Accept, decline, or “it’s complicated”: the honest truth about KYB

I’ve worked in business verification for years, and I still get the same reaction when I explain my job at a party. “Oh, so you google companies?” Not quite. The second most common reaction, usually from people in fintech, is that verifying a business is just like verifying a person, only with a company name.

The comparison I usually reach for is dating. Know Your Customer (KYC) is a first date. You meet one person, make sure they look like their profile picture, and decide whether to see them again. Know Your Business (KYB) is closer to being invited to dinner with the whole family: parents, siblings, a holding company or two, and a cousin abroad who everyone talks about but nobody has actually met.

You still leave the evening with an opinion. It just rarely fits into “yes” or “no”, and it takes a lot longer than a first coffee. If you’re looking at KYB for your business, it helps to understand why before you start comparing tools.

KYC: one person, one question

KYC says: “Show me your ID and your face.”

KYB says: “Show me your ID, your face, and your company’s registry record. And your owners’ IDs. And maybe your owners’ owners’ IDs, please.”

KYC checks answer a fairly contained question: is this person who they say they are? You check that the ID document is genuine, use a selfie and liveness detection to make sure a real person is behind it and that the face matches, and screen them against sanctions and politically exposed person (PEP) lists.

None of that is trivial. Forged documents, deepfakes and bots keep the whole industry busy. But the question itself has clear edges. There’s one person and one identity, checked at one moment. Nobody is 40% owned by someone else, and very few people have a registered address in three countries.

That’s why a good KYC check can be done in under a minute, and why approve, decline, or “please try again with a clearer photo” covers most outcomes. The first date either goes fine or it doesn’t.

KYB: verifying something that has no face

KYC says: “Who are you?”

KYB says: “Who are you, are you still in business, and who runs you?”

A company can’t take a selfie. It’s a legal construct, so the only way to verify it is through its data and the people around it.

The first questions are the basic ones. Does the business legally exist, and is it still active? Do the name, registration number, legal form and address it gave you match the official record? Then you get to the people. Who is allowed to act for the company, and is the person filling in your onboarding form actually one of them? After that comes the harder part: what the business really does, whether that matches what it told you, and whether the company or anyone running it turns up on sanctions, PEP or adverse media lists.

Ownership sits on top of all this and can run through several other companies before you reach a real person. Many of the individuals involved along the way need their own KYC checks, meaning a single KYB process can involve multiple identity verifications. To see how this works in practice, follow the step-by-step process of verifying a marketplace seller.

Bigger family, bigger stakes

KYC says: «I’d like to open an account.»

KYB says: «I’d like to open an account, move a few million through it every month and pay suppliers on three continents.»

One person with bad intentions can do real damage. But a personal account comes with built-in guardrails. The limits are lower, and most people’s money follows a predictable rhythm: salary in, rent out, groceries on Saturday. When a student account suddenly starts receiving transfers from strangers and passing them straight on, it stands out. That’s why money mules and stolen identities tend to get spotted and shut down fairly quickly.

A company plays by different rules. It’s expected to move large sums, pay partners abroad and receive money from people it has never met. The limits are higher because the business genuinely needs them. That’s exactly what makes a company so attractive to anyone who wants to launder money: the same flows that would look odd for a person look completely normal for a business.

And the cases that should worry you most often don’t look messy at all. A company set up to launder money usually has its paperwork in perfect order: a clean registry record, a professional website, every document neatly signed, and an ownership structure with just enough layers that nobody quite reaches the person at the top. Every individual check passes, and the money moves right under your nose.

The warning signs only show up when you step back and ask whether the whole picture makes sense. Why does a three-person consultancy need a holding company in another country? Why does a trading company registered last month already expect the volumes of an established one? Why is nobody on the board connected to the industry the business says it’s in? That’s the real difference: KYC mostly asks whether the documents are real, while KYB also has to ask whether the story holds together.

Back at the dinner table, the family that answers every question perfectly and has all the anecdotes rehearsed isn’t automatically the safest one. Sometimes the most polished photo album is the one worth a few more questions.

Know Your Business (KYB)

Verify businesses with confidence

Learn how business verification helps you reduce fraud, manage risk, and onboard legitimate businesses with confidence.

Contact us

Why business data is messy

KYC says: “Here’s my passport.”

KYB says: “Here’s a registry extract, our articles of association, a certificate of incorporation, an ownership chart from a few years ago. A couple of those people have left, but it’s mostly right.”

A person’s identity usually lives on one document. A company’s identity is spread across business registries, uploaded documents, third-party data providers and screening lists, and each of those comes with its own quirks.

Most registries speak their own language, and translating them goes beyond the words. Legal forms, company statuses and job titles all need to be mapped to something a compliance team can compare across countries.

Job titles are a good example. In Estonia, a management board member runs the company and, in a small business, is often the only shareholder as well. In China, the key person on the registry is usually the legal representative, who carries wide authority and personal liability but may not own a single share. In the US, the name you’re most likely to find is the registered agent, often a commercial service whose whole job is receiving legal papers, with no say in how the business is run. Three entries that look alike can mean three very different things.

Getting into a registry can be a project of its own. In my experience, the barrier is rarely the price. More often, you have to prove that your company has a legitimate reason to access the data.

And registries trail reality. Companies usually get a grace period to report changes like a new director, and some details are only confirmed once a year. A business can be telling you the exact truth while the registry still shows last month’s version.

To see how quickly this adds up, picture a fairly typical application. A ten-person software company registered in Germany applies for an account. The registry extract is in German, so the first job is working out what its legal form and status actually mean. The company applies under its brand name, which doesn’t appear on the registry at all. The person onboarding says she’s the managing director, but the registry still lists her predecessor, because the change was filed two weeks ago and hasn’t shown up yet. Nothing here is suspicious. Yet this one ordinary company already needs translation, a trading-name check, a document request and a human decision.

