Know Your Customer Checks for Freight Forwarders Opening a New Shipper Account

Know your customer (KYC) is the set of checks a forwarder runs on a new shipper account before it books freight on that customer's behalf: does the company exist, who owns and controls it, is it or its consignee on a sanctions list, can it pay, and are the contact and bank details genuine. The aim is to stop fake shippers, sanctions breaches and unpaid invoices at the door, when it costs a few minutes, rather than after a container has moved. This post goes one step beyond the client onboarding checklist, which covers what a new shipper needs from you, and focuses on what you need to know about them.

Is KYC a legal requirement for freight forwarders?

It depends on where you operate and which regime applies to you, so treat any blanket answer with suspicion. Formal customer due diligence duties, including identifying beneficial owners, are written into anti-money-laundering laws that apply to named "regulated" or "obliged" sectors, usually banks, lawyers, accountants and similar. Whether a freight forwarder falls inside that list differs by jurisdiction, and in many countries a forwarder is not on it. Check with your national regulator or a local adviser.

Other duties apply more widely, whatever sector you are in. Sanctions and export-control laws generally apply to anyone who deals with a listed party, with no regulated-sector test, and data protection law governs what you collect about the people behind a customer. So even where no law says "do KYC", sanctions exposure, fraud losses and unpaid debt are reasons enough to do a proportionate version of it. For the sanctions side in depth, see Restricted Party Screening: What Exporters and Forwarders Must Check.

Step 1: Confirm the company exists and who it is

Start with the legal entity, not the trading name on the email signature. Ask for the full registered name, registration number, registered address and country, then check them against the register itself rather than a document the customer sent you. A certificate of incorporation attached to an email proves only that someone can attach a PDF.

• United Kingdom: the Companies House service lets you search by company name, company number or officer name, and shows items such as the registered address, date of incorporation, officers, previous names and insolvency information.
• United States: there is no single national company register. Each state keeps its own business registry, so search the registry of the state where the customer says it is formed.
• European Union: each member state keeps its own business register, and the European e-Justice portal offers a way in to several of them. Coverage and the detail shown vary by country.
• Cross-border lookups: OpenCorporates is an aggregator that says its records come from official registers. Use it as a finder, then confirm on the registry's own page.
• Legal entity identifier (LEI): if the customer is a larger company it may hold an LEI, a 20-character code administered through GLEIF and searchable free of charge. The record shows who the entity is and, where reported, who owns it. Most small shippers will not have one, so its absence means nothing.

Then check that the details agree across sources: the name on the registry, on the booking request, on the invoice address, and in the website domain. Check the status too. A company that is dissolved, struck off or in insolvency proceedings is a different decision from an active one. A company incorporated last month with a large first shipment and no trading history is not a refusal, but it moves the account up a tier.

Step 2: Beneficial ownership, at a sensible depth

Beneficial owners are the natural persons who ultimately own or control a company. The international standard-setter on money laundering, the Financial Action Task Force (FATF), sets out in Recommendation 24 that countries should ensure adequate, accurate and up-to-date beneficial ownership information on legal persons is available to authorities, and Recommendation 25 applies the same idea to trusts and similar legal arrangements. FATF revised Recommendation 24 in March 2022. Those are standards for governments, not direct rules for a forwarder, and countries implement them differently.

The practical consequences for you are these.

• Registers differ and some are not public. The UK register shows people with significant control, but for many countries you will find only directors and shareholders at best. In the US, FinCEN removed beneficial ownership reporting for US-formed companies in 2025, so do not expect a federal register to answer the question. The EU has also restricted open public access to beneficial ownership registers in several member states after a 2022 Court of Justice ruling (reported widely; confirm the current position in the country concerned), so access may require a legitimate interest.
• Ask the customer. A short form listing each person holding 25 percent or more, or otherwise controlling the company, is a reasonable request from a tier-two or tier-three customer (the tiers are below). The 25 percent figure is a common convention, not a universal rule; use the threshold your local rule or your insurer specifies.
• Why it matters even where it is not required: sanctions rules can reach a company that is not itself listed. OFAC's 50 Percent Rule treats any entity owned 50 percent or more, individually or in aggregate, by one or more blocked persons as blocked too. UK rules use a different formulation covering ownership and control, and the details have been under review, so read the current official guidance rather than relying on a summary.

If a customer refuses to say who owns it, or the structure runs through several jurisdictions with no commercial reason, that is information. Record it and escalate.

Step 3: Screen the customer, the consignee and the people behind them

Screen before the first booking, and again whenever the party list changes. The parties to screen are the customer, its beneficial owners and directors where you have them, the consignee, the notify party, and any named bank or intermediary. Screening only the account holder misses the usual problem, which is a clean shipper sending goods to a listed consignee.

