How should organisations structure KYB checks for non-face-to-face business relationships in the Philippines?

Why This Matters for Security Teams

For non-face-to-face KYB, the main risk is not only onboarding the wrong business, but also failing to understand who can act for it, who ultimately controls it, and whether the relationship is being used to conceal fraud, sanctions exposure, or shell-company activity. In the Philippines, that makes KYB a control problem as much as a compliance exercise. Organisations need documented evidence, consistent verification steps, and a repeatable decision trail that can withstand review.

Weak KYB often shows up in production as an account opening issue, but the root cause is usually upstream process design: poor document handling, inconsistent beneficial ownership capture, or overreliance on manual review without clear escalation criteria. Security and risk teams should treat KYB as part of the wider trust fabric, alongside identity verification, fraud screening, and access governance. NIST guidance on control families in NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it reinforces the need for auditable controls, but local regulatory obligations still determine the actual evidentiary threshold.

In practice, many teams discover KYB weaknesses only after a suspicious relationship has already been approved, rather than through intentional risk-based design.

How It Works in Practice

Effective KYB for non-face-to-face relationships should be structured as a sequence of control points, not a single document check. The first step is entity identification: confirm the legal name, registration number, place of incorporation, registered address, and operating status. The next step is authority and ownership verification: determine who is authorised to act, who owns or controls the entity, and whether the ownership chain is transparent enough to support risk scoring. Where the business is complex, layered, or foreign-owned, current guidance suggests collecting additional corroborating evidence rather than relying on a single registry extract.

For remote onboarding, organisations should also verify that the relationship purpose is credible and consistent with the customer’s stated activity. That includes checking source documents, validating signatures or authority instruments, and screening the entity and its related parties against sanctions, adverse media, and internal risk triggers. Best practice is evolving toward a layered approach in which each evidence source supports a distinct question: existence, authority, ownership, and intent. That makes review defensible when no single document is conclusive.

• Collect core entity data before any approval decision.
• Verify beneficial ownership and control, not just legal registration.
• Apply enhanced due diligence when geography, ownership, or activity increases risk.
• Retain decision evidence so investigators can reconstruct the rationale later.
• Escalate unresolved discrepancies instead of forcing a pass through workflow pressure.

This approach aligns well with auditability expectations in beneficial ownership transparency guidance and with control discipline in NIST SP 800-53 Rev 5 Security and Privacy Controls. It also helps separate low-risk routine onboarding from higher-risk relationships that require senior approval or ongoing monitoring. These controls tend to break down when ownership records are fragmented across jurisdictions because no single verifier can confidently reconcile legal existence, control, and authority from the available evidence.

Common Variations and Edge Cases

Tighter KYB often increases onboarding friction and review workload, requiring organisations to balance fraud prevention against customer experience and turnaround time. That tradeoff becomes sharper in cross-border cases, nominee structures, and businesses that operate through agents or service providers rather than a simple local office.

One common edge case is when registry data is valid but insufficient. A company may exist and be in good standing, yet its beneficial ownership remains opaque or changes frequently. Another is when the counterparty is a newly formed entity with limited operating history. In those cases, current guidance suggests treating the relationship as higher risk until corroborating evidence accumulates through transaction behaviour, contractual consistency, and ongoing monitoring. There is no universal standard for how much evidence is enough in every scenario, so organisations should define their own minimum thresholds by risk tier and document the rationale.

Identity intersects with KYB where individuals control business relationships, such as directors, signatories, or beneficial owners. That is where verification, fraud screening, and access governance converge. For organisations handling financial services, remittances, or regulated payments, align the KYB file with broader identity assurance expectations and privacy handling discipline under KYB programme guidance and local regulatory obligations. The practical rule is simple: if the organisation cannot explain who controls the business and why the relationship is legitimate, the onboarding decision is not ready for production use.

Related resources from NHI Mgmt Group

• Why do business verification workflows fail when UBO checks are separate from KYB?
• When should organisations prioritise Zero Standing Privilege for non-human identities?
• Should organisations include ownership checks in offboarding workflows?
• How should organisations govern non-human identities alongside human IAM?