Who are you doing
business with?
A MOODY’S STUDY INTO
ENTITY VERIFICATION

moodys.com

moodys.com/entityverification        Who are you doing business with?

01

KEITH BERRY

Executive summary
One of the key strategic goals of Moody’s compliance and third-party risk management
solutions is to help our customers answer the question – who am I doing business with?
It’s a deceptively simple question that can be very complicated to answer.

I’m excited to present the findings of our latest
study on Entity Verification, as Entity Verificationis crucial to understanding risk across yourthird-party business network, establishingtrust, managing threats, and capitalizing on
opportunities.
In today’s ever-evolving business landscape,the importance of knowing who you are doing
business with cannot be overstated. Economic andgeopolitical uncertainties, stringent compliancerules, and the challenges of data management haveheightened the need for robust Entity Verification
practices.
Our research highlights the critical role Entity
Verification plays in effective risk management andcompliance. With global business interconnectivity,
scrutiny from senior leaders on the importance ofknowing your business partners, and a dynamic
regulatory landscape, the requirements to “get thisright” are pronounced.
For me, the study underscores the growing
significance of Entity Verification data andharnessing that data to leverage it across anorganization – beyond risk and compliance – tomanage financial crime and prevent fraud ofcourse, but to also drive operational efficiencies,
and the imperative of customer experiences.

Finally, I was excited to see the journey ouraudience has been on when it comes to the rising
adoption of artificial intelligence (AI) in Entity
Verification. This is a topic we’re passionate
about at Moody’s, developing our own intelligent
screening solutions using machine learningand launching our GenAI (generative artificial
intelligence) research assistant. Again, theeffectiveness of these new technologies hinges on
data.
Circling back to where I started, helping ourcustomers answer the question – who am I doing
business with? How do you answer a simple
question, well the simple answer is with data.
The way that’s accessed, screened for insights,
managed, and controlled is a massive lever for
success.
I hope you enjoy the report and I look forward to
many more conversations on Entity Verification
with you in the future.
Keith Berry
General Manager,
Moody’s Compliance and Third-Party Risk
Management Solutions

Despite the challenges posed to many by data
quality limitations and the elusive goal of achieving
a single customer view, leading companies withadvanced data governance can create “golden
records,” and are then better positioned to achieve
competitive advantage, manage compliance, andcontrol risk.

moodys.com/entityverification        Who are you doing business with?

01

SECTION ONE

About the research
CONTEXT & OBJECTIVES
If you’re a business operating in the global
economy, how can you be sure who you’re working
with? It is a question that compliance teams
have always had to answer, but one that is of
growing importance as regulations across theworld become more rigorous and complex. Is there
an unscrupulous actor lurking in the shadows?
Is a company you’re dealing with exploiting
forced labor? Entity Verification is crucial tounderstanding the legitimacy of a business andthe risks across a company’s third-party network.
It helps establish trust, manage threats, andcapitalize on opportunities.
Thinking about Entity Verification in a context
of complex threats, sanctions continue to target
a broad spectrum of actors, including states,organizations, and entities, as well as individuals.
These individuals try hard to avoid the compliancenet and clandestine networks are establishedto keep key information hidden. Sanctioned
individuals can, for example, use a web of legal
business structures, often in the form of shellcompanies, to obfuscate ownership.
Firms, and especially compliance teams withinthose firms, walk a precarious financial andreputational tightrope. If they get the decision
wrong one-way, valuable business could be lost.
If they get things wrong in another sense, seniorleaders in the organization could face fines, damage
in the market, or even prison.
Added to this, risks across the world are rising
exponentially, becoming more widespread,interconnected, and difficult to pin down. From
understanding each company across a supply chain
to ESG (Environmental, Social, and Governance)risks or rapidly changing sanctions arising fromgeopolitical instability – companies must get
deeper into the detail of knowing who they are
working with to uncover the threats hiding acrosstheir business network.

moodys.com/entityverification

We wanted to get deeper insight into the challenges
and opportunities companies face in the fieldof Entity Verification, used to help identify andestablish the legitimacy of a business. So, we
conducted an indepth primary study to explore:• To what extent Entity Verification as a topic isunderstood by organizations across financial andnon-financial sectors.
• How important people perceive Entity Verification
to be today and how that will change in the next
two years.
• How companies rate the quality of their internal
entity data, and the maturity of their data
governance strategies.
• How close companies are to having a single
customer view and establishing a ‘golden record.’• Key challenges and barriers faced by companies
in Entity Verification.
• The extent of AI adoption, and the role Entity
Verification is expected to play in supporting therollout of AI.

METHOD
We partnered with market research
specialists, Context+, who designed,
conducted, and interpreted bothquantitative and qualitative research on
our behalf as an independent third-party.
We ran a comprehensive study whichfeatured a detailed online survey gaining
310 responses from individuals across theworld. We followed this up with 30 oneto-one in-depth interviews featuring risk
and compliance professionals in financial
and non-financial organizations to addrichness and detail.

        Who are you doing business with?

02

SAMPLEOur study was global with respondents locatedin 50 countries across the Americas, Europe
and Africa, Asia Pacific, and the Middle East.
Our research spanned professionals working
in the financial space, across banking, asset
management, fintech and insurance, as well as
non-financial organizations, including corporates,
professional services, and government bodies, toprovide the breadth of coverage that forms thebasis of this paper.

PHASE ONE

Online survey
Americas

Europe &AfricaAPAC &
Middle East

Total

Financial Services (NET)

56

88

49

193

Banking

32

51

33

116

Asset & wealth management

7

11

3

21

SectorFintech

7

16

10

33

Insurance

10

10

3

23

Non-Financial Services (NET)

47

51

19

117

Corporates (Non-ﬁnancial)

29

32

13

74

Professional services

14

15

4

33

Government & public sector

4

4

2

10

Total

103

139

68

310

Americas

Europe &AfricaAPAC &
Middle East

Total

Financial Services

3

8

2

13

Non-Financial Services

7

8

2

17

Total

10

16

4

30

Sector

PHASE TWO

One-to-one interviews
Sectormoodys.com/entityverification        Who are you doing business with?

