The corporate KYC process is the sequence a commercial bank follows before it opens accounts for a company: take the application, identify and verify the entity, identify and verify its beneficial owners and control person, establish the nature and purpose of the relationship and its expected activity, screen every party, rate the risk, review the file and approve it, and only then book the products. Each step has a different owner, the relationship manager, the client, the KYC analyst, QC and sometimes a second-line financial crimes team, and a corporate onboarding usually waits far longer between those owners than inside any step. Botminds' Corporate KYC runs the process as one file per client: agents assemble and check it, the client is asked once, and people review, sign and approve.
The worked example is a fictional sample file: Corvane National Bank onboarding Brightwater Cold Chain Holdings, a Delaware holding company with four subsidiaries, for operating accounts, ACH origination, domestic and international wires and a commercial card programme. The rules cited are current to October 2026.
The corporate KYC process in four numbers
1+hour
of staff time per new business account, against about 30 minutes for a consumer account
3
identifying items the CIP rule requires from a company before its account opens: name, address, TIN
1
beneficial ownership certification per client, at its first account, under FinCEN’s 2026 relief
6of 20
days used by the sample file, against its service level, from opening to approval
The corporate KYC process in eight steps
The corporate KYC process has eight steps, and four of them are set by rule. The table names each step's owner on a typical commercial bank's desk and the rule or policy behind it. The owners vary from bank to bank; the rules do not.
Eight steps of corporate KYC, the usual owner, and what sets each
| Step | Usual owner | What sets it | Output |
|---|---|---|---|
| 1. Application and products | Relationship manager | Bank policy | Products requested, client contacts, the first business description |
| 2. Identify and verify the entity | KYC analyst | CIP, 31 CFR 1020.220 | Name, address, TIN before opening; existence verified |
| 3. Owners and control person | KYC analyst | CDD, 31 CFR 1010.230 | Certification; each 25% owner and one control person verified |
| 4. Nature, purpose, expected activity | KYC analyst with the client | Program rule, 31 CFR 1020.210 | A profile monitoring can measure activity against |
| 5. Screening | KYC analyst; sanctions team for true matches | Sanctions law and bank policy | Every entity, owner and signer screened; matches cleared or escalated |
| 6. Risk rating | KYC analyst on the bank’s model | 31 CFR 1020.210 (risk profile); bank model | A rating with its factors and the review cycle it sets |
| 7. Review | QC; second line for high risk | Bank policy and examiners’ expectations | File approved or returned with a reason |
| 8. Booking | Operations | Bank policy | Accounts and products opened in the core |
The table hides the hard part. Steps 2 to 6 draw on different sources, registries, the client's certification, audited statements, screening lists and the rating model, and on a manual desk they are worked by one analyst in whatever order documents arrive. Nothing forces them to be read against each other until review, which is why review is where so many files bounce.
The corporate KYC end-to-end process, step by step and owner by owner
End to end, the process is a chain in which each owner hands the file to the next. GAO's description of the common workflow at 11 banks is the plain version: front-line staff collect the information at opening; a second person, often the BSA/AML officer, checks it is complete and looks for warning signs; and staff "then analyze the information collected to assign a risk rating to the account, which determines the extent of ongoing monitoring required" (GAO-20-574).
One corporate file in Corporate KYC: agents assemble and check, people decide
A person decides
Relationship managerTakes the application and the products requested, and introduces the client’s treasurer or controller.
Never: Never approves the file
Agent
Registry agentPulls company records for the client and every entity in its structure, in each state and country.
Never: Never infers ownership a registry does not disclose
Agent
Ownership agentBuilds the structure from the stock register, the certification and look-through letters, and verifies who must be identified.
Never: Never decides an exclusion alone
Agent
Outreach agentMerges everything missing into one secure request to the client and sends reminders.
Never: Never sends without the analyst’s approval
Agent
Writer, Screening and Risk rating agentsDraft each chapter with a source on every sentence, screen every party and rate the relationship on the bank’s model.
Never: Never sign, clear a match or override the model
Agent
Checker agentRe-reads every chapter against the bank’s CDD standard and the other chapters, and disputes what does not hold.
Never: Never edits a chapter
A person decides
KYC analystSettles each dispute, confirms or escalates screening matches, and signs the chapters as maker.
