Simple Answer, Hard Work: How Kyckr Verifies Who Owns a Company

An interview with Steve Lamb by Sean Murphy

There was a time, Steve Lamb likes to say, when a company register was little more than a notice board. You founded a business, pinned up a declaration that you owned it and that it did roughly what you claimed, and that was it. The board simply held the notice. Lamb, who has spent close to seven years at Kyckr and took over as chief executive last summer, has watched that notice board evolve into something much more. Registers are no longer librarians filing what they are handed; they are being asked to become gatekeepers, and the distance between those two very different roles is an important part of the story of modern financial crime compliance.

Kyckr sits squarely in that gap. The company runs a live network of connections into more than 300 company registers across more than 100 countries, pulling the official record on a business at the moment it is asked for rather than storing a copy that can often go stale. Banks, fintechs and law firms are obliged by law to verify the customers they take on using reliable and independent data, and the awkward truth is that such data is scattered, inconsistent and often hard to reach. Lamb describes the work with the classic image: the swan, gliding across the surface while it kicks furiously underneath. The calmness is the clean profile a customer receives in seconds. The kicking is everything beneath it: registries that fall over without warning and have to be chased through their support teams, data that arrives in a different shape from Denmark than it does from Companies House, and registries that will release nothing until you have been approved as a distributor.

Some of those connections are very good. The UK's Companies House, Lamb concedes, is technically excellent, with proper interfaces and open data, the sort of thing he could count the global equivalents of on one or two hands. But technical quality and trustworthiness are not the same thing, and the register has spent years fielding stories about fraudulent filings and improbable addresses housing dozens of companies. The UK's Economic Crime and Corporate Transparency Act finally forced it to verify the identity of directors and people with significant control, with checks becoming mandatory in November 2025, a step Lamb welcomes while making clear he thinks there is further to go.

The deeper problem is ultimate beneficial ownership, the question of which actual human being sits at the end of a chain of holding companies. Here the obstacle is no longer quality but access. In a November 2022 ruling, the Grand Chamber of the European Court of Justice sided with two Luxembourg company owners who argued that publishing their details as beneficial owners breached their right to privacy, and almost overnight the public registers transparency campaigners had fought for went dark across the bloc. What replaced them is a patchwork of legitimate interest access, where a bank or a journalist must prove a recognised reason before the data is released. Lamb supports the principle of legitimate interest access. The trouble is the execution. Germany asks for credentials on every request; Denmark, once it has identified you as a bank, hands over an API and lets you work. For an institution sending thousands of requests a week, that inconsistency across the market is itself a compliance risk.

Lamb is careful not to caricature Brussels. The EU, he notes, has genuinely pioneered ultimate beneficial ownership transparency even as it has wrestled with the privacy fallout. The next attempt at order is the Sixth Anti-Money Laundering Directive (6AMLD) and its directly applicable sibling, the Anti-Money Laundering Regulation, both taking full effect in July 2027 under a new central authority in Frankfurt. In theory a single legitimate interest form will one day travel across every register in the union. In practice, Lamb expects the rollout to arrive at wildly different speeds, and he is candid that meaningful progress may be a year or two further off than the timetable suggests.

What animates him most is what comes after verification. He talks about Kyckr moving from a data aggregator towards something closer to an infrastructure layer for business identity, layering risk signals onto the raw registry data so that stretched analysts spend less time interpreting and more time deciding. Beyond that sits reusable identity. From 2027, under the EU's digital identity framework, regulated firms will have to accept credentials held in a virtual wallet, and Lamb is intrigued by what happens when a business, not just a person, can carry a verifiable passport of its own. The current model, he says, is collect and verify. A trusted credential could collapse that loop, ending the endless duplication of the same checks on the same firms.

It is a long way from the notice board. Lamb came into this expecting, by his own admission, a dry corner of financial services, and instead found himself loving registry data. The pieces he is betting on - harmonised access, reusable credentials, registers that verify rather than merely record - are all still half-built, arriving at different speeds across a continent that prefers to legislate its way to consistency and usually gets there in the end. Underneath the calm surface, the kicking continues.ar or two further off than the timetable suggests.