KYB for marketplaces: How to verify sellers and merchants at scale

If you’re a compliance officer responsible for Know Your Business (KYB) processes, you’ve probably encountered versions of this story before. The details may change, but the underlying challenges are often the same.

Picture a seller who gets banned for listing counterfeit goods. The account is closed, the listings come down, and the case is marked resolved.

A few weeks later, a new storefront appears. The product photos look familiar. The prices are almost identical. The account belongs to a company registered only last month, and every onboarding check comes back clean.

Nothing in that flow failed. Each check did exactly what it was built to do: look at one account, at one moment, and confirm it was real. What none of them answered was the question that actually mattered: who is this platform doing business with?

Know Your Business (KYB)

Verify businesses with confidence

Learn how business verification helps you reduce fraud, manage risk, and onboard legitimate businesses with confidence.

Contact us

The question changed

For a long time, marketplace trust came down to one question: is this seller account real? If the person behind it passed an identity check and the account behaved, that was usually enough.

The question has grown. Today, marketplaces also need to know which legal entity sits behind a storefront, whether that entity actually exists and is active, who runs it, who ultimately owns or controls it, and whether it, or anyone behind it, is sanctioned. A storefront is a brand. A seller account is a login. Neither is the same thing as the business that is legally responsible for what gets sold.

Regulation is a big reason the question changed. In both the US and the EU, identifying the sellers, and the businesses behind them, is no longer just good practice for marketplaces. It is a legal duty, with defined information to collect, deadlines to meet, and regulators who can enforce it. In the US, the INFORM Consumers Act (codified at 15 U.S.C. § 45f) requires online marketplaces to collect and verify information about high-volume third-party sellers. In the EU, Article 30 of the Digital Services Act (DSA) requires marketplaces to collect trader information, and make best efforts to check it, before those traders can sell.

Speed and scale make it harder. In most relationships, you get time to find out who someone really is. You meet a few times, you learn what they care about, and eventually you see how they behave day to day. A marketplace gets none of that. A seller can sign up on a Tuesday afternoon and receive their first payout by Friday. There’s no getting-to-know-you phase, only the checks you run at onboarding, and the ones you keep running after.

Then there’s volume. A marketplace that onboards thousands of sellers a month cannot look each one up by hand in a business registry. Any process that depends on manual checks turns into a queue, and a queue turns into sellers who give up before they list a single product. And when a regulator asks how a seller was verified, a manual process rarely leaves a consistent record that can be shown. This is where automated business verification, or Know Your Business (KYB), comes in.

What US and EU rules ask marketplaces to know

Two laws shape seller verification for marketplaces on either side of the Atlantic: the INFORM Consumers Act in the US and Article 30 of the DSA in the EU. They were written separately, but they point in the same direction.

The US: INFORM Consumers Act

The INFORM Consumers Act took effect in June 2023. It focuses on high-volume third-party sellers: those with 200 or more separate sales of new or unused consumer products totalling $5,000 or more in a continuous 12-month period within the previous 24 months.

Once a seller crosses that threshold, the marketplace must collect specific information from them, including bank account details, a business tax identification number (or a taxpayer ID if the seller has no business tax ID), and contact details. It must collect this within 10 days of the seller qualifying as high-volume seller, and verify it within 10 days of collecting it. Sellers who still don’t provide it after notice must have their sales suspended.

For a business seller, INFORM accepts either an ID for the person acting on its behalf or a government record showing the business name and address. KYB can cover both: it confirms the company in its official register and verifies the identity of the person signing up for it. Where the registry also lists the company’s officers or owners, a reviewer can check whether that person is one of them.

Individual high-volume sellers are covered too. For them, the check that applies is verifying the person’s own identity.

The obligation does not end at onboarding. At least once a year, the marketplace must ask high-volume sellers to certify that their information is still accurate, or update it. Sellers with $20,000 or more in annual revenue on the platform must also have their name, physical address, and contact details shown to buyers, with some exceptions. The Federal Trade Commission and state attorneys general enforce the Act.

The EU: Digital Services Act, Article 30

Article 30 of the DSA is often called the “know your business customer” rule. Its trader traceability requirements have applied to online marketplaces since February 2024. They don’t apply to marketplaces that are micro or small enterprises, unless the platform has been designated as a very large online platform.

The biggest difference from INFORM is timing. Under the DSA, a marketplace must collect a trader’s information before that trader can operate on the platform. That includes the trader’s name, address, phone number and email; a copy of an identification document or an electronic identification; payment account details; the trade register and registration number, where the trader is registered; and a self-certification that the trader only offers products and services that comply with EU law. 

