KYB Verification: How It Works, Step by Step (2026)

Last updated: 1 November 2026

KYB verification is the process a regulated business uses to confirm that a company customer is real, active and lawfully owned before it opens an account or moves money for it. In practice that means checking the company against its official registry, collecting and testing its corporate documents, identifying the people who ultimately own or control it, verifying those people as individuals, and screening everyone involved against sanctions, PEP and adverse media lists.

A simple company in a well-digitised registry can pass in a few minutes. A fund held through three holding companies in two countries can take weeks. This guide walks through the process one step at a time, lists the documents you will be asked for, explains what changes for crypto exchanges and other VASPs, and covers the most common reasons a KYB check fails. If you are designing a whole program rather than running individual checks, start with our KYB compliance requirements and checklist.

KYB verification vs a KYB check

People use the two terms loosely. A KYB check usually means a single lookup: does this company exist in the registry, is it active, and is it on a sanctions list? KYB verification is the full onboarding decision built on top of those lookups, including ownership mapping, verification of the owners and a documented risk rating. A registry hit on its own tells you a company exists. It does not tell you who is behind it, and that is the question regulators care about.

How KYB verification works, step by step

1. Collect the application data

The customer supplies its legal name, registration number, country of incorporation, registered and operating addresses, business activity, expected transaction volumes and the person applying on its behalf. Asking for the registration number up front saves time, because it lets you query the registry directly instead of matching on a name that may be spelled several ways.

2. Look the company up in the official registry

Pull the record from the company registry in the country of incorporation, such as Companies House in the UK or the relevant national or state registry elsewhere. Confirm the legal name, number, status (active, dissolved, in liquidation), incorporation date, registered address and current directors. Registry data is the anchor for everything that follows, because a document the customer uploads can be edited and a registry extract you pulled yourself cannot.

3. Check the corporate documents

Compare what the customer uploaded against the registry: certificate of incorporation, articles of association, shareholder register, register of directors and proof of address. You are looking for mismatches in names, numbers, dates and directors, plus signs of editing such as inconsistent fonts or missing registry seals. Where a registry publishes the same information, prefer the registry copy and treat the upload as corroboration.

4. Map the ownership and identify the UBOs

Trace ownership from the customer entity up through every holding company until you reach natural persons, and calculate each person's effective interest by multiplying the percentages down the chain. Someone holding 60% of a company that holds 50% of the customer has an effective 30% stake. Under the current EU rules a person with more than 25% is an ultimate beneficial owner, and from 10 July 2027 the EU Anti-Money Laundering Regulation moves that to 25% or more. Control without shares counts too: voting agreements, the right to appoint directors, or a trust structure can make someone a UBO at any ownership level. If nobody meets the test, the framework falls back to senior managing officials, and you should record why.

5. Verify the people as individuals

Every UBO, the directors your policy covers and the person signing for the company go through standard KYC: an identity document check, a liveness or selfie match and, where your risk rules require it, proof of address. This is the point where KYB depends on identity infrastructure, because a business is only as verified as the weakest person in its ownership chart.

6. Screen the company and every person

Run the entity, its trading names, its UBOs, directors and signatory against sanctions lists, politically exposed person databases and adverse media. Screening only the company is a frequent gap. Sanctions often attach to individuals whose companies are not listed themselves, and the US 50% rule extends blocking to entities majority-owned by sanctioned persons even when the entity never appears on a list. For tools that automate this, see our comparison of sanctions screening software for crypto exchanges.

7. Score the risk and decide

Combine the results into a documented rating: country of incorporation and operation, industry, ownership complexity, expected volumes, PEP links and any screening hits. Low-risk applicants can be approved automatically. Higher ratings trigger enhanced due diligence, usually evidence of source of funds and source of wealth plus sign-off from a senior compliance officer. Write down who made the decision and why, since an undocumented approval looks the same as a missing one in an audit.

8. Monitor after onboarding

Ownership changes, directors resign and sanctions lists update every day, so a company that passed in January can fail in March. Ongoing monitoring, often called perpetual KYB, watches registries and screening lists and opens a review when something relevant changes, instead of waiting for a fixed one-to-three-year refresh. Pair it with periodic reviews scaled to risk: high-risk customers get looked at more often.

Documents needed for KYB verification

Exact requirements depend on the country and the risk rating, but most providers ask for some version of this list:

certificate of incorporation or a current registry extract
articles of association, bylaws or the equivalent constitutional document
shareholder register and, for anything more than one layer deep, an ownership chart
register of directors or officers
proof of registered and operating address
identity documents for each UBO, relevant director and the authorised signatory
evidence that the signatory may act for the company, such as a board resolution or power of attorney
for trusts and foundations: the trust deed or charter, and the identities of settlor, trustees, protector and beneficiaries
for higher-risk cases: financial statements, licences and source-of-funds evidence

How long KYB verification takes

Most of the time goes into ownership, not documents. A single-layer company from a jurisdiction with an online registry and a public shareholder list can clear in minutes when the checks are automated. Each extra holding layer, each foreign entity, and any trust or nominee arrangement adds back-and-forth with the customer, because someone has to request and read documents the registry does not hold. Days are normal for mid-complexity structures, and weeks are not unusual for funds and groups spread across offshore jurisdictions.

