Know Your Customer (KYC) and Customer Due Dilligence (CDD)

[Jurg]

Disclaimer: this article is a work in progress.

Purpose

Know Your Customer (KYC) processes help you verify the identity and trustworthiness of your customers. This is not just good practice, in many cases, it is a legal requirement. In particular, the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) obliges financial institutions to verify the identity of their clients in order to combat financial crime.

Under this legislation, organizations must implement Know Your Customer (KYC) policies, which include conducting customer due diligence to establish a risk profile and reporting any unusual or suspicious transactions.

Compliancy processes are relevant when registering new persons or organizations in your application. There are various checks that can be performed, and various compliance service providers where you can perform those checks. Furthermore, you need to know which customer details you have to register in order to pass those checks.

Depending on your organization and the scope of your application you can define which checks to perform and where to perform them. This article aims to give an overview of all the existing KYC components, along with how to implement and how to use them.

Define your KYC process

You can categorize each step of a KYC process as follows:

1. Registration	2. Risk profiling	3. Acceptance
Collecting info on the customer, either through manual input or API connections	Conduct your Customer Due Dilligence by performing required and optional checks through API connections	Determine which check results are decisive for accepting or rejecting the customer

You can register all sorts of data to base your risk profiling on

• Organizations
  • Contact details
  • Contact persons
  • Chamber of Commerce details
  • SBI codes
• Persons
  • Contact details

You can perform checks. De Nederlandsche Bank has determined which checks are required for your customer due dilligence process.

• Required checks
  • FISH check
  • UBO check
  • Compliancy check
• Possibly required checks
  • ID/Passport check
• Optional checks
  • Credit score check
  • Creditcard check
  • IBAN check
  • IDIN check
  • Miscellaneous acceptance criteria determined by the organization

For registration, you can connect to these providers:

Provider	Data
Chamber of Commerce	Contact details, Chamber of Commerce details, SBI codes
CompanyInfo	Contact details, Chamber of Commerce details, SBI codes
RDW	…
Kadaster	…

For checks, you can connect to these providers:

Provider	Check
Solera / CIS	UBO’s, Compliancy, FISH
FRISS	UBO’s, Compliancy, FISH
VNAB*	UBO’s, Compliancy

Ask yourself:

Do you have private or business customers?

• For private customers, you can perform:
  • FISH check; to check for fraud
  • Compliancy check; to check for sanctions
• For business customers, you can perform:
  • Chamber of Commerce searches; to provide info on these customers
  • FISH check; to check the organization for fraud
  • UBO check; to find the bestuur of the customer, resulting in contact persons
  • Compliancy check: to check these contact persons for sanctions

What type of organization are you working for, and what are its required checks?

• Intermediaries have the least amount of obligations.
  • They can optionally:
    • Retrieve organization info from the Chamber of Commerce or CompanyInfo
  • They don’t:
    • Perform FISH checks, UBO checks or Compliancy checks
• Intermediaries who are also brokers have access to info/checks VNAB sanctie platform
  • They can optionally
    • Perform UBO and sanction checks
• Underwriting agencies have the obligation to conduct client due diligence
  • They are required to:
    • Perform UBO-checks and Compliancy checks for
    • Perform
  • They can optionally:
    • …
  • They don’t:
    • Retrieve info from the Chamber of Commerce (UBO-check already provides this info)
    • …

What is the scope of your application?

• If an organization has multiple applications, the required checks might already be performed elsewhere.

Which compliancy service providers will be used, and does your company already have subscriptions with any providers?

How should the KYC results be followed-up?

• Some results might lead to immediately rejecting a customer, while others require manual review

Discuss this with your company to ensure that the selected solution aligns with its internal policies, risk appetite, and regulatory requirements.

To better understand a KYC process, let’s look at a B2B example.

A policy request is made by a new customer. The customer’s employee submitting the request is not necessarily the Ultimate Beneficial Owner (UBO). Ownership may lie with other individuals or entities holding shares in the company. Therefore, the first step is to verify the organization’s details using the Chamber of Commerce API, then to identify the UBO(s) using the Solera / CIS API, and subsequently perform a compliancy check using that same API, to ensure the company and its owners meet regulatory requirements.

Set up KYC in Novulo

After defining your KYC process, you need to know how to implement it. First, let’s take a look at all the components that you can add to your composition.

