KYC and KYB are related but different verification workflows: KYC confirms that an individual is who they claim to be, while KYB confirms that a business exists, operates through legitimate people, and can be understood well enough for the intended relationship. This guide provides a reusable checklist for designing the document, signature, authentication, screening, and review steps that support both processes.
Overview
KYC, or Know Your Customer, focuses on an individual. It commonly includes identity proofing, document verification, liveness or other authentication controls, address information where relevant, and screening against applicable risk lists. KYC may apply to a customer, investor, founder, director, authorized signatory, or beneficial owner.
KYB, or Know Your Business, focuses on a legal entity and the people connected to it. Business identity verification may involve confirming incorporation details, registration status, operating name, business address, directors, ownership structure, authorized representatives, and ultimate beneficial owners (UBOs). KYB often includes KYC checks on the individuals who own, control, or represent the business.
The distinction matters because a verified individual is not automatically a verified business. A person may hold a valid identity document while representing an inactive, misidentified, or differently structured entity. Conversely, a legitimate company may still require additional review when ownership is complex, documentation conflicts, or an authorized signatory cannot be established.
A practical workflow connects four layers:
- Identity: establish who an individual is and whether the presented identity evidence is credible.
- Entity: confirm that the business exists and determine its legal form, status, and relevant jurisdiction.
- Relationship: connect owners, controllers, directors, and signatories to the entity.
- Decision record: preserve the checks performed, the evidence reviewed, the outcome, and any manual decision.
Documents, electronic signatures, and secure authentication should support these layers rather than operate as disconnected steps. For implementation details, see the Verification API integration guide, which covers documents, identity checks, webhooks, and data privacy.
Checklist by scenario
1. Individual KYC for a customer, founder, investor, or officer
- Define the person’s role and why identity verification is required.
- Collect only the information needed for the stated purpose and risk level.
- Request an acceptable identity document and check its validity, consistency, and apparent integrity.
- Use identity proofing controls that connect the document to the person presenting it.
- Apply secure authentication to protect the session, account, or signing event.
- Run sanctions screening and, where appropriate, PEP screening or other risk checks required by the workflow.
- Record the verification result, timestamp, method, and any reason for manual review.
- Provide a clear path for resolving a mismatch without treating every failed attempt as confirmed fraud.
For investors, KYC may be one part of a broader process that also addresses accreditation, source-of-funds questions, or private market compliance requirements. Those checks should be defined separately so that the user understands what is being verified and why. The investor verification checklist provides a related framework.
2. KYB for a straightforward company
- Capture the exact legal name, registration number, legal form, and jurisdiction.
- Confirm that the entity record is consistent across reliable business records and submitted documents.
- Check status information relevant to the relationship, such as whether the entity appears active or has entered a change process.
- Collect the registered address and, where relevant, the operating address.
- Identify directors, officers, authorized representatives, and owners or controllers.
- Complete KYC for the people whose identity or authority must be established.
- Run applicable sanctions, PEP, adverse-information, or other AML screening.
- Store the evidence and decision in an audit trail linked to the entity, not only to the submitting employee.
Do not assume that a company registry extract is sufficient for every use case. The appropriate evidence depends on the entity type, jurisdiction, product, transaction, and risk assessment. A workflow for a simple domestic company may be materially different from one for a foreign subsidiary, holding company, or newly formed entity. See the guide to entity verification for corporations, LLCs, and foreign subsidiaries when those structures are involved.
3. KYB with UBO and ownership complexity
- Draw the ownership chain from the applicant entity to the relevant natural persons or controlling parties.
- Distinguish direct ownership from indirect ownership, voting control, and management control.
- Request organizational documents when registry data does not explain the structure.
- Identify every person whose role meets the workflow’s UBO or control criteria.
- Perform KYC and screening for each required individual.
- Escalate nominee arrangements, trusts, layered entities, unexplained ownership changes, and material data conflicts.
- Document how the ownership conclusion was reached, including the evidence and reviewer rationale.
UBO verification is not simply a field to populate. It is a relationship-mapping exercise. If the workflow cannot explain who owns or controls the business, it should not present a superficial “verified” result.
