How do you identify shell companies when they apply for business accounts? Rarely one file at a time. KYB checks are the steps a bank takes to verify a business customer before it opens an account: confirming the entity exists and is in good standing with its state, verifying its tax identification number and address, identifying and verifying every owner of 25% or more and one control person, screening the business and those people against sanctions lists, and recording what the account is for so a risk rating can be set. Every one of those checks looks at one applicant at a time, and a shell set up on a clean identity passes them all. The cases that cost institutions most are often visible only across applicants, when several businesses share an address, an owner, a phone number or the same bookkeeper. Botminds' Business Account Opening (KYB) makes the single-file checks complete and cited for every packet; this guide is honest about the cross-file check, which is a separate control.
The case at the centre of this guide is real and public: a New York Department of Financial Services consent order. The worked examples beside it use fictional sample businesses at a fictional community bank, as they appear in the solution.
Paxos onboarded 11 businesses located in the same single-story strip mall in South Florida without identifying their shared attributes.
New York State Department of Financial Services, consent order with Paxos Trust Company, August 7, 2025
What are KYB checks? The standard list, one business at a time
KYB, or know your business, is the business-customer side of know your customer. In a US bank its checks come from three rules: the Customer Identification Program rule for the entity's identity (31 CFR 1020.220), the beneficial ownership rule for the people behind it (31 CFR 1010.230), and the customer due diligence rule for the purpose of the account and its risk profile. Sanctions screening sits beside them under OFAC's rules.
The standard KYB checks, each run on one applicant
- The entity exists and is active
Formation document and the state's business filing; standing, assumed names, registered agent and filing history.
- Its identifiers are right
Legal name, physical address and taxpayer identification number obtained before opening and verified.
- Its owners and controller are named
Each individual at 25% or more, directly or indirectly, and one control person, on a certification.
- Those people are who they say
Each owner verified by documentary or non-documentary means, with the same elements the CIP rule uses.
- Nobody is on a list
The entity, its owners and signers compared against OFAC's lists and any other lists the bank checks.
- The account makes sense for the business
Nature, purpose and expected activity recorded and turned into a risk rating at opening.
Run well, these checks answer whether a business is real and who stands behind it. They do not answer whether this business and the one opened yesterday are the same people wearing different names, because no item on the list compares one file with another. A bank can pass every standard check on every applicant and still miss the pattern. Business entity verification covers how far a single file's checks can be trusted; this guide is about what they cannot see by design.
What NYDFS found at Paxos: eleven businesses, one strip mall
In August 2025 NYDFS fined Paxos Trust Company $26.5 million and required a further $22 million of compliance spending. The finding behind the strip mall line was about the tool, not the reviewers. The order says Paxos's software "did not include automated alerts to indicate potentially risky shared customer attributes or provide frontline search capabilities during the onboarding process", and that "This weakness enabled customers who shared addresses, corporate documents, beneficial owners, and certain behavioral characteristics indicative of potential illicit coordinated activity to open multiple accounts and remain undetected" (NYDFS consent order, paragraph 28).
The example the regulator chose shows how far the pattern ran. Three of the eleven strip-mall businesses "were associated with an individual who had transacted approximately $260 million on the exchange during a period of fourteen months", and that individual "was listed as the accountant for a company that prepared the corporate books for at least four other customers onboarded to the platform". Compliance staff "acknowledged that the system did not adequately address the 'linking' of individuals and entities."
Paxos is a New York trust company in virtual currency, not a community bank, and the case should not be stretched beyond what it shows. What it shows is general: a checklist run per applicant, however carefully, produced eleven clean files, and the risk was in the relationship between them. NYDFS treated the absence of a linking control as a program failure, not as bad luck.
How shell companies get business bank accounts, and how to identify them
Shell companies get business accounts because forming one is cheap and each one passes a per-file check. Treasury's 2024 National Money Laundering Risk Assessment describes the supply chain: "complicit mules are also used to create shell companies to open business bank accounts that can be used as part of the laundering process" (Treasury, 2024 NMLRA). A mule with a clean identity is, by construction, an owner who passes verification.
