Between November 2023 and June 2025, Adani Enterprises bought liquefied petroleum gas from a Dubai trader claiming Omani and Iraqi origin. Its know your customer check on the supplier and its selling affiliates found no SDN hits. The gas was Iranian. On 18 May 2026, OFAC settled with Adani for $275,000,000 and called the violations egregious (OFAC enforcement release).
A clean sanctions result on a supplier's name says who the supplier is, not what it sells. OFAC's red flags included a price below the market rate, certificates of origin with nonsequential numbers, a loading port with no facilities for the cargo, and a payment moved to another bank after the supplier's bank stopped it. A KYS file records three layers, each with evidence: the supplier and its identifiers, its owners, and the origin of its goods. The first two are the registry and ownership steps of KYB and UBO verification, applied to the companies a firm pays.
What does know your supplier mean?
KYS is short for know your supplier, also called know your vendor: the checks a firm runs on a company it buys from. It is the part of supplier due diligence that deals with financial crime.
Supplier risk management is wider. Quality, price and delivery stay with procurement, while KYS covers sanctions, bribery, forced labor, fraud and money laundering.
A quality audit can pass a supplier that fails KYS. The production reviews of e.l.f. Cosmetics "focused on quality assurance", and its supplier audits missed North Korean materials in about 80 percent of the false eyelash kits from two suppliers in China. The impact was a $996,080 OFAC settlement on 31 January 2019 (OFAC notice).
What are the components of a KYS check?
In 2023, the freight forwarder Pegasus Worldwide Logistics screened a machine supplier in China by name and got a null response from the SDN List: the supplier had been renamed after its designation, while its listed phone number and email had not changed. OFAC settled for $175,015 on 9 October 2026, calling name screening "a baseline tool" (OFAC release).
A KYS check has three components:
- The supplier. Its registry record and every identifier it uses, screened against sanctions and debarment lists.
- The owners. Under OFAC's 50 Percent Rule guidance of 13 August 2014, a company owned 50 percent or more in aggregate by blocked persons is blocked even if no list names it. One they only control falls outside that rule and may still be designated later.
- The goods. Where the product and its inputs come from, tested against the documents.
complead, formerly Sanction Scanner, follows a supplier's ownership chain up to natural persons, adds up each designated party's holdings and tests the total per regime, as the UK's share test is more than 50 percent (Table 1).
Which rules make a company check its suppliers?
Table 1. Regulatory and legal frameworks and their effect on a buyer's supplier checks (as of October 2026).
| Jurisdiction | Rule | What it asks about a supplier | Layer | Since |
|---|---|---|---|---|
| United States | OFAC sanctions and the 50 Percent Rule FAQs | No dealings with a listed supplier, or with one owned 50% or more in aggregate by blocked persons | Supplier, owners | Aggregation since 13 August 2014 |
| United States | Uyghur Forced Labor Prevention Act and the UFLPA Entity List | Goods made wholly or partly in Xinjiang, or by a listed entity, are presumed barred from import | Goods | 21 June 2022 |
| United Kingdom | Russia (Sanctions) (EU Exit) Regulations 2019, reg 7 | Whether a designated person holds more than 50% of shares or votes, or could in practice run the supplier's affairs | Owners | 11 April 2019 |
| United Kingdom | Bribery Act 2010, sections 7 and 8 | Defense of adequate procedures against bribery by a supplier that performs services for the buyer | Supplier | 1 July 2011 |
| United Kingdom | Economic Crime and Corporate Transparency Act 2023, section 199 | Defense of reasonable procedures against fraud meant to benefit the body by associates who perform services; large organizations only, meeting at least two of more than 250 employees, a balance sheet above £18 million and turnover above £36 million | Supplier | 1 September 2025 |
| United Kingdom | Procurement Act 2023, section 62 | Public buyers must or may exclude a supplier on the debarment list | Supplier | 24 February 2025 |
| United Kingdom | Modern Slavery Act 2015, section 54 | A yearly statement of steps against slavery in supply chains, from £36 million turnover; a statement of "no such steps" is allowed | Goods | 29 October 2015 |
| European Union | Regulation (EU) No 269/2014, Articles 2 and 8 | Freeze funds owned, held or controlled by listed persons, make none available to them, inform the authority immediately | Supplier, owners | 17 March 2014 |
| European Union | Regulation (EU) 2024/3015, Article 3 | No placing on the market, making available or exporting of products made with forced labor | Goods | Applies from 14 December 2027 |
| European Union | Directive (EU) 2024/1760 as amended (European Commission) | Human rights and environmental due diligence across the value chain; EU companies with at least 5,000 employees and EUR 1.5 billion net turnover worldwide, non EU companies with EUR 1.5 billion net turnover in the EU | Supplier, goods | Applies from 26 July 2029 |
Supply chain corruption reaches a UK buyer under section 7 only through an associated person, and the Ministry of Justice says a supplier may be one where it performs services "rather than simply acting as the seller of goods" (Bribery Act guidance, para 38).
