate of incorporation because it is not a separate legal person. Name the alternative you will accept and say so in writing: a notarised ownership declaration, the parent’s registry extract plus the branch registration, or an auditor’s letter.
Will not answer is different. Refusal to name beneficial owners, refusal to state the end user, or evasion on final destination should trigger escalation. Set the rule in advance so sales knows it is not negotiable in the moment. Two chases, seven days apart, then the file goes to the compliance lead with a recommendation to decline or to proceed on restricted terms such as prepayment and delivery to a verified address only.
Log the refusal itself. It is a risk factor in its own right and it belongs in the score.
Keeping the questionnaire alive after onboarding
A questionnaire completed once is a snapshot that decays. Version the form itself, so you know which edition a given customer answered and which questions did not exist yet. Date and initial each answered copy.
Refresh on a cycle and on events. A common pattern is a full re-issue every year for high risk customers, every two years for medium, every three for low. Override the cycle when any of these happens: a change of beneficial owner or director, a new bank account or bank country, a first order to a new destination, a screening alert on a related name, an order more than double the customer’s normal size, or adverse news naming the customer.
Re-screen on a schedule that does not depend on the questionnaire at all. Lists change between your review dates. A customer that cleared in March can be designated in June without telling you.
Keep the completed forms, the evidence and the screening results together as one retrievable file per customer. Regulators expect records to be produced on request, so storage nobody can search is a problem waiting for an examiner. Globalior’s free trade compliance tools cover the screening half of that file.
Key takeaways
- A B2B KYC questionnaire covers six blocks: legal identity, ownership and control, sanctions history, banking, business activity, and the trade block on goods and destination.
- The company registration number and the tax or VAT number are issued by different authorities and must be captured as separate fields.
- Self declared sanctions answers carry no evidential weight. Screen every name the form produces, including owners, directors, end users and forwarders.
- Collect beneficial ownership as percentages, because ownership based sanctions rules turn on proportion rather than on a name appearing on a list.
- Score the answers with written weights and fixed overrides, so the file ends in a risk tier rather than a folder.
- Treat a refusal to name the beneficial owner or the end user as an escalation trigger, and record the refusal as a risk factor.
- Refresh on a risk based cycle and on defined events: a bank change, an ownership change, a new destination country.
Frequently asked questions
How long should a B2B KYC questionnaire be?
Around 35 to 50 fields for a standard corporate customer, which most companies complete in under 30 minutes. Longer forms get abandoned or filled in carelessly, which is worse than a short one done properly. Use a short core form for every customer, then a supplementary section that only appears for higher risk cases such as intermediaries or controlled goods.
Is a KYC questionnaire the same as a KYB questionnaire?
In practice they overlap almost entirely. Know Your Business is the term used when the customer is a company rather than an individual, so it emphasises registry verification and ownership tracing. Many firms use one form and call it KYC. What matters is that the form identifies both the entity and the natural persons behind it, not which label sits at the top.
What beneficial ownership threshold should the questionnaire use?
Twenty five percent is the most widely used figure and appears in many national rules built on international standards. Some regimes apply a lower threshold for higher risk sectors. Check the rule that applies to you rather than assuming. Whatever threshold you set, also ask about control exercised by other means, because a small shareholder with veto rights can direct the company.
Do we need a questionnaire for a customer we have traded with for years?
Yes. Legacy customers onboarded before you had a process are the usual source of audit findings, because nobody ever captured their ownership or their end use. Run a remediation exercise: prioritise by order value and destination country, issue the current form, and give a deadline. Treat continued non response as grounds to restrict terms.
Does the questionnaire replace denied party screening?
No. The questionnaire supplies the names, addresses, dates of birth and nationalities that make screening accurate. Screening is the independent check against government lists. One feeds the other. A file with a completed questionnaire and no screening result, or screening with no identifying data behind it, leaves the same gap open.
If you want a second pair of eyes on your onboarding form or your risk weights, get in touch with the Globalior team.