Corporate KYC documents list, mapped to the field each one proves

The corporate KYC documents list for a US bank comes down to five groups: proof that the company exists and is in good standing, its address and taxpayer identification number, a beneficial ownership certification with identification for each owner and the control person, look-through evidence for any stake held by a trust or fund, and financial information that explains what the account is for and how it will be used. The list matters less than the map behind it. Each field in a corporate file has one authoritative source, and a file that holds a document for every line of a checklist can still fail when nobody checked that the documents agree. Botminds' Corporate KYC builds the file that way, field by field with a cited source, and asks the client only for what is missing.

The worked example is fictional: Corvane National Bank's file on Brightwater Cold Chain Holdings, a Delaware holding company with four subsidiaries, as it runs through the solution. Rules are quoted from the eCFR and FinCEN's consolidated CDD FAQs of May 2026.

The corporate KYC documents list, in one answer

A corporate KYC documents list for a privately held US company usually holds ten items: the account application with the products requested; certified articles or a certificate of formation; a recent certificate of good standing; evidence of the principal place of business; the taxpayer identification number; the beneficial ownership certification; identification for each owner of 25% or more and for the control person; a stock register, operating agreement or partnership agreement that shows the ownership; a trust certification or fund look-through letter for any such stake; and financial statements with the client's expected activity by product. Banks add a board resolution or signer list and, for regulated businesses, the relevant licences.

The sample file holds exactly that evidence: the client's application and products, registry extracts for five entities, the stock register and the certification, the trust certification and the fund's look-through letter, audited statements for two years and the client's answers on expected activity. The difference between a list and a defensible file is what the next section shows.

What documents are needed for corporate KYC? Each field and its source

Every field in a corporate file should name one authoritative source and the rule that requires it, and a reviewer should be able to say what a weak substitute looks like. That is the map below. Read across a row and the file's logic is visible: the field, the evidence, why the bank needs it, and what fails.

The right-hand column is where real files fail. FinCEN fined Bancrédito International Bank & Trust $15 million in 2023 partly because it accepted a law firm's letter as proof of who owned a British Virgin Islands company without checking the letter's claims for itself, although the named owner "was a minor at the time" the company was formed (FinCEN, Consent Order 2023-02; the case is read in full in how to verify beneficial ownership). A letter is a document; it is not, by itself, a source that proves the field.

Proving the entity: formation, good standing, address and TIN

The entity is proved with the documents the CIP rule names. For "a person other than an individual (such as a corporation, partnership, or trust)," documentary verification relies on papers that prove the entity exists; the rule's examples are certified articles of incorporation, a business licence issued by a government, a partnership agreement and a trust instrument (31 CFR 1020.220). The rule also allows non-documentary methods, such as comparing the client's information with a public database, which in practice means a state registry.

Three details catch analysts. The address must be a physical place where the business is run, such as its main office or a local one, so a registered agent's office alone does not answer it. The identification number must be in hand before the account opens; since FinCEN's orders of June 27 and July 31, 2025 a bank may take it from a third-party source instead of the customer, but still before opening (FinCEN, June 27, 2025). And a good-standing certificate ages: GAO found banks checking business information against state records such as good-standing certificates (GAO-20-574), and an extract pulled before a lapse proves nothing about today. Corvane keeps every registry extract under 90 days old.

Proving the owners: the certification and what tests it

Owners are identified by a certification and verified by the bank. The rule lets the bank collect the information on the form in Appendix A of 31 CFR 1010.230 or in another way, as long as the person signing vouches that it is accurate to the best of their knowledge (beneficial ownership certification reads the form line by line). The information comes from the person opening the account, not from the owners themselves; FinCEN's FAQ B.6 is explicit that the bank need not contact owners directly.

The bank may rely on that certification only while it knows of no facts that give it reasonable cause to doubt it, which is why the stock register or operating agreement belongs in the file. If the certification names one 38% owner and the register shows another holder at 30%, the bank now has knowledge of such facts. FinCEN's FAQ B.8 adds that a customer may not name a nominee: the form must name the real people at the top of the chain, not stand-ins (FinCEN CDD FAQs).

Verification of each owner may follow the bank's CIP methods, with one relaxation: for beneficial owners, FAQ B.14 allows photocopies of identity documents, which CIP does not. Look-through stakes need their own evidence. On the sample file, a private-equity fund holds 34% and the fund's look-through letter shows no individual at 25% through it; a family trust holds 9%, below the line, and its trustee is still recorded. Had the trust held 25% or more, the trustee would have been named as the owner for that stake.

KYC requirements for publicly traded companies, partnerships, trusts and nonprofits

The documents change with the type of entity, because the rules treat entity types differently. The table gives the common cases; the starting question is always whether the customer is a "legal entity customer" at all.