What changed for supplier checks in 2026?
- 26 February. Directive (EU) 2026/470 was published, amending the due diligence directive (Table 1).
- 18 May. OFAC's Adani release: "relying solely on counterparty documentation and warranties with respect to cargo origin may be insufficient" (p. 6).
- 30 June. The Commission launched the forced labor preparedness package, guidelines and single portal (Commission page).
- 8 September. The Debarment Review Service page, updated that day, still links a blank UK debarment list.
How does the KYS process run from onboarding to exit?
Implementing KYS takes nine steps:
- Request (procurement). Understanding what is bought, from where and for how much sets the layers.
- Identity (compliance). Registry record, directors and every name, phone and email in use, so a renamed supplier still matches.
- Ownership (compliance). Owners traced to natural persons, sanctioned holdings added up.
- Screening (compliance). Supplier, owners and directors against sanctions, debarment and adverse media lists.
- Risk tier (compliance). A risk assessment of spend, country and product sets the tier; a high tier gets enhanced due diligence, such as origin certificates verified with the issuing authority.
- Contract (legal). Sanctions, anti bribery and origin clauses, asking the supplier to pass the anti bribery terms down its chain (guidance, para 39).
- Payment set up (finance). An account in the supplier's name, any change confirmed on the number in the vendor file: a switched account is how CEO fraud hits supplier payments.
- Monitoring (compliance). Screening again on every list update and ownership change, plus any periodic review the tier sets: a clean supplier can be designated, or gain a designated owner, later.
- Exit (compliance and legal). Payments stop, and a US person holding blocked property reports it to OFAC within 10 business days (31 CFR 501.603); under Regulation 269/2014, funds are frozen and the authority informed immediately.
What does KYS mean in banking?
In banking, KYS has two senses. First, the bank's own suppliers: under the EU's Digital Operational Resilience Act (DORA), applied from 17 January 2025, a bank using ICT services stays "fully responsible" for its obligations (Article 28(1)(a)).
The second is the suppliers behind a trade customer, whose papers reach the bank when payment runs "on a collection basis, against documents", as most of Adani's did (OFAC release, p. 2). The FATF and Egmont Group risk indicators flag a payee whose name differs from the exporter's and prices "inconsistent with market value" (p. 5), signs of trade based money laundering (TBML).
Where does KYS stop and vendor due diligence or KYB start?
KYC checks the people a firm serves, and KYB the companies among them; KYS turns the same checks on the companies a firm pays. Vendor due diligence reaches further, up to a seller's report in a merger. Know your employee (KYE) applies the idea to staff.
Before the next payment run, check the files of the ten largest suppliers by spend:
- Every identifier is screened, not only the current name.
- The owners are named up to natural persons, with a date.
- High risk goods carry origin evidence beyond the supplier's own papers.
Related terms
- Procurement fraud. Fraud in a company's purchasing.
- Corruption. The abuse of entrusted power for private gain, including bribery.
- Enhanced due diligence. Deeper checks.
- Vendor due diligence. The wider review of third parties, up to a merger.
- Know your business (KYB). Verifying business customers.
- Ultimate beneficial owner. The person at the top of the ownership chain.
How this entry was checked. The author is Sinan Tekin (Regional Sales Manager, complead) and the fact checker Javid Khasayev (Senior Anti Fraud Specialist, GoldenPay); last reviewed 28 October 2026. Every rule and case below was reopened at its source on 28 October 2026: OFAC's releases on e.l.f. Cosmetics (31 January 2019), Adani Enterprises (18 May 2026) and Pegasus Worldwide Logistics (9 October 2026), OFAC's 50 Percent Rule guidance of 13 August 2014 and its FAQs, 31 CFR 501.603, the CBP and DHS pages on the Uyghur Forced Labor Prevention Act, Regulation (EU) No 269/2014, Regulation (EU) 2024/3015, Directive (EU) 2024/1760 as amended by Directive (EU) 2026/470, Regulation (EU) 2022/2554, the UK Russia sanctions regulations of 2019, the Bribery Act 2010 and its guidance, the Economic Crime and Corporate Transparency Act 2023, the Procurement Act 2023 and the Debarment List, the Modern Slavery Act 2015, and the FATF and Egmont Group trade based money laundering risk indicators. Rule status is as of October 2026. The three layers follow the issues OFAC names in those releases as red flags and aggravating factors.
