Three dates show how far a business customer can get before its checks end:
- 9 May 2003. The final US rule on bank identification programs asked banks to describe "the terms under which a customer may use an account while the bank attempts to verify" (68 FR 25090).
- 20 May 2015. Directive (EU) 2015/849 Art 14(3) let member states allow accounts to open with no transactions until verification ends.
- 30 June 2026. MLR 2017 reg 30ZA let UK banks open working accounts for identified customers of an insolvent bank.
The KYB and UBO verification guide's five stages run inside this flow: four before the decision, monitoring after opening.
What is KYB onboarding?
KYB onboarding is the order in which a firm takes a business customer on, with a record of who decided each step. It sits inside know your business, the due diligence run on business customers. KYB verification is its stage 3, the checks that prove the company exists and who runs and owns it.
Its purpose is to understand who the firm deals with before money moves, decide on what terms, and show an examiner or auditor later who accepted each risk.
What are the stages of the KYB onboarding process?
The process involves seven stages, and each stage's output is the next one's input.
Table 1. The core elements of KYB onboarding, stage by stage (as of October 2026; the sign off column is an example split, and each firm's policy names its own roles)
| Stage | Comes in | Must exist before the next stage | Signs off | Rule |
|---|---|---|---|---|
| 1. Intake | Name, number, country, activity, purpose; the person acting and their authority | Names to screen and documents to verify | Onboarding analyst | MLR 2017 reg 28(10); AMLR Art 20(1)(i) |
| 2. Early screening | The company, its directors, its declared owners | Sanctions results, owners and controllers included | Analyst; MLRO for a true match | AMLR Art 20(1)(d); OFAC 50 percent guidance |
| 3. Verification | Owner register excerpt, constitution, officer records | KYB verification's seven checks passed, or gaps recorded | Analyst | MLR 2017 reg 30A; AMLR Art 23(4) |
| 4. Every person found screened | Each director, owner and person acting found | Sanctions and PEP results per person | Analyst; senior management for a foreign PEP | FATF R12; AMLR Art 20(1)(g) |
| 5. Risk rating | Stages 1 to 4, activity, countries | A rating that sets review depth and the next review date | Analyst; senior approver for high risk | FATF R1, R10 |
| 6. Decision and record | The file | Approve, add conditions, refer to EDD or decline, with reasons | The approver the policy names | AMLR Art 21(3) |
| 7. Opening and handover | The approved file | Account open; monitoring rules and review date set | Operations; monitoring team | FATF R10(d) |
Passing each output forward is how KYB checks are integrated into an onboarding process: the owners declared at intake are the names stage 2 screens, and stage 3's register excerpt shows whether that list was complete.
Stage 3 follows the chain to each ultimate beneficial owner, a natural person owning or controlling the company from the top of the chain, and stage 4 screens everyone found. A foreign politically exposed person needs senior management approval and enhanced due diligence.
Stage 5 is risk based onboarding: the KYC risk rating sets how deep stage 6 looks and when the file returns for review. After stage 7, ongoing monitoring takes the file over (ongoing due diligence, ODD).
Which parts of KYB onboarding can be automated?
In an effective KYB onboarding flow, automation covers pulls and screening: tools automate register lookups, ownership mapping and rescreening when lists change. Automated KYB checks still leave authority, material gaps and the outcome to a named person. complead, formerly Sanction Scanner, can verify the business, resolve ownership and screen every beneficial owner through one onboarding call, reporting unresolved layers as unresolved. A business verification service or KYB solution runs the same pulls; the firm stays responsible for the result.
Remote onboarding in the EU follows EBA guidelines 29 to 31 (since 2 October 2023): the policy names the entity types onboarded remotely, and the tool collects company data, the agent's authority and the owners.
What are the KYB onboarding requirements, and when must verification finish?
Table 2. When verification of a business customer must finish, by rulebook (as of October 2026)
| Rulebook | Verification finished | What can happen before | If it cannot be finished |
|---|---|---|---|
| FATF, Recommendation 10 and INR.10 paras 11, 12 | Before or during; later only "as soon as reasonably practicable" if risks are managed and business would otherwise be interrupted | Use under set conditions, such as limits on the number, type or amount of transactions | No account; end the relationship; consider a suspicious transaction report |
| EU today, Directive (EU) 2015/849 Art 14 | Before; during if needed for normal business and risk is little | Account opens, no transactions until customer and owners are verified (14(3)) | No transactions; end the relationship; consider a report (14(4)) |
| EU from 10 July 2027, AMLR Arts 21, 23, 33 | Before, person acting included; during if needed for normal business and risk is little (23(2)); lower risk may postpone it up to 60 days (33(1)(a)) | Same account rule (23(3)); proof of beneficial ownership registration or a recent register excerpt (23(4)) | As today; decisions recorded, refusals included (21) |
| UK, MLR 2017 reg 30 and reg 30ZA | Before, person acting and owners included; during if necessary and risk is little | Account opens, no transactions (30(4)); insolvent bank customers transact once identified (30ZA) | No transactions; end the relationship; consider a disclosure (reg 31) |
| US, 31 CFR 1020.220 and 1010.230 | Data before opening; verification "within a reasonable time after"; owners at the first account (February 2026 order) | Account use on the bank's written terms ((a)(2)(iii)(B)) | Procedures on when not to open, when to close, when to file a SAR |
| Singapore, MAS Notice 626 paras 6.32 to 6.36 | Before; deferral only to avoid interrupting business, risks managed | Relations under the bank's own conditions | No relations or transactions; consider an STR; complete means "obtained, screened and verified" (6.36) |
Every rulebook starts from verification first; where it cannot be finished, the firm takes no business and considers a suspicious activity report (in the UK, a disclosure under MLR 2017 reg 31). The exceptions differ: US banks may verify after opening, the EU and UK hold transactions, and FATF and Singapore set conditions in advance.
