What is KYB? A plain-English guide to know your business checks

KYB stands for “know your business.” It’s the process of checking that a business customer is real and legally registered, and of identifying and verifying the people who own and control it — usually covering the company’s registration, tax ID, address, beneficial owners and sanctions screening.

In the U.S., the clearest legal requirement falls on banks, credit unions and certain other financial institutions: the Financial Crimes Enforcement Network’s (FinCEN’s) customer due diligence (CDD) rule requires them to identify and verify the beneficial owners of most business customers that open accounts. Payment companies, marketplaces and business-to-business (B2B) lenders often run similar know your business checks too, because a card network or a specific law requires it, or to manage their own fraud risk.

What does KYB stand for?

KYB is short for “know your business,” and it mirrors KYC, “know your customer.” It’s industry shorthand: the CDD rule text talks about “legal entity customers” and “beneficial owners” instead.

So what is KYB in banking? It’s the part of a bank’s customer identification program (CIP) and customer due diligence that applies to corporations, limited liability companies (LLCs), partnerships and other entities.

KYB vs KYC: what’s the difference?

What is KYC and KYB, in short? KYC checks a person. KYB checks a business — then runs KYC on the people behind it.

• KYC (individuals). Under the bank CIP rule at 31 CFR 1020.220, a bank collects at least a name, date of birth, address and identification number before opening an account, and can verify identity with an unexpired government-issued photo ID such as a driver’s license or passport.
• KYB (businesses). For a business, the same CIP rule calls for a principal place of business or other physical location and, for a U.S. business, a taxpayer identification number. Documents that can show the entity exists include certified articles of incorporation, a government-issued business license, a partnership agreement or a trust instrument. The CDD rule then adds the beneficial owners.

That’s why a complete KYB check usually contains several KYC checks: one for each owner and control person.

KYB compliance: is KYB required in the U.S.?

Here’s where KYB compliance obligations actually come from.

Banks, credit unions and other covered institutions

FinCEN’s CDD rule page lists the institutions it covers: U.S. banks, mutual funds, brokers or dealers in securities, futures commission merchants and introducing brokers in commodities. Credit unions are covered too: the Bank Secrecy Act rules define a “bank” to include a credit union (31 CFR 1010.100), and FinCEN’s FIN-2026-R001 order notes the rule has applied since May 11, 2018.

Under 31 CFR 1010.230, these institutions must identify the beneficial owners of each legal entity customer and verify their identity. A beneficial owner is:

• Ownership: each individual who directly or indirectly owns 25% or more of the equity interests — so up to four people; and
• Control: a single individual with significant responsibility to control, manage or direct the company, such as a chief executive, chief financial or chief operating officer, a managing member, general partner, president, vice president or treasurer.

The rule excludes some customers, such as regulated financial institutions and publicly traded companies. The online text of the rule was current as of October 14, 2026.

In February 2026, FinCEN eased one part of this. Its order FIN-2026-R001 lets covered institutions identify and verify beneficial owners when a business first opens an account, when facts call the earlier information into question, or as their risk-based ongoing due diligence requires — rather than at every new account.

What happened to Corporate Transparency Act reporting?

As of October 16, 2026, U.S. companies don’t file beneficial ownership information (BOI) reports with FinCEN. According to FinCEN’s BOI page, a March 26, 2025 interim final rule removed the requirement for companies created in the U.S., and a final rule announced August 11, 2026 made the exemption permanent, effective August 14, 2026. FinCEN’s questions and answers on the final rule say reporting companies now include only entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction, unless exempt.

For KYB, that means there’s no federal BOI filing to compare a U.S. company against. The same document points instead to the continuing requirement for covered institutions to collect beneficial ownership information under the CDD rule.

Sanctions apply to all U.S. persons

The Treasury’s Office of Foreign Assets Control (OFAC) says all U.S. persons must comply with its sanctions — including U.S. citizens and permanent residents, everyone in the United States, and all U.S.-incorporated entities and their foreign branches (OFAC: who must comply).

Payment companies, marketplaces and lenders

Outside banking, KYB often comes from network rules or a specific law. Visa’s Payment Facilitator and Marketplace Risk Guide (April 2021) says payment facilitators and marketplaces “must collect pertinent public and non-public information” to validate prospective sellers. Under the INFORM Consumers Act, online marketplaces must collect and verify bank account, contact and tax ID information from high-volume third-party sellers (Federal Trade Commission guidance). B2B lenders that aren’t covered by the CDD rule may still choose to run KYB to manage fraud and credit risk. Which rules apply to you is a question for your compliance team or counsel.

