Talk to usTry the demo

KYB Explained: What Company Registers Show, What They Leave Out and How to Use Them

KYC, AML and digital identification

For: Compliance analyst or product owner who onboards companies and has to decide what a company register can and cannot prove

Know your business in practice: the data an obliged entity must collect on a company, what the EU business registers and their interconnection publish, and what they do not.

For information; not legal advice.

A company applies to open an account, join a marketplace or sign a contract, and someone has to answer a plain question: does this business exist, who speaks for it, and who stands behind it? The industry shorthand for the work of answering is KYB, know your business. This article explains what the work consists of, what the official business registers of the European Union actually publish, and where they stop, so that you can design a business check on top of facts and not on top of hopes.

KYB is not a term of EU law. The duties come from the anti-money laundering rules on customer due diligence, which apply to a customer that is a legal entity as they apply to a person, and from company law, which decides what a register holds. This article is educational. It does not describe a product, and it does not replace the analysis of your own obligations.

What a business check has to establish

Strip the label away and a business check answers five questions.

  1. Existence. Is there a legal entity with this name and number, and is it still alive?
  2. Identity. Which exact entity is it, so that it cannot be confused with another one with a similar name?
  3. Authority. Who may act for it, and may they act alone?
  4. Ownership and control. Which natural persons own or control it?
  5. Risk. Is the entity, or anyone behind it, on a sanctions or other list, and does its structure or sector raise the risk?

The Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027, according to its Article 90. Everything this article says about the Regulation describes what it will require from that date. It is kept apart from the obligations in force today, which come from national law, differ by country and are not described here.

From 10 July 2027 the Regulation turns the first three questions into a list of data. For a legal entity, Article 22(1), point (b), says that obliged entities shall obtain at least the legal form and name; the address of the registered or official office and, if different, the principal place of business, and the country of creation; the names of the legal representatives and, where available, the registration number, the tax identification number and the Legal Entity Identifier; and the names of persons holding shares or a directorship position in nominee form, with a reference to their nominee status. Two details in that list deserve attention. The text asks for the principal place of business when it differs from the registered office, which a register entry will not always give. And it asks for the nominee status of shareholders and directors, which is a signal that a company register entry, by itself, may name a front.

The fourth question has its own rules. From that date the Regulation tells obliged entities to collect the information on the beneficial owner of a legal entity set out in Article 62(1), and, where after exhausting all possible means no natural person is identified, or there are doubts, to record that no beneficial owner was identified and to identify and verify the senior managing officials. The companion article on beneficial ownership under the FATF standard and EU texts covers that cascade in detail, and the article on beneficial owners and the registers after the Court's judgment covers the registers.

The verification rule is the one that connects the business check to registers. Article 22(7) of the Regulation will let obliged entities verify the beneficial owner through the identity document route or the electronic identification route, or by reasonable measures that obtain information from the customer or other reliable sources, including public registers other than the central registers. It adds that obliged entities shall also verify the information on the beneficial owners by consulting the central registers. A company register is therefore named by the text as a legitimate source of data, and the beneficial ownership register as a mandatory check on top from that date, but neither is named as proof by itself.

What the EU business registers hold

Company law in the Union is codified in Directive (EU) 2017/1132. The text published in 2017 has been amended, and the version in force today is not the one published then. Directive (EU) 2019/1151 on digital tools in company law replaced Article 16 and Article 19 of the Directive, inserted a new Article 16a and changed Article 18. Directive (EU) 2025/25 amends it again, and Member States must apply most of those changes from 31 July 2028 and some from 1 August 2029, as the part on the EU Company Certificate describes. This section therefore reads Articles 14 and 15 and the first two paragraphs of Article 20 from the text of 2017, which the 2019 Directive did not change, and Articles 16, 16a, 18 and 19 from the 2019 Directive. It does not read the 2025 changes into the present.

The minimum file

Article 14 requires Member States to ensure compulsory disclosure by companies of at least a list of documents and particulars. The list includes the instrument of constitution and the statutes, with any amendments and the complete amended text; the appointment, termination of office and particulars of the persons who are authorised to represent the company in dealings with third parties and in legal proceedings, or who take part in its administration, supervision or control; the accounting documents for each financial year; any change of the registered office; the winding-up of the company; any declaration of nullity; the appointment of liquidators; and any termination of liquidation and striking off. The text on representatives has a feature that is useful in practice: it must be apparent from the disclosure whether the persons authorised to represent the company may do so alone or are required to act jointly.

Read the list for what is missing. It names no shareholders and no beneficial owners. It says "at least", so a Member State may require more, and some registers do hold shareholder data, but the minimum that you can rely on across the Union does not include the owners.

How the file is kept, and how fresh it is

Under Article 16(1), as replaced in 2019, a file is opened in a central, commercial or companies register for each company registered in it. Member States must ensure that companies have a European unique identifier, the EUID, which allows them to be unequivocally identified in communications between registers. The identifier comprises at least elements that identify the Member State of the register, the domestic register of origin and the company number in that register, with features to avoid identification errors where appropriate.

