KYB verification: the documents to collect and how to check them against each other

KYB verification checks that a business customer exists, is in good standing, and is owned and run by the people it names. KYB stands for know your business. Banks, lenders and fintechs do it before they open an account or fund a loan. The business sends papers from the state, an IRS letter with its tax ID and its ownership papers. Your team checks each document against the others and against the application.

KYB vs KYC: what changes when the customer is a business#

KYC checks a person. You collect a name, date of birth, address and ID number, and you check them against a photo ID or other sources. Automated KYC verification covers those checks.

A business has no photo ID. A corporation or an LLC exists because a state accepted its filing, so the proof comes from documents. The filing shows the legal name and the state. A letter from the IRS shows the tax ID, called an employer identification number (EIN). A certificate from the state shows whether the business is still active.

KYB also covers people, because someone owns and runs every business. The rules ask you to identify the owners and one person who controls the business. Then you check each of them the way you'd check an individual customer. So a KYB file holds KYC checks too.

What US rules require for KYB#

For US banks, KYB rests on two rules from FinCEN, the Treasury bureau that writes the Bank Secrecy Act rules.

The CIP rule covers the business itself

The Customer Identification Program (CIP) rule lists what a bank must collect before it opens an account. For a business, that's the name, an address and a taxpayer identification number. The address must be a principal place of business, a local office or another physical location.

The bank then verifies the business with documents, with other sources, or with both. The rule gives four examples of such documents. They are certified articles of incorporation, a government business license, a partnership agreement and a trust instrument. The bank must keep a description of each document it relied on. It must also record how it resolved any substantive discrepancy.

The beneficial ownership rule covers the people

The beneficial ownership rule is part of FinCEN's customer due diligence (CDD) rule. A bank must identify each person who owns 25% or more of the business, directly or indirectly. It must also identify one person with significant control, such as a CEO, CFO, managing member or general partner. For each of them, the bank collects a name, address, date of birth and Social Security number. A non-US person can give another ID number instead.

The person opening the account certifies this ownership information. FinCEN offers a certification form, but using it is optional. The bank can rely on the customer's certification, unless the bank knows of facts that call the certification into question. It then verifies each owner's identity with at least the steps it uses for an individual customer. For owners, a photocopy of an ID is allowed. A bank may also use a threshold lower than 25% when its own risk assessment calls for it.

The ownership rule covers federally regulated banks and federally insured credit unions. It also covers securities brokers and dealers, mutual funds, and futures and commodities brokers. Lenders and fintechs outside that list write their own KYB policy, and a partner bank may set part of it.

What changed in 2025 and 2026

On February 13, 2026, FinCEN issued an order that lets banks collect owner details less often. Banks and other covered institutions no longer have to identify and verify a business's owners each time it opens another account. Instead, they can limit it to the first account the business opens. After that, they do it again when facts call the earlier information into question, or when their own risk-based procedures call for it. In that last case, the customer can confirm that the earlier information is still accurate, and the bank keeps a record of that confirmation. Each bank chooses whether to use this relief, so some still collect ownership at every new account. FinCEN says it plans further changes to the CDD rule.

Beneficial ownership reporting to FinCEN also ended for US companies. An interim final rule removed it in March 2025, and a final rule took effect on August 14, 2026. Only certain foreign companies registered to do business in the US still report. That reporting was a separate rule from the bank's own duty. The final rule notes that banks' duty to do customer due diligence under the 2016 CDD rule continues. So your team still collects and verifies ownership from the customer.

The KYB document checklist#

The rules name only a few documents, so your own policy fills in the rest. A US KYB file usually holds the documents below.

• Formation documentA corporation files articles of incorporation. Some states call them a certificate of incorporation. An LLC files articles of organization. Some states, such as Delaware, call it a certificate of formation. The document shows the exact legal name, the entity type, the state and the filing date.
• IRS letter that confirms the EINThe IRS issues a CP 575 notice when it assigns an EIN, and the original can't be reissued. If the business lost the notice, it can ask the IRS for Letter 147C. An eligible business can also download a digital CP575 from its IRS business tax account. The IRS says banks accept the digital CP575 as written confirmation of an EIN.
• Certificate of good standingThe state issues it, and each state gives the certificate its own name. Delaware issues a certificate of good standing or a certificate of status, and California issues a certificate of status. It shows the business's status on the day it was issued.
• Ownership documentsThese are an LLC's operating agreement, a corporation's stock ledger or a partnership agreement. They show who owns what share.
• Beneficial ownership certificationThis is your own form or FinCEN's optional one, signed by the person opening the account. It lists each 25% owner and the control person.
• An ID for each ownerAsk for an unexpired driver's license or passport for each person on the certification.
• Business license or permitAsk for it if the business's trade needs one. It shows the licensed name and address, and often an expiry date.
• A recent business bank statementA bank statement shows the account holder's name and address, so it gives you a second source for both.
• DBA filing, if the business uses a trade nameA DBA ("doing business as") filing links a trade name to the legal name. Ask for it when a statement or license shows the trade name and your policy requires it.

