KYB and KYC are sequential steps in the same compliance process, not separate programs. KYB verifies the entity and identifies the individuals who own and control it, then KYC verifies each of those individuals. If KYB is skipped or applied superficially, a compliance team can end up with a verified signatory and no visibility into the beneficial owners who control the entity.
In July 2025, the Monetary Authority of Singapore (MAS) imposed S$27.45 million in penalties on nine financial institutions for AML failures tied to a S$3 billion money laundering case. MAS cited inadequate customer risk assessment and weaknesses in verifying ownership and source of wealth at institutions that had written policies covering the KYB vs. KYC requirements. While most penalized institutions had written policies, ownership verification broke down in practice where entity-level and individual-level checks were supposed to connect.
This guide explains what KYB and KYC require and how a compliance team can run them correctly together when onboarding a corporate client.
Key takeaways:
- KYB and KYC are sequential, not parallel
KYB verifies the entity and identifies the people behind it. KYC then verifies each of those individuals. Running KYC without completing KYB first leaves the ownership structure unexamined.
- One corporate onboarding can require multiple identity checks
Because KYB must identify every beneficial owner above the 25% threshold, a single business client can generate five or ten individual KYC verifications, and even more if the institution applies a stricter 10% threshold for high-risk entities.
- Most enforcement failures trace to incomplete execution, not missing policies
The institutions MAS penalized in 2025 had written KYB and KYC policies. The breakdowns happened where entity-level and individual-level checks were supposed to connect.
- The EU’s AML Regulation raises the bar on UBO documentation from July 2027
Firms operating in EU markets are expected to verify beneficial ownership against central registers rather than relying on client self-certification, making more rigorous KYB programs a near-term operational requirement.
- Sigma360 runs KYB and KYC on a single platform
With multiple targeted solutions working together smoothly, Sigma360 makes entity-level and individual-level signals visible in the same case file, rather than managing them across separate systems.
What is KYC?
KYC is the identity verification process that regulated institutions apply to individual customers before opening an account or providing services.
In the US, the process falls under the Customer Identification Program (CIP) required under the Bank Secrecy Act. Internationally, it maps to the Customer Due Diligence obligation in FATF Recommendation 10.
A standard KYC program consists of three elements:
- Customer identification: Collecting and verifying a name, date of birth, address, and government-issued ID through document verification, database cross-referencing, or biometric checks
- Customer due diligence (CDD): Assessing the customer’s risk profile based on occupation, source of funds, expected transaction patterns, and screening results against sanctions lists, PEP registries, and adverse media
- Ongoing monitoring: Tracking account activity for deviations from the customer’s established profile and filing Suspicious Activity Reports (SARs) when warranted
KYC is mandatory for any business classified as a financial institution under AML regulations, including banks, fintechs, payment processors, credit unions, and insurance companies. The specific obligations vary by jurisdiction, but the underlying logic is consistent: Confirm the person, assess the risk, keep watching.
What is KYB?
KYB is the due diligence process that regulated institutions apply when their customer is a business rather than an individual. It confirms the business is legally registered and legitimate, maps its ownership structure, and identifies every person with a controlling stake so each can undergo individual identity verification.
KYB is required whenever a regulated institution onboards a corporate client or enters a lending, payment, or correspondent banking relationship with a business.
The process is more complex than KYC because corporate structures can span multiple jurisdictions, involve chains of holding companies, and include nominee arrangements designed to separate the entity’s legal owner of record from the person who controls it.
Five elements make up a complete KYB verification:
- Company registry verification: Confirming the business is legally registered and in good standing through official registries, including Companies House in the UK, Secretary of State filings in the US, and commercial registers across EU member states
- Incorporation and governance document review: Reviewing articles of incorporation, business licenses, partnership agreements, and governance documents that define the company’s legal structure
- Ownership structure mapping: Tracing the ownership chain from the business being onboarded to the individuals who own or control it, including indirect ownership through subsidiaries and any trust or nominee arrangements
- UBO identification and verification: Identifying every Ultimate Beneficial Owner, defined under the FinCEN CDD Rule as any individual who directly or indirectly owns 25% or more of the equity plus a single individual with management control of the entity, and verifying each UBO’s identity through KYC
- Entity and director screening: Running the business name, all registered trading names, directors, and identified UBOs against sanctions lists, PEP registries, and adverse media databases
Verifying one corporate entity can trigger several individual identity checks. The exact number depends on how many people clear the institution’s ownership threshold, which stands at 25% under the FinCEN CDD Rule but drops to 10% for high-risk entities at many institutions.
Internationally, FATF Recommendation 24 and Recommendation 25 set the beneficial ownership standard, requiring institutions to identify and verify the natural persons who own or control legal entities. For high-risk entities, enhanced due diligence applies an additional layer of scrutiny beyond the standard KYB check.
KYB vs KYC: Key differences
The two processes differ most clearly in ownership verification: KYC has none, while KYB makes it the core of the check.
The table below maps the other key differences across seven dimensions:
| Dimension | KYC | KYB |
| Applies to | Individual natural persons | Legal entities: companies, partnerships, trusts |
| Core question | Is this person who they claim to be? | Does this business legally exist, and who controls it? |
| Documents required | Government-issued ID, proof of address | Articles of incorporation, business licenses, ownership disclosures, UBO identity documents |
| Key data sources | Identity databases, credit bureaus, biometrics, sanctions and PEP lists | Government registries, corporate filings, UBO registers, sanctions lists, adverse media |
| Ownership verification | Not applicable | Required: must identify and verify all UBOs above the applicable threshold |
| Verification complexity | One person, one identity check | Multiple entities and individuals, layered ownership chains, cross-jurisdictional structures |
| Primary regulatory drivers | Bank Secrecy Act, FATF R.10, EU AMLDs, FCA MLR 2017 | FinCEN CDD Rule, FATF R.24 and R.25, EU AML Regulation, AMLA |
This is also where the difference between a passing onboarding and a complete one tends to become clear. KYC confirms the person in front of the institution, while KYB has to trace backward through a corporate structure to reach the people who control the entity without ever appearing in the transaction flow.
