KYB & UBO verification — 27 official registries, one MCP endpoint
AI agents and compliance teams that need Know-Your-Business and Ultimate-Beneficial-Owner data, sourced from the government's own register rather than a normalised aggregator. Live queries, verbatim upstream payload, identifiers that round-trip back to the statutory portal — and the cross-border fan-out built in, so an LLM can walk a multi-jurisdiction ownership chain in a single prompt.
What this gives you
Every call hits the upstream government API live. No scrape-and-cache layer, no normalised re-shaping.
Unified envelope across UK, EU, EEA, Crown Dependencies, APAC. Verbatim jurisdiction_data preserved underneath.
One MCP prompt walks UBO across up to 30 jurisdictions. No manual ID stitching across aggregators.
JSON-RPC over Streamable HTTP. Anonymous tier free. No API key — Dynamic Client Registration per RFC 7591.
The 5-call KYB / UBO workflow
A complete cross-border UBO trace fits into five MCP tool calls. The same shape works whether the target is a UK Ltd with a UK PSC chain, a French SAS owned by a Luxembourg holding, or a Cayman fund vehicle with statutory gating. The agent decides where to recurse and where to stop.
// 1. Resolve the company by name → canonical company_id Step 1. search_companies({ jurisdiction: "GB", query: "Iceland Foods Ltd", limit: 5 }) // 2. Pull the registered profile (legal name, status, address, officers ref) Step 2. get_company_profile({ jurisdiction: "GB", company_id: "01107406" }) // 3. Statutory beneficial-owner / PSC layer for this company Step 3. get_persons_with_significant_control({ jurisdiction: "GB", company_id: "01107406" }) // 4. For every corporate PSC, recurse into the parent's home jurisdiction Step 4. search_companies({ jurisdiction: "GB", query: "Iceland Topco Limited" }) // → repeat steps 2–4 until you reach individuals or a statutorily restricted register // 5. Pull the latest filed accounts as raw iXBRL — verifiable evidence layer Step 5. fetch_document({ document_id: "<from get_financials>", max_bytes: 5000000 })
A worked walkthrough of this exact pattern (real public company, verbatim responses) lives at /docs/case-studies/iceland-foods-chain-walk.
Coverage for KYB / UBO data
OpenRegistry wires 27 national registries. UBO availability is registry-dependent — some jurisdictions publish a public PSC-style register, some sit behind a CJEU-imposed gate, some use shareholder filings as the de facto UBO surface.
Available via OpenRegistry
- UK — Companies House PSC register (full)
- Ireland — CRO directors + shareholders
- Norway — Brreg roller + UBO (Reelle Rettighetshavere)
- Iceland — RSK officers + shareholders
- France — RNE officers + bénéficiaires effectifs (where published)
- Belgium — KBO/BCE officers
- Cyprus — DRCOR officers + shareholders
- Isle of Man / Liechtenstein / Monaco — full officer + shareholder records
- Cayman Islands — CIMA + Companies Registry (paid-tier only)
- + APAC, Canada, Australasia — see the live capability matrix per registry.
Live source-of-truth for which tools each jurisdiction supports is
list_jurisdictions over MCP, mirrored at
/docs/.
Statutorily restricted (we don't proxy)
After CJEU C-37/20 (Nov 2022), eight EU registers became access-restricted to AML-obliged entities only:
- DE — Transparenzregister
- ES — Registro de Titulares Reales
- IT — Registro dei Titolari Effettivi
- NL — UBO-register at KVK
- LU — Registre des Bénéficiaires Effectifs
- AT — Wirtschaftliche Eigentümer Register
- MT — Beneficial Owner Register
- PT — Registo Central do Beneficiário Efetivo
Plus KY Cayman BOTA 2023 (legitimate-interest gate), HK SCR (on-site inspection only), MY RBO (AML-obliged only).
Calls to these registers return a structured HTTP 501 with
alternative_url and alternative_access guidance —
no tier or payment unlocks them. See /docs/errors.
