‘If you don’t do know your customer well, you’re going to get punished’

0:11Simoney Kyriakou: Hello and welcome to the latest episode of Margin Notes with me, Simoney Kyriakou, editor of FT Advisor. We've been talking a lot about financial crime on FT Advisor with a view to stopping it and preventing it, obviously, not with a view to committing it. but for financial services to fight things like money laundering and meet tighter regulations avoid fines which are very important make sure that everything is transparent make sure that ultimate beneficial owner verification is all up to date and just avoid some of the pitfalls with AI having the right knowledge having the right processes in place is absolutely indispensable possible.

0:53Simoney Kyriakou: But in March, KICKR released research that found data deficiencies were a key contributing factor to 68 % of all AML finds in the UK. That's a total of more than£430 million. So here to talk to us about all things data and all things good procedural-wise is KICKR Chief Executive Steve Lamb. Steve, welcome. Thank you. Great to be here. Good. Thank you for joining the podcast. Let's get straight into it. You've talked a lot about things like knowing your customer and knowing your business and how that data itself is vital to combat financial crime. Could you just explain a little bit more about that?

1:33Yeah. So financial crime is all about hidden identities. So to use a service to commit some kind of financial crime or money laundering, you've got to hide your intentions. And then to get away with the crime you've got to hide your identity afterwards so data is really the mechanism through which we verify who we're doing business with whether that's an individual or a business itself and it's really the foundational element for all other kinds of kinds of financial crime detection because if you don't know who you're doing business with when you come to screen them for sanctions you might get a false positive when you come to analyze their transactions you might not really know what you're looking at so good data is really essential to keep the bad actors out.

2:15But I think there's two problems with that. The first is good data is hard to find. So often when we talk about KYC or KYB, what we really mean is a process of collection and verification. So we're collecting information from our customer and we're verifying it from a third party source. Collections fraught with lots of customer friction and back and forth. And when you're talking about verification, often, as I'm sure we'll come on to, the sources are very fragmented, hard to reach as well. The second problem that comes with it is, as you mentioned in your intro, Simony, the fines are getting ever more onerous and harsh as well.

2:54So it's hard to do it well. If you don't do it well, by God, you're going to get punished.

2:59Simoney Kyriakou: Exactly. You mentioned there about perhaps coming up with a false positive. Could you give me an example of what a false positive might look like? Yeah. So if you, let's say you have the name of a director or a beneficial owner, or at least someone you think is the director. If you then screen them against a database of sanctioned individuals, you might not get a match, for example. But if you've been provided with an incorrect name, so a false identity, it could be the person that really owns the company would get a match. Maybe they're a sanctioned Russian individual. So it's really, as I said, the kind of foundational element that all of the other checks are built on.

3:35And to extend that metaphor a bit, it's almost like building it on sand. And if you don't have the correct names or verification details of the directors, the UBOs, the company, those checks decrease in their ability to flag the right things.

3:49Simoney Kyriakou: Well, it sounds like it could then be quite an onerous process. You also mentioned that there could be a lot of to-ing and fro-ing and going back to verify data and going back to ask for more information. um i i guess the virtue of that is the more research you do beforehand the lower or the or the the non-at-all are fine you'll get at the end of the day yeah absolutely um we're starting thankfully talk about it less now but over the last few years there's always been talk about this pendulum between automation and compliance so the idea was that you could have a very automated onboarding experience if you're a financial services business so what we're all used to with with payments companies and neobanks but if you wanted that then you wouldn't be fully compliant or that's at least what we used to say and thankfully that's uh you know that's now changing through through technology um but actually the process of of collecting the right data still is very very inefficient and frequently involves lots of back and forth with your customer and i'll give you a actually a previous uh piece of research we we did about three years ago where we surveyed about 200 small business owners for their expectations on how long it should take to open a bank account and the average answer was 48 hours or less.