Collecting is not enough on its own. Marketplaces must make best efforts to assess whether the information is reliable and complete, “through the use of any freely accessible official online database or online interface made available by a Member State or the Union, or through requests to the trader to provide supporting documents from reliable sources.” If they have reason to believe it is inaccurate, incomplete, or outdated, they must ask the trader to correct it, and swiftly suspend the trader if they don’t.

Marketplaces must also store this information securely for six months after the relationship with the trader ends, and then delete it. And they must show the trader’s name, address, phone number, email, trade register number and self-certification to buyers.

For EU marketplaces, there is a useful overlap: much of this information is also gathered for compliance with Directive 2011/16/EU (latest version of which is known as DAC8), the EU’s tax reporting rules for digital platforms. Platforms can often build on processes they already run, rather than starting from scratch.

The takeaway for a marketplace operating in both regions: the triggers differ, but the expectation is the same. Both laws ask for verified information, not just collected information, and both expect it to stay accurate. Verifying every seller at onboarding, before their first listing, is usually simpler than running two separate processes. Several of these checks can be automated: confirming the business in its official register, verifying the identity of the person acting for it, and screening the business and the people behind it against sanctions lists.

This section is a general overview, not legal advice. Sources: FTC guidance on the INFORM Consumers Act, CCPC guide to DSA Articles 30 to 32, Pinsent Masons on DSA and DAC7.

Know Your Business (KYB)

Verify businesses with confidence

Learn how business verification helps you reduce fraud, manage risk, and onboard legitimate businesses with confidence.

Contact us

Collecting isn´t verifying

The simplest way to respond to these rules is to add fields to the seller sign-up form: company name, registration number, tax ID, address, bank account. That gathers the information. It doesn’t confirm any of it.

A form field without any KYB solution on the backend will accept a company that was dissolved two years ago. It will accept a registration number that belongs to a different business. It will accept a name the seller made up that afternoon. Until the details are checked against an independent source such as an official business registry or a recognised business database, the marketplace only knows what the seller chose to type. That is why the DSA points marketplaces to “freely accessible official online databases”.

One thing I think gets consistently underestimated is how hard company data is to work with. Some registers are free to search. Many sit behind a paywall or charge per document, and registration numbers can be surprisingly hard to track down, sometimes even for the business they belong to. The name on a storefront is often a brand or a trademark, not the legal name of the company behind it, and one company can trade under several. So the details a seller enters are often incomplete, and checking them by hand, one registry at a time, doesn’t scale. And even when every detail is correct, it only shows that a company exists, not that the person who entered it has anything to do with it. That, to me, is the real gap between collecting and verifying.

INFORM sets the bar in its own words: verifying means confirming that the information is valid, belongs to the seller, and has not been misappropriated or falsified. Accurate company details would pass a form. On their own, they would not pass that test. Showing that a business exists is only half the job. The other half is showing that the person signing up is really connected to it, and that half is harder. In some countries, the registry names the company’s directors and owners. In others, including most US states, it often doesn’t, and the connection has to be established in other ways.

Verifying a business seller means answering a few concrete questions:

• Does the company exist? It should appear in an official company registry for the country where it says it is registered. A certificate the seller uploads is not the same thing: a document can be edited, but the seller can’t edit the registry record.
• Is it active? A company can exist on paper and still be dissolved, struck off, or in liquidation. Registry records can also lag behind: in some countries, a bankruptcy, a liquidation or a change of ownership can take a while to appear in the digital register.
• Do the details match? The name, registration number, and address the seller entered should line up with the registry record.
• Who runs it? In many countries, the registry record names the company’s directors or officers, the people legally responsible for it.
• Who owns it? Some registries list shareholders, and some list the ultimate beneficial owners (UBOs), the people who ultimately own or control the company. Where the registry doesn’t, the business can declare its owners itself and back this up with supporting documents, such as a shareholder register. That’s useful, but it’s the business’s own account, so treat it as declared rather than confirmed.

Getting a clean answer is not always straightforward. Sellers put a tax number in the field meant for a registration number, or leave out the legal suffix (Ltd, GmbH, LLC) that distinguishes one company from another with a similar name. Registries themselves differ from country to country in what they publish and how. Working on KYB, I’ve stopped expecting any two registries to agree on what a company record should look like. Living in Estonia, I’ve got used to companies having to report their beneficial owners to the business register, so the owners are almost always right there in the record. In many US states, the record may name little more than a registered agent, often a law firm or filing service rather than anyone who runs the business, and you’re glad to find even one officer who isn’t the agent. We’ll look at why finding the right company is harder than it seems in an upcoming post on how KYB search works.

If you’re new to the fundamentals, our guide to how to verify a business is legitimate covers what business verification is and how manual and automated approaches compare.

Know Your Business (KYB)

Verify businesses with confidence

Learn how business verification helps you reduce fraud, manage risk, and onboard legitimate businesses with confidence.