03

SECTION TWO

Adapting to uncertainty
THE MACRO PICTURE
Risk management and compliance have become
more challenging and subsequently moresophisticated in the years following the 2008
financial crisis, the Panama papers, Russia’s
invasion of Ukraine and unprecedented rates offraud as large swathes of the world’s economy went
digital. It’s a response to the growing complexity,interconnectedness, and risks at the heart of theworld’s politics and economic systems.
The spread of digital technology has created new
ways to monitor risk, but also new ways to posethreats. Business is more global than ever, but
subsequently, economic instability in one region
can quickly spread to another. And as we haveseen in recent years in Ukraine and the Middle
East, geopolitical instability can reverberate aroundworld.
This has led to more regulation, and a more
complex risk and compliance landscape. And it has
increased the chances of organizations coming into
contact with sanctioned entities.
TRACKING THE TOP COMPLIANCE TEAM
CONCERNS
Risk and compliance is a challenging environment
to work in with many dynamic and growing
problems to get to grips with. To set the context, we
wanted to understand the key business challenges
peoplein the field
experience
today.
TOP CHALLENGES
AND CHALLENGES– TOTALTOP CHALLENGES AND CHALLENGES – TOTAL
Regulatory compliancecomplexities
Data management andquality assurance

24%

40%

14%

Technological advancements
and digital transformation

9%

Cybersecurity threats anddata breaches

5%

32%
33%

15%

Increasing AML
regulations

8%

Rises in fraud

5%

36%

20%

High rate offalse positives

Managing Director, Professional Services, UK

When we break down people’s top concerns
between financial and non-financial sectors,
we also see some illuminating results. Financial
services companies are more likely to cite
regulations and Anti-Money Laundering (AML) as
their single top issue compared with non-financials
such as corporates and professional services
firms who face a wider set of issues and are moreworried about areas like talent acquisition andworkforce management, and cybersecurity threats.
TOP CHALLENGE – BY SECTOR
27%
19%
15%
16%

Data management
and quality assurance

35%

12%
16%

31%

25%

28%

Talent acquisition andworkforce management

6%

22%

27%

Competitive market
pressures

5%

22%

27%

Backlog of work
to be done

17%

20%

Sustainability andenvironmental concerns

18%

19%

Supply chain
disruptions“Overall, regulatory compliancecomplexity is our single biggest
challenge. The complexity of
regulations cascades down into a lotof our other issues.”

Economic volatility
and ﬁnancial risks

36%

28%
26%

Technological advancement and digitaltransformation at 42% was next. Cybersecurity
and data breaches were mentioned by 36% of
people, while economic volatility and financial risks
were also cited by 36% of respondents, with 15%
mentioning it as their top concern. This highlighted
a key challenge that people faced which ran
throughout our research.

Regulatory compliancecomplexities

42%

31%

Economic volatility andﬁnancial risks

64%
46%

Regulatory compliance complexity was themost mentioned challenge, with 64% of people
reporting it and 24% choosing it as their single
most important issue. This was followed by data
management and quality assurance issues, cited by
46% of people in total and 14% as their top issue.

Technological advancements
and digital transformation
Increasing AML
regulations

8%
10%
10%
4%

Talent acquisition andworkforce management

4%

Cybersecurity threats
and data breaches

4%

Financial Services
Non-Financial Services
8%

Top challenge
10%

13%

moodys.com/entityverification

Challenge        Who are you doing business with?

8%04

With the growing complexity and stringency ofmodern compliance rules, it is understandable thatteams in both financial and non-financial industries
see this as their top concern, with 27% of financial
services companies and 19% of non-financial entities
citing this. As new rules require lower tiers of the
supply chain to be scrutinized, or owners withsmaller percentage stakes, this adds to the workloadof risk and compliance teams.

SEEING OPPORTUNITY IN ADVERSITY

As a much broader cohort, featuring highly regulatedindustries (like pharmaceuticals and energy) andnon-regulated industries (like retail), the nonfinancial sectors have a far less harmonizedregulatory framework. Depending on the sector andits size, these can encompass various regulations,such as AML/CFT, Anti-Corruption, and Corporate
Sustainability Due Diligence (CSDD), but can also
by very light touch and less complex in comparison.
Accordingly, it’s understandable that compliancecomplexity doesn’t feature as high for some in the
non-financials group.

These departments are no longer confined to thesidelines and fighting to be heard among competing
voices. They are increasingly front and center,as a raft of ongoing and emerging threats andrequirements make their skills essential to theirorganizations’ success. These include:

Economic volatility and financial risks are a featureof a global system where businesses are connected
and interdependent. Companies rely on a networkof third-party providers and vendors. Understanding
who is in your supply chain – for example where raw
materials originated from before they were processed– is an incredibly difficult task that people must now
address. And as the world becomes more digital, thisis becoming difficult. Who made each component inyour product? Who is downloading your software?
How can you be sure they are who they say they are?

Introduction of key anti-bribery and corruption
laws and their mandatory due diligencerequirement on third parties (including the U.S.
FCPA (1977), the UKBA, and France’s Sapin IIlaw), with significant implications for global
business practices, and third and fourth-party
risks

The next highest concern is data management
and quality assurance at 12% of financial services
companies and 16% of non-financials. The data
people are dealing with is complex, and the
databases that house them come from all over
the world and have a wide variety of quality andtimeliness that can be substandard. Finding the rightdata, leveraging it adequately, keeping it up to dateand ensuring it is shared widely and doesn’t end up
in different internal siloes is key to improving data
quality for everyone.

