Skip to main content
Commerce Security Authority
Category: AML and KYC

Know Your Business

Also known as: KYB, Know Your Business verification, business verification, business due diligence
Simply put

Know Your Business (KYB) is the process a company uses to confirm that another business it plans to work with is real, legitimate, and safe to deal with. It examines the identity of the business, who owns or controls it, and the risks it may pose before or during a business relationship. KYB is often described as a regulatory or legal obligation intended to help companies avoid working with criminals or high-risk entities.

Formal definition

Know Your Business (KYB) is a set of due diligence and verification procedures organizations perform to verify the identity, ownership, and risk profile of a corporate entity before establishing, and while maintaining, a business relationship. Per the evidence, KYB typically encompasses confirming that a business is legitimately registered and operating, identifying the parties behind it (including beneficial ownership and control structures), and assessing the entity's risk profile. It is characterized in the evidence as a regulatory and legal obligation to verify an entity's identity before conducting business, and as a control intended to help firms avoid onboarding criminal or illegitimate counterparties. The specific procedures, applicable thresholds, and regulatory requirements are not detailed in the evidence provided and would depend on the governing jurisdiction and framework; readers should confirm requirements against the applicable regulations. KYB is distinct from Know Your Customer (KYC), which addresses verification of individual customers.

Why it matters

Know Your Business verification helps organizations avoid establishing relationships with criminal or illegitimate counterparties. Because a business relationship can expose a firm to the risks carried by the entities it onboards, KYB is characterized in the evidence as a regulatory and legal obligation to verify an entity's identity, ownership, and risk profile before, and while, conducting business. In payment ecosystems, acquirers, payment processors, and platforms that onboard merchants rely on this due diligence to understand who they are actually doing business with and who ultimately owns or controls those entities.

Without adequate KYB, a firm may unknowingly onboard shell companies, businesses fronting for illicit activity, or entities whose beneficial owners it cannot identify. The evidence frames KYB as a control intended to help companies avoid getting into business with criminals, which supports broader objectives such as understanding risk and establishing trust across a business relationship. It is important to treat KYB as a risk-reduction measure rather than a guarantee; it is intended to help firms identify and assess risk, not to eliminate the possibility of onboarding a bad actor.

The specific procedures, applicable thresholds, and regulatory requirements are not detailed in the evidence and depend on the governing jurisdiction and framework. Firms should confirm what applies to them against the relevant regulations rather than assuming a fixed set of steps, and should distinguish KYB from Know Your Customer (KYC), which addresses verification of individual customers rather than corporate entities.

Who it's relevant to

Acquirers and payment processors
Firms that onboard and maintain merchant relationships use KYB to verify that a merchant is a real, legitimately registered, and operating business, to identify its beneficial owners and control structure, and to assess its risk profile. This supports a clearer understanding of who they are actually doing business with before and during the relationship.
Platforms and marketplaces onboarding business counterparties
Organizations that establish relationships with other businesses apply KYB as due diligence to confirm the identity and legitimacy of those entities. The evidence frames this as a control intended to help avoid getting into business with criminals or illegitimate counterparties.
Compliance and due diligence teams
Teams responsible for meeting regulatory and legal obligations treat KYB as the process for verifying an entity's identity, ownership, and risk profile. Because specific procedures, thresholds, and requirements depend on the governing jurisdiction and framework, these teams should confirm obligations against the applicable regulations.
Merchant risk and onboarding teams
Staff who evaluate prospective and existing business relationships use KYB to distinguish legitimate entities from higher-risk ones and to identify the parties behind a business. It is best treated as a risk-reduction measure that helps assess risk rather than a guarantee against onboarding a bad actor.

Inside KYB

Business Identity Verification
Confirmation of the legal existence and identity of a business entity, typically through registration documents, business licenses, tax identification numbers, and cross-referencing against official registries. This establishes that the merchant or counterparty is a legitimate, registered organization.
Beneficial Ownership Identification
Identification and verification of the natural persons who ultimately own or control the business, often above a defined ownership threshold. This is intended to reduce the risk that a legal entity is used to obscure the individuals behind it.
Ultimate Beneficial Owner (UBO) Screening
Screening of identified beneficial owners and controlling parties against sanctions lists, politically exposed person (PEP) lists, and adverse media. Screening is intended to help identify elevated risk but depends on data quality and generates both false positives and false negatives.
Business Risk Profiling
Assessment of the risk associated with onboarding a business, considering factors such as industry or merchant category, geography, transaction patterns, and expected processing volume. This informs the level of due diligence applied.
Ongoing Monitoring
Continuous or periodic review of the business relationship after onboarding, including re-verification of records, transaction monitoring, and re-screening. KYB is not a one-time event; risk indicators may change over the life of the relationship.
Relationship to KYC and AML Obligations
KYB addresses business entities as counterparties, complementing Know Your Customer (KYC) checks on individuals. Both commonly support anti-money laundering (AML) and regulatory obligations, though specific requirements depend on jurisdiction and regulator.