Never: Cannot approve her own file
A person decides
QC reviewer and, for high risk, the second lineApproves the file or returns it with a reason; files at the bank’s high-risk line also go to Financial Crimes Compliance.
In the solution the chain changes shape. Agents work steps 2 to 6 at once and keep the chapters consistent with each other, so the analyst receives a file that is already assembled and already checked, and spends her time on the disputes the Checker agent raises. People still own every decision: the analyst signs, QC approves, and the relationship manager sees progress but never ratings or screening results.
What must happen before the account opens, and what can follow
Identification must happen before the account opens; verification may follow within a reasonable time. That split, set by the CIP rule, decides what the process can safely run in parallel with booking. The bank must collect at least the customer's name, address, identification number and, for a person, date of birth before the account opens, and may complete verification within a reasonable time afterwards (31 CFR 1020.220). The beneficial ownership rule follows the same pattern: owners are identified at the time the account is opened, and FFIEC examiners check that the bank verified them in a reasonable time once the account was open (FFIEC, beneficial ownership examination procedures).
Before the account opens, and what can follow it
- Before opening: the entity’s name, address and identification number
The CIP rule lists four items; for a company date of birth falls away, leaving name, a physical address and the TIN.
- Before opening: the beneficial ownership certification
Identification happens at the time a new account is opened, at the client’s first account under the 2026 relief.
- Before opening: the customer notice
The CIP rule requires adequate notice that the bank is requesting information to verify identity.
- Within a reasonable time: verification of the entity and each owner
Documentary, non-documentary or both, as the bank’s CIP and risk-based procedures set.
- Within a reasonable time: government list checks
The CIP rule allows comparison with federal lists after opening unless another law requires it earlier; sanctions law usually means banks screen first.
- Written in advance: what happens if verification fails
When not to open, how the account may be used meanwhile, when to close it and when to file a SAR.
International standards say the same. FATF's Recommendation 10 asks institutions to verify "before or during the course of establishing a business relationship," allows completion "as soon as reasonably practicable" where risks are managed, and tells them not to open or to terminate the relationship when due diligence cannot be completed (FATF Recommendations). For a commercial client with ACH origination and wires, booking before the file is finished leaves the bank exposed on exactly the products it was asked for, which is why Corvane opens nothing until QC approves.
Who approves corporate onboarding?
No US regulation names who approves a corporate onboarding; the bank's own program does, and examiners judge whether it works. The FFIEC manual tells examiners to focus "on whether the bank has effective processes to develop customer risk profiles," and says that a bank with an effective process that it followed should not be faulted for one customer decision unless the decision undermines the whole CDD program or there is evidence of bad faith (FFIEC BSA/AML Manual, CDD overview; reviewer agreement on EDD reports tests how consistent those decisions are).
A common design is maker and checker: the analyst prepares and signs, a QC reviewer approves, and files above a risk line go to the second line or the BSA officer. Two standards outside US rules do name a senior approval in specific cases: FATF's Recommendation 12 asks for senior management approval of relationships with foreign politically exposed persons, and the EU's AML Regulation will require it for such relationships from July 2027. On the sample file the analyst cannot approve her own file, QC approves, files at 65 or above on the bank's model also need Financial Crimes Compliance, and the relationship manager can see the sign-off sheet but can never approve.
QC approves as checker, after every chapter is signed
How long does corporate onboarding take?
Corporate onboarding takes over an hour of staff work for a simple business account and days or weeks of elapsed time for a group of entities, and the two numbers measure different things. GAO's estimate, over an hour per commercial account against about 30 minutes for a consumer account, counts the staff time to "collect and review customer information" (GAO-20-574). Elapsed time is mostly waiting: for the client's documents, for a registry, for a reviewer to reach the file.
No regulator or research body publishes a reliable measure of elapsed corporate onboarding time in US banks; the figures that circulate come from industry surveys, which we do not use. A bank can measure its own: the days each file spends with each owner. Corvane sets service levels by queue, 30 days for corporate banking, 20 for commercial and 10 for business banking, and escalates a file to the team lead at 75% of its service level and to the head of client onboarding at 100%.
Where the corporate KYC process stalls: the waits between owners
A corporate file stalls in the handoffs. On a manual desk the commonest stall is the second request: the client answers the first email partly, the analyst finds a gap a week later, and the client is asked again. The next is QC, which finds what nobody read together and returns the file. The sample file shows what the process looks like when those two loops are removed.
