Know Your Business (KYB): What It Actually Is, and How It Differs from KYC

A bank, a payment processor, or a B2B marketplace doesn’t open an account for a person who walks in with a name and an address — it opens one for a legal entity, and that entity has no face, no fingerprint, and no passport. Know your business (KYB) is the set of checks that stands in for all three: verifying that the company is real, that it is who it claims to be, and that the humans who actually control it aren’t the problem the whole check exists to catch. Get KYB wrong and the mistake isn’t a bad customer — it’s a shell, a sanctioned owner, or a synthetic entity sitting inside your books with a clean-looking certificate of incorporation.

KYB is frequently used almost interchangeably with KYC (know your customer), and the confusion is understandable — both sit inside the same compliance program, both trace back to the same anti-money-laundering (AML) rules, and both end in the same place: a documented answer to “who, exactly, are we doing business with?” But a business is not a person wearing a corporate hat. It has layers an individual never has — shareholders, officers, parent companies, registered agents — and each layer is a place the real answer can hide. This piece defines KYB precisely, lays the KYB vs KYC distinction out side by side, and walks through the verification steps that separate a real check from a paperwork exercise.

01What KYB actually is

Know Your Business is the process of verifying a business entity’s identity, legal status, ownership structure, and risk profile before and during a commercial relationship — typically before opening an account, extending credit, onboarding a vendor, or processing payments on the entity’s behalf. In the US, the regulatory anchor is FinCEN’s Customer Due Diligence (CDD) Rule, effective since May 2018, which requires covered financial institutions to identify and verify the beneficial owners of legal entity customers at the point of account opening. Internationally, the Financial Action Task Force’s Recommendation 10 sets the same baseline: for legal persons, due diligence must include understanding the ownership and control structure of the customer, not just its name and address.

Functionally, KYB answers four questions a registry certificate alone cannot: Does this company legally exist, and is it in good standing? Who are the natural persons who ultimately own or control it? Is anyone in that chain sanctioned, politically exposed, or otherwise disqualifying? And has anything material changed since the last time anyone checked? A KYB program that only answers the first question has verified a certificate, not a business.

02KYB vs KYC: the same compliance goal, a different subject

The simplest way to hold the KYB vs KYC distinction in your head: KYC verifies a person; KYB verifies a legal structure that is usually made up of several people, at least one of whom KYC still has to check individually. Neither replaces the other — a bank onboarding a corporate customer runs both, layered, with KYB establishing the entity and KYC establishing every natural person material to it.

03The four steps a real KYB check runs

Vendors sell KYB as a single API call, but underneath it is always the same four-step sequence, and skipping any one of them is how a program ends up compliant on paper and blind in practice.

1. Entity verification. Confirm the company exists in the register of the jurisdiction it claims, under the name and registration number it claims, and that its status is active and in good standing — not dissolved, struck off, or suspended. This is the step a certificate of incorporation alone cannot finish, because a certificate is a snapshot from the day of formation, not a live status.
2. UBO identification. Trace the ownership chain past the first layer of corporate shareholders to the natural person or persons who ultimately own or control the entity — the FinCEN CDD Rule sets a 25%-equity baseline, plus a control prong covering a single individual with significant managerial responsibility, though a risk-based program may collect at a lower threshold. See Entity Resolution and Ownership Graphs for why this step fails more often from mismatched records than from missing ones.
3. Sanctions and PEP screening. Screen the entity itself and every named UBO, director, and authorized signatory against sanctions lists, politically-exposed-person databases, and adverse media — a clean entity check means nothing if the 30% shareholder sitting two layers up is on an OFAC list.
4. Ongoing monitoring. Re-check the entity on a risk-based schedule, not just at onboarding, because ownership, officers, and registry status all change after the account is open — and a change nobody notices is functionally the same as never having checked at all.

Each step depends on the one before it: UBO identification is only as good as the entity verification that anchors it to the right legal record, and screening is only as good as the UBO list it runs against. A program that races to step three without finishing step one is screening the wrong entity correctly.