Common questions

Answers to the questions practitioners most commonly ask about KYB.

Is Know Your Business (KYB) the same as Know Your Customer (KYC)?
No. KYC generally refers to identity verification and due diligence on individual consumers, while KYB focuses on verifying the identity, ownership, and legitimacy of a business entity, such as a merchant applying for payment services. KYB typically involves confirming the legal existence of the entity, its registration details, and its beneficial ownership, whereas KYC centers on the natural persons. In practice the two overlap, because KYB often requires KYC-style checks on the individuals who own or control the business. Treat them as related but distinct due diligence processes rather than interchangeable terms.
Does completing KYB checks satisfy PCI DSS requirements?
No. KYB is a due diligence and onboarding process aimed at establishing who a business is and whether it is legitimate; it is not a control defined by PCI DSS. PCI DSS addresses the protection of cardholder data and the security of the cardholder data environment. A business can pass KYB checks and still be out of scope for, or non-compliant with, PCI DSS, and vice versa. Confirm any specific compliance obligations against the current published PCI DSS and against applicable card brand and network rules rather than assuming KYB covers them.
What information is typically collected during merchant KYB onboarding?
Programs commonly seek to confirm the business's legal identity and standing, such as registration or incorporation details, business address, the nature of the business, and information on beneficial owners and controlling individuals. The exact data set depends on the acquirer or processor's risk policy, applicable regulatory obligations, and the merchant's risk profile. Higher-risk categories may prompt additional documentation. Because requirements vary by jurisdiction and program, confirm the specific data elements against your own policy and applicable rules rather than assuming a fixed list.
How does KYB relate to ongoing merchant monitoring rather than one-time onboarding?
KYB is often framed as an initial onboarding step, but many programs treat it as part of a continuing process. Business ownership, activity, and risk profile can change over time, so periodic re-verification and event-driven reviews may be applied. Ongoing transaction and behavioral monitoring is a separate but complementary control that helps detect changes such as shifts in processing volume or patterns. The frequency and triggers for re-review depend on the program's risk appetite and any applicable obligations, which vary by region and network.
How does KYB help address transaction laundering or misrepresented merchant activity?
By verifying who a business is and what it purports to do, KYB is intended to help identify cases where a merchant's stated activity does not match its actual processing, including attempts to route prohibited or unrelated transactions through an approved account. KYB may reduce the likelihood of onboarding misrepresented or shell entities, but it does not eliminate the risk on its own. It is generally combined with ongoing monitoring and other controls, since determined actors can change behavior after onboarding, and detection controls carry false-positive and false-negative trade-offs.
Who is typically responsible for performing KYB in the payments ecosystem?
KYB is commonly performed by the party onboarding the merchant, such as an acquirer, payment processor, or payment facilitator, and responsibilities may be shared across parties depending on the commercial and contractual arrangement. Payment facilitators onboarding sub-merchants often carry specific due diligence obligations under their agreements and applicable card brand and network rules. Because these responsibilities and rules vary by region and can change, confirm the specific allocation of duties against your contracts and the current applicable requirements.

Common misconceptions

KYB is the same as KYC.
KYB focuses on verifying business entities, their legal standing, and beneficial ownership, while KYC focuses on verifying individual customers. They are complementary but distinct processes; verifying a business often also requires verifying the individuals who own or control it.
Completing KYB at onboarding satisfies the obligation permanently.
KYB is intended to be an ongoing process. Ownership, control, risk profile, and behavior can change over time, so periodic re-verification and ongoing monitoring are generally expected rather than a single point-in-time check.
Passing KYB and screening means a business is confirmed to be free of fraud or illicit activity.
KYB helps reduce risk but does not guarantee a business is legitimate or free of wrongdoing. Screening depends on data quality and coverage and can produce false positives and false negatives; KYB is intended to mitigate, not eliminate, exposure to illicit activity.

Best practices

Verify business identity against authoritative and independent sources, such as official registries and issued identifiers, rather than relying solely on documents supplied by the business.
Identify and verify beneficial owners and controlling parties, applying a defined ownership threshold and documenting how each individual was verified.
Apply a risk-based approach, calibrating the depth of due diligence to factors such as industry, geography, and expected activity, and document the rationale for the assigned risk tier.
Screen the business and its beneficial owners against sanctions, PEP, and adverse media sources, and establish a process to review and resolve alerts while accounting for false positives and false negatives.
Implement ongoing monitoring and periodic re-verification so that changes in ownership, control, or behavior are detected after onboarding, not just at initial setup.
Confirm specific KYB and AML requirements against the applicable regulations for your jurisdiction, since obligations, thresholds, and expectations vary by regulator and region.