Six days on the sample corporate KYC file, by who was holding it
- Agents assemble and screenFri
- WeekendSat–Sun
- Analyst signs 1–2, approves one requestMon
- With the clientMon–Wed 10:42
- Wed 10:42: agents redraft, check, screen
- Analyst reads, signs at 3:51
- QC approves at 4:12
Read the colours. The longest stretch the bank controlled was the first day, when agents pulled registry extracts for five entities, built the ownership structure and screened ten parties. The longest stretch it did not control was the client's two days, and the client was asked once, for two items, with a reminder the next morning. When the reply arrived at 10:42 on day 6, the expected-activity chapter was redrafted, the Checker agent found a subsidiary missing from the screening register, and the file was re-rated before lunch.
One reply from the client, and every chapter it touches updated
When the client already banks with you: the second account
For an existing client the process is shorter by rule. The CIP rule does not treat a person who already holds an account as a new customer, as long as the bank already reasonably believes it knows who that person is (31 CFR 1020.100). And since February 13, 2026, FinCEN's order FIN-2026-R001 lets a bank stop identifying and verifying a company's owners afresh every time the company opens another account; it may limit that work to the first account, to moments when it learns facts that call the earlier information into question, and to what its risk-based ongoing due diligence requires (FIN-2026-R001).
The relief is optional, and it moves effort rather than removing it. A bank that relies on it needs to know, at the second account, whether anything has changed: a new owner, a new subsidiary, activity the profile does not explain. That is an argument for one file per client rather than one per account, kept current between openings.
The commercial banking onboarding process compared with retail
The commercial banking onboarding process differs from retail in three ways: more parties, more products with their own risks, and a review step that retail rarely needs. GAO measured the time difference at roughly double for a single business account, and a holding company with subsidiaries multiplies the parties again. Products matter too: ACH origination, international wires and remote deposit capture each change the risk profile, and on the sample file the rating moved from Low, 28 to Moderate, 46 when the client's reply added wires to Mexico and the new foreign subsidiary.
The review step is where regulators have looked hardest. In its 2024 order against TD Bank, the OCC required a customer due diligence program with "a quality control process" among its elements, and with collection "when opening new accounts, when renewing or modifying existing accounts for customers, and when the Bank obtains event-driven information" (OCC, Consent Order AA-ENF-2024-77). What that quality check should test on each corporate file is set out separately.
The corporate KYC process in Corporate KYC, from reply to booking
On the sample file the last afternoon was quiet. The analyst read chapters 3 to 6 and their sources and signed them at 3:51 p.m. with one attestation; at 3:52 she sent the file to QC; at 4:12 the QC reviewer approved it, and the products opened in the core banking system a minute later. The file reached approval on day 6 of a 20-day service level. That is the sample file's result, not a measured result for a customer, and a bank's own files will tell it what to expect.
Approved on day 6, products opened a minute later
To follow the same file from the analyst's chair, see what a KYC analyst does, hour by hour, or start from Corporate KYC.
Questions people ask
What are the KYC onboarding steps for a business?
Collect the application, identify and verify the business, identify and verify each 25% owner and one control person, understand the nature and purpose of the relationship, screen every party, assign a risk rating, review and approve. The CIP rule requires the business's name, address and taxpayer identification number before the account opens.
Can a business account open before KYC verification is finished?
The CIP rule lets verification finish within a reasonable time after opening, provided the identifying information was collected first and the bank has written procedures for using, restricting or closing the account if verification fails. Most banks finish a commercial file before opening because of the products involved.
What happens if a company's identity cannot be verified?
The bank follows the procedures its CIP must already contain: when not to open the account, the terms on which the customer may use it while verification continues, when to close it after attempts fail, and when to file a suspicious activity report. FATF's standard is the same: do not open, or terminate, and consider a report.
Who signs off the risk rating on a corporate file?
The bank decides. A common design is that the analyst proposes and signs the rating, QC approves the file, and ratings above a set line go to the BSA officer or a second-line team. An override of the model's rating usually needs a documented reason and a second approval.
Is the process different for a periodic review of a corporate client?
The steps are similar, but the starting point is the existing file. FinCEN says there is no categorical requirement to update customer information on a fixed schedule; banks set review cycles on risk, and Corvane's policy is every 36, 24 or 12 months for low, moderate and high risk.