When do you need KYC, KYB, or both?
The deciding factor comes down to who your customer is. The table below maps institution types to the checks each one requires:
| Institution use case | KYC required | KYB required | Why |
| Retail bank (individual accounts) | Yes | No | Customers are individual natural persons |
| Bank onboarding corporate clients | Yes | Yes | Entity verification plus KYC on UBOs and signatories |
| Fintech onboarding business accounts | Yes | Yes | B2B relationships require both entity and individual checks |
| Payments firm processing on behalf of merchants | Yes | Yes | Merchant acquiring requires entity and UBO verification |
| Asset manager with corporate fund investors | Yes | Yes | Corporate investors require KYB; fund managers require KYC on principals |
| Insurance firm with individual policyholders | Yes | No | Individual policyholders don’t trigger entity-level checks |
When both processes apply, they run in sequence. KYB comes first, covering entity verification, ownership structure mapping, and UBO identification. Each identified beneficial owner then goes through a KYC check before the onboarding closes.
The EU’s Anti-Money Laundering Authority (AMLA) is building the technical standards that will govern beneficial ownership verification across all EU member states once the AML Regulation applies in full from July 10, 2027. European banks and fintechs are preparing now, as the bar for UBO documentation is set to rise.
Read more: What Is Financial Crime Compliance?
How KYB and KYC programs fail at the boundary
Most enforcement actions in this area trace back to programs that run each process incompletely, or that treat onboarding as a finish line rather than the start of an ongoing obligation.
Four failure points recur consistently:
- Treating KYB as a one-time registration check: Directors resign, beneficial owners transfer equity, and new holding entities emerge. The corporate record at month one may bear little resemblance to the entity two years later. Programs that don’t track ownership changes after the initial check are operating on outdated information.
- Running KYC on signatories but not UBOs: Verifying the individual who signs the account agreement is operationally convenient, but it doesn’t satisfy the obligation. The FinCEN CDD Rule requires identity verification for every individual who owns 25% or more of the entity, including those who never appear directly in the transaction flow.
- Not screening the entity and its individuals together: KYB and KYC screening generate separate alert queues in many compliance programs. A sanctions hit on a UBO may never reach the entity-level case, and a change in a director’s PEP status may not trigger a review of the associated corporate account. Fragmented systems create blind spots that connected risk intelligence can close.
- Applying static risk ratings to dynamic relationships: A corporate client that passes KYB and KYC at onboarding receives a risk rating that governs the relationship going forward. Over time, ownership changes, regulatory actions, and adverse media developments can render that rating obsolete. Perpetual monitoring continuously tracks changes to watchlist status, registry data, and adverse media screening signals, replacing the periodic review cycle many programs still rely on.
Running KYB and KYC on a single platform
Sigma360 is an AI risk intelligence platform built for regulated institutions that run KYB and KYC across complex portfolios. Rather than managing entity-level and individual-level checks through separate systems, the platform brings both together in a single environment, so a sanctions alert on a UBO appears in the same case file as the entity-level KYB record.
The platform’s core capabilities include:
- Match Agent: Automates false positive clearance before alerts reach the analyst queue, delivering up to a 93% reduction in false positives and reducing the manual review load across high-volume onboarding programs
- Adverse Media Summary: Groups related news by event and impact, giving analysts a single structured story to assess rather than a queue of individual articles
- KYB data layer: Draws on 100B+ data points and 150+ corporate registries to map ownership structures across jurisdictions, exposing indirect connections (shared addresses, shared directors, and nominee relationships) that standard registry checks don’t reach
- EDD Agent: Structures the investigation that follows, analyzing and summarizing high-risk entity cases so analysts have a consistent framework at the start of each review rather than assembling one from scratch
After onboarding, Sigma360’s Perpetual KYC solution continuously monitors every entity and individual in a portfolio. For KYB programs, this means ownership changes, sanctions updates, and adverse media developments are caught in real time rather than at the next scheduled review.
Request a demo to see how the platform handles both processes.
FAQ
Is KYB legally required?
Yes, for any regulated institution that onboards business customers. The FinCEN CDD Rule mandates it in the US, and equivalent obligations apply under the EU’s AML directives and the AML Regulation from July 2027.
How long does KYB take?
For simple structures with clean registry data, automated KYB completes in minutes. Multi-jurisdictional ownership chains involving nominees or holding companies can take days to weeks if handled manually.
What happens if a beneficial owner refuses to provide identification?
Refusal is treated as a red flag, not an exemption. The FinCEN CDD Rule requires institutions to obtain and verify UBO information at account opening, and non-cooperation can justify declining the relationship or filing a Suspicious Activity Report.
Does KYB apply to non-bank financial institutions?
Yes. Payment processors, money services businesses, broker-dealers, and many fintechs face equivalent obligations under their own regulatory frameworks, even when the specific rules differ from those that apply to banks.
What is the difference between CDD and KYB?
CDD is the broader framework covering identity verification, risk profiling, and ongoing monitoring for all customers. KYB is the component that applies specifically to legal entities, adding the ownership investigation and UBO verification steps that individual KYC doesn’t require.
How often should KYB be refreshed?
There’s no mandated frequency, but material changes, including a new director, an ownership transfer, or a sanctions designation, should trigger an update. Risk-based programs set shorter cycles for higher-risk entities, and perpetual monitoring replaces fixed schedules entirely.