2. Corporate governance and due diligencerisks:

These challenges are attracting growing attention
from senior leaders as they focus on knowing whothey are doing business with. We are living in an eraof exponential risks, from financial to reputational
non-compliance risks, ESG, and more. Leaders will
increasingly see themselves exposed to dismissal
and even prosecution if their company gets it wrong.
“As a general rule, a competition law breachhits your share price by 5%. A bribery
allegation will take 10%, and the biggest
I’ve ever seen is a 52% hit. What we’re reallyinterested in now is the environmental hits,
the human slavery hits.”
Head of Compliance, Real Estate, UK
moodys.com/entityverification

It’s a difficult time for compliance and risk
professionals with a long list of challenges towrestle with, all stemming from growing compliancecomplexity. But at the same time, it also represents
a huge opportunity for those who can get it right. For
compliance and risk professionals, the place is here,
the time is now.

1. Regulatory and legal compliance risks:More stringent regulations across a growing
number of jurisdictions

A requirement to scrutinize deeper layers of the
supply chain (e.g., German Supply Chain Due
Diligence Act)

A need to scrutinize more and more directors
and shareholders with smaller shareholdings
Increasing sophistication of bad actors to evadedetection (e.g., via circular ownership and shellcompanies)
3. Heightened geopolitical risks:
Geopolitical tensions, and the resulting growth
in increasingly complex sanctions
Heightened awareness of personal risk to board
members from external risk factors
4. Technological and cyber risks:
Dramatic rise in AI-enabled fraud and cyber risks
Increase in cryptocurrency usage, with resulting
increase in risk
While these factors undoubtedly create a morechallenging environment for risk and compliancespecialists, it elevates their profile and makes
their voices heard like never before.

        Who are you doing business with?

05

SECTION THREE

Spotlight on Entity Verification
WHAT’S IN A NAME?

PUTTING IT INTO CONTEXT

As we’ve seen from the issues organizations arefacing, Entity Verification is a broad subject,comprising overlapping areas. People are comingat the problem from different angles based on theirorganizational needs, the industries they are in, andother factors such as how sophisticated their risk
and compliance functions are.

It’s clear from what we’ve covered so far that Entity
Verification is used broadly by different types oforganizations for many different reasons. So, we
also wanted to understand its use cases, putting ourdata into context.

It’s therefore worth defining here exactly what wemean by Entity Verification, so we are using theterm consistently and people understand whether
the respondents to our survey were comparing likewith like, using the term frequently, and whether
there was a difference between financial and nonfinancial sectors.
Entity Verification is the process of validating
the identity and authenticity of a legal entity(business or organization) to ensure they are whothey claim to be. This involves checking various
documents or data against authoritative sources
to confirm legitimacy.
The responses were revealing. While the term wasunderstood by all, its usage varies widely. The termis always or frequently used by 64% of people. When
you look at the sectoral split, 47% always use theterm in the financial sector, while it’s only 24% in
the non-financial. Those using it frequently are 21%
financial vs 33% non-financial.
What is perhaps more surprising is that 1 in 5 people
rarely or never use the term in financial institutions,rising to over a quarter for non-financials. Thatcan be explained by the array of terms being used
to describe the data used for Entity Verification.
‘Beneficial Ownership and Control’ is most often
used to refer to Entity Verification data at 79% of
respondents. Other terms like ‘Company Reference
Data’ (45%), ‘Third-Party Reference Data’ (44%) and‘Live Registry Data’ (33%) also feature highly.
Interestingly the non-financial companies we spoke
to also tend to use more generic terms like ‘Risk
Data’ and ‘Financial Strength Metrics’ more highly
than the financial sector.
It’s clearly a term that tends to be used more in a
regulated environment than in an unregulated one.
Improving understanding and ensuring a clearer
use of different but related terminology acrossorganizations and sectors will be an important stepto achieve better outcomes, share best practice, anddrive a more standardized and effective approach to
Entity Verification.
moodys.com/entityverification

Unsurprisingly, the most common are Customer
Onboarding at 78% of respondents. Perpetual KYC(ongoing Know Your Customer risk monitoring)came in at 73% and Investigations and Enhanced
Due Diligence (EDD) was cited by 71%.
ENTITY VERIFICATION USE CASES
Customer Onboarding

78%

Perpetual KYC(Know Your Customer)

73%

Investigations and Enhanced
Due Diligence (EDD)

71%

Third-Party Risk Management

58%

Fraud Prevention

53%
41%

Client Lifecycle Management
Master Data Management (MDM)

33%

Trade Credit Assessment

26%

Supply Chain Management

23%

Sales and Marketing(e.g. cross / upsell)

19%

Other use cases included Third-Party Risk
Management at 58% of people, as well as somemore surprising uses like Sales & Marketing
19%, and Supply Chain Management at 23%.
Interestingly, Supply Chain Management issignificantly higher among non-financial corporates
who need to monitor their supply chain for things
like ESG risks on an ongoing basis.
For some companies intelligent screening is apotentially important approach where things likenegative news screening on 1000s of stories eachday can help flag risks regarding a supplier orcustomer that need to be mitigated or reported.
Also of note, while use cases like gambling or crypto
currencies were at present less common, they werelikely to grow in importance as digital technology
continues to disrupt financial systems – opening
new opportunities that also have the potential for
new risks related to fraud and cyber-crime.

        Who are you doing business with?

