The words of counterparty vetting, in plain English.

Counterparty vetting

Checking an organisation (or a sole trader or an individual) before you do business with it, whatever the relationship: a customer, a borrower, a vendor or supplier, a partner. It covers the four things below: verification, screening, due diligence and assessment.

Know your business (KYB) and business verification

Confirming that a company exists, is who it says it is, and is in good standing, from a reliable source that is independent of the company: a company registry, a tax authority, a licence register.

Also called KYB. For individuals the equivalent is know your customer (KYC).

Third-party risk management (TPRM)

The discipline of assessing and monitoring the outside organisations a business relies on: suppliers, service providers, partners. Regulators frame it as a life cycle: planning, due diligence and selection, contract, ongoing monitoring and exit.

US Interagency Guidance on Third-Party Relationships (2023); EBA and PRA outsourcing guidelines.

Customer due diligence (CDD)

The legal duty, for businesses covered by anti-money-laundering law, to identify a customer and its beneficial owners, verify them, and understand the purpose of the relationship.

UK Money Laundering Regulations 2017, regulation 28; US FinCEN Customer Due Diligence Rule. Enhanced due diligence (EDD) adds measures for higher risk; simplified due diligence (SDD) is allowed where low risk is established.

Beneficial owner

The person who ultimately owns or controls a company. In the UK and EU: anyone holding more than 25% of the shares or voting rights, or otherwise in control. In the US Customer Due Diligence Rule: anyone owning 25 percent or more of the equity, plus one person with significant responsibility for controlling or managing it.

UK MLR 2017 reg. 5; EU AMLR Art. 2; 31 CFR 1010.230. Often shortened to UBO (ultimate beneficial owner).

Person with significant control (PSC)

The UK Companies House register of the people who own or control a company. It overlaps with, but is not the same as, a beneficial-owner check.

Companies House PSC guidance.

Politically exposed person (PEP)

Someone who holds, or recently held, a prominent public function, together with their family members and known close associates. Business with a PEP calls for enhanced due diligence.

UK MLR 2017 reg. 35; EU AMLR.

Sanctions screening and watchlist screening

Sanctions screening compares a name against government sanctions lists. Watchlist screening also covers politically exposed persons, enforcement actions and other lists. A screening result is a possible match, not a finding.

Wolfsberg Group Guidance on Sanctions Screening.

True match and false positive

The two ways a possible match is resolved. A true match is the listed party. A false positive only looks like it: a different person or company with a similar name. A person decides which, and records why.

Wolfsberg Group glossary.

Adverse media

Public news and records that suggest financial-crime or reputational risk. Also called negative news.

Ongoing monitoring

Keeping what you know about a counterparty up to date after you approve it: a periodic review on a schedule, and a fresh look when something changes, such as a new listing on a sanctions list.

UK MLR 2017 reg. 28(11).

Four-eyes (maker-checker)

A decision that a second person must confirm before it takes effect. Common for high-risk approvals and for overriding a failed check.

Approve and reject

A person's decision on a case, recorded with a reason. A decision records the conclusion on the evidence shown; your own legal obligations, such as customer due diligence, remain yours.

Audit log and record-keeping

An append-only record of who did what and when. Anti-money-laundering law requires records of due diligence to be kept, typically for five years after the relationship ends.

UK MLR 2017 reg. 40.