Why KYC Software Looks Different in Insurance
Most KYC software is built for banks. It assumes a retail customer who opens an account, passes a check and stays put. MGAs and brokers end up adapting those tools to a very different shape of business, and the seams show.
Your firm’s risk sits as much in the counterparties around you as in the policyholders you serve. Capacity providers, coverholders, sub-brokers, TPAs and introducers all sit in your distribution chain, and each one carries conduct, financial crime and reputational risk back to you. Regulators know this. In its review of commercial insurance intermediaries, the FCA found that about half of the due diligence files it reviewed were inadequate, and that risk assessments relied on too few risk factors. That review dates from 2014 and focused on bribery and corruption controls, but the finding about thin due diligence files still describes what many firms recognise in their own records.
This post covers what KYC compliance software must do for an insurance firm, how KYC and KYB fit together across delegated authority, what the 2026 rule changes mean for your checks, where bank-built tools fall short, and the questions worth asking any vendor.
What KYC Compliance Software Must Do for an Insurance Firm
At its core, the software has to do seven jobs well: identity and business verification, ultimate beneficial owner (UBO) identification, PEP, sanctions and adverse media screening, risk scoring, ongoing monitoring, and a complete audit trail. If any one of those is handled outside the system, in an inbox or a spreadsheet, you have a gap that an auditor will find.
The most common mistake is treating KYC as an onboarding step. It is a continuing obligation. A counterparty that was low risk at onboarding can change ownership, pick up a sanctions designation or lose a licence six months later. Good software runs ongoing monitoring and raises alerts on trigger events, so your team reacts to change rather than discovering it at the next annual review. Our guide to PEP and sanctions screening covers how that screening should work day to day.
Evidence matters as much as the checks themselves. The system should produce management information that shows how each decision was reached: what was checked, which sources were used, who approved the outcome and when. That is what lets you evidence outcomes to the FCA rather than reconstruct them under pressure. If you want a working checklist to test your current process against, our KYC and KYB checklist for insurance firms is a good place to start.
The FCA put the stakes plainly in the same thematic review:
The wider cost of getting this wrong is large. GOV.UK estimates that money laundering costs the UK economy at least £100 billion a year, which is why customer due diligence stays a regulatory priority across every sector, insurance included.
KYC and KYB: Why Delegated Authority Chains Need Both
KYC verifies individuals. KYB verifies businesses: their legal status, ownership, directors and licences. When people search for “KYC checks for companies”, they are really asking about KYB, and the difference matters because most of your counterparties are firms, not people.
An MGA or broker needs both across the distribution chain. On the individual side, you need to verify directors, UBOs and persons with significant control (PSCs). On the entity side, you need to verify coverholders, capacity providers, sub-brokers and other firms you place business through or rely on. A KYB check that stops at the company name, without looking through to the people who own and control it, leaves the real question unanswered. Our guide to ultimate beneficial owner (UBO) checks explains how to follow ownership through layered structures.
The point where this becomes operational is the terms of business agreement. Your onboarding evidence and your contract terms should meet in one record. If a counterparty’s due diligence file lives in one place and its TOBA lives in another, nobody can easily answer whether the firm you are trading with is the firm you checked. Joined-up TOBA management software closes that gap, and it is worth testing any KYC system against it. For a broader view of how the two disciplines work together, see our overview of KYC and KYB for insurance.
What Changed in 2026 and What It Means for Your Checks
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) are the main change. According to VinciWorks, most provisions took effect on 30 June 2026. The changes include sterling thresholds, enhanced due diligence (EDD) wording aimed at “unusually complex or unusually large” transactions, and mandatory geographic EDD limited to FATF “Call for Action” countries.
Be careful about how far you read this across to your own firm. VinciWorks does not address insurers specifically, so your compliance lead should confirm how the amendments apply to your regulated activities before you change any process. What you can do now is check that your software lets you adjust risk rules without a vendor project.
