KYB Due Diligence: How Businesses Are Verified, Step by Step

Know Your Business, or KYB, due diligence is the process used to verify a business customer before and during a commercial relationship. Banks, payment firms, marketplaces and other regulated companies use it to help prevent money laundering, sanctions evasion, fraud and related financial crime.

A sound KYB process does more than confirm that a company has a registration number. It establishes whether the entity is real and active, identifies the people who ultimately own or control it, and evaluates whether the proposed relationship fits the firm’s risk appetite. Exact requirements differ across US states, EU member states and other jurisdictions.

Step 1: Collect the company’s core details

The process usually begins with information supplied by the business and, where appropriate, by an authorized representative. Compliance teams should capture enough detail to find the right legal entity and understand what it does.

• Legal name, trading names and legal form, such as a corporation, limited liability company or partnership
• Registration or company number, tax identifier where relevant, and jurisdiction of incorporation
• Registered address, principal operating address and contact details
• Nature of business, products or services, website, expected customers and expected transaction activity
• Names and roles of directors, authorized signatories and known owners

The team may also request documents as supporting evidence. Common examples include a certificate of incorporation, articles of association or equivalent constitutional documents, a shareholder register or ownership chart, and proof of address. These are examples, not a universal checklist: the documents available and required vary by jurisdiction, company type and risk level.

Step 2: Verify the company in official records

The next step is to check the company against an official corporate registry, such as a state secretary of state database in the United States or a national business register in an EU member state. The reviewer compares the registry record with the information provided, including the legal name, registration number, address, directors and legal status.

A registration record is not, by itself, proof that a business is suitable to onboard. But it can confirm whether the entity exists, is active or in good standing where that status is reported, and has not been dissolved or struck off. Registry coverage, data quality and update frequency differ substantially, so discrepancies should be investigated rather than automatically treated as fraud.

Step 3: Map ownership and control

Compliance teams then identify directors and ultimate beneficial owners, often called UBOs. A UBO is a natural person who ultimately owns or controls a company, directly or through one or more other entities. The ownership threshold and definition of control are set by applicable law and policy, and can include voting rights or other means of control, not only share ownership.

Where reliable beneficial ownership registers are accessible, they can be an important source. In other cases, the business may provide a signed declaration, shareholder register or ownership chart. Reviewers should trace each ownership layer to natural persons and document any entity that interrupts the chain. They should also identify people with effective control when ownership is dispersed or held through trusts, partnerships or other structures.

Step 4: Verify key individuals

KYB normally incorporates Know Your Customer, or KYC, checks for UBOs and, depending on the risk model, directors and key controllers. KYC confirms that a person is who they claim to be. It can include validating a government-issued identity document, checking liveness where remote verification is used, and comparing identity details with independent data sources.

The scope should be proportionate and legally supportable. A director with no ownership or control may require different treatment from a controlling owner. Teams should retain a clear record of which individuals were checked, the evidence used and any limitations in the verification.

Step 5: Screen the business and people

The company, UBOs, directors and sometimes authorized signatories are screened against relevant sanctions lists. Sanctions are legal restrictions imposed by authorities such as the US Office of Foreign Assets Control, the United Nations, the European Union and national governments. Firms also commonly screen for politically exposed persons, or PEPs, who are entrusted with prominent public functions, and adverse media, meaning credible reporting linked to financial crime or other material misconduct.

A potential name match is not a confirmed match. Analysts must resolve alerts using identifiers such as date of birth, nationality, address, role and ownership connection. Automated screening can surface possible matches quickly, but false positives and context-sensitive adverse media require human judgment.

Step 6: Rate risk and apply enhanced due diligence

The compliance team assigns a risk rating based on the evidence collected. Typical factors include the industry, countries connected to ownership, operations and payments, ownership complexity, delivery channels, expected volumes and the purpose of the account or service. Higher-risk sectors or cross-border arrangements do not automatically mean rejection, but they may require stronger controls.

Enhanced due diligence is the deeper review applied to higher-risk cases. It may involve obtaining more evidence on source of funds or source of wealth, clarifying the commercial rationale, seeking senior compliance approval, verifying additional ownership layers and setting tighter monitoring rules.

Red flags that merit closer review

• Circular, unusually complex or opaque ownership structures with no clear commercial explanation
• Nominee directors or shareholders, particularly where the person exercising real control is unclear
• Shell company indicators, such as little observable business activity combined with significant proposed financial flows
• Registered, operating and banking addresses that conflict without a credible explanation
• A recently incorporated company expecting transaction volumes that are disproportionate to its stated business

Step 7: Monitor and refresh the record

KYB is not a one-time event. Ongoing monitoring can rescreen customers and associated people when sanctions, PEP or adverse-media data changes, and can flag behavior outside the expected activity profile. Periodic refreshes update company status, directors, ownership and risk information. A refresh may also be triggered by an ownership change, new jurisdiction, unusual activity or an adverse screening result.

Automation supports, but does not replace, review

Automation is useful for registry lookups, document data extraction, identity verification workflows, ownership-data collection and repeated screening. It can reduce routine work and create an audit trail. Manual review remains essential when records conflict, ownership is complex, a screening alert needs resolution or the business model does not match the expected activity. KYB programs should be designed with documented decisions, escalation paths and appropriate human oversight.

This explainer is not legal advice. KYB obligations, access to company and beneficial ownership data, retention rules and acceptable verification methods vary by jurisdiction and regulated activity.