Enterprise KYB vendor RFP: clauses and rubric for complex structures
On this page
This guide produces an RFP clause set and a weighted scoring rubric for selecting an enterprise KYB vendor that handles complex corporate structures. It's written for procurement, legal, and compliance owners. You need your regulatory obligations list, your current onboarding volumes, and a draft RFP template. Difficulty is moderate. Plan on one to two working days to adapt the clauses and calibrate the weights.
The principle behind every clause: require proof, not promises. A vendor that says it "supports" beneficial ownership verification has told you nothing. A vendor that must name its evidence sources, its fallback when no UBO is found, and its log retention period has told you what you're buying.
Step 1: Define scope and pass/fail gates first
Write the scope as one sentence: the vendor must resolve corporate hierarchies, identify and verify ultimate beneficial owners, store evidence, and expose an audit trail. Then fix four non-negotiable gates before scoring anything:
Signed DPA with audit rights
Documented evidence acceptance rules with a "no conclusive UBO" fallback
Escalation and appeal timelines stated in hours or days
Disclosed subprocessor list with change notice
A vendor that fails any gate is out, whatever its total score. For a wider view of what qualifies in regulated procurement, see bank-grade KYB RFP requirements.
Step 2: Insert data protection and residency clauses
GDPR Article 28 requires processors to act only on documented controller instructions, support audits, and flow subprocessor obligations down by contract. Article 33 sets the 72-hour clock for controller notification to supervisory authorities, so your processor must report to you well inside it.
Processing roles. Vendor acts as processor and Customer as controller. Vendor shall process personal data only on Customer's documented instructions.
Breach notification. Vendor shall notify Customer of any personal data breach within [24] hours of becoming aware and provide the information Customer needs to meet Article 33.
Residency and transfers. Vendor shall state every country where Customer data is stored or accessed, and the legal transfer mechanism for each.
Audit rights. Customer and its regulators may audit Vendor and its subprocessors on [30] days' notice. Vendor shall supply current SOC 2 Type II and ISO 27001 reports on request.
Audit logs. Vendor shall keep tamper-evident logs of every access, decision, and policy change for [5] years after the relationship ends, exportable in a machine-readable format.
The EBA outsourcing guidelines (EBA/GL/2019/02) expect access and audit rights over critical outsourced functions, so keep regulator access language intact. As a reference point for what a vendor should disclose, Duna's trust page lists ISO 27001, SOC 2 Type II, and GDPR-compliant EU data residency.
Watch for "may" in place of "shall," an undefined subprocessor list, and silence on log retention.
Step 3: Insert UBO and evidence acceptance clauses
FATF Recommendation 24 calls for accurate, timely beneficial ownership information on legal persons. Translate that into verifiable vendor behavior.
UBO verification. Vendor shall identify beneficial owners through a documented method covering ownership and control tests across multi-layer chains, and record the outcome, sources, and confidence for each entity.
Evidence acceptance. Vendor shall list accepted document types (registry extracts, corporate filings). Each record shall carry jurisdiction, entity identifier, and capture date. Vendor shall document rules for discounting low-confidence or stale evidence.
Trusts, nominees, legal arrangements. Vendor shall map the full structure, including nominee directors and trusts, and state which documents it requests for each.
No conclusive UBO. Where no beneficial owner can be established, Vendor shall flag the case, record the reason, and apply the fallback treatment defined in Annex [X] (for example, senior managing official identification and enhanced review).
Discrepancies and appeals. Vendor shall surface registry discrepancies and false-positive matches with supporting evidence. Customer may contest any outcome, and Vendor shall respond within [2] business days and complete rework within [5].
For tuning match quality, see how to reduce false positives in KYB.
Step 4: Set operational SLAs and KPIs
Require numbers, then verify them in a pilot.
Service levels. Vendor shall meet turnaround of [X] hours for standard cases and [Y] days for complex structures, and shall support re-verification at the cadence in Annex [X].
Reporting. Vendor shall provide monthly exports of decisions, evidence IDs, audit log references, evidence completeness rate, discrepancy rate, and share of cases escalated.
Model and data drift. If Vendor uses automation or AI, it shall validate performance at least [quarterly] and share results.
Set minimum passing targets in the RFP itself, such as an evidence completeness floor, and test them against your own sample entities.
Step 5: Insert change management and exit clauses
Material changes. Vendor shall give [60] days' notice of changes to data sources, models, enrichment logic, or coverage.