06

“My concern is with the different
and growing use cases that Fintech
brings. It initially was just digitalassets trading on exchanges, but now
it has increased to different use cases
like buying a coffee or paying for yourtravel tickets using crypto currencies,
or money transfers.”
Head, Regulations and Compliance
Fintech, Singapore

When we asked non-users of Entity Verification
which use cases they could be likely to adopt,
customer onboarding, KYC and due diligencefeatured highly, but areas like fraud prevention andsupply chain management were also frequently cited– suggesting use cases will continue to change as thefield develops.
DEPARTMENTS, DUTIES, AND DOMAINS
Understanding where the responsibility for Entity
Verification lies and how that is likely to change
in future is an important topic. Getting it right will
help ensure data and intelligence is shared between
departments, duplication of effort is minimized, andrisks are mitigated in the most efficient way.

ENTITY VERIFICATION DEPARTMENTS OR ROLES
Compliance(incl. KYC, AML)“For a long time, EV (Entity
Verification) was a topic stored
in the ‘compliance cupboard,’
so to speak. It was seen as a bit
technical and not that interesting… but it’s starting to come outof the cupboard and into risk
management, sustainability, andother areas, as business leaders arestarting to realize, in fact, that you
could suffer a massive hit if you got
this wrong.”
Head of Compliance, Corporate, UK

The increasing profile of Entity Verification as
a fundamental business function is amplifying
calls within many organizations to centralize theirapproach. At present only 48% of respondents
had a centralized approach, with 19% taking adepartment-by-department stance and 34% taking
a hybrid approach, suggesting plenty of scope forsimplification and efficiency gains.

86%

Risk Management

63%

Credit Origination

41%

Supply Chain and
Procurement

33%

Finance and Accounting

32%

Sales and Business
Development

31%

Customer Support
and Service

31%

Data Analytics

25%

IT and Cybersecurity

24%

Marketing

At present, Entity Verification is the domain ofcompliance and risk management, though in nonfinancials there is wider use by those working in
finance and accounts. This balance may shift as thefield becomes increasingly important to other areasof a business and its significance grows.

“We run multiple legacy ways of
doing this in multiple areas of thewider business. It is expensive,inconsistent, and inefficient. We
want to take a more centralized
approach to improve these thingsand save time and effort.”
Chief Data Officer, Banking, UK

14%moodys.com/entityverification        Who are you doing business with?

07

“Our organization is maturing intoa more risk-aware culture. Entity
Verification is a component of that,and we are moving towards more
centralization of that function overthe next 12-18 months.”
Head of Financial Crimes,
Professional Services, USA
This centralization is one way to ensure a consistent
approach to how data is harvested, managed, andleveraged. That can sometimes mean taking awaysome of the tools departments are using, which
requires a significant culture change.
Timestamping of data, for example, was a relevant
illustration of this. It involves understanding whendata was collected, by whom, the timeliness of data,when it was acted upon last or passed on to clients,or third parties. Having full information on datalineage as well as a clear audit trail is a fundamental
need and one that is far easier to achieve when
operations are centralized and performed by a single
team.

Total

ImportantFinancial Services

THE IMPORTANCE OF ENTITY VERIFICATION“Entity Verification is the absolute
bedrock of everything a bank does.”

Not important
Non-Financial Services

40%
55%

Compliance Director,
Professional Services, USA

Head of Financial Crime Investigations,
Banking, France

IMPORTANCE OF HAVING REGISTRYDATA TIME-STAMPEDVery important“I need metadata for when
documentation was updated in oursystem, when it was updated in theparent system, when Companies
House got it, when our data provider
got it, and when the client got it. I
need a full trail from start to finish ofthat document. I need to understandthat I’m using fresh and up-to-date
data that is within the timelines ofwhat the client is requesting.”

63%

As the above quote suggests, Entity Verification is ofvital importance to many organizations dealing withrisk and compliance associated with third parties. In
fact, 90% of respondents told us that it’s essential orimportant (64% essential, 24% important).

IMPORTANCE OF ENTITY VERIFICATION
39%
30%

Essential

Total

25%

ImportantModerate

Limited

64%

Not Applicable

24%

7% 4%

15%
12%
2%
1%

11%

4%
1%

As we can see, timestamping of primary source
entity data is very important for 55% of all
respondents and important to 30%. And when you
look at Financial Services more people identify it asvery important, reflecting the highly regulated natureof business in this sector. The requirement to base
Entity Verification on real-time entity data comingfrom primary sources, with a full audit trail outlining
when the data was pulled from which source, isbecoming increasingly important across regions.

moodys.com/entityverification

Americas

57%

28%

8% 4%

Europe &Africa67%

APAC &
Middle East

70%

21%

7%

Financial
Services

70%

21%

3%4%

NonFinancial
Services        Who are you doing business with?

54%

22%

29%

6% 5%

13%

08

3%

Within financial services, that rises to 70% ranking
it as essential and 21% important. Even in nonfinancial sectors, only 16% of people were saying it
was of moderate or limited importance.
It’s unsurprising given the increased scrutiny on
the need for effective Entity Verification. Senior
management are beginning to recognize theheightened risks and complexity in the complianceworld and the need to demonstrate an elevated levelof due diligence to regulators. Entity Verification
provides the solid foundation for compliance. And
as the quote above states it is the bedrock, without
which the rest of screening and compliance arepotentially going to falter.
So, when we asked people if they saw theimportance of Entity Verification changing, almost
everyone said it would remain stable (27%) or
increase in importance (73%), with no one surveyed
thinking its importance would decrease in the next
two years. In financial services up to 79% believe it
will grow in importance.

MAPPING THE MOTIVATIONSWhat is driving organizations to prioritize Entity
Verification? As we saw at the start of this paper,companies face a growing set of challenges andcomplexities in the risk and compliance landscapeand the move towards Entity Verification is being
driven by these factors. From Enhancing Risk
Management and Due Diligence (86%) to Evolving
Regulatory Requirements (72%), Improving Customer
Identification and the Ultimate Beneficial Owners(UBOs) (71%), or Improving Due Diligence (70%), thetop responses driving the focus on Entity Verification
should all feel familiar.

