KYC Requirements by Country
KYC Requirements by Country: Why Merchant Verification Changes Across Markets A global onboarding form has an appealing premise: Collect the merchant's KYC and KYB information once. Reuse it everywhere. The first half of that idea is valuable. The second is where global complianc
KYC Requirements by Country: Why Merchant Verification Changes Across Markets
A global onboarding form has an appealing premise:
Collect the merchant's KYC and KYB information once. Reuse it everywhere.
The first half of that idea is valuable.
The second is where global compliance architecture often breaks.
The same legal entity may have one company name, one ownership structure, one group of directors, and one set of ultimate owners regardless of where it seeks payment services. Those facts are relatively reusable.
But the evidence used to establish those facts may not be.
One market may have a searchable corporate register. Another may rely on a different government identifier. One jurisdiction may support government-backed digital identity data. Another may require a different remote-verification method. Beneficial-ownership tests, registry access, accepted evidence, translations, certifications, and the distinction between statutory requirements and provider risk policy can all change.
That is why a useful approach to KYC requirements by country starts with architecture rather than a passport checklist.
Standardize the facts globally. Configure the evidence and rules locally.
This matters because KYC and KYB requirements do not emerge from one global law.
The Financial Action Task Force publishes international AML/CFT standards, currently updated through October 2025, but explicitly recognizes that countries have different legal, administrative, operational, and financial systems and therefore implement the standards through measures adapted to their circumstances.
That shared foundation explains why many countries ask broadly similar questions.
National implementation explains why the answers cannot always be proved the same way.
First: “KYC requirements by country” includes both KYC and KYB
For merchant onboarding, KYC and KYB should not be collapsed into one generic document request.
Conceptually:
KYC asks:
Who is this natural person?
KYB asks:
What is this business, and who owns, controls, or represents it?
A merchant relationship can require both.
For example:
Merchant company
→ KYB
Relevant beneficial owner
→ KYC
Director or controller
→ identity verification where required
Authorized applicant
→ identity plus authority to act where required
The exact population depends on jurisdiction, regulated activity, provider obligations, and risk.
This is already one reason a “global KYC pack” is misleading.
The merchant is not proving one thing.
It is proving a set of relationships among businesses and people.
What can be standardized globally?
The global layer should primarily describe facts, not country-specific document names.
A reusable merchant data model can ordinarily accommodate categories such as:
Legal entity
legal name;
legal form;
incorporation jurisdiction;
registration identifier;
registered address;
operating address where relevant;
business activity.
Ownership and control
direct shareholders;
intermediate legal entities;
indirect ownership;
natural persons ultimately identified under the applicable ownership/control analysis;
relevant control relationships.
Management and authority
directors;
controllers;
authorized representatives;
relationship between the applicant and legal entity.
Relevant natural-person identity data
Depending on legitimate verification requirements:
legal name;
date of birth;
nationality;
residence;
identity-document or official identifier data.
The article brief specifically assigns this global-core/local-evidence model to the page.
The operational benefit is significant.
If a company expands from London to Singapore, the merchant should not have to reinvent:
who owns the company.
It may, however, need to prove ownership against a different registry, disclosure system, or provider process.
What should remain country-specific?
The configurable jurisdiction layer should answer a different set of questions.
Which company identifier applies?
A UK company number, Indian CIN, Japanese Corporate Number, Singapore UEN, and Brazilian CNPJ are not merely different labels for one globally interchangeable field.
Their format, issuing authority, underlying registry, and validation methods differ.
Which registry can be checked?
Some entity information is publicly searchable.
Some beneficial-ownership information is private or restricted.
Some relevant information sits across different national, state, or local registries.
Which ownership/control framework applies?
Do not hard-code:
UBO = 25%
into a universal system.
Ownership thresholds and control tests can vary by jurisdiction, entity type, regulatory context, and relevant policy. The master brief expressly prohibits publishing a universal UBO percentage.
Which evidence is accepted?
Official ID, corporate extracts, electronic sources, registry results, equivalent electronic documents, or other independent evidence may be treated differently.
Which remote-verification channels exist?
This is one of Version 1's strongest insights.
Country variation is increasingly about how authoritative data can be verified, not merely which PDF is uploaded.
KYC requirements by country: practical comparison
The following matrix is an operational comparison for merchants preparing international onboarding. It is not a universal list of documents that every payment provider must request.
The legal obligation often sits with the relevant regulated institution rather than directly with the merchant, while the provider can also request information because of acquirer/bank requirements, internal compliance policy, enhanced due diligence, or the merchant's particular risk profile.
KYC Requirements by Country Matrix — Part 1
Market
Verification subject
Core data / company identifier
Official source or registry
Beneficial ownership / control
United States
Customer/legal entity and relevant beneficial owners for covered financial institutions
Entity data plus state/tribal formation context; identification data for relevant natural persons
Entity formation is generally state/tribal; FinCEN governs federal CDD/BOI regimes relevant to covered institutions
FinCEN's current CDD rule uses an ownership and control model for covered legal-entity customers; current FAQs describe 25% equity owners plus a control person, while permitting lower collection thresholds where a financial institution's risk assessment warrants it.
United Kingdom
Customer, beneficial owner, and people acting for the customer where applicable
Company number for Companies House entities; natural-person identity data where required
Companies House public register
UK AML customer due diligence includes identifying beneficial ownership where applicable. Separately, Companies House maintains PSC information and its current PSC framework includes ownership, voting, appointment, and other control tests.
India
Customer/legal entity, relevant representatives, beneficial owners
Companies may have a CIN; legal-form-specific identifiers also exist
Ministry of Corporate Affairs master data; RBI-regulated entities operate under the RBI KYC Direction
RBI's current KYC direction defines controlling ownership for companies at more than 10% and also provides control-based and senior-management fallbacks; the applicable analysis differs for other entity types.