A policy that lets a business customer use its account before verification ends needs the conditions FATF names, such as a cap on the number, type or amount of transactions and monitoring of large or complex transactions outside the expected norms; an account marked pending with no cap has no condition at all, only an exception nobody signed.
Which firms run KYB onboarding?
Firms that perform customer due diligence on business customers: financial institutions, payment and e money firms included (FATF Recommendation 10), and lawyers, accountants and trust and company service providers for the Recommendation 22 activities.
EU marketplaces run a lighter version on traders (Digital Services Act Art 30): name, address, identity document, payment account and register number, collected "prior to" use and checked with "best efforts". Art 29 exempts platforms that are micro or small enterprises, unless designated very large.
Which onboarding rules were new in 2026?
- 13 February. A FinCEN order lets US banks take a legal entity's owners at its first account and again only on doubt or risk, so a second account no longer restarts that step.
- 30 June. For an insolvent bank's company customers taken on within 30 days, UK banks may allow transactions once they are identified and collect the register excerpt later (reg 30A(8A)).
- 14 August. FinCEN's final rule took effect, keeping US companies exempt from ownership reporting; bank owner checks under 1010.230(b) stay.
- 30 September. AMLA published its final report on the AMLR Art 28(1) due diligence standards, which will be submitted to the European Commission for adoption; existing remote tools meeting its Article 7 requirements may verify a person who can neither show documents in person nor use eIDAS identification.
Next: the AMLR, Art 23 included, applies from 10 July 2027.
Where does KYB onboarding stall?
In the backlog, where the flow holds or leaks. A hold keeps new customers waiting, which is the rule working; a leak lets customers transact on an exception, where risk enters.
A 2020 case shows the importance of a written hold. In October 2016, Internal Audit at Commerzbank AG's London branch reported a "huge backlog" including 1,720 new clients awaiting due diligence, and the branch could not transact with them "until their KYC was approved" (para 4.79).
The leak was an Expiry Exceptions List: existing clients overdue for refreshed checks kept transacting, with no set procedure for approving or recording extensions, and by the end of 2016 its use was "out of control" (para 4.85). In some business areas, owners were not always verified from an independent source either (para 2.5.3). The FCA fined the branch £37,805,400 on 17 June 2020, after a 30 percent discount on £54,007,800 (Final Notice; FCA release).
Why does KYB onboarding take longer than KYC onboarding?
One business file holds several people and at least one ownership chain. Layers have to be walked, some registers name no owners, foreign documents need reading against their own register, and an EDD referral adds a review. The greater focus on owners (UBOs) is a count: each layer adds entities to verify and people to screen. The rules set when verification must finish; none of them sets an industry benchmark for how long it takes.
How is KYB onboarding different from KYC onboarding?
- The entity comes first, because its register entry names whom to check next.
- The chain is resolved, to natural persons or a recorded gap; a personal customer has none.
- KYC runs several times, once per director, owner and person acting, through KYC verification, the person checks.
Onboarding an individual is a separate flow.
What can an onboarding lead fix this week?
- Write which stages may finish after the account opens, under which caps, and for which customers.
- List open files with an owner or person acting unchecked.
- Match every exception on file to a named approver and a date.
Related terms
- KYB verification. The stage proving a business customer exists, and who runs and owns it.
- Ultimate beneficial owner. A natural person who owns or controls a company, directly or through layers.
- KYC verification. The checks that prove a person is who they claim to be.
- Enhanced due diligence. Deeper checks for higher risk customers.
- Ongoing monitoring. The watch on a file after opening.
- Know your business (KYB). Due diligence on business customers; onboarding is its entry flow.
How this entry was checked. On 28 October 2026 every rule in Tables 1 and 2 and the 2026 list was opened in its own text, as were the EBA guidelines, the Digital Services Act, OFAC's guidance and the Commerzbank Final Notice. The definition rests on those timing rules; Table 1's sign off column is an example, not a rule. Minhac Celik (Marketing Advisor, complead) wrote it, and Ufuk Gürdaş (Compliance Specialist) checks its rules as fact checker. Last reviewed: 29 October 2026.
