When the customer is a business, you have to verify two things: that the organisation is real and legitimate, and that the people acting for it are who they say they are and are entitled to act. Know your business (KYB) checks sit at the intersection of identity, fraud and financial crime compliance. Shell companies, fronts for sanctioned owners, hijacked company identities and fake merchants are used to launder money, commit payment fraud and gain trusted access to platforms. This guide explains what KYB covers, how beneficial ownership verification works, how to link a verified business to the individuals and systems that act for it, and what regulation expects.
Key takeaways
- KYB verifies the entity, its beneficial owners and the people authorised to act for it.
- Registry data is a starting point, not proof. Corroborate ownership and control with independent sources.
- Proof every individual who controls or operates the account to the same standard as a personal customer.
- KYB is ongoing: ownership, directors and risk change after onboarding.
- Business accounts need delegated administration and non-human identity governance too, because staff, integrations and agents act for them.
What KYB covers
| Check | Question answered | Typical sources |
|---|---|---|
| Entity existence | Is this a real, registered organisation in good standing? | Company registries, legal entity identifiers (LEI), tax and licensing registers |
| Beneficial ownership | Who ultimately owns or controls it? | Beneficial ownership registers, corporate documents, declarations |
| Control and authority | Who can act for it, and are they authorised? | Director records, board resolutions, powers of attorney |
| Individual verification | Are those people who they claim to be? | Identity proofing of owners, directors and account users |
| Screening | Are the entity or its owners sanctioned, politically exposed or subject to adverse media? | Sanctions lists, PEP data, adverse media |
| Business activity | Does the stated business match reality and risk appetite? | Website, trading history, merchant category, transaction patterns |
Beneficial ownership
- Beneficial owners are the natural persons who ultimately own or control the entity, directly or through layers of other entities. Many regimes use a 25% ownership threshold as a starting point, alongside control by other means.
- Complex structures, nominee directors and offshore layers are red flags that call for enhanced due diligence, not necessarily refusal.
- Registers vary in coverage and access. In the EU, a 2022 Court of Justice ruling limited general public access to beneficial ownership registers, with access for those with a legitimate interest. In the United States, a March 2025 interim final rule exempted US-formed companies from beneficial ownership reporting to FinCEN, although banks' customer due diligence rules still require them to identify beneficial owners of legal entity customers.
- In the UK, identity verification became mandatory at Companies House for new directors and persons with significant control from November 2025, under the Economic Crime and Corporate Transparency Act 2023.
- Treat registry data as a claim to corroborate, not as verified truth.
Verifying the people behind the business
- Proof the identity of beneficial owners, directors and anyone opening or administering the account. See the Identity Proofing and KYC Guide.
- Confirm that the person onboarding is authorised to act, for example through a registry match, a signed mandate or confirmation from a verified director.
- Watch for company identity hijacking: fraudsters changing registered details or impersonating legitimate companies to open accounts or redirect payments. See the Deepfake and AI Impersonation Guide.
- Organisational digital credentials, such as verifiable LEIs and the legal-person wallets planned under eIDAS 2.0, will increasingly let businesses prove attributes and powers of representation cryptographically. See the Digital Identity Wallets Guide.
Regulatory context
This is an orientation, not legal advice.
- FATF Recommendations 24 and 25 set international standards for transparency of legal persons and arrangements, strengthened in 2022 and 2023.
- EU: the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027 with directly applicable customer due diligence and beneficial ownership rules.
- UK: the Money Laundering Regulations 2017 require firms to identify and verify beneficial owners.
- US: the FinCEN customer due diligence rule requires covered financial institutions to identify and verify beneficial owners of legal entity customers.
- Sanctions: ownership and control tests (such as the 50% rule used by some regimes) mean that screening owners matters as much as screening the entity.
See the Financial Services Identity Security Guide for related sector obligations.
Merchant and platform onboarding
- Payment providers and marketplaces use KYB to stop fake merchants, transaction laundering and fraud rings.
- Check that the merchant's website, products and processing patterns match what was declared.
- Link merchants that share devices, bank accounts, directors or addresses. See the Identity Fraud Prevention Guide.
- Monitor after onboarding for sudden changes in volume, refunds or chargebacks.
After onboarding: ongoing KYB
- Refresh ownership and director data periodically and on trigger events, such as registry changes or unusual activity.
- Re-screen owners and the entity against sanctions and PEP lists as lists change.
- Re-verify when the people authorised to act change.
Business accounts as identity estates
A verified business then has many identities acting for it: administrators, employees, API keys, integrations and increasingly AI agents. Give business customers delegated administration so they can manage their own users, require strong authentication for administrators, and apply NHI governance to the API credentials they create. See the Customer IAM (CIAM) Guide and the API Key Management Guide.
Practitioner checklist
- Verify entity existence, status and identifiers against authoritative registers.
- Identify beneficial owners and corroborate registry data with independent evidence.
- Proof beneficial owners, directors and account administrators as individuals.
- Confirm authority to act for anyone opening or administering the account.
- Screen the entity and its owners for sanctions, PEP status and adverse media, and re-screen over time.
- Link related applications through shared attributes to find fraud rings.
- Refresh KYB on trigger events and periodically.
- Govern the business account's administrators, API keys and integrations.
Standards and references
- FATF Recommendations (Recommendations 24 and 25)
- Regulation (EU) 2024/1624: Anti-Money Laundering Regulation (2024)
- FinCEN: Beneficial Ownership Information
- Companies House: identity verification
- GLEIF: verifiable LEI (vLEI)
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Identity Fraud Prevention Guide · Financial Services Identity Security Guide · Identity Verification Buyer's Guide
