Know Your Supplier (KYS): How to Evaluate and Qualify Third-Party Suppliers
What is Know Your Supplier and what does this guide cover?
Know Your Supplier (KYS) is the set of processes an organisation uses to verify the identity, legitimacy, and integrity of its suppliers before entering a relationship and on an ongoing basis. It covers legal existence, registration, beneficial ownership, sanctions screening, bank account details, and periodic updates when any of these elements change.
KYS is modelled on the KYC (Know Your Customer) approach used in banking, adapted for procurement and compliance functions. It is distinct from supplier performance evaluation (which assesses how well a supplier delivers) and from third-party risk management (TPRM, which assesses ongoing risks across the full relationship). KYS focuses specifically on who the supplier is, whether it legally exists, and whether it is subject to sanctions or adverse media.
Compliance drivers for KYS include anti-corruption legislation (which requires organisations to verify the integrity of business partners), financial crime prevention obligations, and procurement policy requirements. The Optivalue Watch regulatory monitoring service covers more than 80 countries, in the jurisdiction chosen by the organisation, as documented in the platform's own product description [lu: know-your-supplier-software.com/en/index.md].
This guide covers data collection, scoring, reassessment, and the software that automates each step.
What data do you need to collect for supplier qualification?
A KYS file for a supplier typically includes: legal name and registered address, company registration number and jurisdiction, VAT or tax identification number, legal form and date of incorporation, beneficial ownership structure (ultimate beneficial owners), bank account details used for payments, applicable licences or certifications, and proof of professional insurance where required.
Beyond identity data, the qualification file may include integrity checks: sanctions list screening, politically exposed person screening, adverse media monitoring, and check against internal blacklists. The depth of the file depends on the risk classification of the supplier: a high-spend supplier in a sensitive category warrants more thorough checks than a low-risk, low-spend supplier.
KYS software structures the data collection by sending a self-declaration questionnaire to the supplier through a dedicated portal. The supplier completes the questionnaire and attaches the required documents. The software then validates the declared information against external sources where available, flags missing items, and archives all submissions as timestamped evidence. Reducing the manual effort of chasing and filing supplier documents is one of the primary reasons organisations adopt KYS software over manual collection in shared drives.
How do you score suppliers: what criteria and weighting apply?
Supplier scoring under a KYS programme converts the collected data into a qualification decision. The scoring model typically covers: completeness of the file (all required documents present), consistency between declared data and external registry data, sanctions and adverse media results, beneficial ownership transparency, and financial soundness indicators where applicable.
Each criterion is weighted according to the organisation's risk tolerance and compliance policy. A supplier that appears on a sanctions list must be rejected regardless of other scores; a supplier with an incomplete file may be accepted provisionally while the outstanding documents are chased. The scoring logic must be documented and consistently applied, because it constitutes part of the evidence the organisation can show to regulators or auditors to demonstrate that its supplier qualification process is operative.
For a TPRM programme that structures ongoing management of qualified suppliers, the KYS qualification score feeds the broader risk profile. Suppliers that pass KYS qualification may still carry operational, financial, or reputational risks that TPRM addresses separately.
How do you reassess suppliers periodically and what triggers an out-of-cycle review?
A KYS programme does not end at initial qualification. Supplier identities change: companies are acquired, beneficial owners change, sanctions are imposed, bank accounts change. An organisation that qualifies a supplier once and never revisits that qualification takes on a growing risk over time.
Periodic reassessment is typically annual for higher-risk suppliers and less frequent for lower-risk ones. Out-of-cycle triggers include: receipt of a new bank account number for payment, news of a change of ownership or merger, appearance on a sanctions list update, an internal report of a concern, or a significant change in the scope of the relationship.
KYS software manages reassessment scheduling by assigning a reassessment date to each supplier file based on the risk classification. It sends automated reminders to both the procurement team and the supplier when reassessment is due. It also monitors external data sources continuously so that a sanctions list hit triggers an immediate alert rather than waiting for the next scheduled review. For supply chain due diligence, the legal framework for KYS programmes, the reassessment records provide the documented evidence of ongoing due diligence that legislation requires.
How does KYS software automate collection and scoring?
A KYS software tool automates: supplier portal for document submission, self-declaration questionnaire management, automated reminders for non-responding suppliers, validation against external data sources (company registries, sanctions lists, adverse media), scoring and qualification decision recording, reassessment scheduling and alerting, and audit trail export for regulatory inspections.
The Optivalue.ai platform operates 85 specialised agents (72 business agents, 12 sector agents, and 1 librarian agent, as documented in the platform's own product description [lu: logiciel-kys.com/index.md]), which train on the organisation's supplier documents and apply screening against the Optivalue Watch regulatory monitoring service, available in more than 80 countries. The platform verifies submitted documents against available external sources and flags discrepancies for human review.
The key selection criterion is whether the software maintains a continuous, auditable chain from initial qualification through periodic reassessment to regulatory reporting, so that compliance teams can demonstrate the programme is operative at any point, not only at the moment of onboarding.
See how Optivalue.ai guides your KYS programme. Book a demonstration
Frequently asked questions
What is the difference between KYS, KYC, and TPRM?
KYS (Know Your Supplier) verifies the identity and legitimacy of a supplier: legal existence, registration, beneficial owners, sanctions, and bank details. KYC (Know Your Customer) applies the same approach to customers, originating in banking regulation. TPRM (Third-Party Risk Management) covers the ongoing management of risks across the full supplier relationship, including operational, financial, and reputational risks that go beyond identity verification.
Which regulations require Know Your Supplier programmes?
Anti-corruption legislation in many jurisdictions requires organisations to verify the integrity of their business partners. Supply chain due diligence laws require traceability and due diligence documentation across the supply chain. Sanctions compliance requires screening suppliers against applicable sanctions lists before and during a business relationship. The specific obligations depend on the organisation's sector, size, and operating jurisdictions.
How do you handle a supplier that refuses to provide the information requested?
When a supplier refuses to provide required KYS information, the organisation must decide whether to proceed with the relationship under a higher-risk classification or to decline the relationship. The refusal itself should be documented as part of the qualification record. KYS software records the refusal and the decision taken, which forms part of the audit trail available to compliance teams and regulators.
What is beneficial ownership and why does it matter for KYS?
Beneficial ownership refers to the natural persons who ultimately own or control a legal entity, even when ownership is held through intermediary companies. KYS programmes collect beneficial ownership information because the individuals behind a company may be subject to sanctions, may be politically exposed persons, or may be associated with corruption risk. Most jurisdictions now require companies to disclose their beneficial owners in public or accessible registries.
How does KYS software integrate with procurement and accounts payable processes?
KYS software typically integrates with the procurement process at the point of supplier onboarding: a new supplier cannot be registered in the purchasing system until the KYS qualification is complete. It also integrates with accounts payable: a bank account change for an existing supplier triggers a re-verification step before payments can be made to the new account. This prevents payment fraud as well as sanctions violations.
<!-- JSON-LD -->
Back to top