Solutions · KYB / UBO

KYB & UBO verification — 27 official registries, one MCP endpoint

AI agents and compliance teams that need Know-Your-Business and Ultimate-Beneficial-Owner data, sourced from the government's own register rather than a normalised aggregator. Live queries, verbatim upstream payload, identifiers that round-trip back to the statutory portal — and the cross-border fan-out built in, so an LLM can walk a multi-jurisdiction ownership chain in a single prompt.

What this gives you

Source-of-truth data

Every call hits the upstream government API live. No scrape-and-cache layer, no normalised re-shaping.

27 jurisdictions, one schema

Unified envelope across UK, EU, EEA, Crown Dependencies, APAC. Verbatim jurisdiction_data preserved underneath.

Cross-border chain walking

One MCP prompt walks UBO across up to 30 jurisdictions. No manual ID stitching across aggregators.

MCP-native, OAuth 2.1

JSON-RPC over Streamable HTTP. Anonymous tier free. No API key — Dynamic Client Registration per RFC 7591.

The 5-call KYB / UBO workflow

A complete cross-border UBO trace fits into five MCP tool calls. The same shape works whether the target is a UK Ltd with a UK PSC chain, a French SAS owned by a Luxembourg holding, or a Cayman fund vehicle with statutory gating. The agent decides where to recurse and where to stop.

// 1. Resolve the company by name → canonical company_id
Step 1. search_companies({ jurisdiction: "GB", query: "Iceland Foods Ltd", limit: 5 })

// 2. Pull the registered profile (legal name, status, address, officers ref)
Step 2. get_company_profile({ jurisdiction: "GB", company_id: "01107406" })

// 3. Statutory beneficial-owner / PSC layer for this company
Step 3. get_persons_with_significant_control({ jurisdiction: "GB", company_id: "01107406" })

// 4. For every corporate PSC, recurse into the parent's home jurisdiction
Step 4. search_companies({ jurisdiction: "GB", query: "Iceland Topco Limited" })
        // → repeat steps 2–4 until you reach individuals or a statutorily restricted register

// 5. Pull the latest filed accounts as raw iXBRL — verifiable evidence layer
Step 5. fetch_document({ document_id: "<from get_financials>", max_bytes: 5000000 })

A worked walkthrough of this exact pattern (real public company, verbatim responses) lives at /docs/case-studies/iceland-foods-chain-walk.

Coverage for KYB / UBO data

OpenRegistry wires 27 national registries. UBO availability is registry-dependent — some jurisdictions publish a public PSC-style register, some sit behind a CJEU-imposed gate, some use shareholder filings as the de facto UBO surface.

Available via OpenRegistry

  • UK — Companies House PSC register (full)
  • Ireland — CRO directors + shareholders
  • Norway — Brreg roller + UBO (Reelle Rettighetshavere)
  • Iceland — RSK officers + shareholders
  • France — RNE officers + bénéficiaires effectifs (where published)
  • Belgium — KBO/BCE officers
  • Cyprus — DRCOR officers + shareholders
  • Isle of Man / Liechtenstein / Monaco — full officer + shareholder records
  • Cayman Islands — CIMA + Companies Registry (paid-tier only)
  • + APAC, Canada, Australasia — see the live capability matrix per registry.

Live source-of-truth for which tools each jurisdiction supports is list_jurisdictions over MCP, mirrored at /docs/.

Statutorily restricted (we don't proxy)

After CJEU C-37/20 (Nov 2022), eight EU registers became access-restricted to AML-obliged entities only:

  • DE — Transparenzregister
  • ES — Registro de Titulares Reales
  • IT — Registro dei Titolari Effettivi
  • NL — UBO-register at KVK
  • LU — Registre des Bénéficiaires Effectifs
  • AT — Wirtschaftliche Eigentümer Register
  • MT — Beneficial Owner Register
  • PT — Registo Central do Beneficiário Efetivo

Plus KY Cayman BOTA 2023 (legitimate-interest gate), HK SCR (on-site inspection only), MY RBO (AML-obliged only).

Calls to these registers return a structured HTTP 501 with alternative_url and alternative_access guidance — no tier or payment unlocks them. See /docs/errors.

How OpenRegistry compares for KYB / UBO use

Three categories of incumbent solve the KYB problem today: aggregators, KYB SaaS, and single-country APIs (or single-country MCP servers). OpenRegistry sits in a fourth category: the live MCP gateway between an AI agent and the original government registers.

