A reliable KYB verification process helps a company understand who it is onboarding, who controls it, and what risks require review before approval. This practical checklist covers business registration, beneficial ownership, sanctions screening, document quality, exceptions, and ongoing refreshes so compliance and onboarding teams can apply a consistent workflow.
Overview
Know Your Business (KYB) verification is the process of establishing that a business exists, operates as represented, and can be linked to identifiable directors, owners, and authorized representatives. It supports AML compliance onboarding, risk assessment, account approval, and later reviews when a customer’s circumstances change.
KYB is not simply a request for a certificate of incorporation. A complete business verification process connects several questions:
- Does the legal entity exist in the stated jurisdiction?
- Is the registration active, current, and consistent with the application?
- Who is authorized to act for the business?
- Who owns or controls it, including through layered structures?
- Do the business, its directors, owners, or representatives present sanctions, fraud, or other risk signals?
- What evidence supports the decision, and when must it be refreshed?
The exact requirements vary by jurisdiction, industry, risk level, and the services being provided. Treat this checklist as an operational framework rather than a substitute for applicable law, regulatory guidance, or internal compliance policy. Before launching in a new market, confirm local definitions of beneficial ownership, permitted registry sources, screening expectations, record-retention rules, and document-validity requirements.
A risk-based workflow is usually more useful than a single pass-or-fail rule. Lower-risk businesses may need standard evidence and automated checks, while complex ownership, high-risk jurisdictions, inconsistent records, or unusual activity may require enhanced review and documented escalation. For broader context on verification controls, see the KYC vendor comparison template and risk-based verification matrix.
Checklist by scenario
1. Standard domestic business
- Collect the legal name and registration number. Record the entity’s registered name, trading names, legal form, incorporation date, registered address, operating address, and stated business activity.
- Verify the registry record. Compare the application with an authoritative company registry or another approved source. Check that the entity exists, is active where relevant, and has not been dissolved, struck off, or otherwise restricted.
- Confirm directors and authorized representatives. Identify directors, officers, and the person submitting the application. Verify that the representative has authority to open the account or enter the relationship.
- Map ownership and control. Obtain the ownership structure and identify each person who meets the applicable beneficial ownership threshold or exercises control through another arrangement. Do not stop at the first corporate shareholder.
- Screen relevant parties. Apply the organization’s approved screening process to the business, beneficial owners, directors, and other required parties. Route potential matches for review rather than treating an automated alert as a confirmed match.
- Record the decision. Store the evidence reviewed, checks completed, reviewer or system outcome, unresolved issues, approval conditions, and next review date.
2. Complex or layered ownership
Request an ownership chart that follows each ownership chain to the natural persons who ultimately own or control the business. For every intermediate entity, capture its legal name, jurisdiction, registration details, and relationship to the applicant. Reconcile the chart with registry records, shareholder information, governing documents, or other approved evidence.
Escalate when ownership percentages do not reconcile, control rights are unclear, nominee arrangements are disclosed, documents conflict, or no natural person can be identified under the applicable standard. Document the basis for the conclusion instead of recording only a final name.
3. Foreign, newly formed, or registry-limited business
Confirm which sources are acceptable for the jurisdiction and whether the registry provides current information. A newly formed company may have limited operating history, so distinguish missing history from contradictory information. Consider requesting formation documents, proof of business address, licenses, ownership records, or evidence of expected activity when permitted by policy.
Where a registry is unavailable, difficult to access, or not sufficiently informative, define an approved fallback process. Record the source, access date, translation approach if applicable, reviewer judgment, and any additional controls applied. Avoid treating an unofficial website or an undated document as equivalent to a verified registry record without a documented rationale.
4. Higher-risk or exception case
Pause automatic approval when there is a potential sanctions match, adverse information requiring investigation, unexplained geography, inconsistent ownership, unusual urgency, suspected document alteration, or a material mismatch between stated activity and available evidence. Assign the case to an appropriately authorized reviewer, define the missing information, and set a clear outcome: approve, approve with controls, request more information, decline, or escalate further.
What to double-check
| Control area | Double-check before approval |
|---|---|
| Entity identity | Legal name, registration number, legal form, status, jurisdiction, and addresses match across the application and evidence. |
| Document freshness | Documents are within the organization’s permitted age limits, legible, complete, and appropriate for the jurisdiction and use case. |
| Beneficial ownership | Ownership percentages and control rights reconcile, intermediate entities are traced, and the applicable threshold or control test is documented. |
| Authority | The applicant is connected to the business and has authority to act, sign, or open the requested account. |
| Screening | Search inputs use consistent identifiers such as date of birth, nationality, registration data, or address where available; possible matches receive human review. |
| Business purpose | The requested product, expected activity, locations, and transaction profile are plausible for the stated business. |
| Audit trail | The file shows what was checked, when it was checked, by whom or by which system, and why the final decision was made. |
Privacy should be part of the control design. Collect only information necessary for the stated verification purpose, restrict access by role, protect sensitive documents in storage and transit, and define retention and deletion rules. If verification is automated, preserve decision-relevant evidence without retaining unnecessary raw data. A documented audit trail should support review while limiting exposure of personal and commercial information. See the KYC audit trail guide for a related records and access-control workflow.
Common mistakes
- Checking only the business name. Similar names can produce mistaken matches, while a genuine risk may sit with an owner, director, or related entity.
- Stopping at the first corporate shareholder. A business verification process should follow ownership and control through each layer to the applicable endpoint.
- Accepting documents without checking consistency. Compare names, dates, addresses, registration numbers, ownership details, and issuing sources across the full file.
- Using one rule for every customer. A standardized baseline is useful, but risk signals should determine when enhanced review, additional evidence, or senior approval is needed.
- Confusing a screening alert with a confirmed match. Similar names require identifiers and documented analysis; unresolved alerts should not be silently cleared.
- Failing to record exceptions. If a registry is unavailable or an alternative document is accepted, record the reason, approver, compensating control, and follow-up date.
- Treating approval as the end of KYB. Ownership, directors, business activity, and risk signals can change after onboarding.
When to revisit
Review this KYB onboarding workflow before entering a new jurisdiction, changing products, replacing verification tools, or beginning a seasonal planning cycle. Revisit it whenever a regulator or competent authority changes applicable ownership definitions, sanctions-screening expectations, registry access, document standards, or recordkeeping requirements. Because these inputs are jurisdiction-specific, assign an owner to confirm changes rather than relying on an old checklist.
At the customer level, trigger a refresh when the business reports a change in ownership, directors, legal name, address, activity, or controlling representative. Other triggers may include a material risk signal, unusual activity, a failed screening review, expiring evidence, a significant change in the customer’s relationship, or an internal review finding. Set review intervals according to documented risk criteria and applicable requirements; do not assume one universal schedule fits every business.
For practical implementation, turn the checklist into a case workflow with required fields and explicit statuses: information requested, automated checks complete, manual review required, escalated, approved, declined, or refresh due. Link every decision to its evidence and reviewer. If the workflow uses an identity verification API or automated events, test error handling, access controls, and webhook integrity as part of the control review. The identity verification API integration playbook and webhook security guide provide related implementation checklists.
Action to take now: assign an owner, confirm the applicable jurisdictional rules, map your current evidence sources to this checklist, and test one straightforward case, one complex ownership case, and one exception case. Record where the process depends on manual judgment, then update the workflow, escalation path, and next-review dates before using it for the next onboarding cycle.