5:02Now if you compare that with the other side of the transaction, any time bank onboarding processes are analysed, what it shows is on average the reality is usually closer to 30 to 90 days. So expectation 48 hours, reality sometimes up to three months to get the right information and ensure its accuracy.

5:21Simoney Kyriakou: Now sure So that depends on the complexity of the case. I mean, some people are just very easy to work out who they are. Yeah, some will be. And if you're a small business, largely dealing with mum and pop shops or, you know, kind of owner run businesses, yes, you might be dealing with a check that only takes a few minutes. However, corporate complexity is increasing. More and more ownership structures are going to Luxembourg or Jersey or the Cayman Islands. And that's really the kind of long tail where the process inefficiency builds up. And also, obviously, the financial crime happens as well.

5:54So a lot of focus of regulated firms is on those edge cases of if we've got a complex case, how can we quickly get to the right answer?

6:01Simoney Kyriakou: So are all complex cases therefore red flag cases? Not necessarily. There can be lots of reasons why you've got a complex ownership structure that aren't necessarily a red flag. but you do need to do the work to go through the process of unwrapping that structure and really understand um who the financial flows accrue to um businesses are they're entities right they're not they're not human beings they don't have a will um you know they only spend money at the direction of of individuals so it's the human beings that we care about and the problem is finding them in complex cases is very difficult and all of this data fragmentation that's happening when we come on to corporate registries in particular, lots of fragmentation globally, it's just making that ever more difficult.

6:48Simoney Kyriakou: So do you still need that human to know the customer before any sort of AI or any sort of automation is put in place? Yeah, absolutely. So a KYB check, as mandated by the UK's AML Act, will look at corporate registration details, so address, registration number, nature of business, what they're doing with the company, but it also incorporates directors, shareholding structure and UBOs as well. When we talk about UBOs, we mean individuals that own 25 % or more of the ultimate shares in a company or have 25 % or more of the voting rights. So you have a legal responsibility to find that information and to verify it as well.

7:31And again, getting it is one challenge, but verifying it with reliable and independent data as a regulation mandate is where it becomes really challenging.

7:39Simoney Kyriakou: It sounds very, very frustrating. What can firms then do to improve this data collection? Are there some really good processes they can put in place or hire the right people? Yeah, so data collection is all about workflow. So having a well-tuned workflow to your typical type of customer, it could be as simple as an online form that requests the right details, can save a lot of time and save a lot of the back and forth that comes with requesting additional information. When it comes to verification and actually how you check that information, it's all about having access to the right data sources, or rather having access to them but also using them, not solely relying on the information that your customer tells you, which sadly firms are still doing.

8:25Now, Kickr, as a business, we aggregate live corporate registry connections. So we've built a platform which builds out to about 300 global company registers and aggregates it to a single flow. Why that's important is registries are legally authoritative records. That is the official record of a company, and it's therefore the best source for verifying that initial information. um now we're fortunate in the in the uk that uh company's house while it's got its faults as i'm sure we'll come on to is is a very accessible registry so having some form of being able to obtain that information whether it's someone in your your firm sitting there and physically logging into company's house or whether you do something slightly more sophisticated and maybe get that data via an api connection at least having a part of your process that that's built to check that source um it is something i would i would always recommend well let's let's let's

9:19Simoney Kyriakou: come on to Companies House then, because obviously we've seen lots of changes recently to Companies House, sort of big improvements made. And then just recently the news broke that people have been logging on and changing other people's details. If you can't trust the authorities, who can you trust? How do you double check to make sure that the person who's meant to be in charge of that data hasn't got it wrong? Excellent question. And there needs to be real progress on this in registry land. I think if we go back previously five, ten years, registries were largely almost librarians. They were keepers of data, but they didn't really look at the data at all.