Changes must be entered, and disclosed, normally within 21 days of receipt of the complete documentation, under Article 15. The wording "normally" and the starting point, receipt of complete documentation, mean that a register is a lagging indicator. A change that has been filed but not entered, or not yet filed, is not in the file you read.

Article 16 also sets out what the register's content means legally. Under Article 16(4), where the register and a national gazette or central electronic platform differ, the documents and information made available in the register prevail. Under Article 16(5), the documents and information may be relied on by the company as against third parties only after they have been disclosed, unless the company proves that the third parties knew of them. For transactions before the sixteenth day after disclosure, they cannot be relied on against a third party who proves that it was impossible to have known them. Third parties may always rely on documents and information whose disclosure formalities are not yet complete, unless non-disclosure means the documents or information have no effect. For a business check this is not a detail: the law itself treats the register as the reference point for third parties, and conflicts between the register and the gazette are resolved in favour of the register. Article 16(6) adds that the documents and information submitted to the register must be stored in a machine-readable and searchable format or as structured data, which is what makes a bulk load of register content possible in principle.

The interconnection

Article 22 of the same Directive establishes the system of interconnection of registers. It is composed of the registers of the Member States, a European central platform, and the European e-Justice portal as the electronic access point. Under Article 18, electronic copies of the documents and particulars are made publicly available through the system, in a standard message format, and the Commission provides a search service in all official languages of the Union in respect of companies registered in the Member States.

What a visitor gets without paying is set by law, and the replacement text is wider than the original. Article 19(2), as replaced in 2019, requires Member States to make at least eight items of information and documents available without charge through the system of interconnection. They are the name and legal form; the registered office and the Member State of registration; the registration number and the EUID; the company website, where recorded in the national register; the status of the company, such as closed, struck off, wound up, dissolved, or economically active or inactive as defined in national law, where recorded; the object of the company, where recorded; the particulars of the persons currently authorised to represent the company, with the information whether they may do so alone or must act jointly; and information on branches opened in another Member State. Under Article 19(4), Member States may decide that the website and the object are available without charge only to the authorities of other Member States. For the other documents and information referred to in Article 14, Article 19(1) says fees through the system must not exceed the administrative costs, including the costs of developing and maintaining registers. So the layer available without charge reaches further than existence and identity: it includes status and the representatives with their alone-or-jointly rule. What can still cost money, within that cost ceiling, is the rest of the Article 14 file, such as the statutes and the accounting documents, and format and language remain for each register to settle. Owners are outside the list altogether.

Article 20 adds a useful feed. The register of a company shall, through the system, make available without delay the information on the opening and termination of any winding-up or insolvency proceedings and on the striking off of the company from the register, where this has legal consequences in the Member State. The branch register must receive it. This is the information that answers "is it still alive", and it is defined as an event feed between registers, not as a promise that every national register shows the same fields.

A national example: Estonia

National practice shows how much the cost layer can differ from the Directive's minimum. The operator of the Estonian e-Business Register states that the data of all legal entities registered in Estonia can be consulted on its portal, and that viewing the data has been without charge since 1 October 2022. It also states that its programming interfaces and downloadable data sets contain only the public data of the register, which could be viewed before but for a service fee. Two exceptions are named: a fee still applies to documents in the public files of non-profit organisations, which may contain special types of personal data, and to data inherited from the European Business Register. For a business check, the point is that the answer to "what will this lookup cost, and may I load it in bulk" is a rule of the individual register, to be read from the operator's own terms, and not a constant across the Union.

What is changing: the EU Company Certificate

Directive (EU) 2025/25 amends the company law directive to expand the use of digital tools and processes. It inserts an Article 16b on an EU Company Certificate, which the registers issue for limited liability companies and partnerships and which, in the words of the Directive, shall be accepted in all Member States as sufficient evidence, at the time of its issuance, of the incorporation of the company and of the information it lists.

For a limited liability company the certificate shall include the name or names; the legal form; the registration number and the Member State of registration; the EUID; the registered office; a correspondence address such as an electronic mail or postal address; the date of registration; the subscribed capital, if applicable; and the status of the company. The status field is described by examples: closed, struck off the register, wound up, dissolved, undergoing insolvency proceedings, economically active or inactive as defined in national law, where recorded in the national register. The certificate also lists the first names, surnames and date of birth, or equivalent information, of the persons authorised to represent the company, and whether they may do so alone or must act jointly, together with the object of the company, its duration if limited, and the details of its website where recorded.

Three details matter for a designer.