Japan
Customer and beneficial owner under applicable regulated context
13-digit Corporate Number for entities to which one is designated
National Tax Agency Corporate Number Publication Site
The FSA's current AML/CFT framework requires risk-based customer due diligence and consideration of beneficial-owner information; higher-risk cases can justify evidence beyond the statutory minimum.
Singapore
Legal entity plus relevant controllers/natural persons depending on regulated context
UEN/entity data
ACRA / Bizfile; Central Register of Registrable Controllers
Singapore companies and certain other entities maintain RORC information unless exempt; ACRA describes registrable controllers as persons or entities with significant ownership or control. Central RORC data is not public.
UAE
Natural or legal customer, representative, beneficial owner
Legal form, registration/reference data, registered office, business information
Relevant registrar plus UAE Economic/Commercial Register architecture
The UAE's 2025 AML executive regulations identify a 25% or greater ownership interest as the first legal-person ownership test, followed by control and senior-management fallbacks where necessary.
Brazil
Legal entity, relevant owners/administrators and natural persons according to applicable regime
CNPJ, now alphanumeric for newly issued registrations since July 2026
Receita Federal CNPJ and related government registration infrastructure
Receita Federal's e-BEF beneficial-owner reporting became mandatory for applicable entities in January 2026 and focuses on persons who directly or indirectly own, control, or exercise significant influence. Sector-specific AML rules can add their own customer-due-diligence requirements.
Australia
Customer, beneficial owners, persons acting for customer and relevant represented persons
Legal-form-specific entity information; ASIC data can support company verification
ASIC registers and other independent/reliable sources
Current AUSTRAC guidance defines a beneficial owner as an individual who ultimately owns 25% or more or otherwise controls the customer.
KYC Requirements by Country Matrix — Part 2
Market
Address / documentary considerations
Certification / translation
Electronic verification
Important local exception or operational issue
Source date to track
United States
Covered institutions may use documentary or non-documentary identity verification methods; government ID is one documentary route
Depends on institution/context; do not create a universal certification rule
Non-documentary verification is expressly contemplated
CTA reporting and financial-institution CDD are different regimes. U.S.-created domestic entities are currently exempt from federal CTA BOI reporting, but that does not erase CDD obligations of covered financial institutions.
FinCEN FAQs updated May 2026
United Kingdom
Official documents and other reliable sources may support CDD depending on regulated context
Depends on evidence and provider
HM Treasury's February 2026 guidance confirms that qualifying digital verification services on the government register can be used to support identity checks under the Money Laundering Regulations.
Companies House identity verification is a separate corporate-register requirement and should not be confused with a payment provider's entire AML/KYC process.
Feb–Jul 2026 guidance
India
RBI's KYC framework recognizes Officially Valid Documents, equivalent e-documents, KYC Identifier/CKYCR records and other defined approaches depending on context.
Foreign/non-resident evidence can require context-specific treatment; verify current rule
V-CIP is an RBI-defined live audio-visual identification method; CKYCR enables retrieval/reuse of existing KYC records in defined circumstances.
Do not reuse Version 1's cadence without qualification: RBI's actual current periodic-updating framework is risk-tiered and has also received amendments and relief for specified customers.
RBI KYC direction updated through 2025 materials
Japan
Verification method is governed by the applicable legal and regulated context
Foreign evidence and language treatment should be verified case by case
Japan amended permitted online-only verification methods in June 2025; the FSA notes that the prior photo-ID-image-plus-face-image approach was among methods changed.
Risk-based FSA guidance can require deeper evidence for higher-risk customers beyond the statutory minimum.
FSA guidance revised Mar 2026
Singapore
ACRA provides official entity and controller infrastructure, while the precise evidence a regulated provider accepts remains context-specific
Verify where foreign documents enter the process
Government-supported Myinfo/Myinfo Business can provide verified personal/corporate data for participating digital services; the new Myinfo Business version became available for onboarding in May 2026.
Registry availability does not mean every provider is legally required to use that registry or that all beneficial-owner data is public. Central RORC is restricted rather than public.
ACRA/Singpass updates through Jun 2026
UAE
Current AML regulations specify legal-person information such as name, legal form, tax registration where applicable, registered/principal address, organizational documents, and senior-management information for covered entities.
Foreign-document legalization/translation requirements must be checked for the specific registrar/provider
Electronic/public-source availability depends on the relevant authority and provider process
The UAE combines federal rules with multiple competent registration/licensing authorities; do not assume one free-zone or emirate workflow represents every UAE entity. The national Economic Register aggregates company-license information.
Federal AML executive regulations 2025
Brazil
CNPJ data can be independently consulted, including registration/status and QSA information.
Foreign evidence should be treated according to applicable authority/provider requirements
Government corporate-registration and beneficial-owner processes are increasingly digital
Systems must now accommodate alphanumeric CNPJs for new registrations, rather than validating every CNPJ as digits-only.
CNPJ change implemented Jul 2026
Australia
AUSTRAC expects KYC information to be verified, as appropriate to risk, using independent and reliable data
Evidence depends on customer/entity type and risk
AUSTRAC expressly permits use of reliable, independent third-party digital identity services.
Australia's AML/CTF regime is in a substantial 2026 transition; transitional arrangements may apply to existing reporting entities, so implementation date matters.
New AUSTRAC guidance published 2026
The table is intentionally not a list of “documents accepted in Country X.”
Accepted evidence can depend on the regulated institution, customer type, risk, product, provider architecture, and precise fact being verified.
A merchant should treat those document rules as configuration data, not article copy that gets hard-coded indefinitely.
The United States: do not confuse CDD with corporate transparency reporting
The United States illustrates why legal labels matter.
FinCEN's CDD framework for covered financial institutions requires customer identity verification, beneficial-owner identification and verification for relevant legal-entity customers, understanding the purpose and nature of relationships, and risk-based ongoing monitoring.
