Introduction
Opening a business account takes more than checking a registered name. A bank has to know that the entity exists, who owns or controls it, what it does and what risk it brings.
For UK banks and growing fintechs, that is harder than it sounds. KYB requirements are risk-based and shift with customer type, product, jurisdiction and regulatory status. The Money Laundering Regulations 2017 (MLRs) set duties for corporate customer due diligence (CDD) but don't define a separate "KYB regime".
This article covers what to collect, how to verify it, how to monitor afterwards and how to govern the process. It is general information, not legal advice.
Key Takeaways
- KYB establishes a business's identity, ownership, control and risk profile.
- Map your framework to the MLRs, FCA rules, sanctions duties and sector guidance.
- Evidence spans registration, owners, directors, activity, licensing, source of funds and screening.
- Keep KYB current after onboarding with reviews, trigger events and documented decisions.
What Is KYB in Banking?
KYB (Know Your Business) is the process of confirming that a corporate customer is genuine and appropriate to onboard. It sits inside customer due diligence and supports anti-money laundering (AML) and counter-terrorist financing controls.
How KYB relates to KYC, CDD and EDD
- CDD is the legal duty under the MLRs. KYB is the entity-focused part of it.
- KYC verifies the people connected to the business: beneficial owners, directors and authorised controllers.
- EDD adds extra measures where risk is higher.
A business account usually needs both KYB and KYC.
Why banks need visibility
Corporate structures can hide the origin and destination of funds. The 2025 National Risk Assessment says UK companies have been used to move or store overseas criminal assets, and overseas cases involve chains of shell companies and trusts.
The main exposures:
- Shell companies and opaque control
- Sanctions breaches
- Fraud
- Activity that doesn't match the stated purpose
KYB Requirements for UK Banks
Entity identity and legal existence
Collect:
- Registered legal name and trading names
- Company or registration number
- Registered office and operating address
- Jurisdiction of incorporation and legal form
- Current registration status and incorporation evidence
Regulation 28 requires reasonable measures to understand the customer's governing law, constitution and management. Checking the register is a start, but you cannot rely solely on information filed at a registrar. Companies House itself says its data is not comprehensive and occasional inaccuracies occur.
If the applicant's details differ from official records, pause, ask for an explanation, request supporting documents and record the outcome. Material PSC discrepancies linked to money laundering or concealment may need reporting to Companies House under regulation 30A.
Ownership and control structure
Map direct and indirect ownership through shareholders, parent entities, trusts and nominees until you reach the individuals who ultimately own or control the business. Tests differ by entity type:
| Customer form | Beneficial owner test |
|---|---|
| Body corporate | Individual with more than 25% of shares or votes, ultimate management control, or other control |
| Partnership (not LLP) | More than 25% of capital, profits or votes, or ultimate management control |
| Trust | Settlor, trustees, beneficiaries (or class) and anyone with control |
Don't treat 25% as universal. Trusts and other arrangements rely on roles and control, not a percentage.
Keep ownership charts, shareholder or partner information and a written explanation for any layered or opaque structure.
Directors, beneficial owners and connected individuals
Verify identity and address for beneficial owners, directors, trustees, senior managers and authorised signatories. Screen each against sanctions, PEP and adverse media sources.
Since 18 November 2025, Companies House identity verification is legally required for directors and PSCs. It is a useful signal, but it doesn't replace your own checks.
If ownership can't be reliably established, someone refuses verification or sources conflict:
- Don't onboard on assumption
- Escalate for senior review
- Consider declining or restricting services
- Assess whether a suspicious activity report is needed
Business activity, purpose and risk profile
Understand the business model, products, customers, delivery channels, operating jurisdictions, expected account use and likely transaction patterns. Add licensing or regulatory status, sector permissions, source of funds or wealth where relevant, and why the business needs the account.
The FCA's 2025 CDD review found some firms failed to record the purpose of the relationship. That information anchors your risk assessment and lets you spot activity that doesn't fit.
Screening and enhanced due diligence
Screen the business and relevant individuals against:
- The UK Sanctions List (the OFSI Consolidated List stopped updating on 28 January 2026)
- PEP databases and adverse media
- Criminal or fraud indicators
- High-risk jurisdiction information
Since 30 June 2026, the MLR country trigger for EDD is FATF's Call for Action list. Check the current list rather than old Schedule 3ZA tables.
An alert isn't proof of wrongdoing. Document the review, resolve false positives and set an escalation path.
Regulation 33 EDD measures include additional ownership information, source of funds and wealth, senior management approval and enhanced monitoring.
Records, privacy and audit evidence
A defensible file shows what you collected, which sources you checked, results, risk rationale, approvals, exceptions, escalations and review history.
- Regulation 40 requires CDD records for five years after the relationship ends, with personal data deleted afterwards unless an exception applies.
- UK GDPR requires data to be limited to what is necessary, kept no longer than needed and secured.
- Restrict file access by role.
Keep your checklist proportionate to your risk appetite, customer type and obligations, and have compliance or legal professionals review it.
How to Implement a Risk-Based KYB Process
Map the regulatory perimeter and risk appetite
Start by identifying which rules, FCA permissions, activities, products and channels apply. Banks, e-money institutions, payment firms and crypto firms have different obligations, and a "fintech" label alone doesn't set scope.
