Compliance checks on international companies are getting deeper every year, and what the internet says about you is now part of them.

By Marianna Konina, Founder & CEO, Reputation City

The problem: stricter rules, deeper checks

Picture a Limassol trading company applying for a corporate account with a bank in Frankfurt. Its documents are in order and its directors have nothing to hide. Before anyone at the bank speaks to them, a compliance analyst has already searched the company, its directors and its beneficial owners in a search engine, a screening database and, increasingly, an AI assistant. The results go into the client file, and that file carries a lot of weight in whether the account is opened.

These checks are getting stricter. The EU Anti-Money Laundering Regulation applies directly in all member states from 10 July 2027 and replaces national rules with one rulebook. The EU Anti-Money Laundering Authority in Frankfurt has been operating since July 2025 and is due to start directly supervising around 40 high-risk financial groups in 2028. Cyprus launched its own National Sanctions Implementation Unit in July 2025, with technical support from the UK, and breaching EU sanctions is now a criminal offence across the Union. Banks, auditors, lawyers and corporate service providers are under closer supervision, and they pass that pressure on to their clients.

Adverse media screening is part of every serious check. European banking supervisors list media reports among the sources firms may use to assess a customer’s risk, so news articles, court references, forum posts, review sites and AI-generated summaries all end up in the file. Cypriot firms are especially exposed to this. According to the European Investment Bank, 81% of Cypriot businesses are integrated into global trade, compared with an EU average of 63%, so counterparties review them in many countries and languages at once. A Russian-language news story or a Ukrainian forum post can end up quoted in an English due diligence report that the company itself never sees.

The consequences: what a failed check costs

A company does not have to have done anything wrong to fail a check. An allegation from years ago that was later dropped, a director who shares a name with someone on a sanctions list, negative articles paid for by a competitor, or simply too little credible information can be enough.

The results are practical. A bank may refuse to open an account or close an existing one, a practice known as de-risking, which the European Banking Authority has warned also hits legitimate customers. Payment providers hold transfers for review. An investor slows down a funding round or pulls out. A partner chooses a competitor whose file was easier to approve, and a company can lose a tender without knowing its online profile was the reason. Banks and investors rarely explain these decisions, so the company often cannot fix the problem because it does not know what it is.

Some of this content is created on purpose. The World Economic Forum’s Global Risks Report 2026 ranks misinformation and disinformation as the second most severe global risk over the next two years. A smear campaign can be published in several countries within weeks and picked up by screening tools and AI assistants long before anyone responds.

The country pays a price too. Cyprus has invested heavily in proving that it is a well-regulated place to do business. When Cypriot companies are held up by problems that could have been fixed in advance, it feeds old perceptions of the jurisdiction that the reforms were meant to change.

The solution: build a profile that passes the check

Manage your digital profile the way you manage any other security risk: on purpose and before it becomes urgent. At Reputation City, we call this reputational security. In practice, it means knowing what a bank, an investor, or an AI tool will find about your company and its owners in every language that matters for your markets, correcting what is wrong, dealing with outdated or hostile content, and building enough credible, verifiable information that your public profile supports your compliance file.

You can start at any stage. A company planning to enter a new market or open accounts abroad can do it before the first application. A startup can prepare before a funding round, when investors run their own checks. A company that has found negative material about itself can start there, and a company that has already been refused by a bank can find out what went wrong and fix it before the next attempt. Starting early costs less and takes less time, but it is never too late to begin.

The full article explains why we see reputation as the fourth pillar of corporate security, alongside physical, cyber and financial security, and goes through the areas where companies can and should protect it: search results, AI visibility, compliance readiness, monitoring, response to information attacks, founder and executive profiles, reviews, and media presence.

ONLINE VERSION (full article, Cyprus Business Group website)

Checked Before You Knock: Reputation as the Fourth Pillar of Corporate Security

By Marianna Konina, Founder & CEO, Reputation City

Picture a Limassol trading company applying for a corporate account with a bank in Frankfurt. Its documents are in order and its directors have nothing to hide. Before anyone at the bank speaks to them, a compliance analyst has already searched the company, its directors and its beneficial owners in a search engine, a screening database and, increasingly, an AI assistant. The results go into the client file, and that file carries a lot of weight in whether the account is opened.

For years, companies saw their online presence as a PR matter. Today, whatever is published about a company, in any language, ends up in its compliance profile. This article looks at why that has happened, what it costs companies that ignore it, and how to protect reputation as seriously as any other business asset.

