KYB and UBO Verification: The Complete Guide (2026)

KYC verifies a person; KYB verifies a business and then the people behind it. Know Your Customer starts and ends with one natural person: An identity document is checked against the individual, the address and date of birth are confirmed, the person is screened against sanctions and PEP lists, and the case is closed. The evidence is standardized, the volume is high, and the process is largely automated. Know Your Business starts with a legal entity and is not complete until every ultimate beneficial owner has been identified, which means walking through holding companies, partnerships, trusts, and nominee arrangements, often across several jurisdictions with different disclosure rules. The data sources differ: Corporate registries and filings rather than identity databases, and in many countries self-declared information rather than anything an official has verified. The cases differ too. A consumer flow handles thousands of near-identical applications, while a business flow handles a smaller number of genuinely different structures, from a sole trader who clears in minutes to a multi-layer group that needs days of analyst time. Ownership also changes silently, so KYB requires ongoing monitoring in a way that a verified passport does not. A second difference sits in the screening step. A person is screened once, against their own name and identifiers. A business is screened as an entity and then again for every director and beneficial owner, and the matching logic for company names, with their suffixes, abbreviations, and translations, behaves differently from the logic for personal names. A third is liability: A firm that misses a sanctioned owner behind a clean-looking company faces the same exposure as one that onboarded the sanctioned person directly. The most common failure is treating KYB as KYC applied to a company name, which produces a file that proves the entity exists and nothing about who benefits from it. The comparison of KYC vs KYB sets out the overlaps and the differences in full.

An ultimate beneficial owner, or UBO, is a natural person who ultimately owns or controls a legal entity, whether directly or through a chain of other entities, and whether through shareholding, voting rights, or other means of control. The word "ultimate" is doing the work: A holding company that owns 60 percent of a trading company is a shareholder, but it is not a beneficial owner, because a company cannot benefit in the way a person does. The UBO is whoever sits at the end of that chain, which might be two or three layers up and in a different country. Most jurisdictions set a threshold, commonly 25 percent of shares or voting rights, above which a person is presumed to be a beneficial owner, but the definition also includes anyone who exercises control by other means, such as the right to appoint or remove directors, a veto over major decisions, or a funding arrangement that makes the company dependent on them. Where no one meets either test, most regimes treat the senior managing official as the beneficial owner of last resort. Identifying the UBO is an exercise in arithmetic and judgment together. Indirect holdings are multiplied through each layer, so a 50 percent stake in a company that owns 40 percent of the customer is a 20 percent indirect interest, and separate chains that lead to the same person are added together. Where the chain passes through a trust, the settlor, trustees, protector, and beneficiaries can all qualify, and where it passes through a nominee, the person behind the nominee does. The concept matters because sanctions and anti-money laundering rules are ultimately about people: A company can be restricted because of who owns it, and laundering typologies almost always involve a person hiding behind a corporate layer. The guide to what a UBO is covers the definition, the tests, and how they are applied.

Twenty-five percent is the figure most regimes use, following the FATF recommendation, but it is a floor rather than a universal rule, and the exact wording matters. The United States CDD Rule and the UK register of people with significant control both use more than 25 percent; the EU's Anti-Money Laundering Regulation moves to 25 percent or more from July 2027, which brings a holder of exactly a quarter into scope and tightens how fragmented stakes are aggregated. Several countries set the bar lower: Nigeria and Colombia at 5 percent, Kenya and the British Virgin Islands at 10 percent, Costa Rica at 15 percent. Structures parked at 24.9 percent exist precisely because 25 percent is so widely assumed. The threshold is also only one of two tests. Every serious regime pairs it with a control limb that catches people who hold no shares at all but exercise influence through voting rights attached to a separate share class, board appointment rights, or contractual vetoes. Indirect holdings are multiplied through each layer and aggregated across chains, so a person who holds 15 percent through one intermediary and 12 percent through another is a beneficial owner even though neither stake looks significant on its own. The threshold also interacts with the sanctions ownership rules in a way that catches teams out. A 30 percent holder is a beneficial owner who must be identified and screened, but that same 30 percent is below the 50 percent ownership test that would block the company under OFAC, EU, or UK sanctions rules, so the two calculations have to be run and recorded separately. For a firm operating in several markets, the practical answer is to resolve ownership to the lowest applicable threshold and document the reasoning. The guide to UBO verification across jurisdictions maps the thresholds and the registries country by country.

