Why AML and KYC matter outside the banking sector
Anti-money-laundering and know-your-customer concepts are often associated with banks, but cross-border companies increasingly encounter the same risk questions in ordinary business. Who owns the counterparty? Who controls it? Is the payment coming from the contracting party? Is the transaction economically coherent? Are politically exposed persons, sanctioned parties, shell entities, unusual jurisdictions, or opaque intermediaries involved?
A company may not itself be legally required to operate a bank-style AML program, yet customers, banks, investors, insurers, auditors, and strategic partners may expect risk-based diligence. Weak counterparty information can also create sanctions, fraud, export-control, corruption, and reputational exposure. For that reason, sophisticated international businesses increasingly treat ownership verification and transaction transparency as part of ordinary commercial governance.
The August 2026 U.S. beneficial-ownership rule change
On August 11, 2026, FinCEN issued a final rule that permanently removed Corporate Transparency Act beneficial-ownership reporting requirements for U.S. companies and U.S. persons. Under the current rule, U.S. companies are exempt from BOI reporting to FinCEN. Certain foreign entities registered to do business in the United States remain reporting companies, but they generally report foreign beneficial owners rather than U.S. persons.
This is a material change from the original CTA framework and from a large amount of online guidance that remains outdated. International companies should not rely on older checklists stating that every newly formed U.S. LLC or corporation must file a BOI report. The analysis now turns substantially on whether the entity is foreign and registered to do business in a U.S. jurisdiction.
The change in government reporting obligations does not eliminate private-sector KYC. Banks and other financial institutions may still request ownership information under their own legal and risk-management requirements, and commercial counterparties may demand the same information contractually.
Legal BOI reporting is not the same as commercial beneficial-ownership diligence
A common mistake is to treat statutory reporting and risk diligence as interchangeable. They are not. A company can be exempt from filing information with FinCEN and still present meaningful ownership risk to a bank, investor, customer, or transaction partner.
Commercial diligence asks broader questions: who ultimately controls the entity, whether nominees are involved, whether ownership recently changed, whether the owners appear on sanctions or enforcement lists, whether politically exposed persons are involved, whether related entities are part of the payment structure, and whether the ownership story is consistent with public records and transaction documents.
A risk-based KYC framework for cross-border companies
A workable KYC framework should begin with tiering. Low-risk counterparties can be reviewed through basic corporate records, ownership declarations, screening, and business-purpose verification. Higher-risk parties may require deeper ownership research, source-of-funds questions, litigation and enforcement searches, adverse-media review, management interviews, references, or enhanced approval.
Risk factors include opaque corporate chains, unexplained offshore entities, high-risk jurisdictions, cash-intensive business, complex payment instructions, state connections, sanctions exposure, rapid ownership changes, nominee arrangements, third-party payments, and transactions inconsistent with the counterparty’s apparent business. The company should document why enhanced diligence was or was not performed.
Payment transparency is part of KYC
Ownership diligence is incomplete if the payment mechanics are ignored. A contract may identify one company while funds come from another jurisdiction or an unrelated third party. In some cases there may be a legitimate explanation, but unexplained divergence between contracting party, invoice issuer, bank account holder, shipping party, and beneficial owner can indicate fraud, sanctions evasion, tax problems, or concealment.
Companies should establish escalation rules for third-party payments, payments to personal accounts, split invoices, round-dollar consulting fees, last-minute changes in banking instructions, and requests to omit information from invoices or shipping records. These controls are particularly important in international trade and higher-risk markets.
KYC must connect with sanctions and export controls
Counterparty identity is central to OFAC and BIS compliance. Screening only the named customer may be insufficient when blocked ownership, intermediaries, freight forwarders, resellers, end users, or diversion risks are present. BIS expressly emphasizes knowledge of end users, end uses, ultimate destinations, and transaction red flags. OFAC likewise expects risk-based sanctions compliance that considers customers, supply chains, intermediaries, products, and geographies.
A strong KYC process therefore captures information that can be used across compliance functions rather than maintaining separate databases that do not communicate with each other.
How much diligence is enough?
There is no universal answer. Diligence should be proportionate to the transaction and risk. A routine office-supply vendor is not equivalent to an intermediary receiving a seven-figure success fee to secure government approvals. A long-standing public company is different from a newly created entity with no operating history and opaque ownership.
The defensible standard is a documented process that can explain what was reviewed, which risks were identified, how anomalies were resolved, who approved the relationship, and when the relationship will be reviewed again. This record becomes particularly important if a bank later questions a transaction or if the counterparty becomes subject to sanctions or enforcement action.
Operationalizing KYC across the business
A KYC framework becomes effective only when responsibility is distributed across the functions that create risk. Sales should know which information must be collected before a relationship is approved. Finance should know when a payment mismatch requires escalation. Procurement should understand when beneficial ownership or sanctions screening is required. Compliance should define risk tiers and enhanced-diligence triggers. Senior management should decide who can accept elevated risk and document the basis for exceptions.
Companies should also maintain a usable record of the diligence performed. That record may include corporate documents, ownership information, screening results, questionnaires, explanations of unusual structures, escalation notes, approvals, and dates for periodic review. Centralization matters because fragmented diligence can leave one department unaware of concerns identified elsewhere.
Finally, companies should establish change triggers. A counterparty that was low risk at onboarding may later change owners, banks, jurisdictions, products, or payment behavior. New sanctions, adverse media, litigation, or government relationships can also change the analysis. A mature process therefore combines onboarding with event-driven and periodic review rather than treating KYC as a one-time administrative exercise.
How Axon Point Advisory Can Help
Axon Point Advisory assists companies, investors, boards, and professional advisers with cross-border risk assessments, factual investigations, counterparty and transaction due diligence, compliance-program design, remediation planning, and coordination of complex matters involving the United States, Armenia, and international markets. Where a matter requires legal advice, legal representation, or a formal legal opinion, that work should be handled under a separate engagement with appropriately licensed counsel.
Frequently Asked Questions
Do U.S. LLCs still have to file BOI reports with FinCEN?
Under the August 11, 2026 final rule, U.S. companies are exempt. Certain foreign entities registered to do business in the United States remain subject to reporting requirements.
Does BOI exemption mean a bank cannot ask for ownership information?
No. FinCEN filing requirements and a bank’s customer-due-diligence obligations are different issues.
Should a private company screen beneficial owners?
For higher-risk transactions, beneficial-owner screening is often a prudent part of sanctions and integrity diligence.
Can KYC be outsourced completely?
Research and screening can be supported by external advisers, but management should retain responsibility for risk acceptance and escalation decisions.
Selected official sources
- FinCEN Final Rule / Press Release, August 11, 2026: Official source
- FinCEN Small Entity Compliance Guide - 2026 notice: Official source
- OFAC Framework for Compliance Commitments: Official source
This article is provided for general informational and business-advisory purposes and does not constitute legal advice. Laws, regulations, sanctions, and enforcement policies change. Legal advice should be obtained from appropriately licensed counsel for a specific matter.