Why the absence of a digital footprint should not automatically become an AML red flag

A business applies for a corporate account.

The company is legally registered.

The owner provides identification documents.

The business has invoices, suppliers and customers.

The company has been operating for several years.

But the compliance analyst searches for the business online.

There is no website.

No LinkedIn page.

No Google Business profile.

Almost no online presence.

The question is immediate:

Is this a problem?

For a compliance team used to assessing businesses in highly digital markets, the answer may appear obvious.

But across many African markets, it is not.

A business can be perfectly legitimate without having a website.

It could be a small importer, wholesaler, retailer, agricultural trader, transport operator, restaurant, construction company or family-owned business.

Its customers may know the business through physical premises, referrals, WhatsApp, mobile money or local networks rather than through a corporate website.

This creates an important KYB question:

Are we assessing the actual risk of the business, or are we simply measuring how digitally visible it is?

A website is not a KYB requirement

Know Your Business is fundamentally about understanding the customer.

That means establishing things such as:

Who owns the business?
Who controls it?
What does it actually do?
Where does it operate?
Who are its customers and suppliers?
What is the expected transaction activity?
Where does its money come from?
Are there relevant financial crime risks?

A website can help answer some of these questions.

But it is only one source of information.

FATF’s beneficial ownership guidance emphasises the importance of obtaining adequate, accurate and up-to-date information and recommends a multi-pronged approach using different sources rather than relying on a single source.

That principle is highly relevant to KYB.

If a company has no website, the correct response should not automatically be:

“High risk.”

It should be:

“What other reliable evidence can help us understand this business?”

Africa’s SME economy does not always look digital

The digital footprint of a business depends heavily on the environment in which it operates.

A technology company serving international clients may be expected to have:

A professional website
Corporate email
LinkedIn presence
Online marketing
Digital payment infrastructure
Online customer support

But consider a small agricultural trader operating in a regional market.

Its business may depend on:

Local suppliers
Physical markets
WhatsApp communication
Mobile money
Bank transfers
Repeat customers
Personal relationships
Transport networks

The business may generate substantial legitimate revenue while having almost no public website.

This is not necessarily unusual.

The World Bank has highlighted the uneven level of digitalisation across African businesses. Research into informal businesses in several Sub-Saharan African countries found that internet and computer adoption remained limited, while mobile-phone usage was considerably more widespread.

The implication for compliance professionals is important:

Digital visibility and business legitimacy are not the same thing.

The WhatsApp business is a useful example

Imagine a small clothing wholesaler in Lagos.

The company has:

A registered business name
A physical warehouse
Several employees
Regular suppliers
Bank accounts
Mobile-money activity
Import documentation
A WhatsApp Business account

But no website.

Customers place orders through WhatsApp.

Invoices are issued electronically.

Payments arrive through bank transfers.

The company has been operating for five years.

Would the absence of a website make the business suspicious?

Probably not by itself.

In fact, the WhatsApp account may tell the investigator more about how the business actually operates than an expensive corporate website would.

This is an important shift in thinking.

KYB should examine how the business really operates, not how closely it resembles a European corporate template.

What should a KYB investigator look at instead?

If a business does not have a website, there are many other sources of information.

Corporate registration

Start with the official company information.

Look at:

Legal name
Registration number
Incorporation date
Directors
Shareholders
Registered address
Business activity

But do not stop there.

Corporate records tell you what the business is legally.

The rest of the investigation should help establish what it actually does.

Beneficial ownership

Who ultimately owns or controls the company?

This becomes particularly important when the corporate structure includes:

Holding companies
Multiple shareholders
Nominees
Cross-border entities
Family ownership
Trust arrangements

FATF’s definition focuses on the natural person who ultimately owns or controls the customer, including through indirect ownership or other forms of effective control.

A missing website tells you very little about this.

The ownership structure tells you much more.

Physical presence

For some SMEs, the physical business can be more informative than its digital footprint.

An investigator may be able to verify:

Office
Shop
Warehouse
Factory
Restaurant
Workshop
Trading premises

The existence of a physical operation can provide useful context.

Of course, physical presence alone does not prove legitimacy.

A fraudulent business can also have an office.

But it can contribute to a broader risk assessment.

Transaction activity can be more informative than online visibility

This is where KYB connects directly with transaction monitoring.

Suppose the business declares:

Wholesale food distribution

Expected monthly turnover:

€100,000

The account subsequently shows:

Payments to food suppliers
Receipts from supermarkets
Payroll
Rent
Transport expenses
Tax payments

The transaction activity appears broadly consistent with the stated business model.

The company has no website.

Should that outweigh the other evidence?

Probably not.

Now consider another company.

It declares:

IT consulting

It has no website.

No visible employees.

No obvious business premises.

It receives large payments from unrelated individuals.

Funds are rapidly transferred to personal accounts.

The transaction activity has little connection to IT consulting.

Now the lack of a digital presence becomes more relevant.

But notice the difference.

The website is not the primary red flag.

The inconsistency between the customer’s stated business and its financial behaviour is.

The danger of digital-footprint bias

One of the risks in modern KYB is assuming:

More digital presence = lower risk

and:

Less digital presence = higher risk.