But the Corporate Transparency Act beneficial-ownership reporting regime changed substantially in March 2025.
FinCEN currently states that entities created in the United States and their beneficial owners are exempt from BOI reporting under the CTA; the revised reporting-company definition focuses on certain foreign entities registered to do business in the United States.
Those facts can coexist.
No domestic CTA BOI filing requirement
does not mean:
No financial-institution beneficial-owner due diligence.
A global compliance system that stores both under the field:
US UBO required? YES/NO
is already too simplistic.
The U.S. also demonstrates why review cadence should not be hard-coded from generic guides
Version 1 described a roughly 1/3/5-year U.S. reverification cycle.
That should not survive into publication.
FinCEN's February 2026 exceptive relief instead allows covered institutions choosing to use the relief to identify and verify beneficial owners when the legal-entity customer first opens an account, when facts call previously obtained information into question, and as needed under risk-based ongoing CDD—rather than requiring identification and verification at each subsequent new-account opening.
The broader editorial lesson is useful globally:
Store the legal trigger and effective date, not a folklore interval.
The United Kingdom: registry identity and regulated CDD are related—but separate
The United Kingdom has unusually accessible corporate information through Companies House.
The public register exposes company-level information including registered name, company number, registered office, status, incorporation date, officers, and other filing information.
Companies House is also implementing statutory identity verification for people setting up, running, owning, or controlling UK companies, with current guidance published through 2026.
That is useful evidence infrastructure.
It is not the entirety of a regulated firm's KYC process.
Businesses subject to the UK's Money Laundering Regulations still perform customer due diligence appropriate to the regulated relationship, including identifying customers and beneficial owners where applicable.
And as of February 2026, HM Treasury and the Department for Science, Innovation and Technology have formally clarified how registered digital verification services can support identity checks under the MLRs.
That is a genuine operational difference from a country where comparable government-backed digital verification is unavailable.
India: the verification channel itself is part of the country's KYC architecture
Version 1 was right to emphasize India's digital-verification infrastructure.
RBI's current KYC framework defines Video-based Customer Identification Process (V-CIP) as a live, consent-based audio-visual identity process and treats compliant V-CIP as equivalent to face-to-face customer identification for purposes of the direction.
The framework also incorporates the Central KYC Records Registry. Where a KYC Identifier is available, regulated entities can retrieve KYC records through CKYCR and are instructed not to demand the same records again except in specified situations.
That is more than a different document name.
It changes how a global onboarding platform should model:
evidence source
reusability
and:
verification channel.
India also demonstrates why ownership logic belongs in a country ruleset rather than a global ubo_threshold = 25 field. RBI's current KYC direction uses more than 10% controlling ownership for companies, alongside control-based analysis where ownership does not resolve the beneficial owner.
Japan: local verification mechanics can change even when the objective stays the same
Japan's fundamental verification objective may look familiar:
establish customer identity, beneficial ownership, transaction purpose, and other relevant risk information under the applicable legal and regulatory framework.
But implementation evolves.
In 2025, Japan amended the permitted online-only verification methods under the Act on Prevention of Transfer of Criminal Proceeds. FSA guidance notes, among other changes, the removal of a previous method relying on images of photo ID plus facial images and the introduction of additional electronic-record methods.
The FSA then revised its AML/CFT Guidelines and FAQs again in March 2026, emphasizing a risk-based process in which higher-risk customers can justify additional beneficial-owner or other evidence rather than mechanically applying only statutory minimums.
Japan also has a public 13-digit Corporate Number system administered by the National Tax Agency, with basic information including the organization's name, head-office/principal address, and Corporate Number available through the publication system.
Again:
Registry available
does not mean:
registry proves every fact required for KYC/KYB.
The Corporate Number source can help establish entity information.
It does not magically resolve the entire ownership and risk analysis.
Singapore: government data can reduce documentary repetition
Singapore gives global compliance teams another architecture.
ACRA maintains company data and beneficial-ownership infrastructure. Its Central Register of Registrable Controllers contains information about people or legal entities that beneficially own or control relevant companies, foreign companies, and LLPs, although the central RORC is not a public beneficial-owner search database.
Singapore also has government-backed digital identity and business-data infrastructure.
Myinfo is used by participating services to retrieve verified personal information with user consent, and government materials describe adoption by financial institutions for KYC.
Myinfo Business extends the concept to corporate and applicant data, and an updated version became available for onboarding in May 2026.
The global onboarding lesson is important:
Where authoritative digital data is available, the right local configuration may be a data connection—not another document-upload field.
UAE: “country” does not always mean one registration workflow
The UAE illustrates another type of variation.
Its current federal AML executive regulations contain detailed customer and beneficial-owner due-diligence requirements for covered institutions, DNFBPs, and virtual-asset service providers. For legal persons, the regulations call for legal form, corporate/tax/reference information where applicable, addresses, organizational information, senior-management information, ownership/control understanding, and beneficial-owner identification.
The current regulations use 25% or greater controlling ownership as the first ownership test for legal persons and then move to actual/legal control and senior management where ownership does not identify the relevant person.
But the corporate-registration architecture itself involves federal, local, and free-zone authorities. UAE commercial-register legislation defines competent authorities to include local government and free-zone licensing authorities, while the national Economic Register is designed to consolidate company-license information nationally.
A global merchant should therefore resist:
“We already onboarded a UAE entity.”
The better question is:
Which UAE legal entity, registered where, under which authority, and what evidence is relevant to this provider relationship?
Brazil: even the company identifier can change underneath your onboarding system
Brazil offers one of the clearest 2026 examples of why country configuration must be maintained.
Brazil's CNPJ is the national legal-entity registration identifier administered by Receita Federal, and company data can be consulted through official government systems.
Historically, many international systems treated CNPJ as a digits-only field.
