KYB vs KYC: what changes when the customer is a company

KYB vs KYC is a difference of customer, not of principle. KYC, know your customer, is how a bank establishes who an individual customer is; KYB, know your business, is the same discipline applied when the customer is a company, and it adds a step KYC never needs: looking through the entity to the people who own and control it. In the US the word KYB appears in no regulation. What a bank must do for a business customer comes from the Customer Identification Program rule, the beneficial ownership rule and the AML program rule's customer due diligence pillar. Botminds' Corporate KYC builds one file per corporate client around exactly those requirements, and it is the worked example on this page.

Where the page uses an example it comes from a fictional bank and client, Corvane National Bank and Brightwater Cold Chain Holdings, as the file runs through the solution. Rules are quoted from the eCFR and from FinCEN's own documents, as they stand in October 2026.

KYB vs KYC: the difference in one paragraph

The difference between KYB and KYC is the look-through. For an individual, identifying and verifying the customer is most of the work. For a company it is the first step: once the entity is identified, the bank must still find the natural persons who own 25% or more of it and the one person who controls it, verify them, and understand what the business will do with the account. Everything that makes KYB slower, from ownership charts to trust deeds to foreign registries, follows from that one extra step.

The terms also travel differently. In fintech and payments, KYB often means only the entity check, a registry lookup and a good-standing certificate. In a US bank the regulators never use either acronym; they speak of CIP, customer due diligence and beneficial ownership, and an examiner will test the bank's file against those, whatever the onboarding screen calls it.

Is KYB required by law in the US? Yes, though no rule calls it that

KYB is required by law in the US for banks, credit unions, broker-dealers, mutual funds and futures firms, through three regulations. The CIP rule treats a company opening an account as a customer like any other: the bank must have at least its name, address and identification number before the account opens, and for anyone other than an individual the address must be a real place of business, such as its main or a local office (31 CFR 1020.220).

The beneficial ownership rule adds the look-through. A covered institution must identify the owners of every legal entity customer when a new account opens, usually by a certification from the person opening the account, and verify each owner's identity under risk-based procedures, as far as is reasonable and practicable (31 CFR 1010.230). The AML program rule then requires the bank to understand the nature and purpose of each relationship well enough to build a customer risk profile, and to keep customer information current on a risk basis (31 CFR 1020.210).

What the law does not require is just as useful to know. FinCEN's consolidated FAQs say the CDD rule does not categorically require any particular extra information, media searches or screening beyond what the risk profile, monitoring and ownership collection need (FinCEN CDD FAQs, F.4). Expected-activity questionnaires, adverse media and PEP screening on every business are bank choices, often good ones, but choices.

What is a legal entity customer under the CDD rule?

A legal entity customer is any corporation, LLC or other entity formed through a public filing at a Secretary of State's office or its equivalent, plus general partnerships and their foreign equivalents, that opens an account (31 CFR 1010.230(e); LLC bank account requirements quotes the definition and walks through the cases). A sole proprietorship is not one: the owner is the customer and gets ordinary CIP. A trust that is not created by such a filing falls outside the definition, though the bank must still understand it.

The rule then removes 16 kinds of entity from the definition, mostly ones whose owners are already known to a regulator, and limits two more to the control prong only. The exclusions are where the most avoidable errors happen in both directions: collecting certifications from a listed company that never needed one, or treating a privately held subsidiary of a regulated group as excluded when it is not.

Which rule covers which party in a business relationship

A business relationship involves more parties than an individual one, and each is covered by a different rule. Mapping them is the fastest way to see why a corporate file has chapters rather than a form.

Two rows surprise people. Signers are not beneficial owners and are not required by the CIP rule unless the bank cannot verify the company another way; the rule asks the bank's program to address situations where it "will obtain information about individuals with authority or control over such account, including signatories, in order to verify the customer's identity." Many banks identify and screen signers anyway, as policy. And subsidiaries are not covered by the parent's file automatically: each one that opens an account is a customer in its own right, which is why managing KYC across a group of entities is its own discipline.

The sample file shows how the parties add up. Brightwater is a Delaware holding company with four wholly owned subsidiaries. Its owners are Graham Ashby with 38%, a private-equity fund with 34% through which no individual reaches 25%, a family trust with 9% and 41 management shareholders with 19% between them, none above 3.6%. One individual must be identified: Ashby, who is both the 25% owner and the control person.

Who owns and controls the sample client, with the one person to identify

CDD vs KYC: where customer due diligence fits

KYC is the umbrella; customer due diligence is the part of it the US rule defines. In everyday use KYC covers everything a bank does to know its customer. In the regulation, CDD is the fifth pillar of the AML program: understand the nature and purpose of the relationship, build a risk profile, monitor, and update customer information on a risk basis, with beneficial ownership included in "customer information." CIP sits beside it as a separate rule about identity.

Enhanced due diligence, EDD, is more of the same for higher-risk customers, and in two places it is mandatory by rule: correspondent accounts for certain foreign banks and private banking accounts for non-US persons. Everywhere else, how much more a bank collects on a higher-risk business is its own risk-based decision, which examiners judge as a process rather than case by case.

What KYB verification means in practice

KYB verification means proving that the company exists as described and that the people named as its owners and controller are real and are who the certification says. The entity side relies on documents and registries. GAO found banks checking state records, such as certificates of good standing, as part of the hour a business account takes. The owner side relies on the same methods as CIP for individuals, with one relaxation: for beneficial owners the bank may accept photocopies of identity documents, which CIP does not allow.

