What is Know Your Business (KYB)? Verification, beneficial ownership, and the rules that changed in 2026.

Know Your Business, or KYB, is the process a regulated firm uses to verify that a company it deals with is real, legally registered, and safe to do business with. It checks the company’s identity and, crucially, the people who ultimately own or control it, so criminals cannot hide behind a corporate shell.

 KYB is the business-facing twin of Know Your Customer (KYC). Where KYC verifies an individual, KYB verifies a company and the humans behind it. It became a formal obligation because shell companies are the money launderer’s favourite tool, and the rules governing it shifted sharply in 2025.

KYB vs KYC: Know Your Business vs Know Your Customer 

The two sit side by side in a compliance programme, and firms that onboard business customers run both.

The hard part of KYB is that last row. A company is easy to register and easy to layer: an operating company owned by a holding company owned by a trust in another country. KYB exists to see through those layers to the real people, the ultimate beneficial owners.

Why does KYB matter, and who has to do it? 

Anonymous companies move dirty money. The UN Office on Drugs and Crime has long estimated that 2 to 5% of global GDP is laundered each year, and shell companies are the standard vehicle. KYB is how a firm avoids onboarding one. 

The scale isn’t hypothetical. Between 2007 and 2015, roughly 200 billion euros of suspicious money flowed through Danske Bank’s small branch in Estonia, much of it routed through UK shell partnerships that existed only to hide who owned the funds. Danske later pleaded guilty and paid a $2 billion fine. KYB, done properly, is what stops a bank from becoming that kind of pipe, and it’s why regulators treat weak business onboarding as a serious failing.

The obligation falls on any regulated firm that takes on business customers: banks, payment providers, lenders, fintechs, insurers, and increasingly the marketplaces and platforms that pay out to business sellers. For them, KYB isn’t optional. Failing it carries fines, licence risk, and the reputational damage of being named in a laundering case. 

How does the KYB process work?

KYB verification runs as a sequence, and the better programmes treat it as continuous rather than a one-off check at onboarding. 

1. Collect the company’s legal name, registration number, address and structure.
2. Verify them against official registries: company registers, tax authorities, licensing bodies.
3. Identify the beneficial owners, tracing ownership and control to the real people behind the entity.
4. Screen the company and its owners against sanctions, PEP and adverse-media lists.
5. Score the risk, weighing jurisdiction, sector, structure and red flags.
6. Monitor on an ongoing basis, because ownership and risk change after onboarding.

Steps three and six are where firms struggle most. Beneficial ownership is hard to trace, and it changes without telling you: a share transfer or a new director the day after you clear a company can shift who really controls it, which is why the monitoring step matters as much as the first check.

What information does a KYB check pull? 

KYB draws on more sources than a KYC check, because a company leaves a wider paper trail than a person and hides behind more of it.

The starting point is official registration data: the company’s legal name, number, registered address, status and directors, pulled from the corporate registry in its country of incorporation. In the US that means Secretary of State records, in the UK it means Companies House, and in the UAE it means the relevant licensing authority. This confirms the company exists and is in good standing.

On top of that sits the ownership layer, which is the hard part. Where a public beneficial-ownership register exists, such as the UK’s People with Significant Control register, a firm can start there. As the sections below show, those registers are shrinking, so most ownership still has to be pieced together from corporate filings and documents.

Then comes screening. The company, its directors and its beneficial owners are checked against sanctions lists, politically exposed person (PEP) databases and adverse-media sources, the same feeds a KYC programme uses. Once the relationship is live, transaction and behavioural data feeds the ongoing risk view. 

Who counts as a beneficial owner? 

A beneficial owner is the natural person who ultimately owns or controls a company. Almost every regime lands on a 25% threshold, but the detail differs by jurisdiction, and this is where a generic KYB check goes wrong.

 The point for a compliance team operating across borders is that “25%” is a starting line, not the whole rule. Control can sit below the ownership threshold, and each regime treats nominee arrangements and “control by other means” differently. 

When does KYB go deeper? Enhanced due diligence 

Standard KYB is the baseline. Some business customers trigger enhanced due diligence, or EDD, where the firm digs further before onboarding and watches more closely afterwards. 

The triggers are risk-based. A company registered in a high-risk jurisdiction, one with a deliberately complex or cross-border ownership structure, a cash-intensive business, or a customer connected to a politically exposed person all warrant EDD. So does any red flag surfaced during the standard check.

EDD adds depth in three ways. It traces the source of the company’s funds and, for the beneficial owners, their source of wealth. It requires documentary evidence rather than relying on registry data alone. And it usually needs senior sign-off before the relationship can proceed, with more frequent review afterwards. The principle is proportionality: most business customers pass a standard check, and the extra work is reserved for the minority that carry real risk. 

The red flags KYB is looking for

Certain patterns recur in the companies that turn out to be fronts, and a firm running KYB watches for them.

Opaque or needlessly layered ownership is the clearest signal: an operating company owned through several holding entities across different countries, with no commercial reason for the structure. A mismatch between what a company says it does and how it is set up is another, as is registration in a jurisdiction known for weak oversight or bearer shares. 