Subprocessors. Vendor shall notify Customer of new subprocessors [30] days in advance. Customer may object, and Vendor shall provide control evidence on request.
Supply chain and lineage. Customer's audit rights extend to subprocessors. Vendor shall disclose the source of each UBO and hierarchy data point.
Exit. On termination, Vendor shall return all evidence, decisions, and audit logs in an open format within [30] days and provide transition assistance.
Reject any language that holds evidence in a proprietary format. You must be able to replace the provider without losing evidence integrity. Vendor data coverage claims, such as Moody's Orbis stating "635M+ entities," describe breadth. They don't replace lineage disclosure.
Step 6: Score responses with a weighted rubric
Score each category from 0 to 4. A 4 requires a named artifact (report, annex, sample export), a 2 requires a described process without proof, and a 0 means no answer.
Category | Weight | Maps to |
|---|---|---|
Technical capability | 40% | Step 3 (structures, evidence model, automation) |
Regulatory and compliance | 35% | Steps 2 and 5 |
Operational support | 25% | Step 4 and escalation |
Weighted score = (score ÷ 4) × weight, summed.
Example filled rubric
Category | Score | Weighted | Assessor note |
|---|---|---|---|
Technical | 3 | 30.0 | Strong hierarchy mapping, no trust or nominee fallback |
Regulatory | 2 | 17.5 | DPA signed, log retention period unspecified |
Operational | 3 | 18.75 | SLAs stated, escalation SLA missing |
Total | 66.25 |
The gate results: DPA with audit rights passes. Evidence fallback fails. Escalation timelines fail. This vendor is disqualified despite a respectable total.
Troubleshooting vendor responses
Log retention not stated. Ask for the retention period, storage location, and an export sample. Write the period into the clause.
Source lineage unclear. Ask for a field-level source list for one complex sample entity.
"No conclusive UBO" handled by manual note only. Require a defined status, reason code, and fallback procedure in the audit trail.
Send each failed gate back as a written clarification with a deadline, and tighten the matching clause before contract signature. Run the surviving shortlist, Duna included, through identical sample structures so scores reflect evidence, not presentation.
This guide produces an RFP clause set and a weighted scoring rubric for selecting an enterprise KYB vendor that handles complex corporate structures. It's written for procurement, legal, and compliance owners. You need your regulatory obligations list, your current onboarding volumes, and a draft RFP template. Difficulty is moderate. Plan on one to two working days to adapt the clauses and calibrate the weights.
The principle behind every clause: require proof, not promises. A vendor that says it "supports" beneficial ownership verification has told you nothing. A vendor that must name its evidence sources, its fallback when no UBO is found, and its log retention period has told you what you're buying.
Step 1: Define scope and pass/fail gates first
Write the scope as one sentence: the vendor must resolve corporate hierarchies, identify and verify ultimate beneficial owners, store evidence, and expose an audit trail. Then fix four non-negotiable gates before scoring anything:
Signed DPA with audit rights
Documented evidence acceptance rules with a "no conclusive UBO" fallback
Escalation and appeal timelines stated in hours or days
Disclosed subprocessor list with change notice
A vendor that fails any gate is out, whatever its total score. For a wider view of what qualifies in regulated procurement, see bank-grade KYB RFP requirements.
Step 2: Insert data protection and residency clauses
GDPR Article 28 requires processors to act only on documented controller instructions, support audits, and flow subprocessor obligations down by contract. Article 33 sets the 72-hour clock for controller notification to supervisory authorities, so your processor must report to you well inside it.
Processing roles. Vendor acts as processor and Customer as controller. Vendor shall process personal data only on Customer's documented instructions.
Breach notification. Vendor shall notify Customer of any personal data breach within [24] hours of becoming aware and provide the information Customer needs to meet Article 33.
Residency and transfers. Vendor shall state every country where Customer data is stored or accessed, and the legal transfer mechanism for each.
Audit rights. Customer and its regulators may audit Vendor and its subprocessors on [30] days' notice. Vendor shall supply current SOC 2 Type II and ISO 27001 reports on request.
Audit logs. Vendor shall keep tamper-evident logs of every access, decision, and policy change for [5] years after the relationship ends, exportable in a machine-readable format.