9:57A friend of mine once described it to me like a notice board. You would go and pin up that you started up a company and the details about it, but that's it really. That's the purpose they were there to serve. And it's only very recently that I think the role of corporate registries, the role that they play in the financial crime process has become clear and some of the work that needs to happen around increasing the quality of the data that they keep and verifying that information. Now Companies House, again, does lots of things well, but I would say on that one, it's been reported, you know, very frequently in the press and I think in the FT as well over the last few years that there have been massive, massive levels of fraud at Companies House.

10:36So even before we come on to the data breach that you're referring to, there's been fairly significant investigative reporting about the amount of registrations that contain what are quite clearly not real company details or fake auditors reports exactly synthetic identities i remember a gentleman former investigator called graham barrow who kick has done some work with before um you know fascinating voice in this space um highlighted some really funny examples there was one where where seven hungarian zoos were registered to an address in Anglesey. Well, why not? Exactly. So, you know, it's been far too easy in the past to get around those processes and actually, you know, for companies or for criminals, let's say, to set up a company with Companies House to give them that air of authority when it comes to accessing financial systems.

11:29But actually, that information has never been verified. Now, I think what it is changing. I'd like to see it changing quicker. But if you look at Companies House in particular, I think they're recognising that their role is changing from librarian to gatekeeper. So actually, they do have a responsibility to verify the information that's coming in. And that's why, and I'm sure lots of your listeners will have been through this process in November of last year, it became mandatory to perform identity verification for all directors and UBOs. So that's a welcome first step in ensuring that actually the information is accurate and that financial crime teams and firms can rely on that data.

12:10But it's not the end, and I'd like to see it go further. And the data breach, and I think we're still working through the details of that and what caused it and how widespread the impact was. But it just shows you, again, how seriously they need to take their role, right, and do every

12:27Simoney Kyriakou: registry globally so how can small firms then really make a difference in terms of their own data because obviously you've got the great big banks and they are brilliant they've got huge teams dedicated to this immense wealth of resources financial and intellectual that can help sort of really drill down to that kind of data but a small firm maybe has two or three people working in it none of whom particularly technically knowledgeable what are they supposed to do how are they supposed is to make sure their data is good and clean and protected, as well as to make sure that things like Companies House are not giving them false information.

13:03Yeah, so I don't think there's one silver bullet on this. I think it takes a range of sources and looking between them. So registries are still the legal record of a company. So if you can show in your KYB process that you looked at the corporate registry, that will always be looked upon favourably by an auditor in this process. but as we've just seen it doesn't mean there aren't inaccuracies with corporate registry data so I think having an approach that that really considers you know the information you are collecting for the firm and from the firm and analyzing that you know by itself cross-referencing that with what's on the corporate registry and possibly cross-referencing that with other third party data sources as well there are some paid options but there are also online sources of information you can look at a company's online footprint so it's it's a you know it's a slightly nuanced approach that I think needs to be taken but the way I would summarize it is go beyond the checklist you know this is the data points we need to collect and slightly widen the lens to think about why are we really doing this what are the risks we're trying to find.

14:05Simoney Kyriakou: Yeah and of course the the biggest risk is that you get fined at the end of the process regardless of what you have found. Obviously you want to protect yourself against fines is this just a case where someone says you know what this looks too complex there's at least three different companies based in the Caymans and one in Malta and I'm not going to touch this particular client or I'm not going to go there I'm going to pass them on to someone else you know our firm's kind of almost at risk of losing out on some really lucrative really good business because they're just it's too complex yeah I think it's important to take a risk-based approach right so so some of those flags that will come up in that initial verification process might dictate the level of additional checks or verification that you undertake.

