KYB
The same obligation as KYC, applied to a company. What verifying a legal entity adds, why the beneficial owner is the hard part, and how it ends up looking like verifying people again.
In short
KYB stands for know your business, knowing your business customer. It is the customer-knowledge obligation applied to a legal entity instead of a natural person, and it comes from the same anti-money-laundering regime. What changes is not the duty, it is the subject: a company has no face and no identity document, and establishing who it is requires verifying three things that do not exist for a natural person.
What KYB adds on top of KYC
A KYC establishes who a person is. A KYB has to establish that an entity exists, how it is structured, and who makes decisions inside it.
- Legal existence — that the company is incorporated, active, and not dissolved, according to the registry of the country where it was formed. This includes legal name, tax ID, registered address, and corporate status.
- Ownership structure — who its partners or shareholders are, in what proportion, and what other companies appear in that structure.
- Beneficial owner — which natural person ultimately controls the company, whether through ownership, through participation, or through other means.
- Representation — who can bind the company, with what powers, and until when. This is the check that decides whether an incoming signature is valid.
- Actual activity — what the company actually does, which does not always match its declared corporate purpose.
The first two are resolved by checking registries. The next three are not.
The beneficial owner is the hard part
The goal of KYB is not the company. It is reaching the people behind it.
The difficulty is structural. A company can be held by other companies, and those by others still, across several countries. Each layer is legitimate on its own, and the combination is exactly the mechanism an anti-money-laundering regime is trying to see through. Verifying only the first level of the chain and stopping there produces a complete file that does not answer the question.
On top of that, the threshold changes. The ownership percentage that makes someone a beneficial owner is set by each jurisdiction, and the same structure can have different beneficial owners depending on the country looking at it. Control is not only about shares, either: whoever appoints the board or actually runs the operation falls under the definition even if they do not appear in the ownership structure.
And there is a source problem. Much of the corporate information depends on what the company itself declared in a registry, and registries get updated only when someone updates them. A KYB that relies on a single document submitted by the customer is verifying their declaration, not their structure.
A KYB ends up being verification of people
The practical conclusion surprises anyone seeing it for the first time: the final part of a KYB is a KYC.
Every legal representative who signs and every beneficial owner identified is a natural person who has to be verified with the same checks as always: a genuine document, a biometric match, and a real presence at the moment of capture. Without that, the process only proves that the company exists and that someone claimed to be named like its representative.
That is where the most common gap shows up. It is common to see company-onboarding processes with rigorous corporate review and person verification resolved with a photo of a document sent by email. The chain of trust breaks at its cheapest link to attack.
Where a KYB is required
The obligation comes from the same place as KYC: anti-money-laundering and counter-terrorism-financing regimes, which reach financial institutions and a broad set of activities outside the financial system.
In Colombia the duty lives within SARLAFT for entities supervised by the Superintendencia Financiera and within SAGRILAFT for the real sector. In Mexico it is imposed by the anti-money-laundering law on financial institutions and on the catalog of vulnerable activities.
Several countries in the region also added the obligation to identify and report the beneficial owner to the tax authority or the corporate registry. Which registry receives it, above what threshold, and on what timeline varies by country, and it is worth confirming against the current regulation before designing the process.
Which part of KYB VU solves
It is worth stating precisely, because the term gets used to sell different things: VU does not query commercial registries or build corporate ownership chains.
What VU solves is the people layer, which is what a KYB relies on to be valid: verifying the identity of legal representatives and identified beneficial owners, with the same identity verification applied to an individual onboarding, run by the Verify capability. Document read and validated, face compared against that document, presence confirmed at the moment of capture.
The liveness detection applied in that flow is certified by iBeta at Level 2 of its testing program, which applies the ISO/IEC 30107-3 standard's methodology to evaluate presentation attack detection.
Frequently asked questions
KYB stands for know your business. It is the process by which an organization verifies a company before onboarding it, under the same regulatory obligation that governs individual KYC. It confirms that the company legally exists and is active, how its ownership is structured, who ultimately controls it, and who is authorized to represent it.
KYC verifies a natural person and KYB verifies a legal entity, and that difference in subject adds three checks that do not exist in KYC: the entity's legal existence, its ownership structure, and the identification of its beneficial owner. The underlying obligation is the same and comes from the same anti-money-laundering regime. In practice, a complete KYB includes several KYCs inside it: one for each representative and each beneficial owner identified.
It is the natural person who ultimately controls a company, whether because they hold a significant stake, because they exercise control through other means, or because they actually run the operation. The ownership threshold that triggers the definition is set by each jurisdiction, so the same corporate structure can yield different beneficial owners depending on the country analyzing it. Identifying that person is the real goal of KYB: everything else in the process exists to reach them.
Not reliably. The documents a customer submits are a declaration, and verifying a declaration is not the same as verifying a structure. A serious KYB checks against the relevant corporate registry and, above all, verifies the identity of the people named in those documents with the same biometric and document checks that would apply to an individual onboarding.