The same assessment records how weak beneficial ownership transparency remains worldwide: FATF's assessments found fewer than one country in ten effective at making beneficial ownership transparent. In the United States the picture changed again in 2025, when US companies stopped reporting their owners to FinCEN, so the bank's own certification is now the only owner list for most US businesses it sees. A pattern of shared owners across applicants is visible to the bank from its own files or not at all.
What a network of mule-owned shells has in common is rarely the owner's name, which is the point of using mules. It is the infrastructure: an address, a phone number, an email domain, the accountant or formation agent who set them up, the device the applications came from, and a run of formation dates within weeks of each other.
Which shared attributes to link across applicants
Link on the attributes a coordinator cannot cheaply vary. Names and owners vary by design; the support behind them does not. The matrix below shows five fictional applicants opened over six weeks. Taken one at a time, each is unremarkable. Read across, four share a bookkeeper and three share an owner, and the only business with nothing else in common is a bakery that has been at the same address since 2014.
Five applicants, five attributes: the link matrix a per-file check never draws
Shared attributes, what they suggest, and the innocent explanation to rule out
| Shared attribute | Why it can matter | Innocent explanation to rule out first |
|---|---|---|
| Physical address | One location fronting several businesses, as in the strip mall case | An office building, a shopping centre, a coworking space or a business incubator |
| Registered agent or formation agent | One service setting up a batch of entities for the same client | Large registered-agent firms represent thousands of unrelated companies |
| Owner or control person | The same person behind businesses that present as unrelated | A serial entrepreneur or a family with several genuine firms |
| Phone number or email domain | One operator answering for several businesses | A shared receptionist, an answering service or a franchise group |
| Accountant or bookkeeper | The coordinator in the Paxos case was the accountant for several customers | Small-business accountants serve many clients by trade |
| Formation dates in a cluster | Entities formed in a batch shortly before applying | A holding structure created for a real acquisition |
| Identical documents | Copied operating agreements, templates or the same photographed ID | An online formation service's standard template |
Can several businesses share an address at a bank?
Yes, and most do so innocently. The CIP rule asks a business for the street address of its main place of business, a local office or some other physical location, and nothing in it forbids two customers from giving the same one. Office towers, shopping centres and coworking spaces host hundreds of businesses, and a registered agent's office is the legal address of thousands. An address match on its own is not a red flag.
It becomes one in combination. Eleven businesses in a single-story strip mall is a different picture from eleven businesses in a forty-floor tower, and three of them sharing an accountant who moved $260 million is different again. The useful question for a banker is not "does anyone else use this address?" but "what else do the businesses at this address have in common, and does the stated business fit the premises?"
Red flags in business account opening that only appear across files
The red flags that per-file checks miss share one feature: they are relationships. A wholesale importer whose premises is a unit in a strip mall can be explained; the fourth importer at the same unit cannot. A new LLC whose owner has a clean identity is normal; the same owner on a third new LLC in a month, each describing a different trade, is a question.
The same applicant, checked alone and checked across files
Checked alone: A real commercial unit, verified against the state's filing
Checked across applicants: The same unit as three other applicants this quarter
Checked alone: Identity verified; not on any list
Checked across applicants: Also the owner of two applicants that describe unrelated trades
Checked alone: Operating agreement present and signed
Checked across applicants: Word-for-word the same agreement as another applicant, down to a typo
Checked alone: Phone answered; email works
Checked across applicants: One email domain registered last month, shared by four applicants
Checked alone: Every line confirmed; account opens
Checked across applicants: Lead for the BSA officer: review the group before more accounts open
Timing matters as much as the attribute. Paxos's order specifically faults the absence of "frontline search capabilities during the onboarding process". A link found by transaction monitoring six months after opening is a suspicious activity investigation; the same link found at the application is a question the banker can ask before any money moves.
