TLDR
- KYB is not KYC applied to a business. It adds three checks KYC never touches: registry verification, beneficial ownership mapping, and business-risk scoring.
- In the US, the FinCEN Customer Due Diligence Rule requires covered financial institutions to identify beneficial owners who hold 25% or more of a legal entity.
- A complete KYB process has six distinct steps. Missing any one of them creates regulatory exposure, not just friction.
- Automated KYB tools can complete registry lookups in seconds. Manual review still requires human judgment for high-risk entities, complex ownership chains, and shell company flags.
- If your onboarding flow asks only for an EIN and a government ID, you are doing KYC on a business, not KYB.
Know Your Business (KYB) is the set of regulatory checks a financial institution or fintech must complete before onboarding a business customer. In the US, a compliant KYB process covers six layers: legal entity verification, business registration, beneficial ownership identification, authorized signer confirmation, AML and sanctions screening, and ongoing monitoring. These checks are required under the Bank Secrecy Act, FinCEN’s CDD Rule, and the 2021 Corporate Transparency Act, and they go well beyond what standard KYC identity checks cover for individual consumers.
What Is KYB and Why Is It Different from KYC?
KYC, Know Your Customer, verifies an individual: name, date of birth, address, and a government-issued ID. That is the full scope of the check. KYB verifies an organization, which is structurally more complex because a business is a legal fiction. It exists only through registration documents, and it can be controlled by a chain of individuals, trusts, or other legal entities that never appear on its public face.
The practical gap between KYC and KYB shows up the moment a fraudster creates an LLC with a clean EIN, files clean incorporation paperwork, and uses the entity to open a payment account. A KYC check on the LLC’s designated representative might pass without a single flag. A KYB check would also require identifying who actually owns or controls that LLC, screening those individuals against sanctions and PEP lists, and validating that the business is actively registered and matches its stated activity. That extra work is what KYB adds.
| Check Type | KYC (Individual) | KYB (Business) |
|---|---|---|
| Identity document | Yes | Yes (for authorized signers and UBOs) |
| Address verification | Yes | Yes (registered business address) |
| Sanctions/watchlist screening | Yes | Yes (entity and all UBOs) |
| State registry lookup | No | Yes |
| Beneficial ownership mapping | No | Yes |
| Business risk scoring | No | Yes |
| Ongoing entity monitoring | Rarely | Yes |
What US Regulations Drive KYB Requirements?
Three regulatory frameworks define the KYB compliance floor in the US. Understanding which one applies to your product determines how strictly you must execute each step.
The Bank Secrecy Act and FinCEN’s CDD Rule
The Bank Secrecy Act requires covered financial institutions to maintain anti-money laundering programs, file suspicious activity reports, and establish customer due diligence procedures. FinCEN’s 2016 CDD Rule, which took effect in 2018, added a fourth pillar to AML programs: beneficial ownership identification. Under the rule, covered institutions must identify and verify the identity of any individual who owns 25% or more of a legal entity customer, plus one individual who controls the entity, regardless of ownership percentage.
The Corporate Transparency Act
The Corporate Transparency Act of 2021 expanded the beneficial ownership reporting obligation to the businesses themselves. US companies with fewer than 20 employees and under $5 million in annual revenue are required to report their beneficial owners directly to FinCEN. This created a national Beneficial Ownership Information (BOI) registry that fintechs can reference as one layer of their KYB checks, though it does not replace independent verification.
State-Level Licensing Obligations
Money transmitters, lenders, and payment facilitators are subject to state licensing requirements that carry their own KYB standards. If you hold or are applying for a money transmitter license in states like New York or California, the background check on controlling persons of your business customers goes deeper than the FinCEN floor. For a breakdown of what state licensing costs, the money transmitter license cost by state guide covers fee structures across all 50 states.
The FintechSpecs KYB Six-Layer Stack: A Complete Checklist
Most published KYB checklists stop at four or five items. The reason the sixth layer, ongoing monitoring, gets skipped is that it is operationally harder than the onboarding checks and has no clear trigger that a product dashboard surfaces. Below is the full six-layer KYB compliance stack, in execution order, with the specific data points each layer requires.
Layer 1: Legal Entity Verification
Confirm the business is a real, registered legal entity with a verifiable formation record. This is not the same as running an EIN lookup. EINs are issued by the IRS for tax purposes and can be obtained for entities that are not in good standing with their state of formation.