“In my opinion, for the overall
success of compliance related work
any organization takes for its clientsor businesses, Entity Verificationis the number one priority. Also, tokeep up with required AML and CTF
policies and procedures this for sureplays a vital role.”
Head, Regulations and Compliance,
Fintech, India

Among non-financial services respondents,
Corporates are quick to flag supply chain complexity,
and the risks from bad actors who are becoming
ever more sophisticated. There’s also a heightenedawareness of Entity Verification as part of a wider
risk framework among unregulated companies. And
finally, Professional Services cite the additional
factor of wanting to demonstrate risk robustness as
part of their wider appeal to customers.

“Put simply, we need to make surethat those whom we are transactingwith are not involved in any businesswe deem inappropriate.”
VP, Third-Party Risk Mgt. Corporates, USA

More creative uses of data like Enhancing Marketing
Quality (11%) or Improving Customer Experience(31%) rank further down the scale.
And when we look between financial and nonfinancial sectors, some clear themes and differences
become apparent.
Among financial services respondents, there is arecognition of Entity Verification as a precondition
for other risk screening activities. There is thepressure to meet ever-more stringent regulations,as well as a desire to increase automation which
demands financial entities know exactly who they
are dealing with before letting a computer handle
the more process-driven side of things. Banks also
cite a desire to improve customer experience andstreamline onboarding, with specific regions (e.g.,
East Asia, Africa) noting this as challenging.

moodys.com/entityverification        Who are you doing business with?

09

LAYING A STRONG FOUNDATION
From what we have seen and heard, far frombeing another step in the risk and compliance
process, Entity Verification should be viewed as thefoundation upon which other processes are built.

Reputational Risk

Regulatory /Compliance Risk

Resiliency /Operational Risk

Cyber
Risk

ESG /
Sustainability
Risk

For many risk and compliance professionals, thesechallenges provide a real opportunity to elevatetheir organization’s approach to Entity Verification
and KYC more broadly and get internal traction andattention for their work. It’s a process that is vitalin today’s world of exponential risk and growing
compliance complexity. And it’s one that needs
continual renewed attention from onboarding
to ongoing monitoring as compliance and riskfunctions face dynamic challenges in a rapidlychanging environment.

Financial Performance Risk

Entity Veriﬁcation

Without effective Entity Verification, it’s impossible
to know with certainty you are evaluating thelegitimacy and trustworthiness of the right company
and its related entities. You cannot know if you’relooking in the right place along a supply chain
for ESG and sustainability risks or know you areprotecting yourself from cyber threats. These issues
can leave organizations exposed to operationalrisks like bad debts or loss of customers, and more
importantly, it opens the threat of falling foul of
AML/KYC regulations with non-compliance risks.
At the top of the ladder, companies’ reputations areon the line. In a digitally connected world, when bad
news travels fast, reputations are what businesses
live and die by. And protection from reputationalrisk can begin with Entity Verification.

“A recent Harvard article
that said a CEO of a major
corporation is more likely to
be fired for an ESG-related
issue than for a failing to meetfinancial targets. It’s becoming
more and more important tounderstand who you’re dealing
with and what they really are.”Head of Compliance, Real Estate, UK

moodys.com/entityverification        Who are you doing business with?

10

SECTION FOUR

The devil is in the data
DATA MATURITY
Getting into the details of the issue, the ability toverify the details of any entity ultimately depends
on the information and data that is sourced.
Consequently, it’s important to look at data maturity
and data governance when considering how wellorganizations will perform.
The results are telling, with nearly two out of
three describing their data as ‘Inconsistent’ or‘Fragmented’. In other words, 62% see their data as
low quality.

High costs at 46%; challenges in keeping data up
to date in a timely manner, 44%; inaccuracy ofdata 43%; and integrating new data sources withlegacy systems 40% – all feature high on the list ofchallenges.
DATA MATURITY CHALLENGES
Data fragmentation andsiloes across departments

51%

High costs associated with data
management and compliance processes

46%

Challenges in updating data
in a timely manner

44%

Inaccuracy of data

43%

Integrating new data sources
with existing systems

40%

Limited access to reliablethird-party data sources38%

Duplication of data leading
to inefﬁciencies

37%

Maintenance and managementof systems/APIs

34%

Difﬁculties with
Entity Veriﬁcation

32%

Ensuring data privacy andcompliance with regulations

32%

DATA MATURITY
24%

38%

22%

13%

3%

Fragmented

Inconsistent

CleanHigh Quality

Superior

With only 16% of companies rating their data as
superior or high quality, there is significant progress
to be made. A huge 84% see significant limitations intheir data.
When we break it down between sectors, morethan 1 in 4 in financial services companies see
their data as fragmented, with 35% describing it asinconsistent.

“I think most companies don’t thinkenough about their data systems.
They’ve just got used to them anddon’t think about what more insights
the base data can provide about
what they’re doing, to make themmore efficient and avoid duplication.”
Head of Compliance, Corporates, UK

RUNNING THE NUMBERS
When it comes to explaining why, companies face a
myriad of data challenges. Data fragmentation andsiloes across departments tops the list at 51%.

moodys.com/entityverification

And the data picture is changing all the time, often
for the better as new technologies improve the quality
and accuracy of information available. But with somuch data out there in the world, dealing with vast
amounts of information, having to check its accuracy,and dealing with countless sources of widely varying
quality needs constant attention, which is time
consuming, even for the biggest companies.
Dealing with fragmentation between different
business areas is important to improve data maturity
across organizations and ensuring that data harvested
in one part of the business, like onboarding, is madeavailable to others, like Enhanced Due Diligence.

