KYB (know your business): the checks a provider runs on your company

What KYB means

KYB stands for know your business. It is the business counterpart of know your customer (KYC): where KYC checks a person, KYB checks a company. In a merchant application, it covers three questions: does your company legally exist, who owns and controls it, and is the business it describes the business it runs?

The two US rules quoted below do not use the phrase. They speak of a customer identification program and customer due diligence, and they bind banks and other covered financial institutions. Guidance for US bank examiners from the Office of the Comptroller of the Currency (OCC) notes that processors are generally not subject to the same anti-money-laundering rules, so a bank that works with processors is expected to manage that risk itself. The provider decides what it asks you for; the rules show what a bank must collect where they apply.

Checking that your company exists

A US bank’s customer identification program must, at a minimum, collect your company’s name, its principal place of business, local office or other physical location, and, for a US company, a taxpayer identification number. A foreign business without an identification number is asked for alternative government-issued documentation certifying its existence.

The bank then verifies that information within a reasonable time. For a company, the rule gives these examples of documents showing that the entity exists:

• certified articles of incorporation;
• a government-issued business license;
• a partnership agreement;
• a trust instrument.

Instead of documents, or as well as them, a bank may use non-documentary methods. The rule’s examples are contacting the customer, comparing what you supplied with a consumer reporting agency, a public database or another source, checking references with other financial institutions, and obtaining a financial statement.

Who owns and controls your company

The customer due diligence rule (31 CFR 1010.230) asks covered institutions to identify and verify the beneficial owners of a legal entity customer when it opens a new account. A legal entity customer includes a corporation, a limited liability company, a general partnership and similar entities formed abroad.

The person opening the account can certify the owners’ details on the rule’s standard form, or give the same information another way and certify that it is accurate as far as they know. The institution verifies each owner’s identity using risk-based procedures, and may rely on the information you supply unless it knows of facts that call it into question. A nonprofit registered with its state is subject only to the control test.

What Visa’s rules add

Card networks set their own duties for the acquirers and payment facilitators that sign merchants. Visa’s rules (edition of 18 April 2026) say that before entering into a merchant agreement, the acquirer or payment facilitator must ensure the prospective merchant is all of the following:

• financially responsible;
• not engaged in any activity that could cause harm to the Visa system or the Visa brand;
• operating within an allowed jurisdiction;
• not misrepresenting its merchant outlet location or locations.

Section 5.2.1.2 adds that, before contracting, the acquirer or payment facilitator must carry out an adequate due diligence review, including a site visit to the business premises where applicable, or a suitable alternative, so that it submits only legal transactions to Visa’s network.

The OCC’s guidance asks a bank’s underwriting policy for a background check that supports the validity of the business, and lists checks against the US sanctions list and the card industry’s MATCH list as standard industry practice. The full underwriting list is in the companion guide on applying for a high-risk merchant account.

FinCEN ownership reports are a separate matter

Older guides to KYB may describe the beneficial ownership reports that companies once had to file with FinCEN, the US Treasury’s financial-crimes bureau. FinCEN’s page, updated on 11 August 2026, says its final rule exempts US companies from those reports, that the rule became effective on 14 August 2026, and that only certain foreign companies registered to do business in the United States must still report.

That change concerns filings to the government. It does not remove a bank’s own customer due diligence: as published on 22 October 2026, the rule in 31 CFR 1010.230 still contains the 25 percent ownership test and the control test. Expect a provider to ask who owns and runs your company whether or not you ever filed a report.

What to have ready

Each item below maps to a check described above. Your provider may ask for more, or accept a different form of the same evidence.

Scroll the table to see all columns.

Keep the same legal name, address and ownership across your registration, your application and your website. If anything has changed recently, such as a new owner, a new address or a new product line, explain it in the application rather than leaving the provider to find it.

On Zolution, you keep documents in your own storage and save a private link for each one, typed as company registration, tax documents, identity of signer, bank statements, processing statements, website and compliance, or other. You choose which links to release to one named provider at the application’s review step, and you can add a missing-history note for anything you cannot provide. Zolution is a free marketplace (Zolution Standard membership costs nothing); it processes no payments, holds no funds and approves nobody.

Questions, answered