Verifying the identity and legitimacy of a business entity before entering into a commercial relationship or financial transaction is one of the most important due diligence steps a South African business can take. It is also, for a wide range of businesses, a legal obligation.
Yet despite the clarity of the regulatory framework, many businesses remain uncertain about exactly how to conduct business verification correctly — what checks to run, in what order, and what to do when something suspicious surfaces. This guide provides a practical, step-by-step walkthrough of how to verify a business or entity in South Africa for KYC and regulatory compliance purposes.
For a comprehensive explanation of what KYB is and why it matters, refer to our detailed guide: What is KYB? Know Your Business Verification for South African Companies.
Who Needs to Verify Businesses in South Africa?
Before walking through the verification process, it is important to establish who is legally required to conduct it.
Under the Financial Intelligence Centre Amendment Act (FICA), certain businesses, institutions, and organisations are designated as Accountable Institutions (AIs). AIs are legally obligated to conduct customer due diligence on the entities they do business with — and business verification, or Know Your Business (KYB), forms a core component of that obligation. The December 2022 FICA Schedule 1 amendments significantly expanded the list of Accountable Institutions to include crypto asset service providers, high-value goods dealers, credit providers, and co-operative banks, among others. For a full explanation of which businesses qualify, refer to our guide: What is an Accountable Institution? FICA Obligations Unpacked.
Beyond legal obligation, many businesses that do not formally qualify as Accountable Institutions conduct business verification as a matter of sound commercial risk management — particularly given that South Africa ranked among the top five countries globally for cybercrime density in 2024, and that synthetic identity fraud increased by 153% in a single year according to TransUnion.
Step 1: Establish the Entity's Legal Identity
The first and most foundational step in verifying a business is confirming that it is a legitimately registered legal entity.
In South Africa, this is done by conducting a business registration check against the Companies and Intellectual Property Commission (CIPC) database — the authoritative national register of all companies, close corporations, and other registered entities. A comprehensive CIPC check should return the entity's registration date, enterprise name, duration of registration, tax and VAT numbers, and all current and historical director details linked to the company registration number provided.
The information returned by a CIPC check allows a business to establish that the entity exists in law and to identify early red flags — such as a very recently incorporated company, inconsistencies between the submitted details and the CIPC record, or a registration status that indicates deregistration or pending compliance issues. Notably, entities that fail to meet CIPC's Beneficial Ownership filing obligations — introduced in their current mandatory form from 1 July 2024 — may be subject to penalty fees or deregistration, which will be visible in the CIPC record and constitutes a meaningful compliance flag.
Step 2: Identify and Verify the Ultimate Beneficial Owners (UBOs)
Establishing who actually controls or benefits from a business — not merely who appears in its formal structure — is one of the most critical steps in business verification, and one that South African regulation has significantly tightened in recent years.
An Ultimate Beneficial Owner (UBO) is the natural person who ultimately owns or controls a legal entity, whether directly or through a chain of ownership or control. Criminals frequently use complex layers of corporate structures, trusts, and smaller shareholdings to conceal their true beneficial ownership — which is precisely why UBO identification has become a cornerstone of AML/CFT compliance globally and in South Africa specifically.
Two important regulatory developments have strengthened UBO obligations for South African businesses. First, the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act 22 of 2022, which came into effect on 1 April 2023, introduced a formal requirement for companies and close corporations to maintain a register of beneficial owners and file that information with the CIPC. From 1 July 2024, CIPC implemented a mandatory hard-stop that requires all entities to submit Beneficial Ownership Declarations alongside their Annual Returns — with non-compliance resulting in the entity being unable to finalise its Annual Return, incurring penalty fees, and ultimately facing deregistration.
Second, the Financial Intelligence Centre has issued new guidance via Public Compliance Communication 59 (PCC59) that lowers the expected UBO identification threshold from 25% to 5%. This means that Accountable Institutions are now expected to identify any natural person holding a 5% or greater ownership stake in an entity as a potential UBO. This change directly addresses the tactic of spreading ownership across multiple smaller shareholdings to evade detection.
When verifying a business, an Accountable Institution should review the entity's share register, directorship records, and CIPC Beneficial Ownership Declaration to identify all UBOs at the 5% threshold and above. Where ownership structures are complex or layered through holding companies or trusts, the verification process must look through each layer until a natural person is reached.
Step 3: Verify the Identity of Directors and UBOs as Individuals
Once the directors and UBOs of the business have been identified, their individual identities must be verified using standard KYC procedures.
This step is where business verification and individual identity verification overlap. Each director and UBO should be subjected to individual identity verification — confirming their full name, ID number, date of birth, vital status, and citizenship against the Department of Home Affairs (DHA) National Identification System (HANIS) database. Where the individuals involved are foreign nationals, the equivalent official identity data source for their country of origin should be used.
This individual verification step is essential because it confirms that the people behind the business are who they claim to be — and that no director or beneficial owner is using a fraudulent or stolen identity to obscure their involvement. For a comprehensive explanation of identity verification and how it works in South Africa, refer to our guide: What is Identity Verification (IDV) and Why Does it Matter?