Linking without de-risking: what a match should and should not do
A link should start a review, not end a relationship. The rules lean against automatic labels: FinCEN's FAQs say a product or customer type does not have to be treated as high risk simply because a government publication names it (CDD Rule FAQs, F.5). The FFIEC's examination manual adds that a bank with an effective risk decision process, which it follows, should not be faulted for a single customer decision unless that decision weakens the CDD program as a whole or comes with signs of bad faith or other aggravating factors (FFIEC BSA/AML Manual, CDD; when enhanced due diligence is required covers the high-risk question).
Read together, those passages describe a defensible design. Links produce a lead with the shared attributes listed; a named person reviews the group, records what was found and decides. Most leads will be a coworking space or a busy accountant, and the file should say so in a sentence. The few that are not get enhanced due diligence or a decline with a reason, and the reasoning protects the bank either way.
In Business Account Opening (KYB) a possible match goes to the BSA officer, not the banker
Where Business Account Opening (KYB) checks and where it stops
Business Account Opening (KYB) does the per-file KYB checks completely and the same way every time. Its Registry agent compares the articles with the state's filing; its Ownership agent recomputes ownership from the operating agreement and sets it against the certification; its Screening agent verifies every owner and signer and screens them and the entity against OFAC and the 314(a) list. Every result becomes a line on the entity sketch with its source and one word: confirmed, differs or missing. A Second Read agent re-reads every line before the banker sees it.
That makes each file's attributes structured, cited and searchable: the address, the registered agent, the owners, the signers and the documents are fields with sources, not pages in an image. A link across applicants is a query over those fields. The solution as published does not describe an automatic cross-applicant alert, so a bank should treat linking as a control it sets up on top of this data, in its monitoring or in a review the BSA officer owns, and test it before relying on it. KYB software and bank size covers what to ask any vendor about this.
Every attribute a link needs, cited on one page
What the solution keeps from the strip mall lesson is the restraint. Agents never clear a potential list match; possible matches and anything touching a suspicious activity report stay with the BSA officer; and nothing in a message to an applicant may mention screening. A linking control built on top should follow the same rules: a person decides, and the applicant is not tipped off. For the classification step that precedes all of this, see LLC bank account requirements.
Questions people ask
What is the difference between KYB and KYC checks?
KYC checks verify an individual customer; KYB checks verify a business and then the individuals who own and control it. In US banks KYB adds the beneficial ownership rule, 31 CFR 1010.230, to the identification rule both share, so a business file always contains KYC checks on its owners.
How do banks detect shell companies opening accounts?
Per-file checks catch a shell whose documents or owners fail verification. Shells set up by a coordinator usually pass those checks, so detection depends on comparing applicants: shared addresses, owners, contacts, accountants, documents and formation dates. Treasury's 2024 risk assessment names mules creating shell companies to open business accounts as a known laundering method.
How do you verify a business is legit?
Confirm it exists and is active in the state's filing, that its name, address and tax number match its documents, that its owners and controller are named and verified, and that its stated business fits its premises and expected activity. Then check whether its address, owners or contacts link it to other recent applicants.
What did NYDFS find at Paxos?
NYDFS found that Paxos's onboarding software had no alerts for shared customer attributes and no frontline search, so customers who shared addresses, corporate documents and beneficial owners opened multiple accounts undetected, including 11 businesses in one strip mall. Paxos paid a $26.5 million penalty and committed $22 million to compliance improvements in August 2025.
Is a shared registered agent a red flag?
Not by itself. Commercial registered agents represent large numbers of unrelated companies, so a shared registered agent is usually meaningless. It becomes relevant only alongside other shared attributes, such as the same owner, contact details or a cluster of formation dates.
Should a bank decline every applicant that links to another?
No. FinCEN's FAQs say institutions are not expected to label customer types high risk automatically, and most links have innocent explanations. A link should send the group to a reviewer who records what was found and decides each case on its facts.