Then document:
- Risk appetite and restricted sectors
- High-risk indicators
- Minimum evidence standards
- Approval authorities
- EDD triggers
Regulation 18 requires a written, up-to-date business-wide risk assessment, and regulation 19 requires senior-management-approved policies.
Collect, validate and reconcile
Run a controlled intake: gather applicant information, then check it against registers and reliable documents. Confirm records are current, investigate name and address mismatches, handle overseas entities and record why any alternative evidence was accepted.
Label every data point as one of:
- Self-declared
- Independently verified
- Inferred from a source
- Outstanding
Trace ownership and run connected-person checks
Analysts should build an ownership and control map, then feed each individual into KYC and screening workflows. Set procedures for nominees, trusts, charities, partnerships, listed groups and entities with no obvious natural-person owner.
End with a written conclusion: who controls the business, what evidence supports it, and whether unresolved uncertainty changes the risk decision.
Apply risk-based decisioning and escalation
Combine entity, ownership, geography, industry, product, channel, transaction and screening factors. Possible outcomes:
- Approve
- Approve with conditions
- Request more information
- Refer for EDD
- Restrict services
- Decline
A score alone shouldn't decide. Assign owners for second-line review and senior approval.
Suspicion triggers duties under POCA sections 330 to 332 and the Terrorism Act 2000 s21A. SARs go to the UKFIU at the NCA. Section 333A makes it an offence to disclose information likely to prejudice an investigation, so avoid tipping off the customer.
Keep an audit-ready record
Capture evidence reviewed, factors considered, rationale, reviewer, approval date, exceptions and the next review trigger. Then prove it works in practice:
- Quality assurance and sample testing
- Role-based training (regulation 24 requires a written training record)
- Periodic policy reviews
The FCA's Monzo final notice shows the cost of gaps: a £21,091,300 penalty, with business CDD procedures that didn't require verifying all beneficial owners or PSCs up to August 2020.
Ongoing Monitoring, Governance and Technology
Ongoing monitoring after onboarding
KYB keeps your view of the business accurate. Transaction monitoring, by contrast, looks at account activity for suspicious patterns. You need both.
The MLRs require CDD to be kept current, but no fixed interval is prescribed. JMLSG says frequency depends on relationship risk, and trigger-based review can't become an excuse for stale information.
Triggers for earlier review:
- Change in ownership or directors
- Change in registration status or licence
- New sanctions or adverse media hits
- New business lines or jurisdictions
- Activity out of line with the stated purpose
Automation with human oversight
Technology helps with document collection, registry checks, ownership mapping, screening, alert routing and case records. It has limits: incomplete registries, name-matching errors and outdated data.
FCA sanctions findings noted that some systems missed obfuscated or variant names, and that customer records had missing or placeholder birth dates. Complex ownership and escalated alerts need human judgement.
When evaluating a provider, ask about:
- UK and cross-border coverage
- Source transparency and refresh cycles
- Explainable results and audit trails
- Integrations and data protection
- Manual-review controls
Governance and accountability
Responsibilities typically sit as follows:
- Board or senior management: approve policies and own MLR compliance
- MLRO: reports at least annually and handles SARs
- First line: onboarding teams run the process
- Legal, risk and internal audit: advise and test independently
Support those roles with:
- Documented policies and role-based training
- Quality assurance and management information
- A process for absorbing regulatory change
Outsourcing doesn't transfer responsibility. Regulation 39 leaves liability with the firm relying on a third party, and SYSC 8 says outsourcing doesn't remove regulatory obligations.
When specialist compliance leadership may help
A scaling bank, fintech, payments or crypto firm may need senior support to design a KYB framework, prepare for sponsor-bank or investor scrutiny, remediate gaps, or cover an MLRO vacancy.
Fraxtional offers director-led fractional and interim compliance leadership, including MLRO services, across UK and cross-border operations. Its work includes evaluating KYC/KYB and sanctions procedures and producing audit-ready documentation.
It complements, rather than replaces, your accountable senior management, documented controls and independent legal advice.
Frequently Asked Questions
What does KYB mean?
KYB stands for Know Your Business. In banking, it verifies a business entity, its ownership, control and risk before and during a financial relationship.
What is KYC in banking?
KYC (Know Your Customer) verifies individual customers. KYB covers companies, while KYC also applies to a business's beneficial owners and controllers.
What documents are required for KYB in UK banking?
Typically incorporation evidence, ownership and control information, identity documents for relevant individuals, licensing evidence and business-purpose information. Higher risk means extra documents.
How is KYB different from KYC?
KYB assesses a legal entity and its ownership structure; KYC verifies people. Banks commonly need both for a business account.
How often should banks perform KYB checks?
Initial checks happen before or at onboarding. Later reviews should be risk-based and triggered by material changes, not only a fixed timetable.
Is KYB required for fintechs and payment firms in the UK?
It depends on the firm's regulated activities, customer relationships and applicable rules. The FCA says the MLRs apply to banks, payment institutions, e-money institutions and cryptoasset businesses. Confirm the current position with FCA guidance and a qualified adviser.
