What Is KYB? A Compliance Program Checklist
KYB explained: what Know Your Business verification requires, how it differs from KYC, UBO identification thresholds, and an eight-step checklist for building a KYB compliance program that survives audit.
Last updated: July 2026
KYC verifies a person. KYB verifies a company, and then verifies the people hiding behind it. That second half is where most programs fail: collecting a certificate of incorporation is easy, establishing who ultimately controls the entity through three layers of holding companies in two jurisdictions is not.
This guide covers what KYB requires, how it differs from KYC in practice, how ultimate beneficial ownership works, and an eight-step checklist for a program that holds up under examination. If you are further along and comparing vendors rather than designing the program, see our guide to the best KYB software for crypto in 2026.
What is KYB?
Know Your Business, or KYB, is the process of verifying the identity, legitimacy and ownership structure of a business customer before entering a relationship with it, and monitoring that relationship over time. It exists because criminals do not open accounts in their own names; they open them in the name of companies whose ownership is deliberately obscured.
A KYB check has four components: confirming the entity legally exists and is in good standing, identifying the people who ultimately own or control it, verifying the authority of the individual acting on the entity's behalf, and screening all of those parties against sanctions, PEP and adverse media sources.
KYB vs KYC
| KYC | KYB | |
|---|---|---|
| Subject | An individual | A legal entity, plus its owners and controllers |
| Core evidence | Government ID, liveness, proof of address | Registry filings, incorporation documents, ownership chain |
| Data sources | Document authentication, biometrics | Company registries, UBO registers, corporate filings |
| Typical duration | Seconds to minutes | Hours to weeks, depending on structure complexity |
| Hard part | Document fraud and deepfakes | Opaque and multi-layered ownership |
Note the last row of that table. KYB is not KYC with more paperwork. It contains KYC as a sub-process, because every ultimate beneficial owner and authorised representative you identify must then be verified as an individual.
Ultimate beneficial ownership
A UBO is the natural person who ultimately owns or controls a legal entity. Under the EU anti-money-laundering framework, the indicative threshold is a shareholding or ownership interest of more than 25%, held directly or indirectly. Control can also arise through other means: voting rights, the power to appoint or remove management, or contractual arrangements that give effective control without formal ownership.
Three complications appear constantly in practice:
- Layered structures. Ownership held through intermediate companies means you must trace the chain until you reach natural persons, calculating indirect holdings at each level.
- No qualifying owner. Where no individual meets the threshold, the framework falls back to senior managing officials. Documenting why you applied the fallback matters as much as applying it.
- Nominee arrangements and trusts. Registered shareholders are not always beneficial owners. Trusts require identifying settlor, trustees, protector, beneficiaries and any other controlling person.
The eight-step KYB program checklist
1. Define risk appetite and prohibited categories
Write down which jurisdictions, industries and structures you will not onboard, before a deal is on the table. A prohibited list decided under commercial pressure is not a control.
2. Verify the entity exists
Pull the record from the official company registry in the jurisdiction of incorporation: legal name, registration number, registered address, incorporation date, status and directors. Registry data beats customer-supplied documents, which can be forged or stale.
3. Map the ownership structure
Build the full chain from the customer entity to natural persons, with percentages at each level. Record the source and date for every link. This artefact is what an examiner will ask to see.
4. Verify UBOs and authorised representatives as individuals
Every identified UBO and the person signing on the entity's behalf goes through document verification and liveness. This is where a KYB program leans on identity infrastructure; providers such as iDenfy combine business verification with the individual KYC layer underneath it, which avoids running two disconnected processes.
5. Screen every party
Screen the entity, its UBOs, directors and authorised representatives against sanctions lists, PEP databases and adverse media. Screening the company alone is a common and serious gap: sanctions frequently attach to individuals whose companies are not themselves listed.
6. Assess and score risk
Combine jurisdiction, industry, structure complexity, expected transaction profile and screening results into a documented risk rating that drives the level of diligence. High-risk ratings trigger enhanced due diligence: source of funds, source of wealth, and senior sign-off.
7. Monitor continuously
Onboarding is a snapshot; ownership changes, directors resign, sanctions lists update daily. A program without ongoing screening and periodic refresh is compliant on day one and non-compliant by month three. Trigger-based reviews on registry changes are more effective than fixed annual cycles alone.
8. Keep an audit trail
Retain every document, every screening result, every risk decision and the identity of the person who made it, for the statutory retention period. In an examination, an undocumented correct decision and a wrong decision look identical.
KYB in crypto specifically
Crypto businesses face the standard KYB obligations plus two additions. First, corporate customers frequently hold and move assets on-chain, so entity-level diligence has to connect to wallet-level analytics: knowing who a company is means little if its deposit addresses have direct exposure to sanctioned entities. Second, the counterparty due diligence required by the Travel Rule is effectively a KYB exercise applied to other VASPs, assessing whether a counterparty institution is licensed, where, and whether it can receive Travel Rule data at all.
Both push in the same direction: the business verification layer and the blockchain analytics layer need to be joined, not run as separate silos with separate case files.
Frequently asked questions
What does KYB stand for?
KYB stands for Know Your Business. It is the process of verifying that a business customer legally exists, identifying the natural persons who ultimately own or control it, confirming the authority of whoever acts on its behalf, and screening all of those parties against sanctions and PEP sources.
What is the difference between KYC and KYB?
KYC verifies an individual using identity documents and biometrics. KYB verifies a legal entity using company registry data and corporate filings, then applies KYC to each ultimate beneficial owner and authorised representative. KYB contains KYC rather than replacing it.
What is the UBO threshold?
Under the EU anti-money-laundering framework the indicative threshold is ownership or control of more than 25%, held directly or indirectly. Control acquired by other means, such as voting rights or the power to appoint management, also qualifies regardless of shareholding percentage.
What documents are required for KYB?
Typically a certificate of incorporation or registry extract, articles of association, a current shareholder or ownership register, proof of registered address, identification of directors and UBOs, and evidence of the signatory's authority. Requirements vary by jurisdiction and by the entity's risk rating.
How long does KYB verification take?
A simple single-jurisdiction company with a clear ownership structure can be verified in minutes using automated registry lookups. Complex structures with multiple layers, foreign entities, trusts or nominee arrangements routinely take days or weeks because the ownership chain must be traced manually.
Does KYB apply to DeFi protocols?
Not to the protocol itself where it is non-custodial and no intermediary onboards customers. JewelSwap, for example, is non-custodial across MultiversX, Sui and Radix: users interact with smart contracts from their own wallets. KYB obligations attach to businesses that onboard customers, including exchanges, custodians and payment providers.
Keep reading