What a KYB check includes, step by step

1. Confirm the business legally exists. Search the business registry in the state where it was formed. Delaware’s free entity search, for example, shows the entity name, file number, formation date and registered agent. Check that the legal name matches what the applicant gave you. Delaware warns that its results include inactive entities and are “not an indication of the current status of an entity,” so ask for a certificate of good standing or status too.
2. Collect and check the tax ID. Ask for the Internal Revenue Service (IRS) letter confirming the Employer Identification Number (EIN) — a CP 575 notice or Letter 147C — and a signed Form W-9, then make sure the legal name matches across them.
3. Verify the business address. The bank CIP rule asks for a principal place of business, local office or other physical location (31 CFR 1020.220), not just a mailing address.
4. Identify beneficial owners and a control person. Ask for an ownership breakdown that goes all the way down to individuals. For example, if an LLC is owned 40% by one person, 35% by a second and 25% by a third, all three meet the 25% test — plus you name one control person, who may be one of the three.
5. Verify each owner’s identity. Each beneficial owner and the control person goes through an ID check. Securely Verify’s business verification (on Growth plans and up) sends each owner and officer a link to verify with a government ID, a live selfie and a liveness check, and records their role and ownership percentage.
6. Screen the business and its owners for sanctions. Run anti-money laundering (AML) screening on the company, its owners and its officers against OFAC’s Specially Designated Nationals (SDN) list. SDNs’ assets are blocked, and U.S. persons are generally prohibited from dealing with them (OFAC: what is an SDN). Under OFAC’s 50 Percent Rule guidance, an entity owned 50% or more in the aggregate, directly or indirectly, by one or more blocked persons is itself blocked, even if it isn’t on the list. For example, if three sanctioned people each owned 20% of a company, none would cross the CDD rule’s 25% line, but together they’d own 60%. OFAC says the rule covers ownership, not control, but advises caution where blocked persons control a company or hold a large stake below 50% (OFAC on ownership and control).
7. Understand what the business does. Banks must understand the nature and purpose of customer relationships to build a customer risk profile (31 CFR 1020.210). Ask what it sells and to whom, then check licenses: the Small Business Administration says federally regulated activities need a federal license or permit, and that requirements often vary by state.
8. Record the decision. Under the CDD rule, identification records are kept for five years after the account closes, and verification records for five years after they’re made.

Documents to ask for

A typical KYB request draws from this list. Your risk policy decides which items a given business needs.

• Formation documents: articles of incorporation or organization, a partnership agreement or a trust instrument
• A certificate of good standing or status from the state
• The IRS EIN letter (CP 575 or 147C) and a signed Form W-9
• Business licenses for regulated activities
• Proof of address, such as a utility bill or lease
• A bank statement or voided check for the account you’ll pay or debit
• An operating agreement or ownership chart showing who owns what
• Government ID for each beneficial owner and the control person

With Securely Verify’s document collection, you can request these through one secure link and have them organized by type for a reviewer. They aren’t verified automatically; a reviewer checks them.

Red flags of shell and front companies

FinCEN’s guidance on shell companies (FIN-2006-G014) describes them as non-publicly traded corporations, LLCs and trusts that typically have no physical presence beyond a mailing address and generate little or no independent economic value — while noting that most are formed for legitimate reasons. Its warning signs include:

• You can’t obtain basic information about the parties sending or receiving the company’s wire transfers.
• Several businesses share one address, or the company gives only a registered agent’s address.
• Payments have no stated purpose and don’t reference goods or services.
• Activity doesn’t fit the company’s stated business or exceeds its expected volume.
• Payments frequently go to beneficiaries in high-risk offshore financial centers.

At onboarding, add a few practical checks of your own: owners who won’t complete identity verification, an ownership split that leaves every owner just under 25%, documents whose names or dates conflict, and no license for an activity that clearly needs one. None of these proves wrongdoing on its own. Each is a reason to ask more questions before you approve.

Keeping KYB current

KYB isn’t a one-time event. For banks, the AML program rule at 31 CFR 1020.210 requires risk-based ongoing customer due diligence, including ongoing monitoring to identify and report suspicious transactions and, on a risk basis, keeping customer information up to date — beneficial ownership included.

In practice, revisit a business when its owners, officers, name or address change, and re-screen the company and its owners when sanctions lists change. Write down your review triggers so every reviewer applies them the same way.

If you want to try this on your own business customers, start a 7-day free trial — 20 verifications, no card required.

Related guides

• How to look up and verify a company’s EIN (tax ID)
• Merchant onboarding: how to verify a merchant and its owners
• Enhanced due diligence (EDD): what U.S. rules require
• Proof of address: what documents count and how to verify them

Sources: 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (Electronic Code of Federal Regulations, current as of October 14, 2026); 31 CFR 1020.220, Customer identification program requirements for banks (Electronic Code of Federal Regulations, current as of October 14, 2026); 31 CFR 1020.210, Anti-money laundering program requirements for banks (Electronic Code of Federal Regulations, current as of October 14, 2026); Information on Complying with the Customer Due Diligence (CDD) Final Rule (FinCEN, accessed October 16, 2026); 31 CFR 1010.100, General definitions (Electronic Code of Federal Regulations, current as of October 14, 2026); FIN-2026-R001, Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening (FinCEN, February 13, 2026); Beneficial Ownership Information Reporting (FinCEN, alert updated August 11, 2026); Final Rule: Questions and Answers (FinCEN, August 2026); FinCEN Permanently Ends Beneficial Ownership Reporting Requirements for Millions of Small Business Owners (FinCEN, August 11, 2026); Who must comply with OFAC sanctions? (OFAC frequently asked question 11, accessed October 16, 2026); What is an SDN? (OFAC frequently asked question 18, accessed October 16, 2026); Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (OFAC, August 13, 2014); Ownership versus control under the 50 Percent Rule (OFAC frequently asked question 398, accessed October 16, 2026); FIN-2006-G014, Potential Money Laundering Risks Related to Shell Companies (FinCEN, November 9, 2006); Payment Facilitator and Marketplace Risk Guide (Visa, April 2021); Informing Businesses about the INFORM Consumers Act (Federal Trade Commission, June 2023, edited January 2025); Entity Search (Delaware Division of Corporations, accessed October 16, 2026); Understanding your CP575 notice (IRS, updated June 16, 2026); Apply for licenses and permits (U.S. Small Business Administration, accessed October 16, 2026). This article is general information, not legal or compliance advice.