KYB for crypto exchanges and VASPs

Crypto businesses run the same process with three additions.

Licensing. In the EU, the MiCA transitional period ended on 1 July 2026, so firms serving EU clients need authorisation as a crypto-asset service provider, and that authorisation comes with full AML customer due diligence on business clients. FATF Recommendation 15 applies the same due diligence standards to virtual asset service providers worldwide, although each country implements them differently.

Counterparty VASPs. The Travel Rule requires an exchange to send originator and beneficiary data with transfers to another VASP. Before it does, it has to decide whether the receiving institution is licensed, where, and whether it can handle the data securely. That counterparty review is a KYB exercise applied to another exchange.

Wallets. A corporate customer's deposit addresses tell you things its registry file cannot. Entity-level KYB should connect to blockchain analytics, so a company with a clean registry record but direct exposure to sanctioned addresses still gets flagged. Our crypto AML compliance guide for exchanges and VASPs covers how these controls fit together.

Common reasons a KYB check fails

The registry and the documents disagree. A director on the upload who is not on the registry, or an old address, usually means the documents are stale, and occasionally means they are forged.
The ownership chain stops short. The customer lists a holding company as its owner and cannot or will not say who owns that company.
Nominee shareholders. The registered owner is a nominee service, and the real beneficial owner has not been declared.
A screening hit nobody resolved. A name match against a sanctions or PEP list is left open instead of being confirmed or cleared with date of birth and nationality.
The signatory has no authority. The person applying is an employee with no board resolution or power of attorney behind them.
Business activity does not match the profile. A company registered as a software consultancy that expects to move large crypto volumes needs an explanation.

Doing KYB by hand vs with software

Teams onboarding a handful of companies a month can run the steps above manually, with registry extracts, a spreadsheet for the ownership chart and a separate screening tool. Past that point the work becomes slow and inconsistent, and the audit trail is hard to reconstruct. KYB software automates the registry lookups, builds ownership charts with effective-interest calculations, runs KYC on the owners in the same flow and keeps monitoring after approval. Providers such as iDenfy combine company checks, owner KYC and AML screening in one workflow, while registry specialists go deeper on company data and leave individual verification to a second vendor.

We compare the main options in KYB Crypto: 6 Best KYB Software Providers 2026. If you also need identity checks for retail users under MiCA, see our guide to KYC and KYB software for crypto exchanges.

Frequently asked questions

What is KYB verification?

KYB verification is how a regulated business confirms that a company customer exists, is active, and is owned and controlled by people it has identified and screened. It covers a registry lookup, document checks, identification and KYC of ultimate beneficial owners, sanctions and PEP screening, a risk rating and ongoing monitoring.

What is a KYB check?

A KYB check usually refers to a single lookup within that process, most often confirming a company's registration and status in its official registry and screening it against sanctions lists. A full KYB verification adds ownership mapping, verification of the owners and a documented decision.

What documents do I need for KYB verification?

Expect to provide a certificate of incorporation or registry extract, articles of association, a shareholder register, a register of directors, proof of address, identity documents for each UBO and the signatory, and evidence of the signatory's authority. Trusts, foundations and higher-risk businesses are asked for more.

How long does KYB verification take?

Minutes for a simple company in a jurisdiction with a digital registry and public ownership data. Days or weeks for multi-layer structures, foreign holding companies, trusts or nominee arrangements, because the ownership chain has to be traced and documented manually.

Who has to be verified in a KYB check?

The company itself, every ultimate beneficial owner, the person acting on the company's behalf and, depending on the firm's policy and local rules, some or all directors. All of them are screened against sanctions, PEP and adverse media sources.

Do crypto exchanges have to do KYB?

Custodial exchanges and other virtual asset service providers are expected to apply customer due diligence to business clients as part of their AML obligations. In the EU that follows from CASP authorisation under MiCA and the AML rules, and FATF Recommendation 15 sets the same expectation globally. Non-custodial DeFi protocols such as JewelSwap, where users interact with smart contracts from their own wallets, do not onboard customers and so do not run KYB on them.

Keep reading

This article is for general educational purposes and is not legal or compliance advice. Confirm your specific KYB, KYC and AML obligations with a qualified professional in your jurisdiction.

Viktor Vostrikov

Co-Founder

About the author.

Co-Founder at JewelSwap & Chief Strategy Officer at iDenfy. Viktor brings his successful track record of superb development & project management.