KYC, KYB, AML, and sanctions controls solve related but different problems

Identity and customer context

KYC commonly refers to knowing and verifying an individual customer; KYB applies similar questions to a business, including ownership and control. Customer due diligence goes beyond collecting documents: it establishes enough context to understand the relationship and identify material change or inconsistency.

AML and sanctions are not synonyms

Anti-money-laundering programs address the risk that funds or services are used to disguise or facilitate illicit activity. Sanctions programs restrict dealings under specific legal authorities and lists. The same customer or transaction may touch both controls, but the legal basis, screening, investigation, escalation, and reporting requirements differ.

Risk-based does not mean improvised

Controls should reflect product, customer, geography, channel, ownership, and transaction risk under the organization’s legal obligations. Teams need documented data sources, matching logic, review procedures, quality checks, escalation, retention, privacy controls, and change governance. This material is a general overview, not individualized legal advice.

Data quality can become control risk

Names, addresses, ownership records and sanctions data can be incomplete, stale or ambiguous. Matching logic therefore needs quality checks, escalation and a way to correct records. A possible match is not a final identity or legal conclusion. This reference explains the conceptual boundary and does not perform screening, collect identities or provide legal advice.

Example: a business record has a complex owner

Verifying the company registration may not identify the people who ultimately own or control it. Customer due diligence can require additional ownership and relationship context under the institution’s obligations. A sanctions-name similarity may then require separate resolution. One check should not be described as having completed every KYC, KYB, AML and sanctions responsibility.

Keep the decision and data source auditable

Record which source was checked, its date, the matching logic, reviewer decision and escalation. Correct data when an authoritative record changes and restrict access to what the task requires. Retention and reporting rules are jurisdiction- and institution-specific. This reference supplies vocabulary, not a universal program design or a live screening result.