Required data points:
- Legal entity name (exact match to state registration)
- Entity type: LLC, corporation, partnership, sole proprietorship
- State of formation and registered agent
- Formation date
- EIN or Tax ID
- Registered address
Vendors like Middesk, Baselayer, and Persona pull directly from state secretary of state databases to return registration status in real time. For a side-by-side of two leading options, the Middesk vs Baselayer KYB comparison covers how each handles high-risk entity types.
Layer 2: Business Registration and Good Standing
A business can be legally formed but not in good standing. A lapsed annual report, an unpaid state fee, or an administrative dissolution removes the liability protections that make an LLC a safe counterparty. Your KYB check needs to confirm active, good-standing status, not just formation.
Required data points:
- Active status in state of formation
- Active status in states where the business is foreign-qualified
- Business license verification (for regulated industries)
- Physical address validation (not a mail drop or virtual office used for shell companies)
Layer 3: Beneficial Ownership Identification
This is the step that separates KYB from anything a basic KYC check covers. Beneficial ownership means identifying the natural persons who ultimately own or control the entity, through however many layers of intermediate holding companies or trusts exist between them and the legal entity you are onboarding.
Required data points:
- All individuals owning 25% or more (the FinCEN threshold)
- At least one control person, regardless of ownership stake
- For each beneficial owner: legal name, date of birth, residential address, government ID
- Ownership percentage for each UBO
- Corporate ownership structure chart if entity is owned by another entity
Collecting this data is only half the work. You still need to verify each beneficial owner’s identity with the same rigor as a standalone KYC check. Tools like Alloy and Trulioo can run both the entity-level KYB and the individual-level KYC checks on each UBO within a single orchestration flow.
Layer 4: Authorized Signer Verification
The authorized signer is the individual who represents the business in the transaction relationship. They may or may not be a beneficial owner. You need to verify their identity independently and confirm they have legal authority to bind the entity.
Required data points:
- Government-issued ID (driver’s license, passport)
- Liveness check or biometric verification
- Confirmation of authority: corporate resolution, operating agreement, or board minutes
Fintechs serving high-risk verticals, such as crypto exchanges, lending platforms, or payment facilitators, should also run the authorized signer through PEP and adverse media checks at this stage, not just at the UBO layer.
Layer 5: AML, Sanctions, and Risk Screening
Every entity and every beneficial owner identified in layers 3 and 4 must be screened against sanctions lists, politically exposed person registries, and adverse media sources. In the US, the mandatory list is the OFAC SDN list. Global programs add EU, UN, and UK sanctions lists.
Required screening layers:
- OFAC Specially Designated Nationals (SDN) list
- FinCEN 314(a) list (for covered financial institutions)
- PEP registries (foreign and domestic)
- Adverse media screening (negative news associated with fraud, corruption, or criminal activity)
- Industry-specific risk scoring (high-risk NAICS codes: cannabis, firearms, adult entertainment, money services)
For fintechs that need dedicated AML screening APIs beyond bundled KYB platforms, the best AML screening APIs for US fintechs covers providers including ComplyAdvantage, Sardine, and Dow Jones Risk and Compliance.
Layer 6: Ongoing Monitoring and Perpetual KYB
Most fintechs treat KYB as a point-in-time check at onboarding. That is a significant gap. A business can change its ownership structure, lose its good standing, or appear on a sanctions list six months after you onboarded it cleanly. Regulators expect ongoing monitoring proportional to the risk tier of the customer.
Required monitoring cadences:
- Sanctions list rescreening: daily or near-real-time for high-risk customers
- Registry status checks: quarterly at minimum
- Beneficial ownership updates: triggered by ownership change notifications or periodic review cycles
- Transaction pattern monitoring: flagging behavior inconsistent with stated business purpose
Perpetual KYB is now a product category of its own. For platforms evaluating dedicated tools, the best perpetual KYB and ongoing monitoring platforms compares vendors built specifically for this use case.
What Does the KYB Process Look Like End-to-End?
Consider a Series A lending platform onboarding small business borrowers. A representative application comes in from a Delaware LLC that operates in California. Here is how the FintechSpecs KYB Six-Layer Stack executes in practice:
- The platform’s KYB API pulls the LLC’s Delaware registration record, confirms active good standing, and validates the EIN against IRS records. This takes under 10 seconds with a modern provider.