04Which number actually governs: FinCEN’s 25%, FATF’s ceiling, or the EU’s 25%-or-more?

Three different regimes write the beneficial-ownership threshold down differently, and a KYB program built around only one of them will misjudge a cross-border customer. In the US, the FinCEN Customer Due Diligence Rule is codified at 31 CFR 1020.210, setting a 25%-equity prong alongside a separate control prong covering a single individual with significant responsibility to control, manage, or direct the entity — two independent tests, either of which can name a UBO on its own.

The Financial Action Task Force’s Recommendation 24, revised in March 2022 with follow-up guidance published 10 March 2023, treats 25% differently again: as a ceiling, not a floor. FATF frames 25% as the maximum a country should rely on, requires a multi-pronged approach combining company-held records, a central register, and other sources rather than one declaration alone, and adds a “sufficient link” test for foreign-created entities — with no requirement that 25% be the number a country actually uses; many set it lower.

The EU’s new Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027 and does its own version of the same thing: Article 52 moves the wording from the older “more than 25%” to “25% or more,” so a holder sitting exactly at the line now counts, and the regulation lets the European Commission push the threshold down to as low as 15% for flagged higher-risk legal-entity categories by delegated act — a power not yet exercised as of this writing. The three regimes don’t disagree on the mechanics so much as on where the line sits and how firmly: a trace built to satisfy only the US’s literal 25% will under-collect against FATF’s guidance, and will under-trust nothing differently than the EU’s inclusive wording already would from 2027 on.

05What level of KYB does this customer actually need?

Not every entity needs the same depth of check, and regulators are explicit that none should be forced into one. The FFIEC’s BSA/AML Examination Manual states plainly that no single customer type automatically presents a higher money-laundering risk; what varies is the customer’s risk profile, built from factors like ownership geography, product usage, and delivery channel. The 2022 interagency Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting Customer Due Diligence directs institutions to scale the depth of diligence to that profile, not apply one fixed checklist to everyone.

In practice that collapses into three workable tiers. A standard tier covers most business accounts: a registry pull confirming active status, UBO identification against the 25%-or-control-prong baseline, sanctions and PEP screening, and an annual refresh. An enhanced tier applies where risk factors stack up — cross-border ownership, a PEP-adjacent holder, a high-risk jurisdiction, or high transaction volume — and typically lowers the effective ownership threshold below 25%, adds a source-of-funds check, requires senior sign-off, and refreshes on an event-triggered basis rather than waiting for the calendar. A simplified tier is permitted in some programs for genuinely low-risk cases, such as a subsidiary of an entity already subject to its own public-company disclosure regime, where the parent’s existing transparency substitutes for part of the independent trace.

Getting the tier wrong runs in both directions: over-applying enhanced diligence to a low-risk small business burns review capacity a real risk case needs, while under-applying standard diligence to a cross-border structure with a PEP-adjacent owner is exactly the gap a regulator will find first.

06Why entity verification is harder than a lookup

The first KYB step sounds like the easy one — look the company up, confirm it exists. To see how far that assumption holds, we ran a live stratified query against Zavia’s dataset on 20 October 2026, sampling 420 companies at random across twelve countries (US, GB, DE, FR, IT, CH, PL, NL, SG, SE, AE, UY).

Registration-number coverage is genuinely strong — 96% of the sample resolves to a filed number, which is the baseline a real entity-verification step needs. Legal-form data tells a different story: of the 330 companies that show any value, 284 — 86% — carry the identical label “Private limited company (Ltd.),” spanning jurisdictions (the US, Germany, Singapore, the UAE) that each have their own distinct entity-type taxonomy and no equivalent form actually called that. That is a normalization artifact sitting where verified legal-form data should be, and it means a KYB program that trusts a labeled field instead of reading the primary registry record is one field away from treating a German GmbH, a US LLC, and a UAE free-zone entity as interchangeable. See Legal Form and Ownership Transparency: What LLCs, Ltds, and Corps Actually Disclose for how far that gap extends across entity types.

