How to verify a business for KYB: the analyst's process

Verifying a business for KYB means establishing a short list of facts about an applicant: that the entity exists, who owns and controls it, what it actually does, and whether that activity fits the product it wants. Every fact comes from a source, and every source has a limit. The difference between a review that holds up and one that does not is usually whether the analyst wrote those limits down.

This guide walks through the process a KYB analyst follows on a business onboarding file, in order, and states at each step what the evidence establishes and what it leaves open. It is US-centric, but the structure carries across jurisdictions. For the condensed version, use the KYB review checklist.

Step 1: Fix the scope before you open a registry

Start with the question the review has to answer: which product, for which activity, in which geographies. A business applying for a card-acquiring account, a stablecoin on-ramp and a treasury account will each face different requirements, and the same applicant can be acceptable for one and not another.

Write down:

• The product and the partner or sponsor bank behind it, if any.
• The declared business activity and the customers it serves.
• Where the business is formed, where it actually operates, and where its customers are.
• The requirement set you are reviewing against: your own policy, and any partner's published requirements (see the provider guides for Bridge and Stripe Connect).

Evidential limit: the application form tells you what the applicant claims. Every item on it is a claim to test, including the legal name and the website. A name that appears in a domain is not evidence that the applicant controls the entity with that name.

Step 2: Establish legal existence

Search the formation registry directly (the Secretary of State or equivalent for the jurisdiction of formation) using the exact legal name and, where available, the registration number. Record the entity type, formation date, status, registered agent and registered address, and any name changes or reinstatements.

If the business operates in a state other than the one where it was formed, check whether it is registered there as a foreign entity. A Delaware LLC that operates entirely from Texas usually shows up in both registries. Our state guides cover what each registry shows, starting with Delaware and Wyoming.

What it establishes: an entity with this name and number was formed on this date, and the registry currently holds this status for it.

Evidential limit: a registry record does not show who owns the entity, whether the person applying is authorized to act for it, or whether it does anything at all. "Active" or "good standing" usually means filings and fees are current. It says nothing about solvency, licences or conduct. See what a certificate of good standing proves.

Red flags at this step: a formation date that contradicts the claimed operating history, a recent reinstatement after administrative dissolution, a registered-agent address used as the only address, or a name change that the applicant did not mention. The shell company red flags guide covers these patterns with real cases.

Step 3: Confirm the tax identifier

For a US entity, the applicant should supply its EIN and an IRS document that ties the EIN to the legal name. The IRS says its digital CP575 notice, available through the business's IRS Business Tax Account, is accepted by banks and other institutions as written confirmation of an entity's EIN, and it substitutes for the original CP575 notices and Letter 147C.

What it establishes: if the document is genuine, the IRS assigned this EIN to this legal name.

Evidential limit: a number typed into a form is not a verified number, and a PDF can be edited. IRS TIN Matching is only available to payers and their authorized agents that file information returns, so many onboarding teams cannot use it. Where you cannot verify the EIN through a database, record that the check relies on the document, compare the name exactly against the registry, and look at the document itself for signs of alteration.

Step 4: Separate the registered address from the operating address

The registered address is where the registered agent accepts legal service. It is often a formation agent's office shared by many entities. The operating address is where the business actually works: an office, warehouse, shop, or, for remote companies, the controlling person's location.

Establish the operating address from evidence that names the business and the address: a lease, a utility bill, a bank statement, or a regulator's record. Check that the address type makes sense for the stated activity. A logistics company with no warehouse, or a retailer at a virtual office, needs an explanation.

Evidential limit: a proof-of-address document shows that a bill or statement was sent to that name at that address on that date. It does not prove that operations happen there. Mailbox and virtual-office addresses are common and legitimate for some businesses; they are a reason to ask, not a conclusion.

Step 5: Map ownership and control

US covered financial institutions must identify and verify the beneficial owners of a legal entity customer at account opening under 31 CFR 1010.230. The rule has two prongs: each individual who directly or indirectly owns 25 percent or more of the equity interests, and a single individual with significant responsibility to control, manage or direct the entity. Many partners apply their own threshold, so read the requirement you are reviewing against rather than assuming 25 percent.

Build the full chain. When an owner is itself a company, go through it until you reach natural persons, and record every intermediate entity with its jurisdiction. Ask for the document that actually evidences ownership: an operating agreement or membership ledger for an LLC, a share register or cap table for a corporation, and for foreign entities the registry's own ownership records where they exist. In the UK, for example, Companies House publishes a register of people with significant control, meaning people with more than 25 percent of shares or voting rights or the power to appoint or remove a majority of directors, although some individuals can apply to protect their details.