OpenRegistry OpenCorporates KYB SaaS
(Veridion / Kyckr / Smarte)
Single-country MCP / API
Source freshness Live, every call Scrape-and-cache (hours–days) Vendor-curated, periodic refresh Live (single registry)
Field shape Verbatim upstream + unified envelope Normalised to OC schema Vendor schema, opaque transforms Native registry schema
Cross-border UBO walk One MCP prompt, ≤30 jurisdictions / 60s Manual ID stitching Bundled, but vendor-mediated Out of scope
Filing PDFs / iXBRL bytes Returned raw Metadata only, bytes paywalled Mostly summarised, not raw Native (single registry)
AI-agent ergonomics MCP-native, JSON-RPC REST REST + dashboard One-registry MCP
Self-serve free tier 20 req/min/IP, all tools, all jurisdictions Non-commercial only, throttled None / sales-led Varies (most: yes)
Authentication OAuth 2.1 + DCR; no API key API key API key + contract API key (typical)
Pricing model $0 anonymous → $9 / $29 / Enterprise Free non-commercial → paid API $30k–$100k+/yr typical Free / per-call

A more detailed teardown — including verbatim-vs-normalised audit examples — lives at /docs/comparison.

Why "verbatim upstream data" matters for KYB

A KYB or UBO finding eventually has to survive a regulator's review. Aggregators reshape the upstream payload into their own schema; that reshape is one tool's interpretation of a statutory field, not the field itself. Silent normalisation errors — a "dissolved" status mapped to "inactive", a corporate trustee dropped from the PSC list, a registered-office address swapped for a service address — break in production and are hard to attribute.

OpenRegistry's contract is the opposite: every response carries the verbatim upstream object under jurisdiction_data, with a thin unified envelope on top. The agent reads the raw field; the audit log shows the raw field. No vendor-side transformation to defend in a review.

Connect from any AI client

Anonymous tier requires no signup, no API key, no contract — paste the MCP URL into your client's settings and the first tool call works.

Claude Desktop / Claude Code / Cursor / Cline

{
  "mcpServers": {
    "openregistry": {
      "url": "https://openregistry.sophymarine.com/mcp"
    }
  }
}

Or via Claude Code CLI: claude mcp add --transport http OpenRegistry https://openregistry.sophymarine.com/mcp. Per-framework guides (LangChain, CrewAI, LlamaIndex, etc.) are at /docs/integrations.

FAQ

Is this a KYB SaaS, or a data API?

Neither, exactly. OpenRegistry is the live MCP layer between an AI agent (or a compliance pipeline) and 27 official government registries. There's no dashboard, no curated dossier, no risk-score engine — just verbatim registry data exposed as MCP tools, so an AI client can compose its own KYB/UBO workflow.

Can I use this for AML-compliant UBO checks in CJEU-restricted countries?

No — and no provider can offer non-AML-obliged third parties access to those registers since CJEU C-37/20. For DE, ES, IT, NL, LU, AT, MT, PT (plus KY, HK, MY under separate regimes), the response is a structured 501 with the statutory portal URL and the eligibility criteria. AML-obliged entities still go through the statutory portal directly.

How current is the data?

Every tool call is a live HTTP request to the upstream registry. No intermediate cache, no scrape lag. If Companies House publishes a director resignation at 14:02, OpenRegistry returns the new state at 14:02 (subject to the upstream registry's own publication latency).

Do I need an API key?

No. Anonymous tier (20 req/min/IP, all tools, all jurisdictions) is completely keyless — paste the MCP URL into Claude Desktop / Cursor / Cline / Goose / Zed and start calling tools. Higher tiers use OAuth 2.1 with Dynamic Client Registration (RFC 7591), so the client auto-registers itself; users sign in with a passwordless email magic link. No API key to paste, ever.

What's the cross-border fan-out limit?

A separate counter caps how many distinct jurisdictions a caller can hit in a rolling 60-second window: anonymous + Free 3, Pro 10, Max 30, Enterprise unlimited. A typical UBO chain walk through 4–5 European jurisdictions stays inside the Pro envelope.

Can I get raw filed accounts (iXBRL / PDF) for evidence?

Yes. fetch_document returns the literal upstream bytes (iXBRL XHTML, PDF, XML — whatever the registry serves). No re-encoding, no extraction into a vendor schema. Pass format: "png" for a rasterised render of scanned PDFs.

Where are the worked examples?

Three full request → response demos at /docs/examples; long-form workflow articles (Iceland Foods cross-border PSC walk, 5-call KYC dossier, why we return raw upstream data) at /docs/case-studies/.