What Is a Risk-Based Approach to AML?
A risk-based approach to AML identifies, assesses, and mitigates illicit finance risk in proportion to that risk. It is not the written assessment.
TL;DR: Cross-border KYB means verifying a business that is incorporated, owned, or operated outside your home jurisdiction. The questions stay the same as domestic KYB, but the evidence changes country by country: registry depth, scripts, ownership thresholds, document formalities, and risk lists all differ. Even a mature registry is not proof on its own. Companies House told UK MPs that 15 to 20 percent of companies on its register likely contain false information.
Same Questions, Different Evidence
Cross-border KYB is the verification of a business customer whose incorporation, owners, or operations sit outside the jurisdiction where the financial institution is licensed. A Delaware fintech onboarding a Hong Kong trading company, a German bank onboarding a UAE holding entity, and a payments firm onboarding a Brazilian marketplace with Cayman parents are all doing it.
The questions do not change: existence and good standing, ownership and control, actual activity, and sanctions, PEP, or adverse media exposure. The full set of steps is covered in our guide to KYB, and the split between verifying people and verifying entities is explained in the difference between KYC and KYB.
What changes is where the answers come from and how far each source can be trusted. Abroad, every domestic assumption about the authoritative registry, the certificate format, and the ownership threshold has to be checked again.
Most cases involve three geographies: incorporation, operations, and owner residence. A company registered in the British Virgin Islands, run from Dubai, and owned by a Russian national has a risk profile no single country field captures.
Registry Access Is Not One Problem
Foreign registry access varies along three separate axes: whether the register can be searched at all, what it contains, and whether anyone has checked the contents. Vendors that advertise coverage of 200 or more countries are usually counting the first axis. Analysts live with the other two.
Europe shows how fast access can change. In November 2022 the Court of Justice of the European Union ruled in WM and Sovim v Luxembourg Business Registers that unrestricted public access to beneficial ownership registers was invalid. Several member states then restricted public access to their registers. Obliged entities kept their access in principle, but in some countries that meant new credentials, new request processes, and in some countries a wait.
Filing coverage is uneven even where a register exists. In a November 2025 parliamentary reply, South Africa's Companies and Intellectual Property Commission reported that only 49.58 percent of active private companies had filed beneficial ownership information. When a South African company has no beneficial ownership filing, that tells you about the register, not about the company.
Accuracy is separate. In a February 2026 letter, the House of Commons Business and Trade Committee reported that Companies House had estimated 15 to 20 percent of companies on its register contained false information, about 750,000 to 1,000,000 companies. Openness tells you a register is easy to reach, not that its filings are true.
The practical rule is to record, for every jurisdiction you onboard from, what the registry can confirm, what it cannot, and what document or secondary source fills the gap.
Names That Do Not Survive Translation
Non-Latin scripts break entity matching before any risk analysis starts. A company registered in Chinese, Russian, Arabic, Japanese, Korean, or Greek has a legal name in that script. Any English version an analyst sees is a transliteration or a translation, and different databases produce different ones.
China makes this explicit. Article 5 of the State Council's Regulations on the Administration of Enterprise Name Registration requires enterprise names to use standard Chinese characters, and Article 4 allows each enterprise to register only one name. The English name on a website, an invoice, or a translated business license has no registry behind it. The same applies to the English name that a data provider generates from pinyin.
Cyrillic and Arabic add several valid romanization standards, so one Russian company can appear under three spellings across a registry extract, a sanctions list, and a vendor database.
Three habits fix most of this:
25 Percent Is Not a Global Constant
The 25 percent beneficial ownership threshold is common but not universal, and cross-border structures put several regimes on the same ownership chain. Your obligation follows your own regulator. The foreign entity's own register follows its home law. The two lists of owners may not match, and that is not always a red flag.
In the United States, the FinCEN CDD Rule FAQs define a beneficial owner as anyone owning 25 percent or more of a legal entity customer's equity, plus one individual with significant control. FinCEN's February 2026 exceptive relief order lets covered institutions identify and verify owners when a legal entity customer first opens an account, rather than at every new account. It does not lower the threshold or remove verification at onboarding.
In the EU, Article 52 of the Anti-Money Laundering Regulation (EU) 2024/1624 keeps the threshold at 25 percent or more, counted across every level of the ownership chain. It also lets the Commission set a lower threshold, generally no more than 15 percent, for higher-risk categories of entity. The AMLR applies from July 2027.
Elsewhere the trend is downward. Open Ownership's review of thresholds lists Argentina at one share, Nigeria at 5 percent, and Kenya, Paraguay, and the Cayman Islands at 10 percent. The FATF's 2023 guidance on Recommendation 24 says a threshold should not exceed 25 percent and that higher risk can justify a lower one.
