How does KYC tell a company whether you have bad intentions or not? Let's say you work in a consultancy doing security research. On paper that looks good right?

How easy would it be for criminal orgs to setup legitimate looking fronts to pass these KYC checks?