That can create a form of digital bias.

A sophisticated website can be created in a few days.

A LinkedIn page can be created in minutes.

A Google Business profile does not prove that a company is genuine.

A polished digital footprint therefore does not automatically establish legitimacy.

Conversely, a business that has operated successfully for years may have little interest in maintaining a sophisticated online presence.

This is why compliance teams need to distinguish between:

absence of evidence

and

evidence of something suspicious.

Those are not the same thing.

Informality makes the picture more complicated

The African SME landscape includes a significant informal or semi-formal component.

This can create challenges for traditional KYB models.

A business may have:

Limited accounting infrastructure
Informal supplier relationships
Cash transactions
Mobile-money payments
Family employees
No dedicated compliance department
Limited digital presence

None of these characteristics automatically indicate financial crime.

At the same time, informality can create genuine AML challenges.

The objective is therefore not to ignore these characteristics.

It is to understand them in context.

A small cash-intensive business should be assessed according to the nature of its business, expected activity, geography and customer profile.

The question is not:

“Does this business look like a multinational?”

It is:

“Does this business behave like the business it claims to be?”

When the lack of a website should become relevant

There are situations where the absence of a website can become meaningful.

Consider a company claiming to be:

A multinational technology provider

with:

€20 million annual turnover
International clients
Hundreds of employees
Offices across several countries

Yet there is:

No website
No corporate email domain
No identifiable employees
No independent business references
No clear physical presence

That deserves investigation.

Not because “no website = suspicious.”

But because the claimed scale and nature of the business are inconsistent with the available evidence.

This is the distinction between:

a missing digital footprint

and

an unexplained digital footprint inconsistent with the customer’s profile.

Open-source information can help — but it has limits

Online research can be extremely useful in KYB.

Investigators may review:

Company registries
Government databases
Industry associations
Procurement records
Professional networks
News sources
Court records where available
Regulatory databases
Social-media accounts
Business directories

But open-source information should be used carefully.

A business not appearing in Google does not mean it does not exist.

A negative search result is not necessarily negative information.

And social-media presence should not be confused with verification.

The quality and reliability of each source matter.

A risk-based KYB approach

A better approach is to start with the customer’s risk profile.

For example:

Low-risk SME

Simple ownership
Local operations
Transparent beneficial owner
Consistent business activity
Reasonable transaction volumes
No significant adverse information

A missing website may have little significance.

Medium-risk SME

Several owners
Cross-border activity
Higher transaction volumes
Multiple business lines

The institution may require additional documentation and verification.

Higher-risk business

Complex ownership
Unclear beneficial ownership
High-risk jurisdictions
Unusual transaction patterns
PEP connections
Significant adverse media
Inconsistent business activity

Here, the absence of a website could become one small piece of a much broader risk picture.

This approach is more consistent with the broader risk-based philosophy of AML.

What documentation can replace a website?

Depending on the customer’s risk profile and local requirements, a financial institution could consider evidence such as:

Certificate of incorporation
Business licence
Tax registration
Shareholder documentation
Beneficial ownership declaration
Invoices
Contracts
Supplier agreements
Import/export documentation
Bank statements
Proof of premises
Utility bills
Payroll records
Financial statements
Regulatory licences

Not every customer needs every document.

The goal is not to create an endless document request.

It is to obtain sufficient reliable evidence proportionate to the risk.

FATF’s financial-inclusion guidance also recognises that lower-risk customers may be subject to proportionate approaches, while situations involving suspected frontmen or straw owners should trigger stronger CDD rather than simplified treatment.

The real KYB question

The most useful question for an investigator is not:

“Does the business have a website?”

It is:

“Can I independently understand and reasonably verify this business?”

That involves several questions:

Who owns it?

Who controls it?

What does it sell?

Where does it operate?

Who are its customers?

Who are its suppliers?

How does it receive money?

How does it spend money?

Does the transaction activity make sense?

Is the information consistent across sources?

Those questions provide considerably more insight than simply searching for a website.

The opportunity for African fintechs

This issue is particularly relevant as African fintechs increasingly serve SMEs.

A digital-first onboarding model can be highly efficient.

But efficiency should not mean assuming that every legitimate business will have the same digital footprint.

Fintechs can potentially build stronger KYB processes by combining:

Corporate registry data

Identity information

Beneficial ownership

Transaction behaviour

Business documentation

Open-source intelligence

Risk-based verification

This creates a much richer picture of the customer.

And it reduces dependence on any single indicator.

Final Thoughts

A business without a website is not necessarily a business without legitimacy.

In many African markets, SMEs operate through physical networks, referrals, mobile phones, WhatsApp, agents and established local relationships.

Their digital footprint may be limited.

Their economic activity may not be.

That creates an important lesson for KYB:

Compliance frameworks should adapt to the business environment rather than forcing every business into the same digital template.

The absence of a website may be worth noting.

But it should rarely be the conclusion.

The better question is:

“What evidence do we have that this business is real, who controls it, what does it do, and does its financial behaviour make sense?”

Because effective KYB is not about finding the most visible company online.

It is about understanding the real business behind the account.

And sometimes, that business does not have a website.

When a Business Has No Website: Rethinking KYB for African SMEs