KYB (Know Your Business)
Due diligence on a business customer: confirming it exists, understanding what it does, and identifying who owns and runs it.
Definition
KYB (know your business) is customer due diligence applied to a legal entity rather than an individual. It covers companies, partnerships, charities, trusts, foundations and similar customers. Where KYC asks who a person is, KYB asks what an organisation is, what it does, who owns it and who acts for it.
The term is industry shorthand rather than a legal category. Regulations describe the same work as due diligence on legal persons and arrangements. The name is useful because the work differs in kind from individual onboarding: the customer cannot show a passport, and the people behind it are often several steps removed.
What KYB covers
A complete KYB file usually answers five questions.
Does the entity exist? Legal name, registration number, legal form, date of incorporation, registered address and status (active, dissolved, in liquidation), confirmed against an official register or constitutional documents.
What does it do? The nature of the business, where it operates, its expected activity and the purpose of the relationship. This is the baseline that later monitoring compares against.
Who owns and controls it? The ownership structure down to beneficial owners, including control that does not follow shareholding.
Who acts for it? Directors, senior management and the individuals authorised to give instructions, with evidence of that authority.
What is the risk? Sector, geography, structure complexity, screening results and any adverse findings, combined into a risk rating that sets the depth of further checks and the frequency of review.
Why a regulated firm cares
Legal entities are the main vehicle for hiding who stands behind money. A shell company with a plausible name can open accounts, receive payments and trade on behalf of someone who would never pass checks in their own name. KYB is where the firm finds out whether the business is real and who is really behind it. It also produces the list of names (the entity, its parents, its officers, its owners) that screening needs.
How it is evidenced in practice
Evidence tends to come from three directions.
- Official sources: company registers, beneficial ownership registers, regulator registers for licensed businesses, and filed accounts.
- Customer documents: articles or constitution, shareholder registers, structure charts, board resolutions or mandates, and trust deeds where relevant.
- Independent checks: sanctions, PEP and adverse media screening on the entity and its related persons; website, trading address and activity checks where the risk calls for them.
The firm reconciles what these sources say. Differences between the customer's chart and the register are common and often innocent, but each one should be explained and recorded. Some jurisdictions go further: in the UK, firms have been required to report certain discrepancies between what they find and the PSC register to Companies House.
KYB is not a one-off event. Directors change, shares are sold, companies are dissolved. The file needs a review cycle based on risk, plus triggers for events such as a change of control.
Regulatory basis
- FATF Recommendation 10 sets customer due diligence duties, including, for legal persons, understanding the nature of the business and its ownership and control structure.
- FATF Recommendations 24 and 25 address the transparency of legal persons and arrangements, which is what makes KYB checks possible.
- Directive (EU) 2015/849, amended by Directive (EU) 2018/843, sets EU due diligence requirements and central beneficial ownership registers.
- UK Money Laundering Regulations 2017 set the UK requirements for corporate customers, alongside the PSC register under the Companies Act 2006.
- US FinCEN CDD Rule (31 CFR 1010.230) requires covered financial institutions to identify and verify the beneficial owners of legal entity customers.
Exact data points and evidence standards vary by jurisdiction and sector. Firms should confirm what applies to them; this article is not legal advice.
Worked example
Hypothetically, a payments firm receives an application from Quillfield Imports Ltd. The register confirms the company is active, incorporated three years ago, with two directors. The application describes wholesale import of kitchen equipment with expected monthly volumes in line with a small trading business.
The customer's structure chart shows a single shareholder, Pembrook Holdings, with a named individual behind it. The register lists Pembrook as the PSC but shows a different registered address from the one on the chart. The firm asks; the customer explains a recent office move and provides evidence. The firm records the explanation.
Screening of the company, Pembrook, both directors and the beneficial owner returns one possible match on a director, which is reviewed and discounted as a false positive with reasons noted. The firm rates the customer standard risk, sets a review date and flags the expected activity profile for monitoring.
Related terms
Related Articles
Account Takeover (ATO)
A form of identity theft where a fraudster gains access to a user's bank accounts, email, or other services.
Adverse Media
Adverse media is published information linking a person or company to crime or serious misconduct, screened as part of customer due diligence.
Alert Rules
Configured parameters within AML software that automatically trigger an alert when suspicious activities match defined criteria.
Algorithmic Fraud
Automated and programmatic approaches to attempting financial fraud at scale utilizing bots and specialized software.