Learn how KYB verification works, what data sources to use, and how to build a verification process that balances compliance with conversion.
KYB verification is the process of confirming that a business is real, legitimate, and safe to do business with. Verifying an individual is relatively straightforward: check a driver's license against a government database. Verifying a business is harder. It requires piecing together information from multiple sources to build confidence in the entity's identity, ownership, and operating status.
This guide explains what KYB verification actually verifies, the data sources available, and how to build an effective verification process.
Business verification isn't a single check. It's a layered process that examines different dimensions of a business's identity.
The foundation of KYB is confirming that the business legally exists. This means verifying that the company is registered with the appropriate Secretary of State or equivalent authority, and that the legal entity name matches registration records.
Key checks include:
This is entity verification in its most basic form: confirming that the business exists as a legal construct.
Legal existence is necessary but not sufficient. A business operates under multiple identities: its legal name (what's on the registration), its trade name or DBA (what customers see), and its physical presence.
Business identity verification connects these dimensions:
Identifying who actually owns and controls a business is central to KYB compliance. Beneficial owners, typically defined as individuals with 25% or more ownership or significant control, must be identified and verified.
Ownership verification involves:
A business can be legally registered but not actually operating. Operating status verification distinguishes active businesses from those that exist only on paper.
Signals of genuine operation include:
This is particularly important for detecting shell companies: entities that are legally formed but have no real economic activity.
No single data source provides complete verification. Effective KYB requires combining multiple sources.
Ground truth data comes from primary, authoritative sources:
State business registries: The Secretary of State in each US state maintains records of registered entities. These are the authoritative source for legal entity existence and registration status.
Tax records: IRS data (EIN verification) and state tax records confirm tax registration status.
Licensing databases: Industry-specific licenses (money transmitter, insurance, healthcare) provide additional verification for regulated businesses.
The advantage of authoritative sources is accuracy; they're official records. The disadvantage is that they're often outdated, incomplete for small businesses, and don't capture operating reality.
Commercial sources aggregate and enhance business data:
Business credit bureaus provide credit files, payment history, and firmographic data for businesses with credit activity.
Data aggregators compile information from multiple sources into unified business profiles.
Verification platforms offer API access to multiple data sources with matching and scoring capabilities.
Commercial data offers broader coverage and enriched information but varies in quality and freshness.
Sometimes you need information directly from the business:
Document upload: Articles of incorporation, business licenses, bank statements, or utility bills provide verification evidence.
Self-attestation: The business provides information about ownership, operations, and other details.
Direct collection captures current information but creates friction and carries fraud risk if documents aren't independently verified.
Strong verification corroborates information across sources. When registry data, commercial data, and collected information align, confidence increases; when they conflict, investigation is warranted.
Entity resolution is the technical challenge of matching records across sources that may have different names, addresses, or identifiers for the same business.
Start by collecting basic identifying information:
The key principle: collect only what you can't retrieve from data sources. Every additional field reduces conversion.
With basic identifiers, query data sources:
Name matching is the first hard problem. Businesses use variations (Inc. vs. Incorporated), abbreviations, and may operate under names that bear no resemblance to their legal registration.
Identify and verify beneficial owners:
Apply a risk-based approach to determine verification depth:
Risk signals include industry type, jurisdiction, ownership complexity, adverse media, and transaction patterns. No single signal is dispositive; they compound.
Reach a verification decision:
Document the verification process, sources consulted, and rationale. This audit trail is essential for compliance examinations.
Traditional KYB works well for corporations with state filings and credit histories. It struggles with smaller entities:
Sole proprietors often operate without state registration, making registry verification impossible.
Micro-businesses may have thin or no credit files and limited commercial data presence.
New businesses, recently formed entities, lack the history that verification relies on.
Alternative verification strategies are needed for these thin-file businesses: SSN matching, bank account verification, transaction history.
Businesses have multiple names: legal name, trade names, brand names, abbreviations. Matching "ABC Holdings LLC" to "ABC Co." to "ABC Services" requires sophisticated entity resolution.
Business graphs, data models that connect related entities, help navigate this complexity by showing relationships between legal entities, trade names, and locations.
Registry data can be months old. A business that was active at last filing may have since dissolved. A registered address may no longer be current. Verification against stale data creates false confidence.
Ongoing monitoring and periodic re-verification address this, but point-in-time verification has inherent limitations.
Business registration, data availability, and verification standards vary dramatically by country. What works for US verification may be impossible for businesses in jurisdictions with limited public records or different legal frameworks.
Cross-border ownership structures add another layer; beneficial owners may be in different jurisdictions than the business itself.
Track these metrics to assess your verification process:
Auto-verification rate: What percentage of businesses are verified without manual intervention? Higher is better for efficiency, but not at the cost of accuracy.
Manual review rate: What percentage require human review? This drives cost and turnaround time.
Time to verification: How long from application to decision? Speed matters for conversion.
False positive rate: How often are legitimate businesses incorrectly flagged? High false positives create friction and lose good customers.
False negative rate: How often do risky businesses slip through? This is the compliance and fraud risk.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Regulatory requirements vary by jurisdiction and change over time. Consult qualified legal counsel for guidance specific to your situation.