KYB compliance software for SBA eligibility: an eight-week plan

KYB compliance software is the category of tools banks use to "know your business": verify a business customer's legal existence, identify and verify its beneficial owners under FinCEN's customer due diligence rule, and screen the business and those owners against sanctions lists. For an SBA 7(a) or 504 loan that covers only part of the eligibility work, because FinCEN's beneficial-owner line is 25% while SBA requires 100% of direct and indirect owners, each tested for citizenship, residency, federal debt, prior losses and exclusions, plus size with affiliates and the ineligible business types. Botminds' SBA Eligibility Screening is built for the SBA case: its agents read the application package, trace every owner to 100%, run every SBA test with a citation, and leave the decision and signature with the lender's officer. This guide is for the team choosing software for that job and planning its first eight weeks.

Plan durations below are our recommendation, not a measured result, and the worked examples use a fictional sample bank in the solution.

What is KYB compliance software?

KYB compliance software automates the bank's know-your-business duties: the customer identification program for the entity, the beneficial-ownership identification and verification required by 31 CFR 1010.230, and sanctions screening. Its definition of an owner is FinCEN's: "each individual, if any, who directly or indirectly ... owns 25 percent or more of the equity interests of a legal entity customer," plus "a single individual with significant responsibility to control, manage, or direct" it (31 CFR 1010.230).

The rule has been loosening, not tightening. In February 2026 FinCEN let banks limit beneficial-owner identification to "when a legal entity customer first opens an account," later only when they have "knowledge of facts that would reasonably call into question the reliability" of what they hold, or as their risk-based procedures require (FinCEN order FIN-2026-R001). And FinCEN's August 2026 rule continues "to exempt reporting companies from having to report the BOI of U.S. person beneficial owners" (91 FR 52508), so there is no federal register of domestic owners to check against. KYB tools that lean on registries and on the bank's existing customer file are drawing from sources that now say less about U.S. owners than they did.

Can KYB software do SBA eligibility?

It can do two of the SBA tests and part of a third: the customer identification program, which SBA requires every lender to follow under 31 CFR 1020.220; the OFAC check, which SBA requires "at the time of application"; and an ownership picture down to the 25% line. Everything else on the SBA eligibility checklist is outside the category's design.

Why is 25% not enough for SBA?

Because SBA's citizenship rule applies to every owner, not to every large owner. Since March 1, 2026, "SBA financing is limited to business Applicants with 100% direct and/or indirect owners and SBA-required guarantors, all of whom must be U.S. Citizens or U.S. Nationals who have their Principal Residence in the United States" (SBA Procedural Notice 5000-876626). A 3% indirect owner who lives abroad makes the business ineligible, and a KYB file that stops at 25% will never see that owner.

The sample file shows how far below the line SBA's owners sit. Copperline Mechanical's application listed three owners at 90%. The documents named nine: a 10% partnership admitted by an amendment, its three members at 4%, 3% and 3% indirect, and two holders of a holding company at 21% and 14%. A 25% screen would have identified one person, the 40% owner. The ownership arithmetic walks through the multiplication.

What to look for in software for SBA eligibility

The test of any tool is whether its output would satisfy a purchase reviewer reading the file three years from now. SBA's own experience is the cautionary case: its 2023–25 screen used real-time data validation, yet did not test size, for-profit status or 14 of 19 business types because "the agency did not have all the data available electronically" (SBA OIG Report 26-07). Software that reads only structured data will repeat that gap. The checklist below is what we would ask of any product, ours included.

Where SBA Eligibility Screening does not fit is worth saying as plainly. It is not a deposit-account onboarding tool and does not replace the bank's CIP and CDD program for accounts; it does not file anything into the SBA Loan System, which stays the processor's job; and it does not decide eligibility. A bank looking for one tool to onboard every business customer should buy a KYB product for that and judge whether its SBA desk needs more. The gap between OFAC screening and an SBA eligibility check is the same argument from the sanctions side.

Questions to put to any vendor, and what a good answer sounds like

How long does it take to implement eligibility screening?

Eight weeks is a realistic plan for a desk that already makes SBA loans, and most of it is the lender's own decisions and evidence, not installation. What the plan needs from the lender is its SBA credit policy and eligibility checklist, access for its officers to the government lists, and a sample of past application packages its officers have already decided.