Let the business do some of the work

KYC says: «I’ll fill in the form myself.»

KYB says: «Our office manager will fill in most of the form, our director will verify their ID, and then all five of our owners need to verify too.»

Many gaps in a KYB case are easiest to fill at the source. The business knows its own trading name, its new managing director and the holding company the registry forgot to mention. Chasing that through long email threads is where onboarding goes to die: three reminders, two attachments with the wrong file name, and a reply from someone on holiday.

It works much better when the business can do it in one go. It confirms the company details you already found, the person onboarding verifies their own identity, missing owners get added, a few compliance questions get answered and the missing documents get uploaded. Back at the dinner table, this is the moment the family hands you the photo album instead of making you guess who everyone is.

Same facts, different answers

KYC says: “Is this person on a sanctions list?”

KYB says: “Is this business on a sanctions list, and what does that mean for us?”

Most KYC questions have a factual answer. The document is genuine and belongs to you, or it doesn’t. You’re on a sanctions list, or you aren’t. With KYB, the facts only get you halfway. The rest depends on the risk appetite of whoever is doing the checking.

Take sanctions. A bank will almost certainly turn away a sanctioned company, but a law firm may still represent it, because even a sanctioned business can end up in court. That work usually needs a licence from the sanctions authority, with conditions attached. Industry works in a similar way. A gambling operator can be a perfectly normal customer for one payment provider and be ruled out by another provider’s policy before anyone opens the file.

Country matters too. Where the company and its people come from can change the outcome. Faced with a business from a higher-risk country and several layers of shareholders, some institutions simply find it easier to decline than to work through the paperwork.

So the same registry record can be approved at one company and declined at another, and both decisions can be right. A KYB decision has to reflect your policy as well as the data.

Why accept or decline isn’t enough

KYC says: “Approved.”

KYB says: “Approved, but let’s check the registry again in six months. And ask the company what’s changed in the meantime.”

Add all of this up, and a lot of KYB cases land somewhere in the middle. Some look like the German company above. Others involve a director who turns out to be a PEP, which is a reason to look closer but not a reason to say no, or a company registered three weeks ago that simply has no history yet.

With only two buttons, every one of these cases goes wrong. Decline them and you lose good customers. Approve them automatically and you take on risk that nobody has looked at.

A wider set of outcomes works much better. Clear cases get approved, and cases with real, unresolvable risk get declined. In between, you can approve with conditions, such as a review in six months or closer monitoring. You can ask the business for more information, like an updated registry extract or a missing document. And when the risk calls for it, you can escalate to enhanced due diligence so an experienced reviewer on your team takes a proper look.

Compliance teams already think this way, because it’s simply the risk-based approach. The trick is having the registry data, documents, screening results and the reviewer’s reasoning in one place, so a “yes, but” decision is easy to make and easy to explain later, instead of living in someone’s inbox. In family-dinner terms, “I liked them, but let’s see them again before the wedding” is a perfectly reasonable verdict.

Onboarding isn´t the finish line

KYC says: «See you next time I lose my passport.»

KYB says: «See you at the next board meeting. And the one after that.»

A person rarely changes who they are. A company does it all the time. Directors come and go, shares get sold, and the friendly local supplier you approved last spring can quietly end up owned by someone you would never have onboarded.

Some of these changes are worth watching every day. If a director becomes politically exposed or a shareholder lands on a sanctions list, you want to know now, not at the next review. Registry changes move more slowly, so many teams re-check them on a schedule: more often for higher-risk customers, less often for the low-risk ones. Either way, the family you met at dinner is not the same family that shows up at Christmas.

Know Your Business (KYB)

Verify businesses with confidence

Learn how business verification helps you reduce fraud, manage risk, and onboard legitimate businesses with confidence.

Contact us

Can you defend it later?

KYC says: «Here’s the selfie.»

KYB says: «Here’s the registry record, the documents, the screening hits, who looked at them and why we said yes.»

Regulators and auditors don’t just ask what you decided. They ask why, and based on what. A grey-zone approval is only as good as the trail behind it. If you can show where every data point came from, which documents you saw and what the reviewer concluded, a judgement call becomes a decision you can stand behind. If you can’t, it’s just a good feeling about a nice family.

Back to the dinner table

KYC and KYB are both about trust, but they ask very different questions. KYC asks whether one person is who they claim to be. KYB asks what a company is, who is behind it, and whether the whole picture fits your appetite for risk.

That’s also why KYB takes longer. Done by hand, it can take weeks or even months. Ask anyone who has opened a corporate bank account, and they’ll tell you it felt more like a mortgage application than a sign-up. Automation shortens the data gathering a lot for the clear cases, but nothing turns KYB into a one-minute selfie check, and it’s worth being sceptical of anyone who promises that.

So when we talk KYB with a team, the most useful things to bring aren’t technical. They’re your answers to a few questions: which countries your business customers are registered in, which industries you won’t work with, and what you want to happen when a case isn’t clear. Those answers shape a KYB flow far more than any single check does.

At Veriff, Business Verification pulls company data from official business registries and trusted data providers across 300+ jurisdictions, with the source shown in every case, so you can see whether a company exists, whether it’s active and whether its details match what it told you. Where the source provides them, you also see directors, shareholders and ultimate beneficial owners, and the business can add missing owners in its own onboarding flow. You can verify the identity of the people behind the business with Veriff identity verification and screen both the company and its people against sanctions, PEP and adverse media lists in the same case, with optional daily AML monitoring afterwards. Your team reviews the case and makes the call, with a full audit trail behind every decision.

And yes, the cousin abroad checked out in the end.