Know Your Supplier (KYS): Supplier Due Diligence and Risk Guide
Know Your Supplier (KYS) is the due diligence process organizations use to verify the identity, ownership, and integrity of the vendors and counterparties in their supply chain. It is essentially the same financial-crime discipline you apply to customers, only aimed at the businesses you buy from. Before a contract is signed, KYS catches sanctions exposure, hidden ownership, and reputational risk, then keeps watching for as long as the relationship lasts.
For compliance and procurement teams, it changes supplier onboarding from a paperwork exercise into a genuine risk decision. The sections below explain what Know Your Supplier covers, how supplier due diligence works in practice, where KYS sits alongside KYC and KYB, and how continuous monitoring keeps a supplier book clean over time.
What is Know Your Supplier (KYS)?
Know Your Supplier is the systematic verification of a third-party vendor before you transact with it, plus the ongoing review of that vendor while the relationship is live. For every supplier on your books, it answers a simple question. Is this entity who it claims to be, who really owns and controls it, and does dealing with it expose the organization to legal, financial, or reputational harm?
A KYS program typically establishes the following for each supplier:
- Legal identity and registration status of the entity
- Beneficial ownership and control structure
- Sanctions, watchlist, and politically exposed person exposure
- Adverse media and litigation history
- Financial stability and operational capacity
- Environmental, social, and governance conduct, including labor and human-rights practices
Together, these checks produce a risk rating. That rating drives the onboarding decision and sets how closely the supplier is watched afterward. A low-risk stationery vendor and a high-risk overseas manufacturer should not pass through the same workflow. A mature KYS process spells out that distinction, rather than leaving it to whoever happens to pick up the file.
How supplier due diligence works
Supplier due diligence is the operational core of any Know Your Supplier process. It runs in stages. Each one narrows uncertainty before the organization commits.
Start with identification and collection. You confirm the legal entity, its registration details, and the jurisdictions it operates in, then gather the documents and data needed to verify those claims. Pull this from authoritative records rather than self-reported forms. That is the line between real verification and box-ticking.
Next comes screening and risk assessment. The supplier and its beneficial owners get checked against sanctions lists, watchlists, and adverse media, and the entity is assessed for financial and operational soundness. Findings roll up into a single risk score, which keeps the decision consistent across the supplier base.
Then the decision and tier assignment. Lower-risk suppliers clear with standard checks. Higher-risk suppliers move into enhanced due diligence, a deeper review that might mean unwinding complex ownership chains, requesting source-of-funds context, running site visits or virtual audits, and scheduling more frequent reviews.
Run this across hundreds or thousands of vendors and manual processes start to buckle. A configurable workflow automation layer routes each supplier down the right path, captures the evidence, and produces the audit trail regulators and internal auditors expect.
Supplier risk: what KYS screens for
Supplier risk is not a single thing. A credible KYS program assesses several distinct categories instead of collapsing them into one generic check.
Sanctions and watchlist exposure. A supplier, or a beneficial owner sitting behind it, may appear on a sanctions or enforcement list. In many regimes, transacting with a sanctioned party is a strict-liability problem, so screening cannot stop at the trading name. It has to reach through to the people who actually control the entity.
Concealed ownership. Shell structures and nominee arrangements exist to obscure who benefits from a contract. Identifying the ultimate beneficial owner matters here, because a clean-looking supplier can hide a sanctioned, politically exposed, or otherwise high-risk individual one or two layers up the ownership chain.
Adverse media and reputation. Negative news, regulatory actions, and litigation can flag misconduct long before it surfaces in formal records. Structured adverse media intelligence pulls these signals together and filters out the noise, so analysts review what actually matters.
ESG and conduct risk. Forced labor, environmental violations, and corruption in the supply chain now carry both regulatory and reputational consequences. Many duty-of-vigilance and supply-chain transparency laws expect organizations to identify and address these risks among their suppliers, not just their direct operations.
When these categories stay separate, a compliance team can apply scrutiny in proportion, accept manageable risk with conditions attached, and save enhanced due diligence for the suppliers that genuinely warrant it.
How KYS relates to KYC and KYB
Know Your Supplier shares its DNA with Know Your Customer and Know Your Business. What changes is the subject and the risk lens.
Know Your Customer verifies the individuals and entities you sell to or onboard as clients, mainly to prevent money laundering, fraud, and terrorist financing. KYS points that same discipline the other way, applying due diligence to the vendors you buy from.
Know Your Business, often shortened to KYB, is the closest relative. KYB verifies a corporate entity, its registration, and its beneficial owners, and it supplies much of the machinery KYS depends on. The real difference is purpose. KYB asks whether a business is legitimate and who controls it. KYS takes that foundation and adds supply-chain-specific concerns such as operational reliability, financial stability, and ESG conduct.
So in practice, a strong KYS program is really KYB applied to suppliers with extra risk dimensions layered on top. That is why KYC Hub's Global KYB solution is the natural engine for supplier verification: the same entity resolution, ownership discovery, and screening that proves a business is real and lawful also tells you whether a supplier belongs in your supply chain.
Continuous supplier monitoring
A supplier that passed due diligence at onboarding does not stay clean by default. Ownership changes. New sanctions designations land, litigation surfaces, fresh adverse media breaks, and any of these can turn a low-risk vendor into a liability between formal reviews. Check once a year and you leave long stretches where that risk sits undetected.
Continuous monitoring closes those windows. Suppliers and their beneficial owners are rescreened on an ongoing basis, and any material change fires an alert that routes to the right analyst. The program shifts from a snapshot taken at onboarding to a live picture of supplier risk.
Done well, monitoring is also efficient. Automated rescreening means analysts spend their time on genuine status changes instead of re-running clean checks. And a central record of every supplier, its risk rating, and its review history means nothing falls through the cracks. When a regulator or auditor asks what you knew about a supplier and when you knew it, you have an answer.
KYC Hub Know Your Supplier solution
KYC Hub's Know Your Supplier solution gives compliance and procurement teams one platform to vet vendors at onboarding and watch them continuously after that. It is built for the realities of trade finance and investment management, where counterparty and supplier risk sit at the center of every transaction.
A few core capabilities anchor the platform:
- Vet suppliers continuously. Onboarding checks and ongoing rescreening run from the same system, so a supplier's risk picture stays current instead of freezing at the moment of approval.
- Catch concealed ownership. Beneficial ownership discovery unwinds layered and cross-border structures to reveal who ultimately controls each supplier and whether that exposes you to sanctions or PEP risk.
- Screen widely. Sanctions, watchlist, PEP, and adverse media screening run against global data, so high-risk suppliers get flagged early.
- Centralize supplier records. Every supplier, document, risk rating, and review sits in one auditable place. No more scattered spreadsheets and email threads, just a defensible record.
Because the same screening and ownership engine powers customer, business, and supplier due diligence, organizations get a consistent risk methodology across the people they onboard, the businesses they verify, and the suppliers they depend on. That consistency is exactly what lets a KYS program scale without piling on more tools or more manual work.