How OpenRegistry compares for KYB / UBO use
Three categories of incumbent solve the KYB problem today: aggregators, KYB SaaS, and single-country APIs (or single-country MCP servers). OpenRegistry sits in a fourth category: the live MCP gateway between an AI agent and the original government registers.
| OpenRegistry | OpenCorporates | KYB SaaS (Veridion / Kyckr / Smarte) |
Single-country MCP / API | |
|---|---|---|---|---|
| Source freshness | Live, every call | Scrape-and-cache (hours–days) | Vendor-curated, periodic refresh | Live (single registry) |
| Field shape | Verbatim upstream + unified envelope | Normalised to OC schema | Vendor schema, opaque transforms | Native registry schema |
| Cross-border UBO walk | One MCP prompt, ≤30 jurisdictions / 60s | Manual ID stitching | Bundled, but vendor-mediated | Out of scope |
| Filing PDFs / iXBRL bytes | Returned raw | Metadata only, bytes paywalled | Mostly summarised, not raw | Native (single registry) |
| AI-agent ergonomics | MCP-native, JSON-RPC | REST | REST + dashboard | One-registry MCP |
| Self-serve free tier | 20 req/min/IP, all tools, all jurisdictions | Non-commercial only, throttled | None / sales-led | Varies (most: yes) |
| Authentication | OAuth 2.1 + DCR; no API key | API key | API key + contract | API key (typical) |
| Pricing model | $0 anonymous → $9 / $29 / Enterprise | Free non-commercial → paid API | $30k–$100k+/yr typical | Free / per-call |
A more detailed teardown — including verbatim-vs-normalised audit examples — lives at /docs/comparison.
Why "verbatim upstream data" matters for KYB
A KYB or UBO finding eventually has to survive a regulator's review. Aggregators reshape the upstream payload into their own schema; that reshape is one tool's interpretation of a statutory field, not the field itself. Silent normalisation errors — a "dissolved" status mapped to "inactive", a corporate trustee dropped from the PSC list, a registered-office address swapped for a service address — break in production and are hard to attribute.
OpenRegistry's contract is the opposite: every response carries the
verbatim upstream object under jurisdiction_data, with a
thin unified envelope on top. The agent reads the raw field; the audit
log shows the raw field. No vendor-side transformation to defend in a
review.
Connect from any AI client
Anonymous tier requires no signup, no API key, no contract — paste the MCP URL into your client's settings and the first tool call works.
Claude Desktop / Claude Code / Cursor / Cline
{
"mcpServers": {
"openregistry": {
"url": "https://openregistry.sophymarine.com/mcp"
}
}
}
Or via Claude Code CLI:
claude mcp add --transport http OpenRegistry https://openregistry.sophymarine.com/mcp.
Per-framework guides (LangChain, CrewAI, LlamaIndex, etc.) are at
/docs/integrations.
FAQ
Is this a KYB SaaS, or a data API?
Neither, exactly. OpenRegistry is the live MCP layer between an AI agent (or a compliance pipeline) and 27 official government registries. There's no dashboard, no curated dossier, no risk-score engine — just verbatim registry data exposed as MCP tools, so an AI client can compose its own KYB/UBO workflow.
Can I use this for AML-compliant UBO checks in CJEU-restricted countries?
No — and no provider can offer non-AML-obliged third parties access to those registers since CJEU C-37/20. For DE, ES, IT, NL, LU, AT, MT, PT (plus KY, HK, MY under separate regimes), the response is a structured 501 with the statutory portal URL and the eligibility criteria. AML-obliged entities still go through the statutory portal directly.
How current is the data?
Every tool call is a live HTTP request to the upstream registry. No intermediate cache, no scrape lag. If Companies House publishes a director resignation at 14:02, OpenRegistry returns the new state at 14:02 (subject to the upstream registry's own publication latency).
Do I need an API key?
No. Anonymous tier (20 req/min/IP, all tools, all jurisdictions) is completely keyless — paste the MCP URL into Claude Desktop / Cursor / Cline / Goose / Zed and start calling tools. Higher tiers use OAuth 2.1 with Dynamic Client Registration (RFC 7591), so the client auto-registers itself; users sign in with a passwordless email magic link. No API key to paste, ever.
What's the cross-border fan-out limit?
A separate counter caps how many distinct jurisdictions a caller can hit in a rolling 60-second window: anonymous + Free 3, Pro 10, Max 30, Enterprise unlimited. A typical UBO chain walk through 4–5 European jurisdictions stays inside the Pro envelope.
Can I get raw filed accounts (iXBRL / PDF) for evidence?
Yes. fetch_document returns the literal upstream bytes
(iXBRL XHTML, PDF, XML — whatever the registry serves). No
re-encoding, no extraction into a vendor schema. Pass
format: "png" for a rasterised render of scanned PDFs.
Where are the worked examples?
Three full request → response demos at /docs/examples; long-form workflow articles (Iceland Foods cross-border PSC walk, 5-call KYC dossier, why we return raw upstream data) at /docs/case-studies/.