The reason the bank cannot simply trust the formation paperwork is that the formation market does not check much. In a field experiment, researchers posing as clients approached 1,264 incorporation firms in 182 countries; a University of Texas summary of the work reports that almost half failed to ask for proper identification, and that in the United States an anonymous shell could be had in under three hours (Findley, Nielson and Sharman, International Organization, 2013; University of Texas summary). Treasury's 2024 risk assessment adds that criminals use willing money mules to set up shell companies and open business accounts in their names (Treasury, 2024 National Money Laundering Risk Assessment).

The beneficial ownership step also has an official price. When FinCEN finalised the rule it estimated 8 million new legal-entity accounts a year, each needing 20 to 40 extra minutes at opening, and banks told it every owner added 10 to 15 minutes (FinCEN, 81 FR 29398).

What changed for KYB in 2025 and 2026

Two changes reshaped US KYB in 2025 and 2026, and they pull in opposite directions. First, US companies no longer report their owners to FinCEN. An interim final rule of March 26, 2025 exempted domestic reporting companies under the Corporate Transparency Act, and a final rule of August 14, 2026 made the exemption permanent (91 FR 52508). Even before that, a bank could see a company's registry entry only if the company agreed (31 U.S.C. 5336).

FinCEN was explicit that the bank's own duty did not change with it. In the same final rule it wrote that the reporting rule and the CDD rule have different purposes and rest on different legal authority, and that it still has to revise the CDD rule to fit the new reporting rule; the OCC told its banks to keep complying with the 2016 CDD rule (OCC Semiannual Risk Perspective, Spring 2025; beneficial ownership information at banks traces what that leaves the bank holding). Our reading: for a US company, the certification and verification in the bank's own file is now the only beneficial ownership information anyone holds.

Second, the bank no longer has to repeat the look-through at every account. FinCEN's exceptive relief order FIN-2026-R001 of February 13, 2026 lets a bank limit beneficial ownership identification and verification to three moments: when the company first opens an account, whenever the bank learns facts that give it reasonable cause to doubt what it holds, and as its risk-based ongoing due diligence requires (FIN-2026-R001). The relief is optional. When a bank does re-identify under its ongoing due diligence, it may rely on the earlier information if the customer confirms it, verbally or in writing, and it must keep a record of that confirmation. The CDD rule itself has not yet been rewritten.

KYB outside the US: FATF and the EU's 2027 multiplication rule

Outside the US the same look-through is set by international standards, sometimes more precisely. FATF Recommendation 10 asks institutions, for legal persons, to understand "the ownership and control structure of the customer," and Recommendation 24 asks countries to keep adequate, accurate and up-to-date ownership information, through a register or an alternative mechanism (FATF Recommendations, February 2025).

The European Union goes further from July 10, 2027, when its AML Regulation applies. It keeps the 25% threshold but says how to count an indirect stake: multiply the percentages held at each layer of the chain (Regulation (EU) 2024/1624, Art. 52). The US rule says "directly or indirectly" and gives no formula, so a US bank with EU affiliates may need to show both readings on the same structure chart. These are context for US banks, not US obligations.

Where Corporate KYC does the KYB work, and where people decide

In Corporate KYC, the KYB steps are split between agents and the analyst. A Registry agent pulls company records for the client and every entity in its structure, across US states and abroad, and keeps extracts under 90 days old. An Ownership agent builds the structure from the stock register, the certification and look-through letters, finds who must be identified and verifies them; it never decides an exclusion alone. A Screening agent screens every entity, owner and signer and proposes clearances, which only a person can confirm.

The look-through is also checked against the rest of the file. On the sample file, the client's reply revealed $6.5 million a month of wires to its new Mexican subsidiary, and the Checker agent disputed the screening chapter because that subsidiary had never been screened. The documents that prove each of these fields are mapped one by one elsewhere.

A subsidiary that will receive wires was never screened

To see the full file the look-through feeds, from registries to QC approval, start from Corporate KYC.

Questions people ask

What is KYB verification?

KYB verification is checking that a business exists as described and that its owners and controller are who the business says. In a US bank it means verifying the entity under the CIP rule, by documents such as certified articles or by non-documentary checks, and verifying each beneficial owner under 31 CFR 1010.230 with the same methods used for individual customers, photocopies allowed.

What does KYB mean in banking?

In banking, KYB means know your business: the due diligence a bank performs when the customer is a company rather than a person. US regulations do not use the term; they require CIP on the entity, beneficial ownership identification for legal entity customers and an understanding of the nature and purpose of the relationship.

Does a sole proprietorship need KYB?

No. A sole proprietorship is not a legal entity customer, because it is not created by a filing with a Secretary of State. The owner is the customer and goes through ordinary CIP; the bank still needs to understand what the business will do with the account.

Who counts as the control person for KYB?

One individual with significant responsibility for running the company, such as a CEO, CFO, COO, managing member, general partner, president, vice president or treasurer. FinCEN expects a high-level official responsible for how the organisation is run; the same person may also be a 25% owner.

Do banks still collect beneficial ownership now that US companies do not report to FinCEN?

Yes. The reporting exemption, final since August 14, 2026, does not touch the CDD rule, and FinCEN says it still has to revise that rule. Until it does, banks collect and verify owners at a company's first account, and since February 2026 may rely on a recorded confirmation at later ones.