  • The electronic certificate can also be obtained through the system of interconnection of registers, and it is authenticated by means of trust services under the electronic identification regulation and is to be compatible with the European Digital Identity Wallet.
  • Each company can obtain its certificate in electronic format without charge unless that causes serious prejudice to the financing of the national registers, and in any case at least once per calendar year.
  • It vouches for what the register holds, not for what is true: the text says it is accepted as evidence of the information held by the register in which the company is registered.

Timing matters. Member States must adopt and publish the laws to comply with Directive (EU) 2025/25 by 31 July 2027 and apply them from 31 July 2028. For Article 19(2), point (i), and Article 19b of the company law Directive the dates are later: the laws by 1 August 2028 and their application from 1 August 2029. Until then, the certificate is a direction of travel and not an input you can count on.

Beyond the registers: other sources of business identity

The Legal Entity Identifier, or LEI, is a unique 20-character alphanumeric code that gives access to identification data about a legal entity, according to the organisation that administers it. The organisation says the LEI is based on the global 17442 standard and answers two questions: who is who and who owns whom. The first set of data, the business card information such as the official name and registered address, is called Level 1. The second set, Level 2, is the ownership data, and it is narrower than the name suggests: legal entities that have or acquire an LEI report their direct accounting consolidating parent and their ultimate accounting consolidating parent. An accounting parent is not a beneficial owner. Level 2 data is useful to map a corporate group, and it is reported by the entity itself, and it does not tell you which natural persons stand behind the top company. Not every company has an LEI; the Regulation asks for it "where available".

The United Kingdom: verification at the register

The United Kingdom has moved some of the checking to the register. Companies House announced that from 18 November 2025 the legal requirements for directors and people with significant control to verify their identities begin. New directors verify their identity to incorporate a company or be appointed, existing directors confirm they have verified at their next annual confirmation statement during a 12-month transition period, and existing people with significant control verify in line with an appointed day within 12 months. Individuals verify through GOV.UK One Login or through an Authorised Corporate Service Provider, receive a personal code, and must provide the code and a verification statement for each company role they hold. Companies House estimated that 6 to 7 million individuals would need to verify by mid-November 2026.

What this changes for a business check is the quality of the data in the register, not the questions. The verification applies to the people who file, direct and control, and it is a statement that a person has verified, not a statement about the business's trading activity, its customers or its funds.

Where a register stops

Putting the sources together, the limits are consistent.

  • Activity. A register records legal existence and status. The certificate text distinguishes economically active from inactive only "as defined in national law, where recorded".
  • Control by other means. Article 14 lists representatives and administrators; it does not list the people who control the entity through agreements, nominees or voting arrangements.
  • Lag. Changes are entered normally within 21 days of complete documentation.
  • Uneven depth. The items guaranteed without charge across the interconnection are the eight listed in Article 19(2); the rest of the file, its format and its language are for each register to settle.
  • Principal place of business. The Regulation asks for it when it differs from the registered office, and a register gives the registered office.
  • Ownership. The company file does not carry the owners, and the group data of the LEI is accounting parentage.

A data plan for a business check

A practical plan maps each question to a source and to a second source that checks the first. Where an item rests on the Anti-Money Laundering Regulation, it describes the position from 10 July 2027, and until then national law decides what an obliged entity must collect.

  1. Existence and status: an extract or search result from the official register of the country of creation, with the date and time of retrieval stored, and the status event feed where available.
  2. Identity: name, legal form, registration number and, within the Union, the unique identifier; the LEI when the company has one.
  3. Addresses: registered office from the register, and the principal place of business from the customer, with a reason recorded when they differ.
  4. Authority: the representatives named in the register, with the alone-or-jointly rule, compared with the person who applies; a power of attorney when the applicant is not a registered representative.
  5. Ownership: a customer declaration of the chain, the central beneficial ownership register, and your own judgement when the two differ.
  6. Persons: an identity check of each natural person you rely on, which is the part of the business check that a person-verification session performs.
  7. Screening: the entity, its representatives and its beneficial owners against the lists you use; see the article on sanctions screening.
  8. Monitoring: a re-check on the events that matter, and a periodic re-check by risk, since the register is a snapshot.

Questions for a supplier of business data

  • Which official register does each field come from, and which fields come from other sources?
  • What is the date of the last update of each record, and what happens in the gap before a filing reaches the register?
  • How do you tell two companies with the same name apart, and do you return the identifier of the register of origin?
  • What do you do when a country has no open register, or the register is in another script or language?
  • Do you return the full list of representatives with the alone-or-jointly rule, or only a flattened list of names?
  • How do you treat beneficial ownership: do you return the register entry, a computed answer, or both with the difference marked?
  • Which parts of your answer are you prepared to stand behind in an audit, and with which source?

Where this sits in a verification flow

The persons in a business check, the representative who applies and each beneficial owner you rely on, can be verified with the same steps as any individual. A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The document step detects, classifies and reads IDs, including printed and handwritten text and the machine readable zone with its checksum. This article describes how to read company registers and does not describe a company verification product.

To see how the person steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us