Stricter rules, deeper checks

The EU is replacing a patchwork of national anti-money laundering rules with a single rulebook. The Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in all member states from 10 July 2027. The new EU Anti-Money Laundering Authority (AMLA) in Frankfurt started operating in July 2025 and, according to EY, will begin directly supervising high-risk cross-border institutions in 2028.

Sanctions enforcement is tightening as well. Directive (EU) 2024/1226 sets common criminal offences and penalties for breaching EU sanctions. In July 2025 Cyprus launched its National Sanctions Implementation Unit, which brings sanctions oversight together under the Ministry of Finance. The UK supported the project, as the UK government announced in December 2024.

Most companies reading this are not obliged entities under these rules, but their banks, payment providers, auditors, lawyers and corporate service providers are. As those firms strengthen their due diligence, their clients will be asked more often about source of funds, ownership structures and anything negative found online, and the answers will be documented more carefully.

The online part of that review is adverse media screening. The EBA Guidelines on ML/TF risk factors, which shape how European banks assess customers, include media sources among the information firms may take into account. A typical review looks at:

• who the directors and beneficial owners are, and whether public records match the documents;
• sanctions and politically exposed persons lists, including people with similar names;
• news, court references, regulatory notices and investigations in any language;
• whether the website, registry data, online profiles and press coverage are consistent with each other;
• more and more often, what an AI assistant says when asked about the company or its owners.

Cypriot companies face this more than most. The EIB Group Investment Survey found that 81% of Cypriot businesses are integrated into global trade, compared with an EU average of 63%, and Invest Cyprus reports that more than 420 companies set up operations on the island through its Business Support Centre in 2024 and 2025. These companies are checked by counterparties in many countries, and the material that causes problems is often not in English or Greek. It might be a Russian-language news site, a Ukrainian forum, an Arabic business directory or a machine translation of a court summary.

What a failed check costs

A company does not need to have done anything wrong to fail a check. In our work with companies, founders and investors, the issues that cause trouble are usually ordinary:

• old allegations that were resolved but never corrected online, so only the accusation is visible;
• confusion with sanctioned or negatively reported people who share a similar name;
• public information that contradicts itself across registry data, websites and profiles;
• groups of low-quality websites publishing negative material, often in several languages, built to rank for a person’s or company’s name;
• too little credible, verifiable information, which leaves whatever else exists to define the company.

The consequences are concrete. Banks refuse to open accounts or close existing ones. The European Banking Authority has warned that this kind of de-risking, when unwarranted, can shut legitimate customers out of financial services. Payment providers hold transfers for review, investors slow down or abandon funding rounds, and partners choose competitors whose files were easier to approve. Companies lose tenders without learning that their online profile was the reason. Banks and investors rarely explain these decisions, so the company often cannot fix the problem because it does not know what it is.

Part of this content is created deliberately. The World Economic Forum’s Global Risks Report 2026 ranks misinformation and disinformation second among global risks over the next two years, behind geoeconomic confrontation. For an international company, a coordinated campaign by a competitor or former partner can be put together in a few weeks, published in several countries and picked up by screening tools well before the company responds.

There is a cost for Cyprus as well. The country has done a great deal to show that it meets international standards. When Cypriot companies are held up by problems that could have been fixed in advance, it feeds old perceptions of the jurisdiction that those reforms were meant to change.

Reputation as the fourth pillar of corporate security

Most boards already think about three kinds of security. Physical security protects people, premises and assets. Cybersecurity protects systems and data. Financial and economic security protects against fraud, sanctions exposure and counterparty failure.

Reputational security is the fourth. It covers how the company is seen by the people and systems that decide whether to work with it: banks, regulators, investors, partners, clients and, increasingly, AI tools. It belongs with the other three because the threats work similarly. Outsiders damage reputations, sometimes on purpose and often without warning, and the damage shows up as closed accounts, lost deals, and partners who quietly stop replying. Like the other three pillars, it needs an owner, regular checks, and a plan for incidents.

Where to protect your reputation

In our work at Reputation City we look at eight areas. Each one affects how a company is assessed during KYC, compliance and due diligence.

Search results. For most counterparties, the first page of results for the company’s name and its owners’ names is the first impression. What appears there differs by country and language, so a company can look clean in English and very different in Russian or Greek. The aim is to make sure that accurate, current and relevant information is what reviewers see in every market that matters.