4. Document signing and account access after verification
- Verify the person before granting access to sensitive documents, funds, or onboarding actions.
- Confirm that the signer is authorized to act for the business and that the authority is current for the transaction.
- Bind the signature to the correct document version and preserve evidence of intent, timing, and completion.
- Use secure authentication for sensitive actions, with stronger controls for higher-risk events.
- Prevent changes to key identity or payment details immediately before signing without an additional review.
- Retain the completed document, signature evidence, verification result, and relevant event logs together.
Verification and e-signature are complementary. A valid electronic signature does not, by itself, prove that the signer is the correct person or has authority to bind the entity. Review the e-signature compliance guide for a workflow-oriented checklist.
What to double-check
Evidence quality and consistency
Check names, dates, registration numbers, addresses, ownership percentages, and document versions across all sources. Small differences may reflect transliteration or formatting, but unresolved contradictions should be assessed rather than silently normalized.
Screening scope and timing
Define which screening checks apply, how often they are refreshed, and what creates an alert. A screening result is an input to a decision, not a substitute for reviewing identity, context, and possible false matches. Keep the list version or source reference where your process requires it, and record how an alert was resolved.
Manual review triggers
Automation is useful for repeatable checks, but a workflow should have explicit escalation rules. Examples include an unreadable or altered document, an identity mismatch, an incomplete ownership chain, a high-risk jurisdiction connection, conflicting registry data, a possible sanctions or PEP match, or a signer whose authority cannot be established. The manual review triggers guide can help teams define these conditions.
Privacy and retention
Document why each data field is collected, who can access it, where it is stored, and how long it is retained under the organization’s policy and applicable requirements. Prefer structured results and limited evidence access when a reviewer does not need the full document. A privacy-first design reduces unnecessary exposure without weakening a legitimate control.
Auditability
An audit trail should answer: who submitted the information, what was checked, which evidence was used, what result was returned, who reviewed exceptions, what decision was made, and when the process occurred. It should also show subsequent changes, rechecks, and overrides. See how to design an audit trail for a more detailed record structure.
Common mistakes
- Using KYC as a substitute for KYB: verifying an employee does not verify the entity they represent.
- Collecting documents without a decision model: more documents do not automatically produce a better outcome. Define what each document proves.
- Ignoring beneficial ownership: stopping at the first visible company or director can leave the control structure unexplained.
- Treating an automated pass as permanent: entities, owners, addresses, and risk signals can change.
- Failing to distinguish an alert from a confirmed match: names and other identifiers can produce false positives that require reasoned review.
- Letting the signer bypass authentication: a signature workflow should not assume that possession of an email account proves authority.
- Keeping weak audit records: a final status without evidence, timestamps, and reviewer rationale is difficult to investigate later.
- Over-automating edge cases: complex ownership, document anomalies, and material inconsistencies need a controlled human-review path.
When to revisit
Review the KYC and KYB workflow before seasonal planning cycles, major onboarding campaigns, new investment or payment products, and changes to document or authentication tools. Revisit it whenever the business enters a new jurisdiction, accepts a new entity type, changes its risk appetite, or introduces a new signing or account-access flow.
A practical maintenance checklist is:
- Compare the current workflow with the business’s products, customers, jurisdictions, and risk tiers.
- Test a standard case, a failed document case, a complex ownership case, and a possible screening match.
- Confirm that every automated result has a documented fallback and that manual reviewers can see the necessary evidence.
- Review approval rates, false positives, review time, abandonment, and repeat-verification patterns. The identity verification metrics guide offers a useful measurement framework.
- Check that API events, webhooks, signatures, document versions, and audit logs remain connected after tool or workflow changes.
- Remove unnecessary data collection and confirm access, retention, and deletion controls.
- Update internal instructions so operations, compliance, and customer-facing teams apply the same escalation rules.
The core rule is simple: use KYC to establish the identity of relevant people, KYB to understand the business and its control structure, and document, signature, and authentication controls to preserve confidence in each important action. Rechecking that connection whenever the workflow or business changes helps keep onboarding both defensible and usable.
