New companies usually assume AML and KYC start after revenue arrives. In practice, they start earlier, often at incorporation, first bank onboarding, first payment provider review, or the moment an investor asks who actually owns the business. If the ownership file is thin, the problem shows up fast.
The legal logic is straightforward. Article 13 of Directive (EU) 2015/849 requires customer due diligence to cover customer identification, beneficial-owner identification, the purpose of the relationship, and ongoing monitoring. In the UK, the People with significant control guidance says companies must identify PSCs, include that information at incorporation, and notify Companies House when it changes. For regulated firms applying AML controls, the FCA's money laundering guidance page is equally blunt: firms need risk-based due diligence, stronger checks for higher-risk cases, and ongoing monitoring. If you want the legal file, ownership logic, and onboarding sequence handled together, Corpenza can coordinate audit and compliance support, company setup services, and tax structuring work in one track.
What is the real AML and KYC file for a new company?
For a new company, the real AML and KYC file is the set of records that lets a regulated counterparty understand who owns the business, what it will do, where money will come from, and why the structure makes sense. A certificate of incorporation alone never answers those questions.
Founders often think KYC means passports and AML means a bank-side checklist. The market treats them as one practical file. A bank, EMI, accounting firm, buyer, or investor wants the same core story to hold together from end to end: legal entity, operating activity, beneficial owners, control rights, expected transaction pattern, and source of funds.
That is why very young companies still get challenged even when they have no trading history yet. The reviewer is not only measuring size. They are testing whether the company is understandable. If the structure is clean and the file is consistent, the lack of history is manageable. If the ownership chain is vague, even a simple company starts to look harder than it is.
Which beneficial ownership details should be ready from day one?
At minimum, founders should be ready with the ownership cap table, control rights, director list, and the natural persons who ultimately own or control the company. Those details sit at the center of both AML due diligence and corporate transparency checks.
The EU rulebook is explicit. Article 13 of Directive (EU) 2015/849 requires obliged entities to identify the beneficial owner and take reasonable measures to verify that person's identity, including understanding the ownership and control structure. The UK takes the same issue straight to the registry level. The PSC guidance says a company must tell Companies House who its PSCs are when it is set up, keep the record current, and report if it cannot identify a PSC.
| Checkpoint | What matters | Official source |
|---|---|---|
| EU customer due diligence | Customer ID, beneficial-owner ID, purpose of relationship, ongoing monitoring | Directive (EU) 2015/849, Article 13 |
| UK company transparency | PSC identification, filing, updates, identity-verification track | GOV.UK PSC guidance |
| US BOI reporting caveat | BOI rules changed, but bank KYC still remains separate | FinCEN BOI alert page |
The U.S. angle changed recently and catches founders off guard. FinCEN's beneficial ownership information page says that, as of the March 26, 2025 update, all entities created in the United States and their beneficial owners are exempt from BOI reporting, while certain foreign reporting companies still face reporting obligations. That does not remove bank KYC. It only changes one government filing track. Reviewers will still ask who owns and controls the company.
Which documents do banks and providers usually ask for?
Most new companies should expect a core packet: incorporation documents, constitutional documents, director and shareholder records, beneficial-owner IDs, proof of address, and a short explanation of business activity. If the company already has an operating trail, invoices, contracts, or a website usually get pulled in quickly.
The exact list changes by institution, but the logic is repetitive. Reviewers want to match the legal file to the commercial story. If the company says it will sell software in the EU, the file should not point to an unrelated cash business in a different geography. If the shareholders are corporate vehicles, reviewers usually want to keep moving upward until the natural-person owners become visible.
A practical starter pack usually includes the certificate of incorporation, articles or equivalent charter, cap table, director register, PSC or UBO summary, passport copy for each controller, proof of address, a one-page business model note, expected inbound and outbound payment flows, and the reason the jurisdiction was chosen. Pre-revenue companies should also prepare a short origin-of-funds explanation. This can be simple, but it should exist.
When do source-of-funds and business-model questions get deeper?
Questions get deeper when the structure is complex, the geography is sensitive, the sector is high risk, or the stated activity does not line up with the documents. The reviewer is then moving from standard onboarding into risk explanation.
This is where weak drafting hurts. A founder may write “consulting” or “trade” because it feels flexible. For AML review that is too thin. A better explanation tells the reviewer what the company sells, who pays it, in which countries, at what average ticket size, and through which bank or payment rails. Vague descriptions create more follow-up than honest specificity.
Source-of-funds review also gets heavier when initial capitalization comes from several individuals, an upstream holding company, a related-party loan, crypto conversions, or a recent asset sale. None of those facts automatically blocks onboarding. But each one creates a document path. If the money trail is real, founders are better off laying it out cleanly at the start instead of waiting for the third follow-up email.
When does enhanced due diligence start?
Enhanced due diligence starts when the risk profile rises above the ordinary baseline. In practice that often means higher-risk countries, politically exposed persons, sanctions exposure, unusual ownership layers, or an activity that makes transaction monitoring more sensitive.
The official sources line up on this. The FCA says regulated firms need risk-based customer due diligence and should apply more intrusive due diligence, called enhanced due diligence, when customers present higher risk. Article 18 of Directive (EU) 2015/849 requires enhanced customer due diligence in higher-risk situations, including relationships linked to high-risk third countries. So founders should not treat EDD as an accusation. It is a risk category and a workload category.
What changes under EDD is usually depth and evidence. More detailed ownership proof. More background on counterparties. More explanation of where funds came from. More clarity on expected payment routes. Sometimes a senior manager approval step on the institution side. A company that can answer these questions in one coherent file often gets through. A company that answers them in fragments usually drifts into delay.
How can founders move the review faster without cutting corners?
Speed usually comes from coherence, not from sending more files. A short, consistent onboarding pack beats a large folder of mismatched records. The goal is to let the reviewer reach a clean conclusion with as few interpretation gaps as possible.
Start with one ownership memo. It should show the entity, directors, shareholders, ultimate beneficial owners, control rights, and the operating purpose of the company in plain language. Then line up the supporting records behind it in the same order. If the cap table says one thing and the articles say another, the review stops right there.
It also helps to prepare for the obvious questions before they arrive. Why this jurisdiction. Why this bank or EMI. Why these counterparties. Why these countries. Why these founders. New companies that answer those five points in advance usually look better than older companies that send only raw corporate records. If you want that package built with operational discipline, Corpenza's compliance team and advisory desk can structure it before the first major review starts.
FAQ
Is a certificate of incorporation enough for KYC?
No. It proves the company exists. It does not explain who ultimately controls it, what it will do, how it will be funded, or whether the transaction pattern makes sense.
Do pre-revenue startups still need an AML file?
Yes. The file may be smaller, but it still needs a clear ownership chain, business-model explanation, founder identification, and origin-of-funds logic.
Does FinCEN's BOI change mean U.S. founders can ignore KYC?
No. FinCEN's 2025 update changed one reporting regime. Banks, payment providers, and investors still run their own customer and beneficial-owner checks.
What usually delays onboarding the most?
Inconsistent ownership data, vague business descriptions, unexplained related-party funding, and documents that point to different countries or activities.
When should a founder bring in external compliance support?
Usually before the first bank or EMI review if the structure is cross-border, the ownership chain has more than one layer, or source-of-funds evidence will need careful packaging.
This is general information, not legal or tax advice. AML rules, registry duties, and onboarding standards change, and the right document pack depends on your structure and jurisdictions.