Weeks 1–2: rules and settings. Start from SOP 50 10 8.1, Section A, Chapter 1, and the notices in force, then make the lender's own choices explicit: who completes Form 1919, who CAIVRS screens beyond the SOP minimum, the order of the size tests, who takes the second look. Each becomes a versioned setting. The SOP's fixed requirements, such as citizenship for 100% of owners, are not choices.

Week 3: list access. CAIVRS through HUD's portal, SAM.gov exclusions, and OFAC's sanctions lists. Decide where each result is saved in the file and in what form; SAM.gov evidence must be kept "for example, a screen shot of the search results."

Weeks 4–5: replay on closed files. Run 20 to 30 closed packages through the solution and compare each test with the decision on file. Choose files with entity owners and related businesses, because that is where both people and software go wrong.

Weeks 6–7: parallel run. New applications go through both the officer's usual process and the solution; the officer signs from the usual file and reviews where the two differ.

Week 8: go live. The officer signs from the solution's checklist, with the replay and parallel-run results kept as the evidence that the lender tested its tool before relying on it.

Week 1's output: the lender's eligibility choices as settings

How do you parallel-run an eligibility tool?

A parallel run compares the tool's findings with the officer's on the same live files, test by test, and investigates every difference before anyone relies on the tool. The unit of comparison is the test, not the file: a file where the tool and the officer agree on eligibility but disagree on who the owners are has a disagreement that matters.

Set the targets before the run. We suggest three: every owner the officer found is also on the tool's tree; every difference has a written cause; and no test the tool marked passed is one the officer would fail on the same evidence. The solution's own design targets, a signed checklist within one day of a complete package and a cited source for every line, can be measured in the same weeks. OIG's September 2026 review of SBA's own AI use is a reminder of why the measuring matters: OMB "presumes any AI model that affects a person's request for critical federal services or benefits, to include loans" is high impact and needs review before deployment (SBA OIG Report 26-15). That rule binds agencies, not banks, but the discipline is the right one for a lender too.

What the replay compares: owners as the documents show them, step by step

What the first eight weeks prove, and what they do not

Eight weeks prove that the tool finds what the lender's officers find on the lender's own files, and where it finds more. They do not prove that eligibility is now automatic, and the solution is not designed to make it so: the officer still decides every judgement call and signs, the compliance officer still takes the second look on cleared hits, and the processor still certifies. What changes is where the officer's day goes. On the sample bank's queue, 36 people and entities were traced against 28 listed on the applications, and the officer's work was the nine items to clear, not the tracing.

For a lender weighing this against a KYB tool it already owns, the honest comparison is test coverage. List the tests on your SBA checklist, mark the ones your KYB tool produces evidence for, and look at what is left. For most lenders it is ownership below 25%, citizenship, CAIVRS, SAM.gov, size and the business types. That remainder is what SBA Eligibility Screening is for.

Questions people ask

What is the FinCEN beneficial ownership threshold?

25%. Under 31 CFR 1010.230 a beneficial owner is each individual who owns 25% or more of a legal entity customer, directly or indirectly, plus one individual with significant control. SBA's thresholds are lower: 20% for several tests and every owner for citizenship.

Can a lender use FinCEN beneficial ownership data for an SBA loan?

Not for domestic owners. FinCEN's August 2026 rule exempts companies from reporting U.S. person beneficial owners, and the bank's own CDD record stops at 25%. SBA's ownership tree has to come from the applicant's entity documents.

Is KYB the same as KYC?

KYC verifies an individual customer; KYB verifies a business and the people who own and control it. An SBA eligibility check needs both for every owner, plus program tests neither covers, such as size with affiliates and CAIVRS.

Does SBA approve or certify eligibility software?

No. SBA has published no approval process or statement on software or AI in lender eligibility review. The lender remains responsible for the determination and for the evidence in its file.

How many closed files does a replay need?

Enough to cover the hard cases: we suggest 20 to 30, weighted to entity owners, related businesses and files with cleared CAIVRS or OFAC hits. A replay of only simple files will show agreement and prove little.