Do not expect US registries to supply ownership. FinCEN's interim final rule of March 26, 2025 removed the requirement for entities created in the United States to report beneficial ownership information to FinCEN, so for a US applicant the ownership picture comes from the applicant's documents and your own verification.

What it establishes: who the documents say owns and controls the entity, and whether the chain is complete.

Evidential limit: the CDD rule lets an institution rely on the beneficial ownership information the customer supplies, provided it has no knowledge of facts that would reasonably call that information into question. That proviso is the analyst's job. If the website names a CEO who appears nowhere in the ownership documents, or an operating agreement is unsigned or names a different entity, reliance is gone until the conflict is resolved. A partial list of founders is not a complete ownership structure. See ultimate beneficial owner and control person.

Step 6: Verify the people and their authority

Run identity verification on the beneficial owners, the control person and anyone signing for the business, according to your policy or the partner's. Separately, establish that the person applying has authority to act for the entity: an officer listing on the registry, a board or member resolution, or the operating agreement's management provisions.

Evidential limit: a LinkedIn profile or a founder page shows a claim of a role, not signing authority. Record which identity checks actually ran, and which are left to the partner or the customer. A review that says "KYC complete" when the checks ran elsewhere is a finding waiting to happen.

Step 7: Screen the entity and the people

Screen the legal name, trade names, beneficial owners and control persons against the sanctions lists that apply to you, and for politically exposed persons and adverse media. For US sanctions, apply OFAC's 50 percent rule: property and interests in property of entities directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons are considered blocked, even when the entity itself is not listed. This is one reason the ownership map in step 5 has to be complete before screening means anything.

What it establishes: that these names were checked against these lists and sources on this date, and how each potential match was dispositioned.

Evidential limit: a zero-match screen is a recorded observation, not a conclusion about the subject. It depends on which names were screened, the spelling variants, the lists covered and the date. Record all four. Distinguish a confirmed namesake from an unsearched source.

Step 8: Establish what the business actually does

Banks must understand the nature and purpose of customer relationships in order to build a customer risk profile (31 CFR 1020.210). For KYB this is where most of the investigative work sits, and where most onboarding problems appear.

Compare the declared activity with independent evidence:

• The website: is it functional, specific and consistent with the application? Check the domain's registration date through ICANN's registration data lookup and the site's history in public web archives.
• Operating evidence: contracts, invoices, fulfilment records, app store listings, licences, regulator records, customer reviews.
• The people: do the principals have a professional footprint that fits the business?
• Regulated activity: does the business model involve money transmission, lending, custody or third-party payments that need a licence or registration it has not declared?

Evidential limit: a polished website shows that someone built a website. An incomplete one, or a thin footprint for an early-stage company, is a request for supporting evidence, not proof of wrongdoing. Keep "the applicant says" and "we independently found" in separate columns.

Step 9: Test expected activity and source of funds

Collect the expected monthly volume, typical transaction size, countries of flows and counterparties. Check them against what you now know about the business. A three-month-old consulting LLC projecting eight-figure monthly flows needs an explanation before approval, not after the first alert. Where risk or inconsistency calls for it, ask for source-of-funds evidence: recent bank statements or financial statements for the entity itself. A statement for a different entity, even a related one, does not evidence this applicant's funds.

Step 10: Reconcile, then ask once

Line up every fact by source and look for contradictions: names that differ across documents, dates that disagree, owners who appear in one place only. Resolve what you can from public and authorized sources before going back to the applicant.

Then send one consolidated request. For each item, say what is needed, why, what will be accepted, and what it unblocks. Requests that arrive one at a time stretch the file out and invite partial answers. The consolidated list is also the clearest record of what the file still lacks.

Step 11: Write the recommendation, and keep the decision where it belongs

A finished review states, for each fact, the evidence and its capture date; for each check, its scope; for each gap, why it is open; and a recommendation with the reasoning behind it. The approval decision stays with the institution, and with the partner where a partner decides. "Research complete", "ready to submit" and "approved by the provider" are three different states. Keep them apart in the file.

You can see this structure applied to an illustrative applicant on the sample KYB review.

Where Sweat AI fits

Sweat AI is an AI-native BPO for banks and fintechs, starting with back-office workflows like KYB, onboarding and fraud reviews. Our analysts, working with AI, run this process on your KYB applications around the clock, so the queue is done when your team logs in. Each file comes back with source-linked evidence, the limits of each check, one consolidated request list and a recommendation. Your team makes the decision. See how outsourced KYB review works, or send us an application to review.