Two rows deserve a second look. A listed company is outside the definition, but the subsidiary of a listed company is outside it only if it is organised in the US and at least 51% owned by the listed parent; a foreign subsidiary or a minority-held affiliate is a legal entity customer like any other. And a trust that is the customer is not covered by the ownership certification unless a state filing created it, yet the bank still has to understand who controls it, so many banks collect the trustees and settlor as policy. How these definitions sit inside KYB is set out in full elsewhere.

Documents that support nature and purpose and expected activity

Nature and purpose is the field documents prove least directly, and the one examiners test most. FinCEN says the bank must understand the nature and purpose of every customer relationship and account, but for lower-risk customers that understanding can come from what is obvious, such as the kind of customer or the kind of account (FAQ F.1). For a commercial client using wires, ACH origination and a card programme, it is rarely self-evident.

The documents that carry it are the application, the products requested, and financial statements recent enough to describe the business as it is. On the sample file, the expected-activity chapter was first written from FY2024 audited statements, which described a company with no operations outside the United States; the client had opened a Mexican subsidiary in 2025. The bank's standard required the most recent audited statements, so the Checker agent disputed the chapter, and the FY2025 statements added 22 wires a month to Mexico. How to set expected activity so monitoring can use it is the next step from here.

The corporate KYC file as a contents page, each chapter with its sources

Why a complete documents list can still fail an examiner

Examiners do not test whether documents were collected; they test whether the bank understood the customer. The FFIEC examination procedure for customer due diligence has examiners sample customer information and judge two things: whether it is enough to understand the nature and purpose of the relationship, and whether the bank built it, ownership included, into the customer risk profile (FFIEC BSA/AML Manual, CDD examination procedures). A file can contain every document on the list and still fail both halves of that sentence.

KYC procedures were manual and functioned merely as a checklist, with employees mechanically focused on ensuring documentation was collected, rather than shining a critical light on information provided by potential customers.

New York State Department of Financial Services, consent order with Deutsche Bank, January 30, 2017

The New York regulator's finding against Deutsche Bank, part of a $425 million penalty, describes the failure mode exactly: documents collected, nothing read against anything else. The cure is the map, plus a reader who checks the rows against each other: the subsidiary in the entity chapter against the screening register, the expected volumes against the statements, the certification against the register.

Asking the client once, for only what is missing

Most of a corporate file's elapsed time is spent waiting for documents, and most of the waiting comes from asking twice. A request that lists everything the bank might want, sent before anyone has checked what is already on file, produces partial replies and second requests. A request built after the file is assembled can be short. On the sample file the Outreach agent sent one secure request to the client's treasurer for two items, the FY2025 audited statements and a five-question form on Mexico activity, and listed what was already on file so it would not be asked again: registry extracts for five entities, the stock register and certification, the FY2024 statements and the trust certification.

One request for corporate KYC documents, and what is already on file

Keeping the documents: what the retention rules require

The ownership documents have two retention clocks. The identifying information, including the certification, is kept "for five years after the date the account is closed"; the verification records, a description of every document relied on, every non-documentary method and its result, and "the resolution of each substantive discrepancy," are kept "for five years after the record is made" (31 CFR 1010.230(i)). The CIP rule uses the same two clocks for the entity's own identity. A bank may simply keep the whole file for five years after the relationship ends, as Corvane does by policy; that is longer than the minimum for some records and never shorter.

To see how the file is assembled from these documents, cited sentence by sentence, start from Corporate KYC.

Questions people ask

What is on a company KYC documents list for a small business?

For a small LLC or corporation: the formation document, a good-standing certificate, the EIN, the beneficial ownership certification, ID for each owner of 25% or more and for one control person, and a short description of the business and how it will use the account. A sole proprietorship needs only the owner's own identification, because it is not a legal entity customer.

Can a bank accept photocopies for corporate KYC?

For beneficial owners, yes: FinCEN's FAQ B.14 says the bank's procedures may accept photocopies of an owner's identity document, which the CIP rule does not allow for the customer itself. The bank decides on risk which copies it accepts and records what it relied on.

How old can a registry extract or good-standing certificate be?

No US rule sets an age. Banks set their own limit, commonly a few months, because a certificate only proves standing on the day it was issued; Corvane uses 90 days. What examiners look for is that the bank's own limit was applied consistently.

Does the subsidiary of a listed company need an ownership certification?

Not if it is organised in the US and at least 51% owned by a company listed on the New York or American Stock Exchange or the Nasdaq National Market, because 31 CFR 1020.315 places it outside the definition. A foreign subsidiary, or one held below 51%, needs the certification like any private company.

What KYC documents does a trust need?

If the trust is the customer, the bank verifies its existence with the trust instrument under CIP and, as policy, identifies the trustees and often the settlor. If a trust owns 25% or more of a company that is the customer, the trustee is that company's beneficial owner for the stake and is identified and verified like any owner.