How should financial firms handle KYC and KYB controls when onboarding peer to peer lending participants across states?

Firms should treat peer to peer lending as a regulated onboarding problem, not just a marketplace problem. The practical approach is to verify both borrower and lender identities, assess creditworthiness, and maintain transparent disclosures, data security, and grievance handling. Because lending activity can sit with state level rules, teams should align workflows to the correct regulatory perimeter before launching.

How to Treat KYC and KYB as a Cross-Border Onboarding Control Problem

KYC and KYB should be designed as separate but connected control paths. KYC verifies the individual participant, while KYB verifies the entity and the people acting for it. For peer to peer lending, the onboarding flow must also account for state-by-state licensing, disclosure, and eligibility differences so the same customer journey does not create different legal outcomes in different jurisdictions.

The practical question is not just “who is this participant?” but “who may lawfully participate, under which capacity, and with what disclosures?” That means onboarding design should separate identity proofing, business verification, and regulatory eligibility checks so firms can apply the right control to the right actor without conflating borrower, lender, and intermediary obligations.

For the identity proofing layer, firms should use a process that can support remote onboarding, document validation, and fraud resistance. NHIMG’s Identity Proofing and KYC Guide is a useful reference for structuring that control path because it covers document checks, liveness checks, synthetic identity risk, and account-opening fraud.

Why KYB Matters When the “Participant” Is Really a Business or Intermediary

KYB becomes essential whenever a lender, funding vehicle, referral partner, servicing entity, or platform counterparty acts through a business structure. In those cases, the firm is not only verifying a legal entity, it is also verifying beneficial ownership and the people authorised to act for that entity. That distinction matters because a clean KYC file for an individual does not satisfy the control need for a company account or a business-side onboarding relationship.

For firms that onboard business participants, KYB should establish the legal entity, the control persons behind it, and the authority chain for signing, funding, or acting on behalf of the business. NHIMG’s KYB and Business Identity Verification Guide aligns with that need because it focuses on legal entity verification, beneficial ownership, sanctions screening, and merchant-style onboarding decisions.

In practice, KYB also helps prevent role confusion. A business that originates loans, services payments, or pools capital may need different evidence than a retail participant who is simply lending or borrowing. The onboarding rule should therefore attach the right evidence to the right role, rather than assuming one control set fits all participant types.

State Variation Changes the Control Design, Not Just the Legal Review

Peer to peer lending across states creates a regulatory-routing problem as much as a customer-verification problem. A firm can collect strong KYC and KYB evidence and still fail if its workflow does not account for state licensing, product restrictions, or disclosure requirements before activation. The safest design is to route applicants through jurisdiction-aware decisioning before the account becomes live.

That means onboarding logic should determine jurisdiction, participant type, and product permissibility early enough to block unsupported combinations. It should also preserve an auditable record of why a participant was accepted, restricted, or referred for manual review. Where the firm cannot clearly establish the legal perimeter, the default should be to pause onboarding rather than treat uncertainty as a back-office issue.

Risk and Threat Considerations

Cross-state onboarding increases exposure to identity fraud, beneficial ownership opacity, and regulatory misclassification. The practical failure mode is not only bad identity evidence, but also a control stack that verifies the participant while missing the state-specific rule set that makes the participation permissible.

Failure mechanism: Inadequate segregation of KYC, KYB, and jurisdiction checks lets firms approve an applicant whose identity is valid but whose participation is not permitted under the relevant state or role.

Impact: That can create compliance breaches, failed disclosures, disputes over account status, and downstream remediation costs when the firm has to unwind a live onboarding decision.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-8 — Identification and Authentication (Non-Organizational Users)	KYC onboarding hinges on proving external customer identity.
	IA-12 — Identity Proofing	Remote onboarding needs stronger proofing to resist synthetic and fraud-driven applications.
	AC-3 — Access Enforcement	Jurisdiction and role checks determine whether a participant may be onboarded at all.
Recommendation — Apply IA-8 to verify external participant identities before account activation. Use IA-12 to strengthen identity proofing and document-based verification. Enforce onboarding eligibility rules before granting any platform access.
ISO/IEC 27001:2022	A.5.15 — Access control	Onboarding must restrict access according to participant role and eligibility.
	A.5.31 — Legal, statutory, regulatory and contractual requirements	Cross-state lending must align onboarding with applicable state obligations.
Recommendation — Apply A.5.15 to ensure only eligible participants are admitted. Map onboarding checks to the legal and regulatory obligations that govern each state.
CIS Controls v8	CIS-5 — Account Management	Participant onboarding is an account lifecycle and entitlement control problem.
	CIS-6 — Access Control Management	The answer requires role-based admission and restriction decisions.
Recommendation — Use CIS-5 to standardize onboarding, approval, and deactivation workflows. Use CIS-6 to restrict participant access by role and jurisdiction.
GDPR	Personal data processing principles	Identity verification and onboarding data handling affect personal data processing for EU subjects.
Recommendation — Minimize and protect onboarding data used for KYC and KYB decisions.

Practitioner Guidance

What to prioritise: Build the onboarding workflow around participant role first, then attach the correct evidence package. Borrower, lender, business intermediary, and servicing counterparty should not share the same approval logic unless the legal and control requirements are truly identical.

What to verify: Confirm that the onboarding record shows three separate decisions: identity verified, business or authority verified where relevant, and jurisdiction permitted. If any one of those is missing, the account should stay in a pending or restricted state.

Decision rule: If a participant can be identified but the state-level rule set is unclear, do not convert identity confidence into onboarding approval. Treat legal-perimeter uncertainty as a blocking condition, not a documentation gap.

Practitioner takeaway: The control objective is not simply to know who the participant is, it is to prove that the participant is the right kind of actor, in the right state, under the right onboarding rule before the relationship goes live.