That assumption is now obsolete for newly issued registrations.
Receita Federal implemented alphanumeric CNPJs in July 2026 and generated the first identifier in the new format on July 31, while existing CNPJs remain valid.
That sounds like a formatting issue.
Operationally, it can affect:
onboarding validation;
database schemas;
API validation;
registry lookup;
compliance tooling.
Brazil also changed beneficial-owner reporting infrastructure. Receita Federal states that its digital final-beneficiary form, e-BEF, became mandatory for applicable entities from January 2026, centralizing disclosure of people who own, control, or exercise significant influence.
This is why country requirements should be treated like versioned software configuration.
They can change while the merchant's legal entity stays exactly the same.
Australia: country-specific KYC architecture is changing in 2026 too
Australia's current AUSTRAC materials are another reminder that “KYC by country” needs an effective date.
AUSTRAC's updated 2026 customer-due-diligence guidance says initial CDD can require establishing the identity of the customer, relevant representatives and their authority, and beneficial owners for non-individual customers. It defines a beneficial owner as an individual who ultimately owns 25% or more or otherwise controls the customer.
It also explicitly supports verification using reliable and independent electronic data, including suitable third-party digital identity services.
At the same time, Australia's AML/CTF reforms have introduced new 2026 obligations and transitional arrangements. Certain existing reporting entities can continue using previous applicable customer-identification procedures for defined customer classes during a transition running to March 2029 if specified conditions are satisfied.
A global matrix therefore needs:
rule
and:
effective date.
A country name alone is insufficient.
The European Union adds a regional layer above country configuration
Version 1 correctly identified the EU's shift toward a more harmonized AML framework, but the publication needs precise dates.
Regulation (EU) 2024/1624—the EU AML Regulation—will generally apply from 10 July 2027, with some later application for specified sectors. It is designed to create directly applicable EU-wide AML/CFT rules, including customer-due-diligence and beneficial-ownership provisions.
As of August 2026, merchants should therefore not write as though that 2027 framework is already fully applicable.
Nor should they assume that one EU onboarding workflow today captures every member-state operational difference.
The right architecture is:
EU/regional rule layer
plus:
current member-state configuration
plus:
provider policy.
That architecture can converge as harmonized rules become applicable without requiring the merchant to rebuild the global data model.
Country of merchant is not the same as country of person
Another frequent implementation mistake is to assign every KYC rule according to the company's incorporation country.
Consider:
Merchant company: United Kingdom
Director: Singapore resident
Beneficial owner: Indian national residing in UAE
Parent entity: Japan
Which country's requirements matter?
Potentially several, for different purposes.
The incorporation jurisdiction may govern the company's registration evidence.
The payment provider's regulated jurisdiction can shape its due-diligence duties.
The individual's nationality or residence can affect available identity documents or verification methods.
The ownership chain may require evidence from another corporate registry.
The master brief therefore explicitly requires merchants to distinguish merchant country from an individual's nationality or residence.
Do not store one field called:
country
and expect it to drive an international compliance workflow correctly.
Registry availability is not the same as a legal requirement
A public company registry can be extremely useful.
It is still only an evidence source.
For example:
the UK Companies House register provides public corporate information;
Japan publicly exposes basic Corporate Number information;
Brazil allows official CNPJ consultation;
Singapore's Central RORC exists but beneficial-owner data is restricted rather than a public search dataset.
Those architectures differ.
But there is another distinction:
The fact that information exists in a registry does not itself establish that a payment provider is legally required to use that source, permitted to rely on it exclusively, or prohibited from requesting additional evidence.
The verification objective comes first.
The evidence source comes second.
Country law and provider policy are two different configuration layers
This is one of the most important distinctions in global merchant onboarding.
A payment provider can request information because of:
law or regulation
regulator expectations
bank or acquirer requirements
provider compliance policy
enhanced due diligence
the merchant's specific risk profile.
Suppose two providers onboarding the same company in the same country request slightly different evidence.
It does not necessarily mean one misunderstood the country's law.
Their:
regulated entities;
banking partners;
products;
risk assessments;
permitted verification methods;
internal control frameworks
may differ.
That means a global onboarding database should not have one field:
Country X requires document Y.
A more accurate model is:
Jurisdictional requirement
→ verification objective
→ permitted evidence
→ provider-specific request
→ merchant evidence supplied
→ verification outcome.
Build the global KYC system around facts, not PDFs
A document-centric architecture asks:
Which documents do we have?
A verification-centric architecture asks:
Which facts have been established, by which evidence, under which jurisdiction and provider context?
That shift makes reuse much safer.
For example:
Fact
Legal entity name.
Evidence
Official corporate registry.
Market
United Kingdom.
Source
Companies House.
Verified on
Date.
Provider
Provider A.
Then a second provider can determine whether the existing evidence is reusable or whether its own obligations require something else.
The merchant does not blindly resubmit:
certificate_of_incorporation_final_v7.pdf
and hope it solves the problem.
The Global Core + Local Requirement architecture
A scalable system can be organized into three layers.
Layer 1 — Global merchant master data
Store relatively durable business facts:
entity identity;
group structure;
ownership;
directors;
authorized representatives;
addresses;
business description;
banking relationship where relevant.
Layer 2 — Country requirement configuration
For each jurisdiction record:
verification subject;
identifier;
official source;
ownership/control logic;
evidence expectations;
digital methods;
language requirements;
certification requirements where applicable;
exceptions;
effective date.
Layer 3 — Provider configuration
Overlay:
provider-specific information requests;
bank/acquirer requirements;
additional risk review;
accepted evidence formats;
workflow;
escalation.
This avoids two bad extremes.
Bad extreme 1
Build thirteen completely separate country onboarding systems.
That creates duplication.
Bad extreme 2
Build one “global KYC” form and force every country through it.
That creates exceptions everywhere.
