When your customer is a person, the checks are fairly simple. You confirm who they are, screen them and keep a record.

When your customer is a business, there is more to check. You need to know the business is real. You also need to know who owns it, who runs it and who is acting for it.

That is the difference between KYC and KYB:

  • KYC (know your customer) checks individuals.
  • KYB (know your business) checks companies, trusts and other organisations, and finds the people behind them.

If you take on business customers, you need both. KYB tells you who the owners are. KYC then checks those owners as people. One without the other leaves a gap.

The rules differ from country to country. Check what applies to your business before you rely on any one example.

What is KYC?

KYC means confirming that an individual customer is who they say they are. It also means understanding enough about them to judge their risk. Most anti-money laundering (AML) laws treat KYC as part of customer due diligence (CDD).

A typical KYC check covers:

  • full name, date of birth and home address
  • proof of identity, such as a passport, driver’s licence or trusted electronic data
  • screening against sanctions lists and politically exposed person (PEP) lists
  • adverse media checks, where the risk calls for it
  • a judgement about the customer’s money laundering risk

At the end, you decide to go ahead, go ahead with extra checks or say no.

What is KYB?

KYB applies the same idea to organisations. It checks that a business really exists. It then works out how the business is set up and who is behind it.

A typical KYB check covers:

  • legal name, company number and registered address, checked against an official registry
  • the type of entity and its current status (for example, active or deregistered)
  • directors and other office holders
  • the chain of ownership, through any holding companies or trusts
  • the ultimate beneficial owners (UBOs), meaning the real people who own or control it
  • screening of the business itself against sanctions lists and adverse media

KYC and KYB side by side

KYC-vs-KYB-NameScan

Why you need both checks

KYB is about looking through a business to the people behind it. Once you know who those people are, you check them with KYC. Usually that means:

  • the beneficial owners
  • the directors or senior managers
  • the person giving you instructions for the business

International standards set by the Financial Action Task Force (FATF) point the same way. Businesses covered by AML rules should know who really owns and controls their customers.

Here is how two countries put this into practice.

Australia (AUSTRAC)

AUSTRAC’s guidance says that if your customer is not an individual, you must identify its beneficial owners. In short:

  • A beneficial owner is a person who owns 25% or more of the customer, directly or indirectly.
  • A person who otherwise controls the customer is also a beneficial owner.
  • A customer can have several beneficial owners, or none who meet the 25% test.
  • If an owner is another company, you keep following the chain until you reach real people.

This matters more since 1 July 2026. From that date, AML rules started to apply to many lawyers, accountants, conveyancers, real estate professionals and company service providers in Australia. Many of them act for companies and trusts every day.

United States (FinCEN)

Under the FinCEN Customer Due Diligence Rule, US financial institutions use two tests for business customers:

  • Ownership test: every person who owns 25% or more of the business.
  • Control test: one person with major responsibility for running it, such as the CEO.

FinCEN treats 25% as a starting point. Institutions can use a lower figure if their risk assessment calls for it.

Why owners matter for sanctions

Checking the company name alone can miss sanctions risk. Under the US OFAC 50 Percent Rule, a company is treated as sanctioned if sanctioned people own 50% or more of it in total. This applies even if the company is not on any list. If you never find out who owns your customer, you cannot see this risk.

How to combine KYB and KYC in one onboarding flow

These steps work for most small and mid-sized organisations. Adjust the depth to your risk level and your local rules.

  1. Sort the customer type. Is it a person, sole trader, company, trust, partnership or association? The type decides which checks you run.
  2. Check the business is real. Confirm its name, number, status and address with an official registry. Do not rely only on documents the customer sends.
  3. Map who owns and controls it. Note each layer of ownership and where the information came from. Keep going until you reach real people.
  4. List the people who matter. Usually the beneficial owners, the directors and the person instructing you.
  5. Verify each person. Use ID documents, electronic checks or a selfie check, as your policy requires.
  6. Screen everyone. Check the business, its owners and its directors against sanctions, PEP and adverse media sources.
  7. Decide. Give the customer a risk rating. Higher risk means extra checks, such as asking where the money comes from.
  8. Record and review. Keep evidence of each step. Check the customer again when owners, directors or activity change.

KYB-KYC-Onboarding-Workflow-NameScan

When a simple check is enough and when to dig deeper

A standard check is often enough when:

  • the business is registered locally
  • the ownership chain is short and clear
  • there are no PEP or sanctions matches
  • the activity matches what you know about the customer

Consider extra checks (enhanced due diligence) when you see:

  • many layers of ownership, overseas holding companies or nominee shareholders
  • a trust where the trustees or beneficiaries are unclear
  • an owner, director or close associate who is a PEP
  • a possible sanctions match on the business or anyone linked to it
  • news reports linking the business or its owners to financial crime
  • reluctance to explain who owns the business or where its money comes from

Keep in mind that a PEP match is a reason to look closer. It is not proof of wrongdoing.

Common mistakes to avoid

  • Stopping at the first company. If a company owns your customer, you have not found the real owner yet.
  • Taking the customer’s word for it. Check ownership claims against registry data, especially for higher-risk customers.
  • Screening only the company name. Directors and owners need their own checks.
  • Ignoring control. Someone can control a business without owning shares, for example as a trustee.
  • Treating onboarding as a one-off. Owners and directors change. Review the customer when they do.

How NameScan can help

NameScan is built for smaller teams that need these checks without an enterprise system. In one platform you can:

  • run a Know Your Business check that pulls data from official registries and shows directors and UBOs
  • verify a person’s identity by matching their ID document to a live selfie
  • screen the business and each person against PEP, sanctions and adverse media sources
  • keep a timestamped report of every check as evidence

NameScan supports your due diligence. It does not replace your AML/CTF programme, your risk assessment or your own judgement.

Frequently asked questions

Is KYB just KYC for businesses?

Partly. KYB checks the business itself, such as its registration and ownership. But a full KYB process also includes KYC on the people behind the business. So KYB usually contains KYC rather than replacing it.

What documents do I need for a KYB check?

It depends on the business type and your local rules. Common items include:

  • a company registry extract
  • the company constitution, or the trust deed for a trust
  • a share register or ownership chart
  • ID for the beneficial owners, directors and the person instructing you

Who counts as an ultimate beneficial owner (UBO)?

A UBO is a real person who ultimately owns or controls a business. Many countries, including Australia and the US, use 25% ownership as the main test. People who control the business in other ways, such as through voting rights, can also count.

Do sole traders need KYC or KYB?

A sole trader is not a separate legal entity, so the main check is KYC on the person. Many firms also record business details, such as the business name and number, to understand what the customer does.

How often should I repeat KYC and KYB checks?

There is no single rule. Most businesses review customers based on risk, for example more often for higher-risk customers. You should also check again when something changes, such as new owners, new directors or unusual activity.

Next step

If you take on business customers, try a free Know Your Business check on your next client. Then screen its directors and owners with a free NameScan account.