Smaller tells add up. A very recently formed company presenting large transactions, a registered address shared by hundreds of other entities, nominee directors with no real role, or a beneficial owner who is hard to pin down. None of these proves wrongdoing on its own, which is why KYB scores risk across the whole picture instead of rejecting on a single flag.

The US rule that changed in 2025: the Corporate Transparency Act

For years the expectation was that the United States would finally build a central beneficial-ownership registry. The Corporate Transparency Act, effective from January 2024, required companies to report their beneficial owners to FinCEN.

It has since been dismantled for domestic firms. After legal challenges, FinCEN issued an interim final rule on 26 March 2025 that removed the reporting requirement for all US-created entities and US persons. Only foreign companies registered to do business in the US still have to report, and they don’t report US persons as owners.

The practical effect for KYB is easy to misread. The federal registry that would have handed compliance teams a single source of US ownership data has, for domestic companies, largely gone. But the obligation to verify beneficial ownership hasn’t: banks and other financial institutions still identify beneficial owners under the 2016 Customer Due Diligence rule, and some US states run their own registers. The registry that might have helped is gone, and the work still sits with the firm. 

KYB in the UAE and the Gulf

The UAE has moved the other way, tightening rather than loosening. Under Cabinet Decision 109 of 2023, which replaced the earlier Decision 58 of 2020, companies on the mainland must keep a register of their ultimate beneficial owners, file it with the relevant authority, and notify any change within 15 days. The threshold is the familiar 25%, with a fallback to whoever controls the entity by other means.

Two details matter for anyone running KYB in the region. The mainland regime doesn’t apply to companies in the ADGM and DIFC financial free zones, which run their own beneficial-ownership rules. And the registers are private, filed with authorities rather than published, so a firm onboarding a UAE counterparty still has to verify ownership itself rather than pull it from an open source.

Who provides KYB technology?

Doing this at scale is a software problem, which is why a market of KYB compliance providers has grown up around it. In the US, Middesk, Socure and Alloy are among the better-known independent players; Persona and Ondato compete on business and identity verification; and larger financial-data groups such as Moody’s and LexisNexis sell KYB alongside their wider risk products. 

The distinctions are real but the shortlist changes, so treat any vendor list, including this one, as a snapshot. The buyer’s checklist is steadier: registry coverage across the jurisdictions you operate in, the depth of beneficial-ownership tracing, and how well the monitoring keeps a file current after onboarding.

KYB beyond banking: platforms and the speed problem

KYB used to be a bank concern. It’s now spreading to any business that pays out to other businesses. Payment providers, marketplaces, embedded-finance platforms and business-to-business lenders all onboard company customers, and all inherit the obligation to know who they are dealing with.

This creates a tension the banks never had to resolve at the same scale. A marketplace onboarding thousands of business sellers wants near-instant approval, while KYB wants time to verify ownership and screen every party.

The platforms that get it right treat the two as a risk-based split: clear the low-risk, well-documented companies automatically in minutes, and route the complex or high-risk ones to a human. Getting that balance wrong shows up either as fraud losses or as abandoned sign-ups, so KYB has become a growth problem as much as a compliance one.

The challenges KYB still hasn’t solved 

Three problems persist regardless of the tooling. Ownership structures are deliberately complex, so tracing a beneficial owner through a chain of holding companies and trusts across borders is genuinely hard. Registry quality is uneven: data is fragmented, out of date, or simply missing in many jurisdictions. And ownership changes silently, so a file that was accurate at onboarding drifts out of date unless something is watching it.

None of this is a reason to skip KYB. It’s why the check has to run continuously instead of once at onboarding.

FAQs

What is KYB in simple terms?

KYB, or Know Your Business, is how a regulated firm checks that a company it deals with is real and legitimate, and identifies the people who ultimately own or control it, to prevent money laundering through shell companies.

What is the difference between KYB and KYC?

KYC verifies an individual customer. KYB verifies a business and its ultimate beneficial owners. A firm onboarding business customers runs both, and KYB is the harder of the two because company ownership can be layered and hidden.

Who is a beneficial owner in KYB?

The natural person who ultimately owns or controls a company. Most regimes, including the US, UK and UAE, use a 25% ownership or voting threshold, with a fallback to whoever controls the entity by other means. 

Is beneficial ownership reporting still required in the US?

For companies created in the US, no. FinCEN’s March 2025 interim rule removed the Corporate Transparency Act reporting requirement for domestic entities and US persons; only foreign registered companies still report. Banks must still verify beneficial owners under the 2016 CDD rule. 

Do UAE companies have to report beneficial owners?

Yes. Under Cabinet Decision 109 of 2023 (which replaced Decision 58/2020), mainland UAE companies must keep and file a register of beneficial owners and notify any change within 15 days. Companies in the ADGM and DIFC financial free zones follow those zones’ own rules.

What documents does KYB require?

Typically the company’s certificate of incorporation, proof of its registered address, ownership and structure documents, and identification for directors and beneficial owners. Higher-risk cases add evidence of the source of funds and wealth.

How long does KYB take?

A straightforward company can be verified in minutes to hours with automated tools. Complex ownership, cross-border structures or missing registry data can push it to days or weeks, which is why firms automate the routine cases and keep analyst time for the hard ones.

Next read 

For how firms keep these checks current after onboarding, see perpetual KYC and the wider Compliance hub.