The better approach is:
one global data model, multiple verified configurations.
Every country rule needs provenance
The most important fields in the KYC Requirements by Country Matrix may be the final two:
Source
and:
Effective date / last verified.
Why?
Because rules change independently.
In the period relevant to this article alone:
the U.S. changed CTA beneficial-ownership reporting scope in 2025 and FinCEN changed CDD account-opening treatment through 2026 relief;
the UK added significant Companies House identity-verification requirements and published new digital-identity guidance for MLR checks;
India's RBI amended KYC updating requirements;
Japan revised online verification methods and updated FSA AML/CFT guidance;
Brazil introduced alphanumeric CNPJs and a new digital beneficial-owner process.
The correct conclusion is not:
KYC rules are always changing, so global onboarding is impossible.
It is:
Global compliance requirements should be maintained like versioned operating rules rather than copied into a permanent document checklist.
What merchants should prepare once
A merchant can still do substantial preparation centrally.
Maintain an authoritative record of:
exact legal entity names;
registration identifiers;
incorporation jurisdictions;
legal forms;
registered addresses;
business activities;
ownership structure;
intermediate parent entities;
relevant natural owners/controllers;
directors;
authorized representatives;
supporting authority relationships;
relevant banking information.
The master brief identifies these as useful merchant-readiness information while explicitly warning that they do not form a universally sufficient onboarding pack.
The objective is not:
one package accepted everywhere.
It is:
one trusted source of merchant facts from which country-appropriate evidence can be produced efficiently.
What merchants should not standardize
Do not globally hard-code:
One UBO threshold
One proof-of-address age
One acceptable ID list
One document certification rule
One registry lookup
One electronic-verification method
One periodic review interval
or:
One assumption about what the provider is legally required to collect.
The brief specifically prohibits those universalizations because they convert a global onboarding system into a collection of hidden legal assumptions.
Faster international KYC does not mean weaker KYC
The useful distinction is:
necessary verification
versus:
preventable operational friction.
Country-specific requirements themselves are not necessarily the inefficiency.
The avoidable friction often appears when:
the wrong entity identifier is supplied;
legal names do not match;
an ownership chain stops at an intermediate company;
the applicant's authority is unclear;
the onboarding workflow requests evidence for the wrong verification subject;
a country-specific digital source could have been used but the workflow only supports document upload;
the same evidence is requested repeatedly because its previous verification is not recorded;
the legal requirement and provider-specific request are stored as though they were the same rule.
Solving those problems can accelerate launch without removing legitimate controls.
The operating decision for global merchants
The wrong global KYC objective is:
Create one documentation package that every market accepts.
The better objective is:
Create one reliable model of the merchant and the people behind it, then maintain jurisdiction- and provider-specific rules for how those facts must be established.
That architecture accommodates a world in which:
the United States can change beneficial-ownership reporting scope;
India can support CKYCR and V-CIP;
Singapore can expose verified business data digitally;
Japan can change online verification mechanics;
Brazil can change the format of the company identifier itself;
and the European Union can move toward a directly applicable regional AML rulebook.
None of those developments changes who the merchant fundamentally is.
They change how the merchant's identity, ownership, control, and authority are established in a particular compliance environment.
That is the scalable answer to KYC requirements by country.
Standardize the truth.
Localize the proof.
🙂 🙂 🙂 🙂 🙂 🙂 🙂
A. Brief interpretation
Article-owned question: Which parts of merchant KYC/KYB onboarding can be standardized globally, and which must remain configurable by jurisdiction?
Verification subject: The merchant legal entity plus the relevant natural persons behind or acting for it—such as beneficial owners, directors/controllers, and authorized representatives where applicable.
Verification objective: Establish the identity and existence of the business and relevant people using evidence appropriate to the jurisdiction, regulated context, provider, and risk profile.
Key distinction: Global core data ≠ local evidence requirement. A second mandatory distinction is country law/regulation ≠ payment-provider policy.
Editorial position: A global merchant should not build onboarding around one country's documentation model and label every other market an exception. Instead, standardize the underlying facts and make local evidence, registries, identifiers, ownership tests, and verification methods configurable.
Unique evidence anchor: The same company can submit an identical global onboarding package in several markets and still receive different requests because the applicable registry, identifiers, beneficial-ownership framework, verification channel, language, and evidentiary requirements differ.
How Version 1 improves the final: I retained its useful international framing, country sections, digital-verification discussion, and emphasis on regulatory change. I did not preserve unsupported universal statements from Version 1—for example its U.S. “1/3/5-year” KYC cadence—and updated materially changed country facts using current primary sources.
ARTICLE — PUBLICATION COPY
SEO / VISUAL / EDITORIAL NOTES — NOT PART OF THE ARTICLE
What Version 1 contributed
I retained Version 1's strongest search and editorial ideas:
there is an international FATF foundation rather than one global directly applicable KYC law;
U.S., UK/EU, India, Japan, Singapore/APAC, UAE, and Brazil make useful search-intent markets;
verification channels are an important form of country differentiation;
regulations and operating requirements have to be actively maintained rather than treated as a frozen checklist.
The final article strengthens those ideas by making global core data vs local evidence the governing framework.
Version 1 claims corrected or removed
U.S. “1/3/5-year cadence”
Remove.
Current FinCEN CDD materials support a risk/event-driven approach rather than that universal schedule, and February 2026 relief changed beneficial-owner identification requirements for subsequent account openings.
“AMLD6 has been transposed and AMLR is arriving”
Rewritten more precisely.
The directly applicable EU AML Regulation 2024/1624 generally applies from 10 July 2027.
India 2/8/10-year KYC cadence
This is directionally supported by current RBI material—at least once every 2 years for high-risk, 8 years for medium-risk, and 10 years for low-risk customers—but the final article treats it as RBI-regulated-context information, not a universal merchant onboarding rule.