Some teams also ask for a W-9, which repeats the legal name and EIN as the business states them. W-9 data extraction covers how to read and check one.

How KYB verification works#

The packet often arrives as one PDF or as a batch of email attachments. First, your team or your software splits the packet into separate documents and labels each one. Then the same team or tool pulls the key details from each document into fields. The fields include the legal name, EIN, state, status date, owners and shares.

Next, the fields are compared across the file and with the application. A file where everything agrees moves on to the registry and screening checks. A file with a mismatch goes to a person, who sees the two values side by side. That person fixes the record, asks the business for a document, or escalates the file under your policy.

The fields that must agree across the file#

A few fields appear on several documents. Check each one everywhere it appears. The table shows where to look and why a field may differ.

When a field doesn't match, write down how you resolved it. For banks, the CIP rule requires that record for each substantive discrepancy. The beneficial ownership rule (31 CFR 1010.230(i)) requires the same record for owners. Keep it for five years after you make it. A note such as "statement shows the trade name; DBA filing on file" is that record.

Our take. Judge KYB automation on whole files, not single pages. A tool can read every field on an IRS letter and still miss that the name on it differs from the formation document. The comparison across the file is what decides whether an analyst has to open it. So test any tool with complete packets from real customers, not a stack of single documents.

Where KYB files stall#

A KYB file stops when two documents disagree about an ordinary fact. These are the gaps to plan for.

Start with names. The formation document shows the full legal name, and the bank statement shows a shorter trade name. Your policy decides whether that passes or needs the DBA filing. Write the rule down, so two analysts don't settle the same gap two different ways.

The IRS letter can carry an old name. The original CP 575 can't be reissued, so a business that changed its name may still send the notice with its first name on it. Delaware's long-form certificate of good standing lists every filing, including name changes, so it can explain the difference.

Certificates also go out of date. A good standing certificate shows the status on the day the state issued it. If your policy sets a maximum age and the certificate is older, ask the business for a new one.

Ownership is harder when another company owns part of the customer. The rule counts indirect ownership. In FinCEN's own example, one person owns 20% of the customer through one company and 16⅔% through another. That's 36⅔% in total, so she's a beneficial owner, though neither stake reaches 25% on its own.

Then there are gaps in the packet itself. The signed certification is missing, or one owner's ID never arrived. Someone has to ask for it, and the file waits until it comes.

Which checks need data from outside the file#

Reading the documents tells you whether they agree with each other and with the application. Other KYB questions need data that the documents don't carry.

• Document checks

  Read each document, compare its fields with the rest of the file and the application, and flag anything missing. Document AI does this part.

• State registry lookups

  Confirm that the state's records show the business as active today. KYB data vendors query state records, or your team checks the state's website.

• Sanctions and watchlist screening

  Check the business and the people behind it against sanctions lists and other watchlists. Screening tools run these name checks.

• Owner identity checks

  Compare each owner's ID with a live selfie when owners apply online. ID verification tools do this.

Different vendors may run these checks. Make sure an analyst can see every result for a business in one place. The best KYC document verification software compares the ID verification tools.

Where Docsumo fits in the workflow#

Docsumo does the document checks.

It reads any document type, so formation papers, IRS letters and state certificates don't need a pre-built model. It has pre-trained models for passports and driver's licenses. Driver's license OCR covers the fields on the front of a license and the barcode on the back.

Packets reach Docsumo by upload, by email or through the API. On the Business plan, Docsumo sorts each uploaded document by type and splits a combined PDF into separate documents. Its AI Split feature takes a plain-English definition of each document type.

On the Enterprise plan, cross-document validation compares the documents with each other and with the application. That's the step that checks the fields in the table above. Case management, also on the Enterprise plan, keeps each business's documents together in one case. You can add your own checks as steps in the workflow, such as a step that adds up the owners' shares.

You set a confidence threshold for each field. A field below its threshold goes to a person. When the reviewer clicks it, Docsumo highlights the line in the document where the value came from. If a document is missing, the Document Collection and Email agents can email the sender to ask for it. Checked data goes to your onboarding or loan system through the API and webhooks. For lenders, IDP for lending covers the rest of the loan file.

KYB files hold owners' Social Security numbers. Docsumo is SOC 2 Type 2 audited and ISO/IEC 27001:2022 certified. It encrypts data in transit and at rest, and it can find sensitive data such as Social Security numbers and redact it. The security page lists the details.

Docsumo isn't a KYB data vendor. It doesn't look up state registries, screen names against sanctions lists or watchlists, or run selfie checks. Pair it with the tools that do.

Start with the KYB files your team sent back#

Pick a few recent files that needed a second request or a manual fix. They show which fields disagree most often in your own customers' papers. Run those files through any tool you're considering, and count the mismatches it finds without help. Then compare the mismatches the tool flagged with the notes your analysts wrote.

Book a demo with a few of your own KYB files, or start a free trial.

Frequently asked questions#