What is KYB (Know Your Business)?
KYB — Know Your Business — is the process of verifying that a business customer is real, legitimate and who it claims to be, before you let it move money. It is the corporate counterpart of KYC, it is a legal requirement for any regulated payments business, and it is considerably harder than verifying a person, because a company can be structured specifically to obscure who controls it.
AML rules require a regulated payments or crypto business to know exactly who its customers are — not only at sign-up, but continuously. For a company customer, “knowing” means establishing three things: that the business is real and legally registered, who ultimately owns and controls it, and whether the business or those people present a financial-crime risk.
The reason this is harder than verifying an individual is straightforward. A person is a person. A company can be assembled out of other companies, across several jurisdictions, with nominee directors and a trust somewhere in the middle — and that structure can exist for entirely ordinary tax and commercial reasons, or specifically so that nobody can tell who is behind it. KYB is the work of telling those two cases apart.
The four checks
1. Entity verification
Confirm the company exists, is active and in good standing, and that its details — legal name, registration number, registered address, directors, status — match an authoritative source.
The trap is treating a registry extract as the answer. Registries differ enormously: some verify what is filed, many simply record what was self-declared; some update promptly on a change of control, others lag by a year or more. A registry extract tells you what a company said about itself. It is a starting point to corroborate, not proof.
2. Ownership and control
Identify the natural persons who ultimately own or control the business, through every layer of the chain, and verify them.
The standard threshold is more than 25% of shares or voting rights, with several regimes applying lower thresholds to higher-risk cases. But ownership percentage is only one route to control. A person can be a UBO through a shareholders’ agreement, a class of share carrying special rights, the power to appoint or remove the board, or a documented ability to direct management. Structures built to obscure control usually work by staying under the percentage threshold while retaining control through one of those other mechanisms — which is why a purely arithmetic reading of the ownership chart misses precisely the cases it most matters to catch.
Where the chain runs through a trust, the analysis extends to settlor, trustees, protector and beneficiaries. Where it terminates in a jurisdiction whose register is not publicly accessible, you obtain the evidence from the customer and corroborate it independently.
One practical note that has changed since 2022: following a Court of Justice of the European Union ruling, several EU member states restricted general public access to their beneficial ownership registers. Obliged entities retain access for AML purposes, but the workflow is no longer “search the public register”, and any process still assuming it is will fail.
3. Screening
Screen the business, its beneficial owners and its directors against the sanctions lists that apply to you, against politically-exposed-person data, and against adverse media — at onboarding and on an ongoing basis afterwards.
Sanctions exposure can arrive through the ownership chain rather than the entity itself. A company is not listed; its 30% shareholder is. Screening the entity alone would not find it, which is the practical reason the ownership work has to be finished before screening is meaningful.
4. Risk rating
The findings produce a rating that determines what happens next: how much monitoring the relationship gets, how often it is reviewed, and whether standard due diligence is sufficient or enhanced due diligence applies.
This step is what makes the rest defensible. Under a risk-based approach you are not required to treat every customer identically; you are required to be able to explain why this customer received this level of scrutiny.
KYB and KYC compared
| KYB | KYC | |
|---|---|---|
| Subject | A business entity | An individual person |
| Establishes | Registration, ownership chain, control, legitimacy of the business | Identity, address, legitimacy of the person |
| Principal sources | Company registries, constitutional documents, shareholder registers, audited accounts | Identity documents, biometric or documentary verification, address evidence |
| Fails when | The ownership chain is not resolved to natural persons | The document is forged or the person is not who they claim |
| Typical use | Onboarding a company customer | Onboarding the people behind it |
They run together. You KYB the company and KYC its beneficial owners and directors — the second is part of completing the first.
Where KYB goes wrong
- The chain stops early. Verification reaches a holding company and stops, because the next layer sits in a jurisdiction that is inconvenient to check. An unresolved chain is not a completed KYB file.
- Registry data taken at face value. Self-declared filings treated as verified fact.
- Control ignored in favour of ownership. Everyone under 25% and nobody identified, when a shareholders’ agreement hands control to one of them.
- Never refreshed. Accurate at onboarding, wrong within two years, and nobody re-checked.
- Documents collected, not assessed. A file full of PDFs that nobody reconciled against each other. Supervisors read the analysis, not the attachments.
How KwiikPay handles KYB
KwiikPay is a trading name of KWP Finance Limited, registered in Canada as a Payment Service Provider under the Retail Payment Activities Act, supervised by the Bank of Canada, and as a FINTRAC-registered Money Services Business including dealing in virtual currency.
Business onboarding runs the full sequence — entity verification, ownership resolved through every layer to natural persons, sanctions, PEP and adverse-media screening of the business and those individuals, and a risk rating that sets the ongoing regime — with enhanced due diligence where the profile warrants it and periodic refresh thereafter. The detail of what we ask for is on the KYB onboarding page; the sectors and jurisdictions we will not serve at any level of diligence are in the risk appetite statement.
That posture is what lets us serve regulated businesses other providers decline, without weakening the network. If your structure is complex and you would rather establish up front whether it is workable, talk to us before you apply.
FAQs
What is the difference between KYB and KYC?
KYC verifies an individual person; KYB verifies a company — its registration, its ownership structure, and the individuals who ultimately control it. Onboarding a business almost always involves both: KYB on the entity, KYC on its beneficial owners and directors. They are not alternatives.
What does a KYB check involve?
Four things. Confirming the company exists and is in good standing against an authoritative registry; identifying the ultimate beneficial owners through every layer of the ownership chain; screening the business, its owners and its directors against sanctions, PEP and adverse-media data; and assigning a risk rating that determines how much ongoing due diligence the relationship attracts.
What is a UBO?
An Ultimate Beneficial Owner is a natural person who ultimately owns or controls a company. The common threshold is more than 25% of shares or voting rights, though several regimes apply lower thresholds to higher-risk cases. Ownership is not the only route — control through a shareholders' agreement, a golden share or the right to appoint the board also makes someone a UBO, and structures designed to obscure control usually exploit exactly that.
Is a company registry extract enough?
No, and relying on one is a frequent finding. Registries vary enormously in quality; many are self-declared and unverified, some are not updated when ownership changes, and several jurisdictions restricted public access to beneficial-ownership registers after the 2022 Court of Justice ruling. A registry extract is a starting point to be corroborated, not an answer.
How long does KYB take?
It depends entirely on the structure and the risk profile. A single-jurisdiction company with two named individual shareholders and clean screening resolves quickly. Layered ownership across several jurisdictions, nominee arrangements, trusts, or any hit requiring enhanced due diligence takes materially longer, because each additional layer has to be resolved to a natural person and evidenced. We do not quote a standard turnaround, because a promise that ignores your structure is not worth anything.
Does KYB stop after onboarding?
No. Customer due diligence is a continuing obligation. Ownership changes, directors resign, sanctions lists update and businesses change what they actually do. Ownership data captured accurately at onboarding and never refreshed is one of the most common supervisory findings there is.