Brazil “advanced KYC triggered by transaction threshold”
Removed.
That Version 1 language was too broad for a country-level merchant onboarding statement.
Singapore MyInfo as a “dominant verification channel”
Narrowed.
Official government sources support Myinfo/Myinfo Business as significant government-backed verification/data-sharing infrastructure, including use by financial institutions for KYC, but “dominant” is unnecessary.
UAE “most significant overhaul”
Removed.
The final uses the actual 2025 federal AML law/executive regulations rather than promotional comparative language.
SEO package
KYC Requirements by Country: Global Merchant Guide
Alternative with stronger differentiation:
KYC Requirements by Country: What Changes Between Markets
I prefer the second editorially.
H1
KYC Requirements by Country: Why Merchant Verification Changes Across Markets
Keep the brief title.
Meta description
Compare KYC requirements by country and learn what changes across the US, UK, India, Japan, Singapore, UAE, Brazil and Australia—from company identifiers and beneficial ownership to registries and digital verification.
This is stronger for SEO than Version 1's meta because it includes concrete country and entity terms without claiming a universal rules checklist.
URL slug
/kyc-requirements-by-country/
Full proposed cluster path:
/solve/compliance-slows-launches/kyc-and-kyb/kyc-requirements-by-country/
KYC requirements by country
Secondary keywords
KYC requirements countries
KYC by country
KYB requirements by country
merchant verification by country
global KYC requirements
country KYC documents
international merchant KYC
local KYC requirements
These are the assigned targets.
Related entities
know your customer
KYC
know your business
KYB
customer due diligence
CDD
beneficial owner
UBO
controller
director verification
authorized representative
business registry
company identifier
company registration number
Companies House
CIN
CKYCR
V-CIP
Corporate Number Japan
UEN
ACRA
Myinfo Business
CNPJ
e-BEF
FATF
FinCEN
RBI
FSA Japan
AUSTRAC
AMLR
digital identity verification
Recommended excerpt
KYC requirements by country differ in more than document names. Global merchants face different company identifiers, registries, beneficial-ownership rules, digital identity systems, and provider requirements. The scalable approach is to standardize core merchant facts globally while configuring evidence and verification rules locally.
Featured-answer opportunity
Use near the introduction:
KYC requirements vary by country because international AML/CFT standards are implemented through different national laws, registries, identity systems, beneficial-ownership frameworks and verification methods. Global merchants should standardize core entity and person data while maintaining jurisdiction-specific rules for the evidence used to verify those facts.
This is concise enough for AI/search retrieval and communicates the article's actual information gain.
Long-tail country query coverage
The final article now naturally supports search intent around:
KYC requirements in the United States
UK KYC requirements
KYC requirements in India
Japan KYC requirements
Singapore KYC requirements
UAE KYC requirements
Brazil KYC requirements
Australia KYC requirements
beneficial ownership requirements by country
company verification by country
digital KYC requirements by country
KYB requirements by country
I would not create 30 shallow country subsections merely for keyword coverage.
The better future strategy is to spin high-volume jurisdictions into individually maintained country pages whose current facts can be reviewed independently.
Internal links
Use contextual links to the four brief-assigned pages:
Anchor
Destination
identity verification of natural persons
KYC Explained
verifying the merchant legal entity
KYB Explained
country-specific beneficial-owner tests
Ultimate Beneficial Owner Requirements
tracing ownership through parent and holding companies
Corporate Structure Verification
Also consider a contextual link to KYC vs KYB early in the article because international merchant onboarding typically involves both.
Do not reproduce each sibling page's full explanation here.
Supporting visual — KYC Requirements by Country Matrix
The primary visual should show this architecture rather than a world map covered in flags.
GLOBAL MERCHANT CORE
|
+-------------------+-------------------+
| | |
Legal entity Ownership People
identity structure & authority
| | |
+-------------------+-------------------+
|
v
COUNTRY CONFIGURATION LAYER
|
+----------+--------+--------+----------+
| | | |
Identifier Registry BO/control Evidence
| | |
Digital ID Language Documents Exceptions
\ | | /
+---------+-----------------+---------+
|
v
PROVIDER REQUIREMENTS
|
v
VERIFICATION OUTCOME
Image alt text:
Global KYC requirements architecture showing reusable merchant identity and ownership data feeding country-specific identifiers, registries, beneficial-ownership rules, evidence and digital-verification methods before provider verification.
Secondary visual — country configuration record
Show one example record:
COUNTRY: ______________________
Verification subject: _________
Core identity data: ___________
Company identifier: ___________
Registry/source: ______________
BO/control rule: ______________
Director/controller rule: _____
Address rule: _________________
Common evidence: ______________
Translation/certification: ____
Electronic verification: ______
Local exception: ______________
Primary source: _______________
Effective / checked date: ______
This directly operationalizes the brief's original KYC Requirements by Country Matrix.
Structured data
Recommended:
Article
BreadcrumbList
If country-specific child pages are later created, consider a clean hub-and-spoke information architecture rather than adding generic FAQ schema to this page.
Source and verification plan
Claims that require primary-source rechecking immediately before publication
Reverify every statement involving:
beneficial-ownership percentage;
statutory KYC/KYB population;
accepted documents;
registry availability;
company identifiers;
electronic identity methods;
certification/notarization;
translation;
periodic review;
remote onboarding;
country-specific effective dates.
The brief explicitly requires current research and says not to rely on memory for these fields.
Primary sources to retain
Global: FATF Recommendations. Current edition amended through October 2025.
United States: FinCEN CDD Rule/FAQs and current CTA BOI pages.
United Kingdom: HM Treasury/HMRC Money Laundering Regulations guidance and Companies House.
EU regional layer: EUR-Lex AML Regulation 2024/1624.
India: Reserve Bank of India KYC Master Direction, current amendments, and MCA company data.
