Know Your Business (KYB)

KYB compliance means a company is following Know Your Business rules. This involves performing suitable due diligence like enhanced due diligence (EDD) on businesses and their Ultimate Beneficial Owners before working with them — and continuously performing AML checks throughout the business relationship. 

While businesses can’t detect all potentially fraudulent transactions, compliance with the Financial Industry Regulatory Authority (FINRA) and other regulations requires implementing reliable and repeatable processes to ensure companies understand who they’re dealing with before allowing or rejecting transaction requests.

While Know Your Customer (KYC) refers to verifying customer identities before carrying out transactions, Know Your Business (KYB) process requires companies to verify the businesses they work with — and the people behind those businesses — to assess the AML/CFT risk.

The main purpose of KYB is to determine:

• Whether a company is real or if it just exists on paper

• Who ultimately owns and operates the business (its ultimate beneficial owners)

• Whether or not the business and its owners are safe to engage with or if you they should be denied access to your services or platform

Governments around the world have adopted KYB regulations to make it more difficult for criminals to use shell companies to engage in financial crimes like money laundering, tax evasion, and the criminal financing of terrorism.

Know Your Business is important for organizations operating in industries that are subject to laws and regulations requiring them to perform KYB. Without a well-designed KYB strategy, you risk falling out of compliance and potentially being hit with severe penalties.

That being said, even businesses not subject to KYB requirements can see value in implementing a KYB strategy. Performing KYB when onboarding a new supplier or vendor, for example, decreases the risk that you will fall victim to fraudulent misrepresentation, business impersonation, or another form of fraud. It can also be a point of pride for your organization, and something that speaks to the trust and safety of your platform — particularly for online marketplaces.

Financial institutions that engage with businesses as their customers are required to perform Know Your Business checks during the account creation phase andas well as in an ongoing manner. This includes businesses like:

• Banks

• Credit unions

• Payment companies

• Insurance agencies

• Gambling platforms

• Cryptocurrency platforms

• Asset management firms

• Real estate agencies

• Dealers of high-value goods

• and others

Likewise, in many jurisdictions, online marketplaces are required to perform KYB for vendors and sellers using their platform, in order to reduce fraud and create a safer platform for shoppers.

In the United States, KYB requirements for financial institutions were established by the Bank Secrecy Act (BSA) and subsequent laws that built upon or expanded it, including the USA PATRIOT Act and the 2016 Customer Due Diligence (CDD) Rule issued by FinCEN. Meanwhile, KYB requirements for online marketplaces were established by the INFORM Consumers Act.

In Europe, the Fourth Anti-Money Laundering Directive (4AMLD) outlined KYB requirements for financial institutions, which were further expanded with the 5AMLD and 6AMLD. The DAC7 brought online marketplaces into the fold.

Many other countries around the world have their own KYB regulations, making it important to have a plan in place for international KYB if you are considering expanding into a new jurisdiction.

To perform KYB you will typically need to collect and verify:

• Information about the business itself, potentially including business registration numbers, tax numbers, and business documentation

• Information about the business’s owners, often including their names, dates of birth, addresses, taxpayer identification number (TIN), and IDs

Verification itself can be completed via whatever combination of methods allows your business to comply with the regulations it is subject to while meeting your risk tolerance. This can include document verification, ID verification, database verification, selfie verification, and more.

KYB can also involve additional checks and screenings to ensure that a company and its owners are safe to do business with, such as:

• PEP screenings

• Watchlist screenings

• Sanctions list screenings

• Adverse media checks

• and more

Note that the KYB process can vary significantly from business to business and from jurisdiction to jurisdiction.

You can collect and verify a variety of business documents as a part of your KYB process. Usually, these will be broken into buckets like:

• Ownership documents, such as ownership agreements, partnership agreements, trust agreements, membership agreements, shareholder agreements, stock certificates and ledgers, etc.

• Tax documents, such as Form W-8 ECI, Form W-8-BEN-E, Form W-9, IRS 147C Letter, IRS CP565 Letter, IRS CP575 Letter, etc.

• Other corporate documents, like articles of incorporation, articles of organization, business registration certificates, business licenses, statements of information, annual reports, and more

KYB faces many of the same challenges that are prominent in the broader identity space, including:

• A fragmented regulatory landscape where requirements vary from jurisdiction to jurisdiction and from industry to industry

• Non-universal database coverage, where a database that exists in one country (such as a UBO database) may not exist in another country

• The emergence of generative AI, which has made it easier than ever for fraudsters to forge or alter IDs and documents (including business documents)

When performing KYB on a business, it’s important to keep an eye out for red flags which may indicate that they are at a higher risk for engaging in money laundering or other financial crimes. While there are many risk factors to consider, some important ones to be aware of include:

• Lapsed corporate registration status

• Incorrect or missing TIN, EIN, VAT, registration, or other numbers

• Complex of otherwise unusual business structure

• Operations based in high-risk countries or territories

• Operation in an industry with a high risk for fraud

• Unusual transactions for their industry or type of business

• Presence on a sanctions list, watchlist, or other risk report

• Connection to businesses or individuals known for engaging in fraudulent activities

It’s also important to look for inconsistencies between business documents and the information the business provides to you, as these inconsistencies may indicate that documents have been forged or altered.

In a manual KYB process, once a business has submitted its information and business documents, a human would be responsible for validating the authenticity of the documents and verifying the information contained within them. While this may be a viable option for smaller organizations that infrequently onboard business customers, it is difficult to scale, and is not typically well-suited for organizations that see a larger volume of business customers. 

With an automated KYB process, on the other hand, documents and IDs are automatically validated using AI and other technologies. These technologies can also rapidly cross-reference the information contained within the documents against authoritative data sources, such as issuing databases, as well as between documents to ensure that there are no discrepancies. 

While it’s possible to have either a purely manual or purely automated KYB process, for many organizations the sweet spot lies somewhere in the middle — with a mix of both automated and manual processes. 

Keep learning: The case for automated identity verification.