“Lots of data is fragmented andthat’s to do with the organization.
Onboarding is owned by one area,
then EDD is another area. So, it’s
making sure that those dots are
all joined. Really it needs to be inmachine readable format if we reallywant to get things joined up.”Compliance Manager,
Credit Management, Sweden        Who are you doing business with?

11

WHAT’S IMPEDING PROGRESS?
There is widespread recognition of the detrimental
impacts of poor data maturity. These include
compliance risks and potential penalties which 62%
of people mentioned. Also at 62% were operational
inefficiencies and higher cost. And challenges in
Entity Verification leading to missed KYC/AML
issues was cited by 60% of respondents.
What’s stopping companies from addressing thesewell-known issues? Well, concerns about high costs
understandably top the list with 58% of people
feeling this is a barrier to reaching data maturity.
Given these systems’ primary function is to protect
against losses rather than generate revenue, proving
the value of investments is difficult, particularly
when budgets are already stretched.
BARRIERS TO REACHING DATA MATURITY
High costs of integrating andmaintaining data systems

58%

sources into internal tools. Systems and data in
one country may be vastly better or worse than in
another, this provides incompatible information orleaves gaps in the Entity Verification process.
Even internally, transparency of data can be poor
with information on the same entity held in multiple
places. And obviously the cost of accessing theright databases and systems can be prohibitive toprogress, particularly for small organizations.
TOWARDS ENHANCED DATA GOVERNANCE
It’s clear governance problems are at the heart ofissues many organizations are facing with theirdata. Many people we spoke to talked about havingrobust frameworks and strategies in place todictate how data was dealt with. The problem lay inensuring those frameworks were followed. With araft of systems to navigate (some of them outdated)and different teams logging information, ensuring
data is recorded accurately and in a timely manner
is a challenge. Data governance is clearly a work inprogress, with fewer than 1 in 10 firms describing
themselves as ‘advanced’ in data governance, withmost in the ‘developing’ phase.

Ineffective collaboration
across business units

40%

Obsolete or inadequate
technology platforms

37%

Limited access to high-quality,
veriﬁable third-party data

37%

Inadequate tools for effective
Entity Veriﬁcation and validation

33%

Resistance to organizationalchanges in data culture30%

Absence of robust data
governance frameworks

29%

Leadership's reluctance toinvest in data infrastructure26%

10,000+ FTEs

Deﬁciency of data literacy
and management expertise25%

1,001-10,000 FTEs

11%

<1,000 FTEs

15%

DATA GOVERNANCE MATURITY: BY COMPANY SIZE

Ineffective collaboration and the data fragmentation
we just spoke of are another barrier to effective
data maturity – cited by 40% of people. Data
fragmentation includes the challenge of reconciling
multiple external vendors’ data with internal
records.
Then platform challenges and obsolete orinadequate technology (37%) is another widelyreported problem impeding access to high-quality
data and adequate screening tools.
THIRD-PARTY PROBLEMS
There is also a large degree of dissatisfaction withmany of the tools used for Entity Verification, due topoor third-party data quality (37%) and inadequate
solutions for effective Entity Verification andvalidation (33%).
These issues stem from a reliance on multiple
technologies which face integration issues,particularly combining multiple external data

moodys.com/entityverification

Non

Nascent

Developing

MatureAdvanced

8%

13%

49%

23%

6%

existent

5%

46%

34%

57%

21%

11%

23%

48%

6%

14%

As the chart shows, size matters. Larger companies
rate their governance better, with 45% viewing it as‘Mature’ or ‘Advanced’. That compares with only 15%
in small companies and 29% as an average acrosscompanies of all sizes.

“Even though we have data
governance in place for new data,
we still have a whole bunch of legacy
suppliers we need to work on. It’s nottied together. We can’t see it end-toend. We have different teams thatwork inside those protecting each of
the areas.”
Global Head - Risk & Compliance,
Corporate, USA        Who are you doing business with?

12

The organizations that are leading the way in data
governance are more likely to have a Chief Data
Officer in place. And they are also more likely tomake it a priority for discussion at board level, with
50% of companies with advanced or mature data
governance making this a top priority vs. only 22%of those who rate their governance as developing
or worse. Put simply, when it is a priority at board
level, data governance is more likely to improve andbe mature or advanced. And when you look at thebenefit that delivers, clear robust data governanceis a target to strive for.

moodys.com/entityverification
moodys.com/entityverification		

BENEFITS REALIZED FROM DATAGOVERNANCE STRATEGY: TOP 6

Improved data quality and accuracy

82%

Strengthened risk management and security measures

72%

Enhanced operational efﬁciency and reduced costs

70%

Facilitated compliance with existing and new regulations

69%

Reduced fragmentation of data among organizational siloes

62%

Provides holistic view of clients and / or third parties58%        WhoWho are you doing business with?

13

SECTION FIVE

The elusive goal: a single customer view
Given the vast problems people face with competing systems and data fragmentation, moving towards a single
customer view of each entity seems like the ideal level of data maturity all companies should work towards. But isthat realistic or even achievable? Would the costs outweigh the benefits? And how far along that road do people
currently see themselves?
TO WHAT EXTENT HAVE YOU ACHIEVED A SINGLE CUSTOMER/COUNTERPARTY VIEW
Fully achieved

14%

Total

Americas10%Europe & Africa

11%

37%

30%

10%

Slightly achieved

37%

35%

16%

Financial Services

Partially achieved

33%

Not achieved

9%

7%

10%

8%

46%

26%

APAC & Middle East

Non-Financial
Services

Mostly achieved

37%

18%

29%

41%

41%

29%

Only a small minority of respondents have fully
achieved a single customer view at 14% – mostly
top-tier banks and small fintechs. Over half claim
to be some way from this goal. When we lookat different regions, APAC and the Middle East
are performing best, with 66% ‘Mostly’ or ‘Fully’
achieved. Europe and Africa lag at only 41% in thisbracket, reflecting a less mature approach to dataand perhaps a reliance on multiple third-party
databases.
Financial services also trail non-financials, whichis reflective of the more stringent compliancerequirements in the sector, causing businesses
to rely on multiple sources of data, as well as acontinued dependence on outdated legacy systems
created in the early days of AML and KYC.