14:49So I'd never say a one-size-fits-all approach is right for every firm. And as you rightly said, an HSBC or a Barclays, their financial crime process is going to be completely different from your average advisory firm. And there's only so many lessons that can be drawn from the two. So I think that risk-based approach is key and you know there's an element of best efforts in this you know making sure that you've taken what necessary steps you can to investigate those threads and pick up that ownership document it document it exactly and be really clear that the process you've taken is the right one and that also that you know you've got a good risk framework internally for who you should

15:31Simoney Kyriakou: be dealing with are there any in your experience are there any sort of glaring issues that quite simple to fix or like a glaring omission that someone hasn't done that seems to be quite common and you know you say to this person have you thought about doing x and they're oh okay no that's a really good idea and they put that in place have you got like maybe one or two of these kind of golden nuggets to start off yeah absolutely so um something we've been working on actually recently um with through our technology is around and confirming nature of business so you would be surprised or maybe you wouldn't with the amount of firms that register on companies house with with an activity code that is nothing whatsoever like what they actually do right um in fact one of the uh the most commonly registered company uh activity codes on companies house is that the second one on the drop down which is not a hungarian zoo no no um it's not i forget what it is but but you know people think oh the first one's too obvious so i'll go for the second one on the list so um you know there's there's different ways you can you can check that one is to look at the company's website.

16:31So, okay, they might be declaring to me that they provide consulting services, but then I check their website and it turns out they're a crypto scam. So it sounds like a really obvious thing to do, but you'd be surprised how often those slip through the net. And actually, when we looked at our research, you had high street banks over the last five years that haven't checked the activity code was accurate. So yeah, that's an example of a simple one you can do. For your small firms, all that is is you know checking the company's website checking their online footprint does it match what they say they do for some of the larger firms that's where technology can come in to use

17:06Simoney Kyriakou: ai to automate some of that additional checking so that could take a matter of minutes really exactly save you a 430 million pound fine um total i think that that's that's a really helpful tip thank you um but but obviously while we're sort of looking at this looking at what we're doing with the company's house looking at some of the issues that we have internally in the uk we're also at a time of huge political instability. We have sanctions against more countries, I think, than we've ever had sanctions against before. Someone's going to criticize me and tell me that in 1974 there were far more, but never mind, I wasn't around then.

17:41Simoney Kyriakou: But we have got this hugely uncertain political climate and things change so quickly. How can companies keep up in such a world of idiosyncratic risk? yeah very very challenging indeed so i think part of that is still having access to the right data sources um so if you're using a sanction screening service for example and it's a reputable one then they will they will be keeping those lists up to date on a daily basis you want to be using live data um i think for advisors and for other small firms and keeping in touch with your industry bodies as well and what their advice is on compliance and what the right risk frameworks are to apply is really key.

18:23But if I could just touch on something more broad, you know, I think the interesting thing about this is how affected it is by the geopolitical environment. So you touched on sanctions, and that's a really clear one, particularly post the invasion of Ukraine in 2022. Another one that's really interesting to kick here is actually about ownership transparency. Ownership transparency is such a volatile topic of conversation globally, And it really does shift with the political winds. So take the US, for example, the Corporate Transparency Act passed in the US. Suddenly, all US firms were required to report their UBOs to their state registers.

19:02Then what happened is that there were court challenges to it. Donald Trump came in at the beginning of 2025, come to March 2025, and FinCEN filed an interim final rule and halting that and actually saying that firms no longer needed to record their UBOs. So that's something I really empathise with our customers and with other firms doing this is that the really key bit, I think, of verification is about ownership. And as we said earlier, where do the financial flows accrue to? And where to get accurate ownership information is just an ever-changing question. And in many cases, I would say on a global level, we're regressing slightly, unfortunately.

19:43Simoney Kyriakou: Because if you can't verify who the beneficial owner is, it could be someone completely different from the named person, someone's wife. I mean, we know a lot of assets get passed into the wife or the spouse or the children or someone related. And that's just to avoid some kind of sanction or some kind of fine. So, I mean, in those cases where you can't find a beneficial owner, does it automatically mean that you just say no to that business? Not necessarily. I mean, I think, again, it comes down to every firm's risk framework, which I'm by no means an expert on for your listeners. But what I would say is do the work to try and find it before you make any decisions.