Currently, Novulo supports the following components for registration:

Registration	Component
Contact details, contact persons	M3019 Novulo Relatiebeheer
SBI codes	M8763 Novulo Bedrijfsindelingen
Chamber of Commerce details	M3380 Novulo KvK bij Organisaties

The following components are created to connect with providers for registration:

Provider	Component
Chamber of Commerce	M6642 Novulo KvK koppeling
CompanyInfo	M8851 Novulo Company.Info koppeling
FRISS	M9852 Novulo FRISS koppeling

The following components exist for checks:

Provider	Component(s)
Solera / CIS	M4024 Novulo Solera ABZ koppeling (for Compliancy, FISH), M8750 Novulo UBO koppeling (for UBO’s)
FRISS	M9852 Novulo FRISS koppeling

Set up registration processes in Novulo

Basic contact registration

For the basics of the contact tables, see Datamodel: Connections, Persons, Organizations and Contacts

Chamber of Commerce registration

Adding M3380 to your composition adds fields to your data model to support Chamber of Commerce information.

You can fill these manually, with custom processes, or by using the Chamber of Commerce API.

To implement the Chamber of Commerce API, you can first test with their test API and api-key. However, for an actual implementation you’ll need a Chamber of Commerce subscription as detailed on their website.

1. Go to All apps → Application maintenance → settings.
2. Find General settings and open the first row.
   • Be reminded to pin the related tiles and panels to access all configuration.
3. Add the connection details for KvK settings.
   • Use https://api.kvk.nl/test/api/ as test-URL. Our component choose the best suffix.
     
     

To use or test the Chamber of Commerce API, take a look at M6642 in the Architect to see the processes and buttons created there. One way is to go to

1. All apps → [your application nam] → New KvK search
   • Use Basic search to get information on current contact information.
   • Use Profile search to get a basic profile with KVK-number and three sub-sources: owner, head office and branches.
     
     

Add SBI codes

Each business relationship should be assigned an industry classification, known as the Standaard Bedrijfsindeling (SBI). These codes can be used as part of acceptance criteria in workflow configurations.

Add an SBI code to a relation:

1. Go to All apps → Customers.
2. Select a business relation or customer.
3. (Add and) Click the panel or tile Industrial classifications.
   
   
4. Click on the plus icon to add a classification
   
5. Choose the classification and save.
   
   

Approximately every 10–15 years, the Kamer van Koophandel (KvK) updates the SBI classification. Most recently in September 2025. All new SBI codes are published under the provider SIVI, while older codes remain available under SIVI2023. When creating or updating new relations, it is recommended to select a code from the SIVI provider to ensure alignment with the latest standards. Older codes may still apply to existing business relations.

Both the new list (SBIA25) and the previous list (SBIAFD) can be viewed on the SIVI website. If needed, SIVI also provides a mapping table to help convert old codes to the new standard: SBI-AFD Hoedanigheid | SIVI

Import or change your settings:

1. Go to All apps → Application maintenance → settings.
2. Go to Management → Classification issuers.
   
   
3. Click the plus icon to add an issuer.

Set up checks in Novulo

Retrieve UBO('s)

1. Go to All apps → Application maintenance → settings.
2. Find General settings and select your GUID.

• Be reminded to pin the related tiles and panels to access all configuration.

11. Add the connection details for Company info (UBO).
    
    
    
    
    

Perform a manual check for a business relation:

1. Go to All apps → Customers.
2. Select a business relation or customer.
3. (Add and) Click the panel or tile UBO checks.
   
   
4. Click on the plus icon to add a UBO check.
5. Fill in the details needed.
   
   
6. Click save.
7. Click Execute UBO check.
   
   

Note: in this instruction the compliancy check was included in the UBO check.

Compliancy check

1. Go to All apps → Application maintenance → settings.
2. Find General settings and select your GUID.

• Be reminded to pin the related tiles and panels to access all configuration.

1. Go to Solera connections.
   
   
2. Add the connection details (API endpoint, credentials, tokens) for Solera (ABZ)
   
   

Automate KYC Checks

Once integrations are configured, you can automate checks in your processes. For example:

• Trigger a KVK lookup when a business customer is created.
• Run an IBAN validation when a new payout account is added.
• Periodically refresh UBO data for existing customers.

Use Novulo’s Process Designer to add these checks as automated steps or decision points in your workflow.

Tip: Add a status field (e.g. “KYC verified”) to your customer object to make it easy to track which customers have completed checks.