Japan: Financial Services Agency AML/CFT guidance and National Tax Agency Corporate Number system.
Singapore: ACRA plus Singpass/GovTech Myinfo materials.
UAE: UAE Legislation and Ministry of Economy & Tourism.
Brazil: Receita Federal and, for sector-specific AML claims where appropriate, COAF.
Australia: AUSTRAC current 2026 CDD guidance.
Country-specific publication checks
Before publication, add a last_verified date to each country record.
I would also make the CMS treat each material rule as structured content with:
Jurisdiction
Verification subject
Rule
Regulated context
Primary source
Effective date
Exceptions
Last checked
That follows the brief's source discipline directly.
Provider-policy checks
what merchant information is collected;
which directors/controllers require verification;
applicable UBO identification logic;
document acceptance;
certification or translation requirements;
registry checks;
supported electronic verification;
risk-based additional information;
reverification/ongoing-review triggers.
I would not carry Version 1's Terminal3 paragraph into publication yet.
Before adding a commercial section, internally verify:
Terminal3's precise MoR compliance responsibilities;
supported jurisdictions;
whether country-specific verification is performed centrally or through partners;
current country/market count;
document workflows;
UBO/director requirements;
ongoing merchant monitoring;
any automation claims;
any launch-speed claims.
Once verified, the preferred commercial message is not:
It is:
A global payments model can reduce the amount of jurisdiction-specific onboarding infrastructure a merchant has to operate directly, while required verification still needs to be completed under the applicable model.
Human review recommendation
Author: Global payments/compliance content specialist.
Primary compliance reviewer: Global KYC/KYB lead.
Country reviewers: Regional compliance specialists for the jurisdictions actually published in the matrix.
Legal reviewer: Payments legal counsel, especially for claims distinguishing statutory requirements from provider policy.
The brief specifically calls for regional compliance specialists, a global KYC/KYB lead, and payments legal review.
Add a visible Last reviewed: [date] field because this page is unusually time-sensitive.
Final fact-check / amber flags
Do not publish these claims without jurisdiction-specific support:
“Every country uses a 25% UBO threshold.”
“Every merchant must complete KYB.”
“Every director needs KYC.”
“Proof of address must be under three months old.”
“Every market accepts passports.”
“Electronic KYC is legally equivalent everywhere.”
“A company registry proves the beneficial owner.”
“If information is public, providers cannot request documents.”
“A merchant's incorporation country determines every individual's KYC requirements.”
“Every provider in the same country asks for the same evidence.”
“FATF rules are directly applicable global KYC law.”
“The EU AMLR already applies in full.”
“U.S. domestic businesses must currently file CTA BOI reports.”
“U.S. KYC is refreshed every 1/3/5 years.”
“India uses 25% as the universal company UBO threshold.”
“Singapore's RORC is a public beneficial-owner database.”
“Every UAE entity follows the same registry workflow.”
“Brazilian CNPJs are digits-only.”
The controlling brief's biggest safeguard is the same one the article ultimately teaches:
Never let the convenience of one global checklist erase the jurisdiction, verification subject, source, effective date, or provider context that gives a KYC requirement its actual meaning.
V1
KYC Requirements by Country: The Ultimate Guide
There is no single global KYC law. What exists is a shared international framework — the Financial Action Task Force's 40 Recommendations — that virtually every country builds its own national rules on top of, enforced by a different regulator, codified in different legislation, with different documents, different verification channels, and different re-verification schedules. Two markets can both claim to be "FATF-compliant" and still require a merchant to build meaningfully different onboarding flows for each.
This is a working reference to how the major regimes actually differ, not a substitute for legal review in any specific market — regulatory detail here should be confirmed against current guidance before being treated as final. This content is general information, not legal advice. KYC and AML regulation changes frequently and varies by jurisdiction and business model; consult qualified legal counsel for any specific compliance decision.
The shared foundation underneath every regime
Every national KYC framework, regardless of jurisdiction, is built around the same three core duties: confirm who a customer actually is, understand how they move money, and weigh the risk of the relationship before it opens. In practice, this translates into common building blocks across nearly every market:
Identity data collection — name, date of birth, address, and a government-issued identity document, at minimum
Risk-based tiering — simplified due diligence for lower-risk relationships, enhanced due diligence for higher-risk ones, rather than one uniform process for every customer
Beneficial ownership identification for corporate or entity customers, tracing through to the actual individuals who own or control the business
Ongoing monitoring and periodic re-verification, not a one-time check at account opening
Sanctions and politically exposed person (PEP) screening, cross-referenced against relevant watchlists
What varies, market by market, is the specific documents accepted, the verification channels used, the re-verification cadence, the regulator enforcing it, and — increasingly — the data privacy law governing how the collected information can be stored and used. That's where a genuinely global KYC program has to do real, jurisdiction-specific work rather than treating this shared foundation as sufficient on its own.
United States
KYC obligations flow from the Bank Secrecy Act and the USA PATRIOT Act, enforced by FinCEN. The Customer Identification Program (CIP) rule, under PATRIOT Act Section 326, mandates identity verification at account opening, and a separate FinCEN beneficial ownership rule covers legal-entity customers. Re-verification cadence in the US tends to follow roughly a 1/3/5-year pattern depending on assessed risk tier. One notable recent shift: in March 2025, the US narrowed beneficial ownership reporting obligations to remove domestic companies from certain reporting requirements — a reminder that even a well-established regime like the US framework continues to change, sometimes in the direction of less obligation rather than more.
European Union
The EU is mid-transition from a directive-based model to a directly-applicable single rulebook. The Sixth Anti-Money Laundering Directive (AMLD6) has been transposed into national law across member states, while the new Anti-Money Laundering Regulation (AMLR) — intended to harmonize obligations directly, without requiring national transposition — is set to apply from July 2027, with the EU's new Anti-Money Laundering Authority (AMLA) already operational and publishing its work programme in the interim. For a merchant operating across multiple EU member states today, this means current obligations still vary somewhat by country under AMLD6, with a genuinely harmonized single standard arriving on a defined but still-future timeline.