20:25So, you know, there are always tools that are available. You know, there are public tools. Kicker and other similar businesses have tools to help with some of that ownership unwrapping. and what you need to demonstrate is that you've you've taken the necessary steps to try and determine the ownership before saying you know we simply couldn't make that determination and what it will very very much do if you you can't find the ubo's i think raise an immediate red flag um and at the very least you need to be collecting that information from your customer so you would need to evidence that you've taken that as a declaration and if you find a potential red flag even if it's not a customer of yours do you have a duty to report it to anyone you do So we have a well-established reporting framework for suspicious activity by the FCA in the UK.

21:10Interestingly, on UBO specifically, you actually have a legal responsibility to report inaccurate information that you found in the registry to Companies House as well. Now, we have a very, very high number of reports in the UK, which I think tells you something about the level of verification that's done on the data. another benefit of increased verification is it would probably alleviate some of the reporting burden on small firms and from having to tell companies house when they spot those errors

21:37Simoney Kyriakou: as well do you get fined or censured for not reporting yeah i'm not i'm not across the the exact um you know the exact censure that's in in place for that but but certainly it is a it's a legal responsibility yeah for regulated firms sure again so to avoid coming foul of someone's the long arm or the short arm of the law, it's best to make sure that you are reporting where you find inaccuracies. So this all sounds, I mean, it does sound quite almost overwhelming, and it sounds quite frightening and intimidating sometimes to think about, you know, how do I as a small firm owner kind of, what are my responsibilities?

22:15Simoney Kyriakou: How do I deal with this? But I guess it boils down to better be safe than sorry, right? Yeah, absolutely. I mean, the penalties are so harsh that I think you've just got to embed compliance in your standard operating procedures as a fact of life. Now, an interesting thing to consider is can you make compliance a competitive advantage? So if we have a very slick, you know, a nice onboarding process that, you know, doesn't involve lots of customer friction, actually that might confer some kind of competitive differentiation from the other firms that we're competing with. and I can tell you you know I am both a CEO of a firm that that does business verification at massive scale but I'm also someone that regularly has to go through business verification processes whether that's kicker applying for a new bank account or a virtual office and there is a stark difference you know between some of these processes and the the level of kind of rigor and efficiency that's applied to them to the point that you know it will it will have a quite a large bearing on my decision to go with a firm.

23:18Another bit of research going back a few years ago now, about 13 % of businesses have dropped out the banking onboarding process because of delays in the compliance and KYB. So try not to think about it too much as something to be feared or something that's a necessary cost. It is those things, but actually it can be an enabler as well if you get it right.

23:40Simoney Kyriakou: Sure. And I suppose delays don't really matter if you are communicating with the client saying, we're just doing this you know we should hopefully get us to you by Thursday next week we'll contact you on Wednesday if you're still keeping up that communication then if you think this could be an important client you're at least communicating with them during a slightly longer than usual process yeah absolutely it's like any good customer service right you you don't want to be sitting there not knowing what's happening on the other side or why you're being asked for the same information twice and so making clear you know I think some of the obligations you're under and why this process is necessary goes quite a long way.

24:12Simoney Kyriakou: Well, that's a very positive actual note to end on. Thank you very much. Because obviously, if you can get your customer service right, and your compliance is efficient, and effective and robust, then you will have that competitive advantage. So that applies to small and large firms. Thank you very, very much, Steve, for coming into talking to us. Thank you. And thank you for listening. Until next time, take care.

24:55Simoney Kyriakou: Quick question. When was the last time a display ad changed your mind? Now think about the last time a friend told you about something they loved. Different feeling, right? That's how podcast advertising works. A host who's built real trust with their audience talks about your brand in their own words, in their own voice. It doesn't interrupt the experience. It's part of it. With Acast, you can access the world's largest podcast marketplace. Choose the right shows, the right audiences, the right format. Then watch the data tell you it worked. You're not buying impressions. You're buying influence.

25:29Simoney Kyriakou: Learn more by visiting acast.com slash advertise.