KYC and KYB for law firms
Client due diligence before the engagement letter: identity, KYB for company and trust clients, and LSEG Risk Intelligence screening in one timestamped file.
Short Answer
Verifica gives law firms client due diligence before the engagement letter. It verifies the client's identity document, runs a liveness check, and when the client is a company or trust it runs KYB: legal existence, directors and signatories, and the ownership chain traced to the people who own or control it. Everyone in the structure is screened on LSEG Risk Intelligence for sanctions, PEP and adverse media. The firm decides whether to act, and a timestamped audit file records every step.
Who this is for
Law firms and in-house risk teams that take on transactional work: real estate, company formation, M&A, fund structuring, trusts and client money. In most AML regimes these are the matters that make a firm an obliged entity, and the check has to be done before the engagement letter is signed, not when the first invoice is paid.
If client intake still means a partner emailing for a passport scan and a junior searching sanctions lists by hand, this is the product view of that problem. The longer regulatory read is KYC for law firms.
What the client file has to show
A conflicts check is not client due diligence. Before acting, the firm has to be able to show who the client is, who stands behind the client if it is a company or trust, whether any of those people are sanctioned or politically exposed, and why the matter makes sense for this client.
Verifica runs that sequence from one secure link sent to the client:
- Government-issued ID and document authenticity checks for individual clients
- Biometric liveness matching, so a photo of someone else's passport does not pass
- Sanctions, PEP and adverse-media screening through LSEG Risk Intelligence
- Know Your Business (KYB) checks when the client is a company, trust or foundation
- A record of the nature and purpose of the matter, plus source-of-funds evidence where the risk calls for it
- A timestamped audit trail of every decision, hit review and re-check
Your firm still sets the risk policy, decides on enhanced due diligence and decides whether to act. The platform takes the document chase off fee-earners.
KYB: when the client is a company
Most of a firm's AML exposure sits with entity clients: the SPV buying a building, the holding company being sold, the trust receiving the proceeds. Verifying the person who sends the email is not enough. KYB is required, and Verifica builds it into the same file:
- Legal existence. Certificate of incorporation or a recent registry extract, with registration number, registered address and current status.
- Control and authority. Directors, officers and authorised signatories, plus evidence that the person instructing the firm has authority to do so.
- Ownership chain. Shareholder registers and structure charts traced through each intermediate company to the natural persons who own 25% or more, or who control the entity by other means.
- The people behind it. ID and liveness checks for each beneficial owner and signatory, not just a name on a chart.
- Screening of the whole structure. The entity, its directors and its beneficial owners are screened, not just the contact person.
- Register cross-check. Where a beneficial ownership register exists, the declared owners are recorded against it, so a discrepancy is caught and documented.
Complex structures, nominee shareholders, trusts and offshore layers are flagged for enhanced review, not approved by default.
Why this is now a requirement
FATF Recommendation 22 brings lawyers within AML customer due diligence rules when they prepare or carry out transactions such as buying and selling real estate, managing client money or assets, and creating, operating or managing companies and trusts.
- European Union: lawyers carrying out those activities are obliged entities, and the AML Regulation (AMLR) sets one directly applicable rulebook from 10 July 2027
- Portugal: lawyers are obliged entities under Law 83/2017 when they take part in those operations
- United States: lawyers are not BSA financial institutions, but ABA Model Rule 1.16 and Formal Opinion 513 expect a lawyer to inquire into the client and the purpose of the matter when there are signs of risk
This page is not legal advice and does not claim that running a verification satisfies a firm's obligations. It is the identity, KYB, screening and audit file those obligations rest on.
Screening with LSEG Risk Intelligence
Verifica screening is powered by LSEG Risk Intelligence and its screening database. It aggregates information from more than 100,000 credible sources and is used by over 300 global financial institutions.
A small practice can run the same screening as a bank without negotiating a data licence. LSEG Risk Intelligence screening is included in Verifica processes that require advanced KYC/AML verification. Enhanced reports and continuous monitoring are priced before activation. The full screening page is LSEG Risk Intelligence in Verifica.
Frequently Asked Questions
Do law firms need KYC?
Yes, when they act in transactional matters. Under FATF Recommendation 22, EU law and Portuguese Law 83/2017, a lawyer who handles real estate deals, client money, company formation or trusts must identify and verify the client and its beneficial owners before acting. In the US, ABA ethics rules expect the same inquiry when there are signs of risk.
What is KYB and when does a law firm need it?
Know Your Business is due diligence on a client that is a company, trust or foundation. The firm checks that the entity exists, who directs it, who can instruct on its behalf and which natural persons own or control it. A law firm needs it whenever the client is not an individual.
Does Verifica decide whether the firm can act?
No. Verifica collects the evidence, runs the checks and flags risk. The firm sets the policy, decides on enhanced due diligence and decides whether to take the matter. The audit file records who decided.
How does the client provide documents?
The firm sends one secure link. The client uploads ID and company documents, completes the liveness check and answers the questions on the purpose of the matter. No email attachments and no second request for the same document.
Does it cover clients outside the EU and the US?
Yes. Identity checks cover documents from many countries, and LSEG Risk Intelligence screening covers sanctions, PEP and adverse media worldwide. The platform runs in English and Portuguese.
Next step
Take the KYC efficiency assessment for a two-minute read on cost, delay and gaps, or contact the team for a demo against a real client file.