Step 4: Screen the Entity and Its Principals for AML Risk
With the entity's legal identity and ownership structure established, the next step is to assess whether the business or any of its principals presents a financial crime risk.
This is done through AML screening — the process of cross-checking the entity and its associated individuals against a range of risk indicators and databases. A comprehensive AML screen for business verification purposes should include the following checks.
A sanctions screen confirms whether the entity, its directors, or its UBOs appear on any national or international sanctions lists — including those of the United Nations Security Council, OFAC, the European Union, and the Financial Intelligence Centre. Conducting business with a sanctioned entity or individual is in many cases unlawful, and proceeding without resolving a sanctions flag carries serious legal risk.
A PEP check determines whether any director or UBO is a Politically Exposed Person — specifically, whether they qualify as a Domestic Politically Exposed Person (DPEP) or a Foreign Politically Exposed Person (FPEP) under the updated FICA terminology introduced in December 2022. PEP status does not constitute evidence of wrongdoing, but it does trigger an obligation to apply Enhanced Due Diligence to the business relationship.
An adverse media screen checks whether the entity or any of its principals have been the subject of negative news coverage — including reports of fraud, corruption, financial crime, or regulatory sanctions — that would indicate a risk not yet captured by formal watchlists.
For a detailed explanation of each of these screening components, refer to our guide: What is AML Screening? PEP, Sanctions & Adverse Media Explained.
Step 5: Verify the Entity's Bank Account
Before making any payment to, or receiving any payment from, a business entity, its bank account details should be verified using a company Account Verification Service (AVS) check.
A company AVS check confirms that the bank account number provided is valid and active, that it is registered to the entity in question, and that the company name and registration number linked to the account match the details provided. This step is a critical fraud prevention measure — fraudulent businesses frequently provide recently opened accounts or substitute legitimate account details with fraudulent ones in order to divert payments.
A recently opened company bank account is one of the most consistent indicators of fraud in a business context and should always be treated as a red flag requiring further investigation before any transaction proceeds. For a comprehensive explanation of how AVS works and the specific fraud types it prevents, refer to our guide: What is Bank AVS? How Account Verification Prevents Fraud.
Step 6: Assess the Entity's Credit Profile
For business relationships that involve extending credit, approving financing, or entering into significant long-term commercial commitments, assessing the entity's credit profile is an important additional step.
A comprehensive company credit report returns a credit summary of all associated directors, together with a calculated company risk score that provides a data-driven assessment of the entity's overall credit risk. This step confirms the financial standing of the entity and can surface indicators of financial distress, poor credit behaviour, or other risk factors that would be relevant to the commercial decision at hand.
Step 7: Apply Enhanced Due Diligence Where the Risk Warrants It
If any of the preceding steps surface a significant risk indicator — such as a PEP director, a sanctions match, adverse media coverage, an opaque beneficial ownership structure, or involvement in a high-risk industry — Enhanced Due Diligence (EDD) should be applied to the business relationship before it proceeds.
EDD goes beyond the standard verification checks by requiring deeper investigation into the source of the entity's funds, the nature and purpose of the proposed business relationship, the reasonableness of the entity's financial activity relative to its stated business, and a more intensive review of its ownership and control structure.
Senior management approval should be obtained before establishing or continuing a high-risk business relationship identified through the EDD process. For a full explanation of when EDD is required and what it involves, refer to our guide: What is Enhanced Due Diligence (EDD) and When is it Required?
Step 8: Establish Ongoing Monitoring
Business verification is not a once-off exercise. South African law requires Accountable Institutions to conduct ongoing monitoring of their business relationships to detect any changes in risk profile over time.
Ongoing monitoring involves periodically re-screening the entity and its principals against AML risk databases, reviewing transaction patterns for unusual or suspicious activity, and updating the entity's verification records when material changes occur — such as a change in directorship, a new beneficial owner, or a change in the entity's business activities. Any suspicious transaction must be reported to the Financial Intelligence Centre (FIC), including any cash transaction exceeding R49,999, which triggers a mandatory Cash Threshold Report (CTR).
What Red Flags Should You Look For?
Across all of the verification steps described above, certain findings consistently signal a heightened risk that warrants further investigation or escalation.
A very recently incorporated company, a recently opened bank account, or a director who appears to be recently appointed are all common indicators of a hastily assembled fraudulent entity. Discrepancies between the details submitted by the entity and those returned by the CIPC, DHA, or banking records suggest either error or deliberate misrepresentation. A complex or layered ownership structure that makes it difficult to identify a natural person as the UBO is a classic money laundering red flag. A director or UBO who is a PEP, appears on a sanctions list, or features in adverse media requires immediate escalation to EDD procedures.
Business Verification Solutions for South African Businesses
As South Africa's leading provider of world-class KYB, KYC, AML screening, and due diligence solutions, ThisIsMe gives Accountable Institutions and businesses of every size the tools they need to verify business entities accurately, efficiently, and in full compliance with FICA. From CIPC company registration checks and UBO director verification to company AVS, AML risk screening, credit reports, and ongoing monitoring, our comprehensive suite covers every step of the business verification process. To experience our full range of solutions and find out how we can serve your business, contact our team here.