- The platform checks California secretary of state records to confirm foreign qualification, since the business operates there.
- The KYB form prompts the authorized signer to declare all beneficial owners above 25%. Two individuals are listed: one owning 60% and one owning 40%. Both are routed through identity verification with document upload and liveness detection.
- Both individuals and the entity itself are screened against OFAC, PEP lists, and adverse media. No hits return.
- The business’s NAICS code is flagged as moderate-risk. The compliance team sets the customer to a quarterly review cycle rather than the annual default.
- Ninety days later, the monitoring system flags that the Delaware registration has lapsed. An automated workflow triggers a remediation request.
Manual review at step 4 would have added two to three days. The automated path completes steps 1 through 5 in under 30 minutes, with human review reserved only for the risk flag. That is the operational gap between a well-configured KYB stack and a manual compliance process.
How Do KYB Requirements Vary by Business Type?
Not every business entity requires the same depth of verification. The table below maps entity type to the practical complexity of the KYB process.
| Entity Type | Registry Check | UBO Complexity | Typical KYB Challenge |
|---|---|---|---|
| Sole proprietorship | DBA filing (varies by county) | Single individual, same as KYC | No central registry; address validation harder |
| Single-member LLC | State SOS lookup | One UBO | Low complexity if US-based |
| Multi-member LLC | State SOS lookup | Multiple UBOs, possible operating agreement review | Ownership splits can be unequal or tiered |
| S-Corp or C-Corp | State SOS lookup | Shareholders above 25% | Private companies may not disclose share register |
| Holding company or subsidiary | Multiple state lookups | Parent entity must also be verified | UBO chain may span multiple legal entities |
| Foreign entity operating in US | Home country registry plus US foreign qualification | Non-US UBOs require cross-border ID verification | Registry data quality varies by country |
Which KYB Providers Handle US Business Verification?
The KYB vendor market has consolidated around a few categories. Fully bundled KYB platforms cover registry lookups, UBO collection, and identity verification for beneficial owners in one API. Specialized registry data providers focus on the entity layer and integrate with separate identity tools. Compliance orchestration platforms combine KYB with fraud signals and transaction monitoring in a single decisioning flow.
Middesk is the most widely cited registry-first KYB provider for US business verification, pulling from all 50 state secretary of state databases. Alloy positions itself as an orchestration layer that can run KYB signals alongside identity and fraud checks in a configurable decision engine. Baselayer focuses on high-risk entity types where registry data alone is insufficient. Trulioo and Sumsub extend coverage to cross-border verification for businesses with non-US registration. For a full comparison, the 10 best KYB providers for B2B fintech onboarding covers pricing structures, coverage depth, and integration complexity for each.
Pricing across the category is not publicly standardized. Most providers charge per verification, with volume discounts at scale. The mix of entity checks, UBO identity verifications, and ongoing monitoring add-ons makes total cost highly dependent on your customer mix. For a framework to evaluate vendor economics before signing, the fintech vendor evaluation framework covers the seven questions worth answering before any contract.
What Are the Most Common KYB Compliance Mistakes Fintechs Make?
Four failure patterns appear repeatedly in KYB programs at early-to-growth-stage fintechs.
Treating UBO Collection as a Form Field
Collecting a name and ownership percentage in a form is not beneficial ownership verification. You have to verify the declared information: confirm the ID document is authentic, match the face to the document, and screen the individual against sanctions lists. Many platforms collect the data and do nothing with it, which does not satisfy the CDD Rule and creates liability without the compliance benefit.
Stopping KYB at Onboarding
A clean KYB at onboarding with no subsequent monitoring means your compliance posture is frozen at the date of application. Ownership changes, sanctions designations, and registry lapses happen after onboarding. A compliance program without ongoing monitoring is a snapshot, not a program.
Applying a Single Risk Tier to All Business Customers
A solo consultant LLC and a multi-entity holding company operating in a high-risk industry carry different risk profiles and require different verification depth. Flattening them to the same process either over-collects on low-risk customers, causing drop-off, or under-screens high-risk ones. Risk-tiered KYB is standard practice, not optional sophistication.