Start with the registry of the jurisdiction of incorporation and confirm the legal name, registration number, incorporation date, registered address, and current status. Dissolved, struck-off, and in-liquidation statuses are the fastest disqualifiers. Then check that the registry information matches what the customer told you and what appears in other sources: The company's own website and domain registration, tax or VAT registration, licenses required for its stated activity, and, where available, filed accounts. Look at the people. Pull the directors and shareholders from filings and confirm that they are real, that they are not sanctioned or politically exposed, and that they have some plausible connection to the business. Then look for the signals that cluster around illegitimate entities: An incorporation date only weeks before the contract, a registered address shared with hundreds of other companies, directors resident somewhere with no link to the business, ownership split into stakes that sit just below the disclosure threshold, and a mismatch between stated activity and any visible operations. None of these is conclusive alone; three together rarely have an innocent explanation. Scale the depth to the risk. A domestic sole trader opening a low-limit account does not need a structure chart and a source of funds review; a newly incorporated trading company with cross-border ownership and a high expected volume does. Document what was checked, what could not be obtained, and why, because a file that shows a genuine attempt to resolve an opaque structure survives regulatory review and a file that shows a registry lookup alone does not. Finally, recognize the limits of what a registry can tell you. Most registers record what the company filed, not what anyone verified, so a clean registry record is a starting point rather than a conclusion. The guide on how to check if a company is legitimate walks through the checks in order and the evidence to keep.

Partly, and the part that matters for financial institutions never changed. The Corporate Transparency Act created a federal beneficial ownership registry at FinCEN and required most US companies to report their owners. After a series of court challenges, FinCEN issued interim relief in March 2025 exempting domestically formed companies, and in August 2026 finalized a rule making that exemption permanent. Today only foreign reporting companies file, and only for their foreign beneficial owners. The Act itself has not been repealed and litigation over its constitutionality continues, so the position could shift again. What did not change is the obligation on banks and other covered institutions under the Customer Due Diligence Rule to identify and verify the beneficial owners of legal entity customers at 25 percent or more, plus one individual with significant control, at account opening. That obligation was never dependent on the registry and it remains fully in force. The confusion through 2026 came from conflating the two: A registry closing is not a due diligence requirement lifting. Two further points matter for KYB programs. The CDD Rule was itself relaxed in February 2026 when FinCEN granted exceptive relief from re-verifying beneficial owners at every new account opening for an existing customer, so the burden now falls at onboarding and at periodic review rather than on each product added. And non-US institutions onboarding US-incorporated customers can no longer expect any registry to confirm ownership, so they must collect and verify it from the customer as they would for an entity from a jurisdiction with no register at all. In practice, US institutions can no longer expect to rely on a FinCEN identifier or a registry lookup and must collect ownership information from the customer and verify it against other evidence, exactly as they did before the CTA. The guide to the Corporate Transparency Act tracks the current status and what it means for KYB programs.

They are different numbers answering different questions, and running one calculation for both is a common and costly error. The beneficial ownership threshold, usually 25 percent, answers a due diligence question: Who are the people behind this company that must be identified, verified, and screened? The 50 percent rule answers a sanctions question: Is this company itself blocked because of who owns it? Under OFAC's rule, an entity owned 50 percent or more, directly or indirectly, by one or more sanctioned parties is blocked even if it is not named on any list, and the stakes of multiple sanctioned owners are aggregated. The EU adopted the same 50 percent or more test with aggregation in 2024 and added control as an independent trigger, so a designated person with a minority stake and dominant influence suffices. The UK uses a more than 50 percent test, generally without aggregation, alongside separate control criteria. Put the two together and the mismatches are obvious: A 30 percent holder is a beneficial owner who must be identified and screened, but a sanctioned 30 percent holder does not by itself block the entity under the ownership test. A 55 percent sanctioned holder blocks the entity outright. The practical answer is to run two calculations on the same structure chart and record both. The first resolves every natural person at or above the applicable beneficial ownership threshold, and applies the control tests, so that each can be identified and screened. The second aggregates the holdings of any sanctioned parties found in the chain against the 50 percent test of each sanctions regime that applies to the firm, and separately asks whether a sanctioned party controls the entity by other means. Treating the 25 percent screen as sufficient produces false comfort; treating every sanctioned UBO as a blocking event produces unnecessary exits. The guide to the 50 percent ownership rule sets out the calculation, and entity screening versus individual screening explains why the matching logic also differs.

The core set is the same almost everywhere, with local variations in what the registry provides and what the customer must supply. For the entity: Certificate of incorporation or registration extract, evidence of current status and good standing, the registered address, and the constitutional documents such as articles or a partnership agreement that set out how the company is governed. For the people: A register of directors and officers, the shareholder register or cap table, and, for each ultimate beneficial owner, the same identity evidence a KYC check would require, meaning a government-issued identity document and proof of address. For the ownership structure: A structure chart showing every layer between the entity and its natural-person owners, with percentages, plus the underlying documents for each intermediate entity where the chain crosses jurisdictions. For the business itself: Evidence of the nature of the activity, such as licenses, contracts, or a functioning website, and, for higher-risk relationships, financial statements and source of funds. Jurisdiction changes the list at the margins. Some registries provide certified extracts that double as evidence of directors and shareholders; others provide nothing beyond a name and a number, and the customer must supply notarized or apostilled documents instead. For trusts, the trust deed and the identities of the settlor, trustees, protector, and beneficiaries replace the shareholder register. For partnerships, the partnership agreement identifies who holds what. Two points catch teams out. First, self-declared information is not verification; a signed ownership declaration is a starting point that must be checked against registry and other evidence. Second, the file should record what could not be obtained and why, because regulators judge the effort and the documentation rather than the completeness of a perfect structure chart. The guide to KYB verification lists the documents stage by stage, and KYB onboarding shows how to collect them without stalling a commercial relationship.