Contact us

Why banned sellers can come back

Go back to the seller from the start of this post. How did they return so easily?

Re-registration usually follows a simple pattern. A new company is set up, often in a matter of days. The same people stand behind it. A new seller account is opened under the new company’s name. To a platform that only checks accounts, the new storefront is a stranger. To a platform that only checks whether the company exists, it is a newly registered business with nothing against it.

The link between the old storefront and the new one is the people. Companies can be created and closed quickly. The individuals running them change far less often.

That is why verifying a business seller works best when it covers both the company and the people responsible for it. When a platform knows which directors and owners stand behind each business it works with, whether from the registry or declared by the business itself, and has confirmed who those people are, it has the information it needs to notice someone it already knows behind a new company.

AML screening matters here too. A company can be perfectly legitimate on paper while one of its directors appears on a sanctions list, a PEP list, or in adverse media. Screening only the legal entity would miss that. Screening the entity and the people behind it closes the gap. And because a director can be added to a sanctions list after onboarding, screening works best when it continues, not just once at sign-up.

None of this makes re-registration impossible. Someone determined to return can recruit a different person to put their name on a new company. That is one reason to look past directors to the people who own the company, where the registry provides ownership data. A stand-in can be named as director, but control usually stays with the owner. The goal of good seller verification is not to promise that bad actors can never come back. It is to make coming back slower, harder, and more expensive than it is worth.

Friction is a seller acquisition cost

Everything above could be read as an argument for checking every seller as thoroughly as possible. That misses half the picture.

For a marketplace, sellers are supply. Every extra step in onboarding delays the moment a new seller lists their first product, and every day without listings is revenue the platform doesn’t earn. Sellers who hit too much friction often don’t complain. They simply go and sell somewhere else.

From the product side, I think of every onboarding step as a small tax on supply. Some of those taxes are set by law. The rest have to earn their place.

So the real question isn’t how much verification a marketplace can do. It’s where verification should sit, and how fast it can run.

Match the depth to the moment. Not every seller carries the same risk on day one. Depending on the regulation and the platform’s own policies, verification can be placed at different points in the seller journey:

• before a seller’s first listing goes live
• before a seller can receive payouts, which is often when the bank account the payouts go to is checked
• when a seller crosses a sales volume threshold, as INFORM requires in the US
• and again at least once a year, when INFORM requires marketplaces to ask sellers to confirm their details are still accurate

Know where you have room, and where you don’t. In the EU, the DSA requires trader information to be in place before a trader operates, so there is less flexibility on timing. That puts more weight on how quickly the check itself can be completed. Pre-filling what the official registry already holds means the seller confirms their details instead of typing them in from scratch.

Let automation do the gathering. For many sellers the answers are straightforward: the company is in the registry, it is active, and the details line up. Automation can pull the registry record, list the people behind the company (where the registry provides them), verify their identity and screen everyone against sanctions, PEP and adverse media lists, so a reviewer can confirm a clear case quickly. The cases that need judgment, such as a name that doesn’t quite match or a possible match on a sanctions list, arrive with the evidence already in one place.

That last point matters more for businesses than it does for individuals. Business verification rarely ends in a simple yes or no, and we’ll explore why in a separate post on the difference between KYB and KYC.

What this means for each team

Seller verification touches several teams at once, and each one feels it differently.

Trust and safety gets a clearer view of who is behind each storefront. Knowing the business and the people who run and own it makes it easier to spot patterns that a single account would never reveal.

Compliance and legal get a documented record of how each seller was verified: what the official registry returned, which checks were run and when, and who reviewed the case. When a regulator, or a brand owner raising a complaint, wants to know how a particular seller was allowed onto the platform, there is an answer beyond what the seller typed into a form.

Product and growth get faster activation for legitimate sellers. When the checks run in the background and reviewers only need to confirm the clear cases, the sellers a marketplace most wants to attract spend less time waiting and more time listing.

Engineering gets fewer moving parts. Checking a business, screening it and its directors, and verifying the identity of the person signing up can each be handled by separate tools. When they work together in one case, with an API and webhooks for each check and decision, and the same cases available to reviewers in a dashboard, there are fewer integrations to build and maintain, and fewer gaps between them.

Knowing who you do business with

Think back to the storefront that reappeared a few weeks after its ban. The account was new. The company was new. The people behind it were not.

A marketplace that verifies only accounts will keep meeting that seller as a stranger. A marketplace that verifies the business, confirms it is real and active, knows who runs and owns it, and has verified who those people are, has a far better chance of recognising them, and of meeting its obligations in the US and the EU while it does.

If this story has a moral, it’s this: marketplace trust used to mean knowing your accounts. Increasingly, it means knowing the businesses behind them, quickly enough that the right sellers barely notice the checks are there.