Business partner due diligence often fails because teams ignore small inconsistencies. A shareholder record does not match onboarding information. A beneficial owner cannot be clearly identified.
A company operates through several jurisdictions without a clear commercial reason. A sanctions check looks clean at the entity level, but the ownership structure tells a different story. These anomalies matter because they can help unmask a business’s true ownership or control.
Recommendation 24 was enhanced by the Financial Action Task Force to improve access to adequate, accurate, and timely beneficial ownership information. FATF also notes that shell companies and complex legal structures can be leveraged for hiding illegal activities.
Listed below are the 12 red flags compliance teams should investigate before and during a business relationship.
Ownership and Legal Identity Red Flags
Among these are:
-
Company Information Does Not Match Across Sources
A prospective partner provides one address while the corporate registry shows another. Director details differ between documents, or incorporation details conflict with onboarding data.
One discrepancy does not prove misconduct, but unresolved inconsistencies should trigger further verification.
Companies House now has stronger powers to query information that appears incorrect, inconsistent, or potentially fraudulent.
-
Frequent Unexplained Changes In Ownership Or Directors
Shifts in shareholders and directors may be valid. The risk rises when changes occur often, without an apparent reason, or are inconsistent with what has already been mentioned.
Ownership shift may change a company’s effective control and should therefore be included in induction and ongoing monitoring.
-
Complex Ownership Has No Clear Commercial Rationale
Holding companies, subsidiaries and joint ventures are common in legitimate businesses. The concern begins when multiple ownership layers across several jurisdictions make it unusually difficult to identify the people who ultimately control the entity.
FATF specifically addresses the misuse of complicated legal structures to conceal beneficial ownership.
The key question is simple: Can you identify the natural persons at the end of the ownership chain?
-
The Company Resembles a Shell Entity
Some shell companies have a legal purpose. Others may be used to conceal their source of ownership or financial activity.
FATF includes a range of features that could warrant further scrutiny: limited physical presence, minimal personnel, nominee arrangements, and unusual corporate structures.
When combined with opaque ownership or lack of company information, these indicators are more meaningful.
-
The UBO Cannot Be Confidently Discovered
Knowing a company’s immediate shareholder is not always enough. Ownership may pass through holding companies, subsidiaries, trusts, or other legal arrangements before reaching the natural person who ultimately owns or controls the business.
If the ownership trail ends at another company, the due diligence process may still be incomplete.
Business Profile Red Flags
It includes:
-
Stated Activity Does Not Match the Company’s Observable Profile
A business claims significant international operations but has little evidence of employees, customers or commercial activity. Its website, registry records, and stated business model may also tell different stories.
Under the EU AML Regulation, relevant organisations must understand the purpose and intended nature of business relationships.
A business whose actual activity cannot be reconciled with its stated purpose deserves closer review.
Regulatory and Compliance Red Flags
This involves:
-
The Company is Not Sanctioned, But Its Owners May Be
Entity-level sanctions screening alone can create blind spots. A company may not appear on a sanctions list by name while restrictions still apply due to its ownership or control.
UK sanctions guidance advises organisations to investigate the ownership and control of prospective and existing business partners rather than relying only on list matching.
This makes UBO identification an essential part of sanctions due diligence.
-
PEP Relationships Were Not Disclosed
A politically exposed person connection does not automatically mean wrongdoing. It does change the risk profile. FATF requires additional measures around relevant PEP relationships and also considers family members and close associates.
The stronger warning sign is finding a material PEP connection that was not disclosed during onboarding.
-
Adverse Media Contradicts Onboarding Information
A business may present a clean corporate profile while credible external sources reveal regulatory action, litigation or allegations of misconduct.
The issue is not negative coverage alone. It is whether reliable information materially contradicts what the partner disclosed.
UK government guidance on preventing fraud also identifies risk-based due diligence methods, including screening tools, internet research, trading history checks and professional status verification.
-
Ownership Crosses Higher Risk or Low Transparency Jurisdictions
Cross border ownership is normal. However, multiple jurisdictions can make it harder to verify shareholders, directors and beneficial owners, especially where corporate information is limited.
Jurisdictional exposure should therefore form part of the overall risk assessment rather than being treated as an isolated signal.
-
Supporting Information is Repeatedly Delayed
Occasional document delays happen. Repeated inability to provide ownership, registration, or control information is more concerning.
Warning signs include changing answers, unexplained ownership gaps, documents that do not match registry data, or uncertainty about who controls the business. If reliable information cannot be established, enhanced due diligence may be necessary.
Ongoing Monitoring Red Flags
This includes:
-
The Partner’s Risk Profile Changes After Onboarding
Passing due diligence once does not guarantee that a partner remains low risk.
Directors change. Ownership changes. A beneficial owner may become politically exposed. Sanctions exposure may emerge. New adverse media may appear.
In 2026, AMLA consulted specifically on guidelines for the ongoing monitoring of business relationships, reinforcing the importance of keeping business relationship information current.
This reflects a wider shift from one time verification toward continuous risk awareness.
Turning Red Flags Into a Repeatable Due Diligence Process
One red flag does not automatically make a business high risk. The real concern is when several indicators appear together.
A complex structure may be legitimate. A PEP connection may be legitimate. A director change may be legitimate.
However, the combination of indicators needs a process to decide whether standard checks are adequate or whether enhanced due diligence is needed.
The KYB is useful for businesses to obtain a more systematic and thorough assessment of business risk and verify company information during business due diligence.
UBO Identification helps identify the natural persons behind UBOs. Risk Assessment serves as a framework to incorporate ownership, jurisdiction, and compliance attributes into a structured risk decision.
Perpetual KYB supports ongoing monitoring as business relationships and risk profiles change. Because the value of a red flag is not simply knowing it exists. It is finding it early enough to act. Book a demo with The KYB today!