Missing Foreign-Qualified Entities
A business incorporated in Delaware but operating in California should appear in both state registries. Many KYB processes check only the state of formation. Checking only one registry misses inactive or lapsed foreign qualifications and can create a false picture of a business’s operational legitimacy.
Frequently Asked Questions
What is the difference between KYC and KYB?
KYC (Know Your Customer) verifies an individual person using identity documents, date of birth, and address. KYB (Know Your Business) verifies a legal entity and includes additional checks that KYC does not cover: state registry confirmation, business good standing, beneficial ownership mapping, and entity-level AML screening. KYB also requires running KYC checks on each identified beneficial owner and authorized signer, so it encompasses KYC but goes significantly further.
Who is required to perform KYB in the US?
FinCEN’s Customer Due Diligence Rule formally applies to covered financial institutions: banks, credit unions, mutual funds, broker-dealers, and futures commission merchants. In practice, sponsor banks require their fintech partners to perform equivalent KYB on business customers as a condition of their program agreements. Payment facilitators, lending platforms, and marketplace operators also face KYB expectations from card network rules and their BaaS providers, even if they are not directly regulated by FinCEN.
What documents are required for a KYB check?
A standard US KYB check requires: articles of incorporation or LLC formation documents, EIN verification, a certificate of good standing from the state of formation, a list of beneficial owners with ownership percentages, and government-issued photo ID for each beneficial owner and authorized signer. High-risk or complex entities may also require an operating agreement, corporate resolution, and proof of business address such as a utility bill or lease agreement.
What is a beneficial owner under FinCEN rules?
Under FinCEN’s CDD Rule, a beneficial owner is any individual who owns 25% or more of a legal entity customer, or any single individual who exercises significant control over the entity regardless of ownership stake. The 25% threshold means a legal entity with four equal owners, each holding exactly 25%, requires all four to be identified and verified. There is no minimum threshold for the control prong, so a CEO with no equity stake still qualifies as a beneficial owner under FinCEN’s definition.
How long does a KYB check take?
Automated KYB checks for straightforward US entities, single-state registration, clear ownership, and no sanctions hits, typically complete in under five minutes with a modern API-based provider. Complex cases involving multi-entity ownership chains, foreign UBOs, or manual document review take one to three business days. The biggest variable is UBO identity verification response time, particularly when beneficial owners have non-US passports that require manual document review.
What happens if a business fails a KYB check?
A failed KYB check does not automatically mean rejection. Most compliance programs distinguish between a hard fail, such as an OFAC sanctions match, which requires immediate denial and potentially a SAR filing, and a soft flag, such as a mismatched address or lapsed registration, which can be remediated with additional documentation. Your compliance policies should define escalation paths for each failure type. Treating every KYB exception as a binary pass-fail outcome leads to unnecessary customer rejections and missed revenue.
Does the Corporate Transparency Act replace KYB?
No. The Corporate Transparency Act created a beneficial ownership reporting obligation for the businesses themselves, requiring many small companies to file UBO information directly with FinCEN’s BOI registry. Financial institutions and fintechs must still perform their own independent KYB verification. The BOI registry is an additional data source that can supplement verification, but FinCEN’s CDD Rule obligation for covered institutions to independently verify beneficial ownership remains separate and unchanged.
Where KYB Sits in the Broader Compliance Stack
KYB does not operate in isolation. It sits at the front of an onboarding flow that connects to fraud detection, transaction monitoring, and ongoing risk management. A business that passes KYB cleanly at onboarding can still generate suspicious transaction patterns six months later. The KYB check establishes a risk baseline; the monitoring infrastructure maintains it.
For fintechs building compliance programs from scratch, the KYB layer integrates with identity orchestration tools upstream and AML transaction monitoring downstream. Getting the handoffs right between these layers is where most implementation complexity lives. The fintech product and compliance readiness checklist maps where KYB sits relative to the full compliance stack, including licensing, AML programs, and ongoing monitoring obligations.
The underlying insight is this: KYB compliance is not a single check. It is a process with six interdependent layers, and the value of any one layer depends on the integrity of the others. A clean registry check means nothing if beneficial owners are not verified. Sanctions screening means nothing if it is not rerun after onboarding. Fintechs that treat KYB as a checkbox rather than a continuous process will eventually discover the gap at the worst possible moment, in an exam, a fraud incident, or a sponsor bank audit.
