AML and KYC Compliance for Construction Companies and Contractors

Large contracts, payments in stages and a chain of subcontractors: the profile regulators ask builders to document. Do it once per counterparty and keep it current.

Talk to us on WhatsApp See every service Estimate your costs

Non-financial obligated entities Audit-ready evidence Screening in seconds

COX gives a construction company or contractor a due diligence file for every owner who hires the work, every buyer of a unit and every subcontractor or supplier the policy covers: documents read automatically, sanctions and PEP screening with a certificate, beneficial owners recorded and a risk score that reflects the project, the origin of the funds and the country.

Where compliance hurts

The owner pays the work in stages, from accounts that change, and the origin of the money is rarely documented
The client is a project company whose real owners sit behind other entities
Subcontractors and suppliers change from one job to the next and nobody screens them

Cash still moves on site: crews, materials and small contractors
Public works put officials on the other side of the contract, and nobody recorded who was a PEP

Who is obligated, country by country

Construction concentrates large sums, long payment chains and real estate that holds value, and the region treats it accordingly. Some countries name builders and contractors as obligated entities outright; others reach them only when they sell or broker real estate. Each country draws the line differently.

Panama

Law 23 of 2015 lists construction companies, general contractors and specialised contractors among the non-financial obligated entities supervised by the Superintendency of Non-Financial Subjects, with no condition attached, and the SSNF regulates them together with the real estate sector.

Mexico

The LFPIORPI makes construction and real estate development a vulnerable activity when it involves buying or selling the property for clients, and since the 2025 reform also receiving funds for a real estate development meant for sale or rent; notices go to the SAT.

Colombia

Building and civil works companies supervised by the Superintendency of Companies adopt the Chapter IX system, formerly SAGRILAFT, or its minimum measures regime, according to their revenue or assets.

Guatemala

Article 3 of Decree 15-2026 lists the promotion, brokerage and sale of real estate among the obligated activities but does not name construction as such: a builder is covered when it promotes or sells real estate.

Dominican Republic

Law 155-17 names construction companies, but CONCLAFIT clarified in 2025 that they are obligated only when they buy, sell or broker real estate: a builder that only executes works for others is not, and one that sells its projects is supervised by the DGII.

Venezuela

The organic law against organized crime and terrorism financing names the construction of buildings among the activities with prevention duties, and the UNIF's risk-based guide for the real estate sector covers it.

Ecuador

The organic law against money laundering of 2024 lists construction among the non-financial obligated activities; construction companies are supervised by the Superintendency of Companies, Securities and Insurance and report to the UAFE.

Thresholds and reporting deadlines change: the platform reads the ones in force for your company's regime. Confirm your status with your regulator.

Why they choose COX

Owner, buyer and subcontractor

Each counterparty of the project has its own file and its own screening, with its role recorded, so the chain of who pays whom is documented.

Project companies

The corporate file records shareholders and controllers of the company that hires the work, and each of them is screened as well.

PEPs in public works

PEP screening with enhanced due diligence when it applies, so a public official on the other side of the contract is on record with the officer's decision.

How It Works

Three steps from a new customer to a documented file

Collect

Send the customer a secure onboarding link. They upload their identity document, proof of address and source of funds from any device, and the platform reads the document for them.

Document reading and prefill
Selfie and liveness check
Beneficial owner declaration

Verify

Sanctions, PEP and restrictive lists are searched at once, adverse media on request, and the risk matrix scores the customer with the weights your policy sets.

Sanctions, PEP and watchlists
Risk matrix by country and activity
Enhanced due diligence when required

Document

Every search, decision and document stays in the file with its date and author. Print the due diligence report or the screening certificate when the regulator asks.

Immutable audit trail
Sealed PDF reports
Renewal reminders

Red flags the file has to document

Advance payments far above what the progress of the work justifies, or refunds asked to another account
The work paid in cash or by third parties with no relation to the owner
A price far from the market, or a project with no permit or no verifiable land
A subcontractor with no verifiable address, staff or equipment
A contract changed or cancelled right after the origin of the funds is asked for

What the platform gives you

Everything a non-financial obligated entity needs, without a compliance department

Identity verification

Documents read automatically, selfie with liveness check and the data proposed for the officer to confirm.

List screening

Sanctions, PEP, restrictive and open-data lists, with a certificate that says which edition of each list was consulted.

Risk matrix

Country, activity, product, channel and PEP status weighted the way your manual says, with the result explained.

Adverse media

News about the customer ranked by how surely it names the same person, never a list of homonyms.

Due diligence files

Natural and legal persons, beneficial owners, related parties, documents with expiry dates and renewal alerts.

Reports for the regulator

Due diligence report, screening certificate and training records, each sealed with a verifiable fingerprint.

Built for

Construction companies

Who builds for others or for its own projects

General contractors

Who takes the whole work and hires the rest

Specialised contractors

Electrical, plumbing, structures and the other trades

Real estate developers

Who builds to sell, and meets the buyer as well

Encrypted storage

Full audit trail

Roles per user

Six countries covered

Frequently asked questions

It depends on the country. Panama names construction companies and contractors without condition; the Dominican Republic and Mexico reach them only when they buy, sell or broker real estate; Colombia by sector and size. The table above says how each country draws the line.

If your policy or your regulator treats them as counterparties, yes, and a sanctioned subcontractor is as serious as a sanctioned owner. COX keeps a file for each of them with its role in the project.

The officials who award or supervise the contract may be PEPs. The platform screens them, records the result and asks for enhanced due diligence when the risk level requires it.

Yes. Digital onboarding sends a link; the customer uploads the identity document and the platform reads it and proposes the data. The builder only confirms what it sees.

COX charges per credit: you pay for each screening or report you run, with no monthly minimum. Monthly plans exist for companies with steady volume.

Know who you build for