Point-in-time verification decays from the day it completes, so the honest answer is continuously, with periodic reviews as a backstop. Ownership changes when shares are transferred, directors resign or are appointed, registered addresses move, and a company can be struck off or enter liquidation without anything in the customer relationship signaling it. A risk-based approach sets the periodic review interval by customer risk: Annually or more often for higher-risk entities such as those with complex cross-border structures, PEP or high-risk-jurisdiction exposure, or cash-intensive activity, and every two or three years for low-risk domestic entities with simple ownership. Event-driven triggers matter more than the calendar: A change filed at the registry, a new director, a sanctions list update that touches an owner, adverse media, a material change in transaction pattern, or a customer-initiated change to the account should each prompt a review of the affected file. A refresh is not a full re-onboarding. It re-checks the entity's status, compares the current register of directors and shareholders against the file, re-resolves ownership only where a change has occurred, and re-screens every identified party against updated sanctions, PEP, and adverse media data. What it must always do is produce a dated record that shows what was checked and what changed, because a periodic review with no evidence of review is indistinguishable from no review at all. Continuous monitoring, sometimes called perpetual KYB, replaces the periodic batch with an ongoing watch on registries and data sources so that a change surfaces when it happens rather than at the next review date. This is where automation earns its place, since watching thousands of registries for filing changes is not analyst work. The guide to AI-powered KYB covers how ongoing monitoring is built, and KYB verification covers what a refresh must re-check.

A shell company has no meaningful operations, employees, or physical assets. It exists on paper, often as a holding vehicle, a special purpose entity, or an investment structure, and many are entirely legitimate. Their usefulness for concealment comes from exactly that legitimacy: A shell looks like thousands of other holding companies, and there is nothing in its filings to distinguish a tax-planning structure from a laundering vehicle. A front company is the harder case. It has real operations, real revenue, real customers, and real invoices, and it uses that genuine activity to disguise illicit flows running alongside it. A restaurant, a car wash, or an import business can absorb cash, inflate invoices, or route payments in ways that blend into legitimate trade. Detection differs accordingly. Shells are caught by structural signals: Recent incorporation, a registered address shared with hundreds of entities, nominee directors, no employees, and ownership that resolves to a trust or another shell. Fronts are caught by behavioral signals: Revenue out of proportion to the visible business, cash deposits that do not match the trade, payments to counterparties that make no commercial sense, and margins that no comparable business achieves. The two also carry different regulatory consequences for the firm that onboards them. A shell that turns out to be a laundering vehicle usually exposes a failure in ownership resolution, since the structure was there to be found in the filings. A front company that turns out to be laundering usually exposes a failure in ongoing monitoring, since the onboarding file was accurate and the problem sat in the transactions that followed. Both are frequently set up and administered by trust and company service providers, which is why that profession appears in so many typologies. The guides to shell companies and front companies cover the typologies and the red flags for each.

Yes, and the obligation has expanded faster for platforms than for almost any other sector. Any platform that onboards business sellers, pays out to merchants, extends credit, or moves funds between parties is likely to sit inside a regulatory perimeter, whether as a payment institution, an e-money issuer, a money services business, or an agent of a sponsor bank that carries the obligation on its behalf. Card networks and payment processors impose their own KYB requirements on merchants regardless of regulation, and marketplace regulations in the EU and elsewhere now require platforms to verify the identity and details of business sellers before allowing them to trade. The constraint is scale. A bank might onboard a few hundred business customers a month with an analyst on each; a marketplace might onboard thousands of sellers a day, most of them small, many of them sole traders, and a growing share from jurisdictions where registry data is thin or absent. The program has to be tiered: Automated registry verification and screening for low-risk, low-volume sellers, with ownership resolution and manual review reserved for entities above risk or volume thresholds, and continuous monitoring to catch the seller who was small at onboarding and is now moving significant sums. Platforms also carry a fraud dimension that banks see less of. A seller account is a receiving point for scam proceeds and stolen card payments, and a business that was verified as legitimate at onboarding can be sold, hijacked, or repurposed within weeks. Payout velocity, chargeback ratios, and sudden changes in product category or ship-from location are KYB signals in this context as much as fraud signals, and the monitoring program has to treat them that way. Business verification services provide the registry connectivity that makes the automated tier possible. The guide to KYB for marketplaces and platforms covers how to design the tiers and what regulators and card networks expect.