Visibility in AI systems. Search engines now answer questions themselves. A Semrush study of more than 10 million keywords found that Google’s AI Overviews appeared for 6.49% of keywords in January 2025, rose to nearly 25% in July and stood at about 16% in November. Analysts and investors also ask ChatGPT, Perplexity and similar tools for quick company profiles. These systems build their answers from whatever they can find and present it with confidence. Generative engine optimisation (GEO) means making sure they find accurate, authoritative sources about you.

Compliance readiness. We review a company and its beneficial owners the way a compliance team would, looking at adverse media, sanctions name matches and inconsistencies that could trigger enhanced due diligence. We flag what is likely to raise questions and help put the public record in order before an application or a transaction. This work supports formal legal and compliance advice and does not replace it.

Monitoring. Regulators expect banks to monitor their clients continuously, not only at onboarding. Companies need the same habit for their own reputation: tracking new mentions, new websites and changes in AI answers across languages, so that a problem is found while it is still small.

Response to information attacks. When a coordinated campaign appears, speed matters more than anything else. A prepared company knows who decides, which facts and documents it can publish, which platforms and outlets to contact, and how to make sure that accurate information outranks the attack in search and AI results.

Founder and executive profiles. KYC checks look at people as well as companies. Investors check founders before they check business plans. A director’s personal profile, including old interviews, previous companies and name matches, can block a deal that the company itself would pass.

Reviews and rating platforms. Reviews are no longer only a consumer matter. BrightLocal’s Local Consumer Review Survey 2026 found that 97% of consumers read reviews for local businesses and that AI search tools are now among the most used sources of recommendations. Employer review sites and business directories are read by partners and investors too, and patterns of fake or hostile reviews can become part of a risk picture.

Media presence and authority. Credible coverage in the languages of a company’s key markets gives reviewers something independent to verify. Interviews, expert commentary and professional publications create a record that confirms who the company is and what it does, and it is much harder for a smear campaign to dominate a profile that already has substance.

You can start at any stage

Reputational security isn’t reserved for companies in crisis, and it is never too late to start. Companies usually come to it at one of four points:

• before entering a new market or opening accounts abroad, when the first checks are coming;
• before a funding round, an acquisition or a large contract, when investors and partners run their own due diligence;
• after finding negative or inaccurate material about the company or its owners;
• after a refusal or a delay from a bank or partner, to find out what went wrong and fix it before the next attempt.

Starting early costs less and takes less time. Starting late still makes the next check easier than the last one.

About Reputation City

I founded Reputation City in Cyprus in 2023 to work on this problem. We treat reputation as part of corporate security and prepare companies, founders, and investors for KYC, compliance, and due diligence checks across jurisdictions. We start by looking at a company the way its counterparties will, through search engines, screening sources and AI systems in the languages that matter for its markets, and then resolve what could raise a red flag. We work alongside legal, compliance and advisory firms and do not replace them.

In international business, trust must be checked before it is given, and most of that checking happens before the first meeting. Companies that prepare for it get through the process faster and with fewer surprises.

Reputation City is a Strategic Partner of Cyprus Business Group.

ABOUT THE AUTHOR

Marianna Konina is the Founder and CEO of Reputation City, a reputational security company based in Limassol. She has 20 years of experience in communications and helps companies, founders and investors prepare their public profile for KYC, compliance and due diligence across jurisdictions, and protects them from information attacks in search engines and AI systems. She spoke at the Cyprus Diaspora Forum 2026 on building a stronger global identity for Cyprus.

SOURCES (online version)

• Regulation (EU) 2024/1624 (AMLR), EUR-Lex
• EU Anti-Money Laundering Authority (AMLA)
• EY: How can EU leaders get ahead as AMLA and AMLR transform supervision
• Directive (EU) 2024/1226, EUR-Lex
• Chrysostomides: Cyprus establishes a National Sanctions Implementation Unit
• GOV.UK: UK and Cyprus to tackle serious organised crime and Russian illicit finance
• EIB Group Investment Survey: Cyprus
• Invest Cyprus: Annual General Meeting 2026
• EBA Guidelines on ML/TF risk factors
• EBA: Opinion on the detrimental impact of unwarranted de-risking
• World Economic Forum: Global Risks Report 2026
• Semrush: AI Overviews Study
• BrightLocal: Local Consumer Review Survey 2026

Author: Din Kumar