Companies House identity verification is the second moving part. DWF reported in August 2026 that compulsory verification, and the registration of filing agents as authorised corporate service providers, is now expected no earlier than November 2027, with at least six months’ notice. Treat that as preparation time, not a reason to pause. Firms that map their counterparties and their current verification gaps now will not be scrambling when the date firms up.
The practical lesson is that rules keep moving. Your software needs configurable risk rules, and it needs a record of which version of your policy applied to each decision. Without that, you cannot show a regulator why a check made in March was reasonable under the rules and policy in force in March.
Where Bank-Built KYC Tools Fall Short for MGAs and Brokers
The gap is simple to describe. Tools built for retail onboarding assume a customer journey: an individual applies, is checked and is approved. They do not assume a network of counterparties linked by TOBAs, binders and licences, where the same firm may appear in several roles across your business.
The failure modes follow from that design:
Checks get duplicated across partners, because each relationship is treated as new. Refresh dates live in spreadsheets, so monitoring depends on someone remembering to look. Different teams hold different views of the same counterparty, with no shared record. And per-check pricing can punish exactly the behaviour you want, because every re-screen and every monitoring cycle adds to the bill.
Onboarding friction is a real commercial cost across financial services. Research from Fenergo, reported by FinTech Global in October 2025, found that 70% of the 600 senior executives surveyed at banks, asset managers and fund administrators said they had lost clients in the past year because of slow onboarding. That is a banking sample, not an insurance statistic, and it should not be read as one. It is useful as a signal of how much slow, manual onboarding costs firms that rely on it. For a closer look at the problem in your own market, see our page on broker onboarding delays.
How to Evaluate KYC Compliance Software: Questions to Ask
Vendor demos tend to show the best case. These questions are designed to surface how a system behaves on the awkward days, and they work whether you are comparing two vendors or reviewing the one you already have.
- Does it verify businesses and their ownership as well as individuals?
- Does it monitor continuously and alert you when something changes?
- Does it cover insurance licences and regulatory status, not just company registration?
- Can several teams see one record per counterparty?
- Can you export an audit-ready evidence pack for a given decision?
- How are data sources and refresh frequency disclosed?
- How long does implementation take, and who owns the rules afterwards?
Ask for answers in writing, and ask to see each one working on your own data rather than in a prepared demonstration.
On cost, look beyond the licence fee. Staff time spent on manual refreshes, chasing documents and rebuilding evidence usually outweighs the licence cost, and that time is hardest to see when it is spread across several people. Ask each vendor to explain how its pricing behaves as your counterparty count and monitoring frequency grow. If a system makes your team’s routine work slower, the saving on the licence is not a saving.
How REG Supports KYC and KYB Across the Distribution Chain
REG Network brings counterparty onboarding, monitoring and document exchange into one place. It supports KYC and KYB checks, UBO, PEP and sanctions screening, and audit-ready records, giving you a single source of truth for each counterparty. Because the checks, the documents and the monitoring sit together, your teams get real-time visibility of the same record, with compliance embedded in the way you onboard and manage relationships rather than added afterwards.
For structured counterparty risk assessment, REG Risk 365 gives you a consistent way to assess and record the risk each counterparty presents. Where your firm needs to share and exchange compliance information with partners, REG Exchanges supports that as well.
The platform is used by more than 400 businesses and covers more than 38,000 counterparties across 180 countries. Clients include CNA Hardy, Ageas, Atrium, Arc Legal Group and Lorega.
KYC software for insurance has to follow the distribution chain, not just the policyholder. Your risk sits in the capacity providers, coverholders, brokers and introducers around you, and your checks need to reach them, look through to their owners and stay current after onboarding.
The stakes are clear. Weak due diligence files and manual refresh cycles are exactly what regulators find, and they are hard to defend once found.
The 2026 rule changes and the delay to Companies House verification give you a window. Map your counterparties and your current checks now, find where evidence is thin or out of date, and use the time to move from reactive to proactive risk management.