8%
11%
8%
10%

5%
8%
6%
9%

There is also a strong correlation with data
governance among firms reporting the strongest
single customer view. Two thirds have advanced
data governance and Master Data Management(MDM) with more centralized budgets for achieving
a single customer view. Clearly those businesses
who invest in the data governance strategies we justspoke of are closer to reaching a single customer
view - one enables the other. Conversely, threequarters of those with limited single customer
view have only a nascent or non-existent data
governance strategy.

LEADING THE WAY
What makes leading companies different? Well, thecompanies that are more advanced in their progress
towards a single customer view have implemented
a wider range of measures including establishinga data governance framework (reported by 56% of
those with a fully achieved single customer view)and engaging in ongoing staff training (56%).

moodys.com/entityverification        Who are you doing business with?

14

CASE STUDY:HOW CLOSE ARE YOU TO HAVING A ‘GOLDEN RECORD’

MAKING A DIFFICULT CALL

(ON 1 TO 10 SCALE, 10 IS HIGH)
1 or 2 (out of 10)

A European bank we spoke to has made great
advances in their Entity Verification efforts,
investing significantly in creating a centralized
data view and appointing a Chief Data Officer
to lead these efforts. Getting senior buy-in andboard level attention has unlocked investment
and unified efforts towards achieving acentralized, single customer view.
But despite progress, challenges remain withdata integration and GDPR compliance hurdles
impeding their ability to share Entity Verification
data across markets. Avoiding information
siloes and achieving a single view is difficult, as
legacy systems with overly manual processes
hinder full automation and a positive, seamlesscustomer experience.
Efforts continue to move towards fullautomation for better reliability and fasterprocessing, but that goal remains some way off.
The case highlights that even advanced banking
systems face barriers to Entity Verification andobstacles in achieving seamless, centralized
data management.

Total

8%

16%

Americas7%17%Europe & Africa

8%

20%

APAC & Middle East

8% 5%

3 or 45 or 6

7 or 830%

9 or 10

36%

22%

11%

41%

13%

38%

23%

29%

5%

44%

21%

Financial Services

8%

14%

32%

33%

13%

Non-Financial
Services

7%

18%

26%

41%

8%

Only 1 in 10 firms claim to have a ‘golden record’, withfirms in Europe & Africa claiming to be further away fromthis goal with only 5% of respondents stating they had
achieved this. It suggests a gap in efficiency and overall
compliance risk between different regions.
It also appears a two-tier system is emerging, with firms
who have fully or mostly achieved a single customer view
overwhelmingly closer to having a golden record. This
could potentially create a performance advantage in futurewhen compared to peers with less developed systems.
COMPANIES THAT HAVE ACHIEVED A SINGLE CUSTOMER
VIEW ARE MUCH CLOSER TO HAVING A ‘GOLDEN RECORD’
1 or 2 (out of 10)

Total

8%

3 or 416%

5 or 6

7 or 830%

9 or 1036%

11%

IN SEARCH OF THE ‘GOLDEN RECORD’
The ultimate goal for companies involved in Entity
Verification – the holy grail – is what’s called theGolden Record.

The Golden Record in master data
management refers to a single, accurate,and complete version of data for a specificentity. It serves as the authoritative sourceof truth for that data, ensuring consistency
and reliability across all systems andprocesses.
The Golden Record helps improve data
quality, decision-making, and operational
efficiency.

Fully / Mostly
achieved

4% 13%

Partially
achieved Not achieved

14%

60%

24%

46%

15%

TOWARDS A JOINED-UP APPROACH
There is almost unanimous agreement around theinterdependence of Master Data Management(MDM), Customer Lifecycle Management (CLM)
processes, and KYC controls, with 9 in 10 people‘Agreeing’ or ‘Strongly Agreeing’.
AGREEMENT WITH STATEMENT
Agree strongly

Total

Americas
Europe &Africa

Agree

60%

59%

        Who are you doing business with?

Disagree + Disagree strongly

30%

12%
9%
26%
10%

24%

65%
50%

9%

31%

71%

Financial
Services
NonFinancial
Services

Neither

32%

54%

APAC &
Middle East

moodys.com/entityverification

22%

41%

5%4%

15

THREE KEY THEMES EMERGE AS TO THE
INTERDEPENDENCE OF KYC, CLM AND MDMi) the criticality of data quality and integrity;ii) the interconnectedness and synergy between
these processes;iii) the direct impact on business outcomes when
this is in place.
By understanding how MDM, CLM and KYC are
intrinsically linked and working to improve eacharea in union will ultimately lead to superior
operational efficiency, strengthened regulatorycompliance, and a positive impact on customer
experience.

SECTION SIX

To AI, or not to AI?
CONNECTING INTELLIGENT TECH

Perhaps what is more telling is the trend in uptake
compared to a Moody’s study conducted in 2023:
COMPARISON OF STUDIES
49%

Entity Veriﬁcation study 2024
AI study 2023

AI. You may have heard about it recently. In fact,
you would have struggled to miss it. From financeto the legal profession to marketing and healthcare– if you have kept up with any tech news in the last
18 months, you will have heard that AI ‘changes
everything’. And it probably will. But it is not
happening quite yet in this field. Because despite
the hype, only a small minority (11%) of companies
are actively using AI for compliance and risk
management.
However, many are now in the pilot phase (29%) andothers are considering its use (38%).