The status split matters for step four, ongoing monitoring: 88% Active against 9.5% Inactive and a small Intermediate residual means a non-trivial share of any onboarded portfolio will drift out of good standing over time, and only a program that re-checks status on a schedule — rather than once at account opening — will ever see that drift happen.

So what does a generic label actually hide? The funnel below breaks the same 420-company sample down step by step, from “a company we found” to “a legal-form value we can actually trust.”

07Where KYB programs actually break

Most KYB failures aren’t missing steps — they’re steps run against the wrong data, or run once and never repeated.

1. Stopping at the first corporate shareholder. A holding company is not a UBO. If the chain’s top layer is still a legal entity, the trace isn’t finished.
2. Screening the entity name but not its owners. Sanctions programs target people and the entities they control, not just the entity’s registered name — a clean company name screens fine while a sanctioned owner sits one layer up. See Sanctions Screening and Beneficial Ownership for how often that combination slips through.
3. Treating onboarding as a one-time event. Ownership, officers, and status all change after the account opens, and a program with no refresh cadence has no way of ever learning about it.
4. Trusting a normalized label over the primary filing. As the sample above shows, a legal-form tag can be a placeholder rather than verified data — the only way to know is to read what the register itself actually filed.

08What does a KYB check that stops too early actually miss? A worked example

Take a hypothetical structure, built here purely to illustrate the mechanics and not drawn from any real company: “Atlas Fulfillment Ltd,” a UK-registered entity, is wholly owned by “Meridian Holdings B.V.,” a Dutch besloten vennootschap. A KYB check that stops at the first corporate shareholder records “Meridian Holdings B.V., 100%” and closes the file — but Meridian is a legal entity, not a person, so nothing has actually been verified yet about who controls Atlas.

Go one layer further and Meridian’s own cap table shows three holders: a Luxembourg SICAV investment fund at 38%, a Cayman Islands exempted limited partnership at 34%, and a named natural person at 28%. The natural person clears the ownership prong outright and gets screened directly. The two fund vehicles don’t: a fund is a legal entity too, so the trace has to continue again — to the SICAV’s management company and the Cayman ELP’s general partner — and under the control prong, each of those may surface its own controlling individual even though no one in the fund structure holds a direct equity stake above the 25% line on Atlas itself.

This is also exactly where the legal-form labeling problem from the earlier sample reaches in. If Meridian’s registry entry is read through a normalized “legal form” field instead of the primary Dutch Kamer van Koophandel filing, a program risks recording it as a generic Ltd.-equivalent and treating it as a terminal node — when the real Dutch besloten vennootschap form carries its own beneficial-ownership disclosure obligation, one a collapsed generic label gives no indication even exists. The failure here isn’t a missing document. It’s a trace that looked finished because the label said “company” and nobody opened the filing it was summarizing.

09Building KYB into onboarding, not after it

A workable sequence runs in this order, every time: pull the primary registry record and confirm active status before anything else proceeds; trace ownership past every corporate layer to a named natural person, a regulated fund, a listed public company, or a disclosed government entity — the only valid stopping points; screen the entity and every named person against sanctions, PEP, and adverse-media sources; and set a refresh cadence by risk tier so that a later ownership or status change actually reaches someone’s desk. The full version of that last step, including how to prioritize which accounts get re-checked first, is covered in UBO Verification Workflow: From Initial Check to Ongoing Monitoring.

The recurring obstacle is the one the data above quantifies directly: a registration number is usually there, but the fields built to summarize legal form and status can’t be trusted at face value, and the only fix is going back to the primary record instead of the convenience label sitting on top of it.

10Glossary

11Frequently asked questions

Related reading: once entity verification and UBO identification are both underway, mismatched records are the most common way the trace fails silently — see Entity Resolution and Ownership Graphs. For the deeper lifecycle this checklist feeds into, see UBO Verification Workflow: From Initial Check to Ongoing Monitoring. And for how KYB platforms stack up against dedicated risk-intelligence tools, see Top Sayari Alternatives in 2026: Best Platforms for UBO Discovery, KYB & Risk Intelligence.