The EBA outsourcing guidelines (EBA/GL/2019/02) expect access and audit rights over critical outsourced functions, so keep regulator access language intact. As a reference point for what a vendor should disclose, Duna's trust page lists ISO 27001, SOC 2 Type II, and GDPR-compliant EU data residency.
Watch for "may" in place of "shall," an undefined subprocessor list, and silence on log retention.
Step 3: Insert UBO and evidence acceptance clauses
FATF Recommendation 24 calls for accurate, timely beneficial ownership information on legal persons. Translate that into verifiable vendor behavior.
UBO verification. Vendor shall identify beneficial owners through a documented method covering ownership and control tests across multi-layer chains, and record the outcome, sources, and confidence for each entity.
Evidence acceptance. Vendor shall list accepted document types (registry extracts, corporate filings). Each record shall carry jurisdiction, entity identifier, and capture date. Vendor shall document rules for discounting low-confidence or stale evidence.
Trusts, nominees, legal arrangements. Vendor shall map the full structure, including nominee directors and trusts, and state which documents it requests for each.
No conclusive UBO. Where no beneficial owner can be established, Vendor shall flag the case, record the reason, and apply the fallback treatment defined in Annex [X] (for example, senior managing official identification and enhanced review).
Discrepancies and appeals. Vendor shall surface registry discrepancies and false-positive matches with supporting evidence. Customer may contest any outcome, and Vendor shall respond within [2] business days and complete rework within [5].
For tuning match quality, see how to reduce false positives in KYB.
Step 4: Set operational SLAs and KPIs
Require numbers, then verify them in a pilot.
Service levels. Vendor shall meet turnaround of [X] hours for standard cases and [Y] days for complex structures, and shall support re-verification at the cadence in Annex [X].
Reporting. Vendor shall provide monthly exports of decisions, evidence IDs, audit log references, evidence completeness rate, discrepancy rate, and share of cases escalated.
Model and data drift. If Vendor uses automation or AI, it shall validate performance at least [quarterly] and share results.
Set minimum passing targets in the RFP itself, such as an evidence completeness floor, and test them against your own sample entities.
Step 5: Insert change management and exit clauses
Material changes. Vendor shall give [60] days' notice of changes to data sources, models, enrichment logic, or coverage.
Subprocessors. Vendor shall notify Customer of new subprocessors [30] days in advance. Customer may object, and Vendor shall provide control evidence on request.
Supply chain and lineage. Customer's audit rights extend to subprocessors. Vendor shall disclose the source of each UBO and hierarchy data point.
Exit. On termination, Vendor shall return all evidence, decisions, and audit logs in an open format within [30] days and provide transition assistance.
Reject any language that holds evidence in a proprietary format. You must be able to replace the provider without losing evidence integrity. Vendor data coverage claims, such as Moody's Orbis stating "635M+ entities," describe breadth. They don't replace lineage disclosure.
Step 6: Score responses with a weighted rubric
Score each category from 0 to 4. A 4 requires a named artifact (report, annex, sample export), a 2 requires a described process without proof, and a 0 means no answer.
Category | Weight | Maps to |
|---|---|---|
Technical capability | 40% | Step 3 (structures, evidence model, automation) |
Regulatory and compliance | 35% | Steps 2 and 5 |
Operational support | 25% | Step 4 and escalation |
Weighted score = (score ÷ 4) × weight, summed.
Example filled rubric
Category | Score | Weighted | Assessor note |
|---|---|---|---|
Technical | 3 | 30.0 | Strong hierarchy mapping, no trust or nominee fallback |
Regulatory | 2 | 17.5 | DPA signed, log retention period unspecified |
Operational | 3 | 18.75 | SLAs stated, escalation SLA missing |
Total | 66.25 |
The gate results: DPA with audit rights passes. Evidence fallback fails. Escalation timelines fail. This vendor is disqualified despite a respectable total.
Troubleshooting vendor responses
Log retention not stated. Ask for the retention period, storage location, and an export sample. Write the period into the clause.
Source lineage unclear. Ask for a field-level source list for one complex sample entity.
"No conclusive UBO" handled by manual note only. Require a defined status, reason code, and fallback procedure in the audit trail.
Send each failed gate back as a written clarification with a deadline, and tighten the matching clause before contract signature. Run the surviving shortlist, Duna included, through identical sample structures so scores reflect evidence, not presentation.
Continue reading
Industries
Customers
Company
Resources
Industries
Customers
Company
Resources
Industries
Customers
Company
Resources