“We are in the trial phase. We
are one step behind the businesswhere it is more widely adopted
among different units, due to
Not being a profit center … soany priorities with technology,
innovation, go to the businessfirst because that’s where they
make money.”
SVP, Risk & Compliance,
Corporates, Hong Kong

moodys.com/entityverification

38%
29%
21%

11%

22%

21%

9%

AI is actively
being utilized

We are currently in We are considering
the trial or pilot phasethe use of AI

We are notconsidering using AI

There is clearly growing use of AI for risk andcompliance with more companies moving fromconsideration to trial and usage, while morecompanies are actively encouraging the use of large
language models (LLMs).
As with any new technology, it is importantcompanies are aware of the risks as much as thebenefits – identifying the potential of bad actors
to use these tools to subvert Entity Verification, or
the multiple ways things could go wrong when they
are used internally. That involves being on the front
foot and exploring and trialing new and developing
technology as it becomes more sophisticated.
In this endeavor, size matters. Larger companies
are more likely to use or trial AI as they see
opportunities to automate tasks and standardize
the quality of areas like customer experience. But
the trend towards AI is clear, with ongoing shifts
towards acceptance, encouragement, and adoption,
as more companies take a positive stance on AI,
driven in large part by the rise in the use of safer,private LLMs.

        Who are you doing business with?

16

ENTITY VERIFICATION AS AN ENABLER“If there is garbage in, thengarbage out. If I start with things
that I don’t trust or I can’t prove,or it’s making a mess, there’s no
way I’m going to end up with theproper compliance answer.”

AI is coming to a risk and compliance team near
you soon. But how is it going to be used with Entity
Verification? Do you use Entity Verification data toenhance the data you use for AI, or do you use AI toclean the data before verifying an entity? There is aclassic chicken and egg situation here.
The answer comes back to the quality of data. Gooddata quality is essential for effective AI adoption
because AI’s usefulness depends on having
confidence in the data going into it.

VP, Third-party Risk Mgt.
Professional Services, USA

Accurate Entity Verification – and having effective
Master Data Management – is a fundamental
prerequisite for effective AI. And while manyfinancial services players are trialing AI, special
attention is being paid to the quality of the Entity
Verification data being put into it. When you get
it right, Entity Verification first enables and thenenhances AI technologies.
ROLE OF EV IN ENHANCING AI TECHNOLOGIES
CriticalValuable but not essential

Total

27%

Americas27%

Europe & Africa

Non-Financial
Services

Currently not utilized

50%

12%

46%

21%

9%

22%

48%
53%

4%
21%

55%

29%

12%

23%

48%
38%

APAC & Middle East
Financial Services

Minor role

7%
11%
13%

11%
13%

There is broad agreement – 77% of people – on the positive role of Entity Verification in enhancing the accuracy andeffectiveness of AI technologies, particularly in compliance and risk management. In APAC and the Middle East,
that rises as high as 93%, again reflecting more sophisticated, technology-led approaches in this region.

moodys.com/entityverification
moodys.com/entityverification		        WhoWho are you doing business with?

17

SECTION NINE

Key takeaways& conclusion
As we have seen, Entity Verification has never been more relevant. From geopolitical tensions to stricter regulations
and a need to get deeper into supply chains, there are many factors driving this shift. But data and organizational
obstacles persist. By overcoming these challenges and others, companies can unlock better clarity in relation to
the third-party entities they are dealing with, improving their risk and compliance processes across their entire
organization.

are highly uncertain times,
01 Thesewith high levels of risk, but thischallenges include siloes,
05 Datapoor accuracy and the costs of

Verification is perceived as
02 Entity
important, and is widely predicted

is some dissatisfaction with
06 There
the quality of tools and data for EV,

important, EV is still more
03 Thoughvisible to risk and compliance roles,

a single customer view is still
07 While
elusive, more advanced companies

provides risk and compliance teams
with the opportunity to be heard bysenior management.

to grow in importance; use cases
are expanding as new instruments
emerge (e.g., crypto).

and its impact is not fully visible
among the wider business andsenior leadership.

remediation, as well as effective
integration of internal / external
data.

not least due to the lack of clear
data lineage.

are more likely to have senior buyin, and to have implemented moremeasures.

Verification needs to be
and LLM (Large Language Model)
04 Entity
08 AIadoption
considered as the essential bedrock
continue to progress, albeit
underpinning all third-party risk
management, with a direct link to the
avoidance of reputational damage.

not quickly. EV is considered bymany as the key to unlocking AI,
by ensuring data accuracy.

As digital technology continues to develop, companies must ensure they are positioned to seize the opportunities it
presents. Ensuring they have access to high quality data, good levels of data maturity, and data governance unlocks
the door to effective Entity Verification, which in turn, enables the use of AI in this sphere.
And as we learned from our research, good Entity Verification is the foundation on which companies can protect
themselves against many other risks. It is what enables effective Master Data Management, Customer Lifecycle
Management and Know Your Customer activities.
When you see it in this light, it couldn’t be more important. Those companies that can overcome these challenges
will be best placed to avoid the multiple risks associated with poor Entity Verification, having a better answer to thequestion “Who am I doing business with?”
moodys.com/entityverification        Who are you doing business with?

18

GET IN TOUCH

Contact
information
Please get in touch with the team at
Moody’s to discuss Entity Verificationand how to solve your risk andcompliance challenges. Access real-timedata from commercial registers and tax
offices worldwide via our single platform
for secure and seamless verification.
Visit moodys.com/entityverification for
more information.

AMERICAS+1.212.553.1653
clientservices@moodys.com
EUROPE+44.20.7772.5454
clientservices.emea@moodys.com
ASIA (EXCLUDING JAPAN)+852.3551.3077
clientservices.asia@moodys.com

moodys.com/entityverification        Who are you doing business with?

19