United Kingdom
Post-Brexit, the UK's Financial Conduct Authority (FCA) and HM Treasury have maintained AML rules closely aligned with the EU's risk-based approach, while operating as an independent regime rather than a directly EU-governed one. Sector-specific FCA guidance supplements the core framework, and UK requirements should be treated as their own jurisdiction to track — aligned with the EU model in spirit, but not automatically updated in lockstep with EU rule changes going forward.
India
The Reserve Bank of India (RBI) issues KYC norms through its Master Direction framework, periodically updated to balance financial inclusion against AML safeguards. India has a notably mature digital verification infrastructure relative to many markets — Video-based Customer Identification Process (V-CIP) is a well-established, widely used verification channel — and periodic re-verification cadence in India is explicitly tiered by risk, commonly cited around 2, 8, and 10-year cycles for different risk classifications, a more granular approach than the US's roughly flat 1/3/5-year pattern. India has also been actively tightening scope recently: guidance from India's Financial Intelligence Unit in January 2026 pulled virtual digital asset providers more fully into the country's core anti-money-laundering law, illustrating how quickly the perimeter of what's covered can expand in a single market.
Japan
KYC sits under the Act on Prevention of Transfer of Criminal Proceeds, overseen by Japan's Financial Services Agency (FSA). The core requirement is verifying a customer's name, address, and date of birth against official documents — a comparatively straightforward core standard relative to some other major markets, though sector-specific overlays apply depending on the type of financial service involved.
Singapore and the wider Asia-Pacific region
Singapore's Monetary Authority of Singapore (MAS) oversees the regime, and the market stands out for its verification infrastructure: MyInfo, a government-backed digital identity service, is a dominant verification channel for Singapore-based onboarding, similar in function to how BankID operates as the dominant verification channel across the Nordic countries. Elsewhere in the region, Hong Kong's HKMA and Australia's AUSTRAC anchor their respective national regimes, each with their own documentation and reporting specifics under the shared FATF umbrella.
United Arab Emirates and the Gulf
The UAE has recently undertaken what's been described as its most significant KYC overhaul since exiting the FATF's grey list, reflecting a broader Gulf-region trend toward tightening AML infrastructure following periods of heightened FATF scrutiny. Requirements in this region have moved and continue to move faster than in more established regimes, making current-state verification particularly important before treating any specific UAE requirement as settled.
Brazil
Banco Central do Brasil (BACEN/BCB) is the primary regulator for KYC and AML across banks, payment institutions, and fintechs, with Brazil's financial intelligence unit, COAF, handling reporting and oversight for sectors not covered by other regulators. The foundational law is Law 9.613/1998, with more recent legislation (Law 14.478/2022) extending BACEN's authority to virtual asset service providers, formalized further through BACEN resolutions published in late 2025. Brazil also uses explicitly tiered verification tied to transaction value — a basic account tier with lower limits, and an advanced KYC tier (typically requiring a liveness selfie and full ID upload) triggered once transaction activity crosses a defined threshold, particularly relevant for real-time payment methods like Pix. Notably, general marketplaces in Brazil are not automatically treated as obligated parties under the core AML law unless they directly operate payment, credit, crypto, or betting services — a distinction worth understanding for any platform business trying to determine whether Brazil's KYC obligations actually apply to it directly. Sector-specific regimes layer on top for certain verticals — Brazil's iGaming KYC framework, built through 2023–2024 legislation and ministerial ordinances, is described as one of the more rigorous regimes of its kind in the region.
Verification channels differ as much as the underlying requirements
One of the more operationally significant differences between markets isn't the legal requirement itself but how verification actually gets carried out: V-CIP in India, MyInfo in Singapore, BankID across the Nordics, liveness-selfie-plus-document-upload flows in Brazil. A KYC program built around a single verification method — say, a standard document-upload-and-manual-review flow — will underperform in markets where a locally dominant digital verification channel is what customers actually expect and trust, independent of whether the underlying legal requirement would technically be satisfied either way.
Data privacy regimes add another layer of divergence
Collecting and storing the identity data KYC requires runs into a separate, equally fragmented layer of regulation: GDPR in the EU, India's Digital Personal Data Protection Act (DPDP), Brazil's LGPD, and China's PIPL each impose different constraints on retention, cross-border transfer, and consent — meaning a KYC data flow that's compliant in one market's privacy regime may need real structural changes, not just a policy update, to be compliant in another.
Why this matters operationally, not just legally
Every specific example above — the US narrowing beneficial ownership scope, the EU's multi-year shift from AMLD6 to AMLR, India tightening crypto-adjacent AML scope, the UAE's recent overhaul — makes the same underlying point: KYC requirements are not a static checklist a business builds once and maintains indefinitely. They're a moving target, market by market, on regulatory timelines that don't coordinate with each other. A compliance program built for a snapshot of today's requirements in five markets will need active maintenance in all five, on five different schedules, indefinitely.
Title
KYC Requirements by Country: The Ultimate Guide
Url
/solve/compliance-slows-launches/kyc-and-kyb/kyc-requirements-by-country/
Pillar
Compliance Slows Launches
Cluster
B — KYC and KYB
There is no single global KYC standard — only a shared foundation and dozens of national variations on top of it. Here's how the major regimes actually differ, market by market.
Status
draft — regulatory specifics checked against current sources (July 2026); this is general informational content, not legal advice, and KYC regulation changes frequently — verify current requirements with local counsel before acting on any market-specific detail here
Need help narrowing down payment options?
Answer a few questions about your business and compare the capabilities that matter to you.
Explore matching options ↗