For cross-border files, the workable approach is to compute effective ownership through every layer yourself, apply your own threshold, and treat the foreign register as one input to reconcile. Where a foreign register names a 10 percent holder your rule would not capture, record it. That person may matter for sanctions or PEP screening even below your threshold. The mechanics of tracing ownership through layers are covered in UBO identification.
Apostilles and Translations Prove Less Than They Seem
An apostille confirms where a document came from, not what it says. The HCCH Apostille Handbook states that an apostille certifies the signature, the capacity of the signer, and any seal or stamp, and "does not relate in any way to the content" of the underlying document. A certificate of incorporation with a valid apostille can still list the wrong directors, if the registry that issued it held the wrong data.
The Apostille Convention now has 130 Contracting Parties, according to the HCCH status table. China joined in 2023 and Canada in 2024, and Thailand acceded in June 2026. Documents from non-member states still need consular legalisation. Many Contracting Parties run e-Registers where an apostille can be verified online.
Translations carry a similar limit. A certified translation attests that the translator rendered the source accurately. It does not authenticate the source document. Check the original-language document against the registry, not the translation. The patterns to look for are covered in KYB document fraud detection.
High-Risk Jurisdictions and the FATF Lists
The FATF publishes two lists that drive cross-border risk scoring. Its black and grey lists were last updated on 19 June 2026. The call-for-action list names the Democratic People's Republic of Korea, Iran, and Myanmar. The increased-monitoring list named 22 jurisdictions after the June 2026 plenary, including the British Virgin Islands, Bulgaria, Kenya, Monaco, Vietnam, and the newly added Bosnia and Herzegovina and Iraq.
For call-for-action jurisdictions, the FATF calls on members to apply enhanced due diligence and, in the most serious cases, countermeasures. For grey-listed jurisdictions, it does not call for EDD but expects firms to factor the listing into a risk-based approach. National regimes can go further. HM Treasury, for example, treats both lists as High-Risk Third Countries under UK regulations. The FATF plenary runs 28 to 30 October 2026, so lists cached in a rules engine need a refresh process that runs within days, not quarters.
Apply the lists to all three geographies: incorporation, operations, and owner nationality or residence. A grey-listed holding company two layers up should trigger the same review as a grey-listed applicant. What that review contains is covered in enhanced due diligence. Offshore layering patterns are covered in shell company red flags.
How to Evaluate Cross-Border KYB Coverage
The right test is not how many countries a provider covers. It is what the provider can actually prove in the specific countries your customers come from. Test against your last 12 months of applications by country of incorporation and owner nationality. For vendor-by-vendor comparisons, see our KYB platforms for regulated financial services. The criteria below apply to any of them:
Every provider has thin jurisdictions. The dangerous one hides them.
Where Sphinx Fits
Sphinx's agents handle the investigative part of cross-border KYB that lookups leave to analysts. Sphinx Atlas pins down the right entity in the right jurisdiction, traces ownership through holding entities to natural persons with percentages at each layer, checks addresses and web presence, and screens the people behind the business. Every claim carries a source. When ownership in a jurisdiction can only be confirmed with documents the customer has not yet provided, Atlas flags the gap instead of guessing, and the case moves to an analyst or a request for information. Final approval stays with the institution.
Frequently Asked Questions
What is cross-border KYB?
Cross-border KYB is the verification of a business customer that is incorporated, owned, or operated outside the financial institution's home jurisdiction. It covers the same questions as domestic KYB: existence, ownership, activity, and risk exposure. The evidence, however, comes from foreign registries, documents, and legal regimes that differ in depth and reliability.
How do you verify a foreign company that is not on an accessible registry?
Ask for the incorporation certificate, a recent good-standing certificate, and the share register, apostilled or legalised where available, with the native-language originals. Corroborate them with secondary sources such as LEI records, audited accounts, trade and customs records, and the company's operating footprint. Record which facts could not be independently confirmed and set the risk rating to match.
Which beneficial ownership threshold applies to a foreign business customer?
Your own regulator's threshold applies to your obligations: 25 percent or more under FinCEN's CDD Rule and under EU AMLR Article 52. The foreign company's home register may use a lower threshold, such as 10 percent in Kenya or 5 percent in Nigeria. Compute ownership yourself to your threshold, and keep any extra owners the foreign register names for screening.
Does an apostille prove a foreign document is genuine?
No. According to the HCCH Apostille Handbook, an apostille certifies only the signature, the signer's capacity, and the seal on a public document, not its content. A document with a valid apostille can still contain outdated or false information, so the content still has to be checked against the registry.
How often should FATF high-risk jurisdiction lists be updated in KYB rules?
The FATF updates its lists after each plenary, three times a year, typically in February, June, and October. Rules engines should apply changes within days of publication. Lists should apply to the country of incorporation, the countries of operation, and the countries linked to each beneficial owner, not just the applicant's address.
