Why KYB and Compliance Must Shift to Real-Time Data

I think this is one of the biggest weaknesses in the way we continue to manage compliance. We spend a lot of time deciding what to check at onboarding: RFC, corporate information, tax status, shareholders, sanctions, documents, signatures. We build increasingly sophisticated checklists.

Then, once the company passes, we often stop looking.

But the company does not stop changing.

Its customers change. Its suppliers change. Invoice activity changes. Tax certificates expire or are suspended. Revenue can fall. Concentration can increase. A counterparty can enter a SAT process that did not exist when the relationship began.

The risk we approved is not necessarily the risk we have today.

Risk Does Not Wait for the Next Review

I have spent years working with business data, financial institutions, fintechs, and companies in Mexico, and one pattern keeps repeating: the most useful information is often not the original status of a company, but the change.

Was it issuing invoices normally and suddenly stopped?

Did five important customers become one?

Did its supplier network change dramatically?

Did its fiscal status change?

Did a company we have been paying for years suddenly appear in an Article 69-B process?

These are not annual questions. In many cases, they are not even monthly questions.

They are events.

And events should trigger attention when they happen.

69-B Is a Good Example

Article 69-B is usually discussed as a tax matter. Understandably so. It deals with taxpayers presumed to have issued invoices for operations that may not have actually existed.

But imagine you are a CFO or procurement director.

You approved a supplier nine months ago. Everything was in order. Today, something changes in that supplier's SAT status.

Would you rather know today or during the next annual supplier review?

The issue is bigger than tax compliance. It can affect payments, deductions, audits, procurement decisions, reputation, and the continuity of the relationship itself.

That is why I see 69-B as more than a blacklist check. It is one example of why compliance needs to become continuous.

From Tax Data to Risk Intelligence

This connects directly to something I have written about before in Mexico Business News.

When I wrote about Credit Intelligence, my argument was that Mexico had already created an extraordinary digital infrastructure through SAT and CFDI. The next challenge was learning how to turn that information into useful intelligence.

More recently, I wrote about accountants becoming risk advisers. The idea was similar: reporting what happened last year is valuable, but identifying what is changing now is much more powerful.

Continuous compliance is the next step in that evolution.

Having access to data is not enough.

Checking it once is not enough.

The real value comes when the information tells us that something meaningful has changed.

KYB Should Not End at “Know”

The name itself may be part of the problem.

We call it Know Your Business, KYB. That naturally pushes us toward the question: who is this company?

But perhaps we need another question: Who is this company becoming?

At onboarding, I want to know that the RFC is valid, that the company exists, who represents it, and whether there are obvious compliance concerns.

Six months later, I care about different things.

Is it still operating normally? Has its invoice activity changed? Has its customer concentration increased? Is its e.firma still valid? Has its fiscal situation changed? Are there new regulatory or sanctions alerts?

That is a very different mindset from repeating the same checklist every year.

What Should Companies Actually Monitor?

There is no universal list. A bank, retailer, manufacturer, accounting firm, and logistics company will care about different risks.

But in Mexico, there are several signals worth considering: changes in SAT status, Article 69-B developments, e.firma and certificate status, invoice activity, unusual cancellations, customer and supplier concentration, major changes in counterparties, and significant drops in operating activity.

The objective is not to create hundreds of alerts.

That is another mistake technology can make very easily.

If every movement becomes an alert, nobody pays attention.

The objective is to identify the few changes that require a human decision.

The Same Idea Applies Beyond Compliance

In an earlier MBN article, I wrote about how apparently healthy SMEs can quietly become fragile. In another, we analyzed how a disruption in Jalisco could spread through customer and supplier relationships far beyond the state itself.

The common lesson is that risk is dynamic.

A company does not suddenly become risky on the day we discover the problem. Usually, something was changing beforehand.

The same principle applies whether we are talking about compliance, supplier risk, credit, fraud, or operational resilience.

The earlier we recognize the change, the more options we have.

From Periodic Reviews to Continuous Visibility

I do not believe the answer is simply “more compliance.”

Companies already have enough processes, questionnaires, and checklists.

The better answer is smarter timing.

Keep onboarding checks. Keep periodic reviews. Keep human judgment.

But between those reviews, let the data watch for meaningful changes.

That changes compliance from a calendar exercise into an early-warning capability.

And to me, that is where the opportunity is.

Mexico already has much of the infrastructure needed to do this. SAT, CFDI, public regulatory information, and increasingly connected business data give us visibility that would have been unimaginable a decade ago.

The challenge now is to use that visibility intelligently.

Because the company you approved last year is not necessarily the company you are doing business with today.

Compliance can no longer be a monthly check.

It needs to tell us when something changes.