KYB Verification Checklist: How to Verify a Business Before Onboarding

Overview

Know Your Business (KYB) verification is the process of establishing that a company is real, correctly represented, and appropriate for a proposed relationship. It combines business identity verification with document review, individual identity proofing, ownership checks, and risk screening.

A reliable KYB workflow should produce more than a pass or fail result. It should create an evidence trail showing what was checked, which sources or documents were used, who reviewed the information, and why the final decision was made. That record supports consistent onboarding and gives your team a reference point when company details change.

The depth of review should match the risk of the relationship. A low-risk domestic vendor may need a lighter process than a regulated customer, a cross-border payment counterparty, or a private-market entity with a complex ownership structure. Your written policy should define those tiers before a difficult case arrives.

For a broader comparison of individual and business checks, see KYC vs. KYB Verification. For private-market workflows, the Private Market Onboarding Checklist provides additional context.

Checklist by scenario

1. Customer or platform onboarding

• Confirm the legal entity: Record the exact legal name, entity type, registration or incorporation number, jurisdiction, formation date where available, and current status.
• Match submitted information: Compare the application, contract, website, email domain, invoices, and official registry information. Resolve differences rather than treating them as minor formatting issues.
• Identify representatives: Verify the identity and authority of the person opening the account or signing the agreement. A person who can communicate with your team is not automatically authorized to bind the company.
• Map ownership and control: Obtain the ownership structure and identify beneficial owners, controlling persons, directors, or equivalent officers as required by your risk policy.
• Run relevant screening: Apply sanctions screening and, where appropriate, politically exposed person (PEP), adverse-media, or other risk screening. Define how potential matches are reviewed and cleared.
• Assign a risk tier: Consider geography, industry, product use, transaction pattern, ownership complexity, and the quality of submitted evidence.

2. Vendor or partner onboarding

• Verify the contracting entity and the entity that will receive payment. These may not be the same, particularly when a parent company, subsidiary, or payment intermediary is involved.
• Confirm the operating address, business contact details, and expected service or delivery location. A registered office alone may not establish where the business actually operates.
• Check bank-account ownership using approved evidence and a controlled process. Treat requests to change payment details as a separate authentication event.
• Review the individuals responsible for the relationship, especially where the partner will access systems, confidential information, customer data, or funds.
• Retain the signed agreement, approval record, verification results, and any exceptions in one controlled file.

3. Investor, founder, or private-market onboarding

• Verify the person’s identity using an appropriate identity-proofing process and confirm that the person is acting for the stated entity.
• Verify the fund, holding company, special purpose vehicle, or other legal entity separately from its representatives.
• Trace ownership through intermediate entities until the relevant beneficial owners or controlling persons are identified, subject to the requirements of your policy and applicable rules.
• Complete appropriate AML, sanctions, and PEP screening before accepting funds, granting access, or finalizing participation.
• For investor-related workflows, distinguish entity verification from investor accreditation verification. They answer different questions and should not be treated as interchangeable.
• Use controlled document and e-signature workflows so that the final agreement is connected to the verified entity, authorized signer, and approval record.

For more detail on this use case, see Investor and Founder Verification for Venture Capital and Investor Verification for Venture Capital.

What to double-check

Legal name versus trading name: A brand name, domain, or invoice header may differ from the legal entity. Record both, but use the legal entity in the agreement and verification record.

Registration status: A company can have a valid registration number but be inactive, dissolved, in liquidation, or otherwise unsuitable for the proposed relationship. Confirm current status where the relevant registry provides it.

Ownership changes: Ownership charts become unreliable when they are undated. Ask when the structure was last updated and seek supporting records when the chain is complex or inconsistent.

Directors and authorized signers: The director, beneficial owner, and contract signer may be different people. Verify each role that matters to your decision rather than relying on one identity check.

Address quality: Separate the registered office, principal operating address, correspondence address, and address of a parent company. An address mismatch should trigger clarification, not an automatic rejection.

Document integrity: Check dates, page continuity, names, registration numbers, signatures, and visible signs of alteration. Document verification software can assist with consistency and fraud indicators, but high-risk or ambiguous cases still need human review.

Screening match quality: A name match is not proof of a risk match. Compare identifiers such as date of birth, nationality, location, role, and entity details, and record the basis for clearing or escalating the result.

Decision traceability: Preserve the submitted data, verification outputs, reviewer notes, decision, exception rationale, and timestamp. Access should be limited to people who need it, with retention and deletion rules defined in advance.

Teams measuring workflow quality should track approval rate, false positives, and review time together rather than optimizing only for speed. The guide to identity verification metrics can help structure that review.

Common mistakes

• Accepting a certificate as the whole review: Formation documents establish that an entity was created; they do not necessarily confirm current status, ownership, control, or operating activity.
• Checking only the customer-facing contact: The person answering email may not be an owner, director, or authorized representative.
• Copying an ownership chart without testing it: Ask who prepared it, when it was prepared, and whether it agrees with available corporate records.
• Using one review level for every entity: A uniform process can create unnecessary friction for simple cases and insufficient scrutiny for higher-risk relationships.
• Letting automation make every decision: Automation is useful for data extraction, registry checks, screening, and routing. It should not conceal uncertainty or replace a defined escalation path.
• Failing to authenticate later changes: A request to change an owner, signer, bank account, email domain, or payment destination should be verified through an independent channel.
• Collecting more personal data than necessary: Privacy-first authentication means gathering only information needed for the stated purpose, protecting it appropriately, and documenting access and retention practices.

Define manual review triggers in advance. Examples include an unresolved registry mismatch, an opaque ownership chain, a possible sanctions or PEP match, inconsistent identity documents, unexplained urgency, or a request to bypass the normal document and signature workflow. See Manual Review Triggers in Identity Verification for a practical framework.

When to revisit

KYB is not a one-time form. Revisit the record on a schedule based on risk and whenever a meaningful change occurs. A review may be appropriate when the company renews a contract, changes ownership or directors, moves jurisdictions, introduces a new product, begins a materially different transaction pattern, changes its payment account, or becomes subject to a new internal risk requirement.

At minimum, assign an owner and next-review date to every approved entity. High-risk relationships may need more frequent checks; lower-risk relationships may be reviewed less often if there are no change signals. Your policy should specify what happens when information expires, a screening alert appears, or the business does not respond to a refresh request.

Before seasonal planning cycles, review whether your registry sources, verification tools, document requirements, escalation rules, and retention settings still match the workflow. Revisit the checklist whenever you change your onboarding form, CRM, verification API, e-signature platform, or approval permissions.

A practical next step is to turn this article into a controlled internal checklist with five fields for every check: requirement, evidence, reviewer, decision, and next review date. That simple structure makes business identity verification repeatable without pretending that every company presents the same risk.