• Use the official lists of every regime that binds you: for example the US Treasury and Commerce lists, the UK Sanctions List, and the EU consolidated list. Which ones apply depends on your jurisdiction, your currency flows and your carriers' own policies.
• A name match is a lead, not a verdict. Compare country, address and owner details before deciding it is a true match, and record the decision, including no-match results.
• A clean customer does not mean clean goods. Check the commodity, destination and end use against export controls separately.

Step 4: Credit check and trade references

KYC and credit control are separate questions that share the same paperwork. KYC asks whether you should deal with this customer at all. Credit asks how much exposure you will accept. Ask for two or three trade references, ideally carriers or other forwarders the customer has paid, and actually call or email them with the same questions each time: how long the relationship has run, typical invoice size and whether payment was on time. Pair that with a credit report where one exists for the country, and decide the limit and payment terms in writing. The mechanics, including terms, limits and chasing, are in Getting Paid: Credit Control for Freight Forwarders, and where your exposure is larger than you want to carry, trade credit insurance has its own entry requirements, including what the insurer needs to know about the buyer.

Step 5: Verify bank details and contacts through a second channel

Collect the customer's payment contact and, if you ever pay them (refunds, claims), their bank details at onboarding, and confirm them by calling a number you found independently, such as the one on the registry record or the company's own website, not the number in the email asking for the change. Name two authorised contacts and agree that any later change of bank details or approver needs a call-back to a known number. Most payment redirection fraud works because the first change request is treated as routine. The attack patterns are covered in Business Email Compromise and Bank Detail Fraud in Freight.

Step 6: Red flags for fake shippers and fictitious pickups

Fraudsters impersonate real shippers or invent them. Warning signs that justify slowing down:

• A free-mail address, or a very recently registered domain, claiming to be an established company.
• Urgency plus unusual instructions: a rush pickup, a change of consignee after booking, or a request to release cargo to another party.
• Pressure to skip steps, or a payer who differs from the named customer.
• A pickup address that does not match the registered business address, or a price far below market for the lane.

The trucking-specific versions, fictitious pickups and double brokering, are in Freight Fraud: Fictitious Pickups and Double Brokering.

When US motor-carrier or broker authority matters

Most shippers are not registered with the US Federal Motor Carrier Safety Administration (FMCSA), so there is nothing to look up. It becomes relevant when the new customer is itself a for-hire carrier or broker moving freight in the US. In that case the FMCSA SAFER company snapshot shows the operating authority status and links to licensing and insurance details, and the authority and insurance filings should match the name and address you were given. The routine for carriers is in Vetting a Trucking Carrier: MC Authority, Insurance and Carrier Packets.

A tiered approach: match the checks to the risk

Running every check on every customer wastes time, while running too few leaves you open on the largest accounts. Tier the customer on a few risk factors: how large the exposure could be, how long the relationship will run, whether the goods or destinations are sensitive, the customer's jurisdiction, and how it arrived (a trusted introduction or an unsolicited enquiry). Set your own thresholds with your insurer, your adviser and your loss history; there is no single industry number.

Prepayment is a legitimate way to keep a one-off customer in tier one, but it does not remove the sanctions or identity checks, because the money still has to come from somewhere acceptable. Move a customer up a tier when its volumes rise, its ownership changes or a red flag appears.

Records: what to keep, and for how long

Keep one short file per customer: the dated registry extract, ownership declaration, screening results, references, credit decision and call-back log. Then apply data protection law to it. Under UK GDPR and EU GDPR, personal data (the names, IDs and contact details of owners and directors are personal data) must be adequate, relevant and limited to what is necessary for your purpose, and must not be kept longer than needed. The UK Information Commissioner's Office says not to collect personal data on the off chance it might be useful later. That means collecting what the tier requires, not photocopies of every passport, and setting a retention period rather than keeping files indefinitely.

The right retention period depends on your country and sector. Anti-money-laundering rules, tax and customs record rules and limitation periods for claims each set their own minimums, and they differ. Check the local rule or ask a data protection adviser, write the period into your policy, and delete or archive when it expires.

What to do next

1. Write down your tiers and the checks each one gets, so the decision does not depend on who is on shift.
2. Turn the checklist into a one-page onboarding form and a standard file, and apply it to every new account from this week.
3. Rescreen your top existing customers against current sanctions lists and re-confirm their bank and contact details by call-back.
4. Check your local anti-money-laundering, sanctions and data retention rules with your regulator or adviser, and write your retention period into your policy.

If you are looking for forwarders or other logistics partners to work with, more than 29,300 logistics companies are searchable by country and service in the CargoLinked directory, and the public requests board lists freight that shippers have posted for forwarders to quote on directly. Run your own checks on any company you deal with, whether it is a customer or a supplier.

This article is general information, not legal, compliance, tax or financial advice. Know-your-customer, sanctions and data protection obligations differ by country and sector and change over time. Confirm the requirements that apply to you with your regulator, the issuing authority or a qualified professional.