KYB compliance is customer due diligence with a harder subject. A business customer cannot be identified the way a person can, and the evidence you need sits partly in registries and partly in documents the customer has to produce. This page is about what the file has to contain, who ends up carrying the work, and the two places it usually falls down.
What the file has to contain
Evidence that the entity exists and is what it says it is. Evidence of who controls it, meaning at least one senior person who can act for it. Evidence of who owns it, traced to individuals rather than to another company. A risk rating with a stated reason. An approval where the rating warrants one. And a date when all of that is looked at again. The federal beneficial ownership threshold sits at 25 percent, so each individual who directly or indirectly owns 25 percent or more of a legal entity customer belongs in the file by name.
Finance and compliance end up sharing it, badly
In firms below a certain size there is no dedicated onboarding team, so KYB work lands wherever the customer arrives, which is often finance or the commercial side. That is not a problem in itself. It becomes a problem when the evidence lives where it landed: a certificate of incorporation attached to a sales thread, an ownership chart in someone's downloads folder, and no single record that says the file is complete. The fix is not a new team, it is one place the pieces are attached to the customer.
Two failure modes, both quiet
The first is stopping too early in the ownership chain, taking the first corporate shareholder as the answer rather than reading through it. The second is treating the check as one-time, when company ownership changes without notifying anyone. Neither failure announces itself. Both are found either by a review that actually happens or by somebody outside the firm asking a question you cannot answer.
Questions people ask about kyb compliance
Are KYB requirements different from KYC requirements?
The obligations come from the same place; the evidence is different because the customer is a company. In practice most firms run one policy with a business-customer section rather than two programmes.
How far up the ownership chain do we have to go?
To the individuals who meet your ownership threshold, reading through intermediate companies rather than stopping at them. Where the chain is long or opaque your policy should say what happens next, because that is a judgement call and it needs to be made the same way twice.
Can we rely on a registry search alone?
For some entities in some jurisdictions a registry is good evidence; for others it is a starting point that the customer has to supplement. What matters for the file is that it records which source was used and when, so that a year later the basis of the decision is visible rather than assumed.