KYB vs KYC: what to verify on a sub-merchant, and how deep

Your team approved a sub-merchant's file on Monday. On Thursday the acquirer sent it back: the passport of a shareholder holding 25 percent through a holding company was missing. Nobody made a mistake. You verified the same company to two depths.

KYB and KYC are nested, and the depth of each is a risk decision taken by two parties, your team and the partner that underwrites. Onboarding tools flatten that into one document list. NORBr Onboard keeps the structure: one file per merchant holding the entity, its people, a risk level and a depth that changes with the answers. It does not verify identities itself.

This article, written in October 2026, sets out what each layer verifies, who decides, and how often you do it again.

What does KYB actually verify on a sub-merchant's legal entity?

KYB, Know Your Business, verifies that the company exists, who owns it and what it sells. That means the registration record, legal form and registered address, the ownership chain down to the natural persons who ultimately own or control it, sanctions and adverse-media screening on the entity, and the business itself: website, products, merchant category code.

The entity part has a legal definition. Article 22 of the EU AML Regulation lists the legal form and name, the registered office, the country of creation, the legal representatives and, where available, the registration number, tax identifier and Legal Entity Identifier. The ownership part has a threshold. Under Article 52, a beneficial owner is a natural person holding, directly or indirectly, 25 percent or more of the shares, voting rights or other ownership interest, with indirect holdings multiplied along each chain and added across chains. The fourth directive said more than 25 percent. A shareholder at exactly 25 percent is now in scope, hence the Thursday passport.

The business part has no legal definition and matters as much to a payment partner. A clean ownership chain can still sell something the acquirer does not want on its books. MCC, website and declared volume are the KYB answers that set the depth of everything that follows.

What does KYC add on the people behind the entity?

KYC, Know Your Customer, verifies the natural persons that KYB surfaced: the directors, the signatory of the merchant agreement and each beneficial owner. For each, the operator collects identity data, verifies it against a document or an electronic identity, and screens the person against sanctions and politically exposed person lists.

The same Article 22 sets the data points for a person: all names, place and full date of birth, nationality, usual residence and, where applicable, national identification and tax numbers. Its paragraph 6 sets two verification routes: an identity document, passport or equivalent, or an electronic identification means at the substantial or high assurance level under eIDAS. Liveness detection, the check that the person presenting the document is actually present, is a vendor feature inside the first route, not a legal requirement, applied where the risk or the partner asks for it.

In a sub-merchant file the people change more often than the entity. A director resigns, a holding is sold. Each is a KYC event on a KYB that has not moved, which is why the two layers belong in separate blocks rather than one PDF.

What does light KYC mean, and how do operators tier it by risk?

Light KYC is not a legal category. It is the industry's name for identity verification limited to the signatory and the main beneficial owner, reserved for merchants whose category, country and volume place them in the operator's low-risk tier. Full KYC extends the checks to every director and beneficial owner, with enhanced screening and often a liveness check.

The tiering logic predates the AMLR. Visa's payment facilitator and marketplace risk guide, dated April 2021, describes categorising prospective sellers from higher to lower risk, cascading approval limits per category, approval concurrence for sellers that pose a higher risk based on MCC or sales volume, and enhanced due diligence for high-brand-risk merchants. KYC depth is the operational output of that classification.

Depth is also what the file costs. Fenergo's October 2024 survey of more than 450 bank executives put a medium-risk KYC review at around 2,250 dollars per case, and 67 percent of banks had lost clients to slow onboarding. A sub-merchant file is lighter, but a person verified beyond what the risk requires costs money and days, and a person skipped below what the partner requires costs a rejected file.

In practice the tier is a switch, not a slider. A few answers, the MCC, the country of incorporation, the declared volume, a holding in the ownership chain, move the merchant from light to full. The difficulty is making that switch fire inside the questionnaire, as the merchant answers, rather than three days later when a reviewer notices.

Who decides what: the operator, the acquirer or the scheme?

The operator collects and reviews. The acquirer or payment partner underwrites and carries the scheme liability. The scheme sets the frame for both, and a PayFac, PSP, ISO or ISV is rarely the party that decides whether the merchant processes.

Visa's description of the payment facilitator model, dated February 2024, puts it in one line: acquirers are responsible for the acts of both payment facilitators and sponsored merchants. The acquirer must ensure that proper due diligence occurs when sponsored merchants are signed, the payment facilitator monitors sponsored merchant activity, and the acquirer monitors the payment facilitator. That chain is why an acquirer's requirements can be stricter than your policy, and why a file you approved can still be declined.

Your own obligations do not disappear because a partner underwrites. A payment institution or e-money institution is an obliged entity under the AMLR in its own right. So two due-diligence tracks run on every sub-merchant: yours, against your obligations and risk appetite, and the partner's, against its scheme and regulatory position. The second is a different party reading the same facts against a different requirements list. The operational question is whether the two tracks read one file or two copies.

How often does a sub-merchant file have to be refreshed?

At least every five years for a standard merchant, every year for a higher-risk one, and sooner when something relevant changes. Article 26 of the AMLR sets those ceilings and three triggers: a change in the customer's circumstances, a legal obligation to contact the customer that year, any relevant fact coming to light. The regulation applies from 10 July 2027.

AMLA, the new EU authority, is drafting the detail. Its consultation on guidelines for ongoing monitoring under Article 26(5), opened on 3 June 2026 with comments due by 3 September, distinguishes periodic from event-driven reviews and lists what to reassess: identification data, beneficial ownership, legal representation, purpose of the relationship, PEP status. Final guidelines are announced for the fourth quarter of 2026.

NORBr Onboard does not run that refresh for you: no document-expiry tracker, no automatic periodic review workflow today. It keeps the file whole, every document version and exchange attached, so the review reopens a file instead of rebuilding one.

How does NORBr Onboard hold KYB and KYC in one file?

As a structure, not a list. In NORBr Onboard, a white-label onboarding platform separate from the NORBr Console that runs payments, the file is a questionnaire your team builds without development. KYB sections describe the entity, and a repeatable group holds one block per beneficial owner, within the bounds you set, each with its identity questions and document upload inside.

The light-to-full switch lives in the form. Conditional logic shows a question or a section, or makes it required, based on an earlier answer. An MCC chosen from the 298 codes, a country from the 249, or a declared volume above your threshold opens the full KYC section for every director. Conditions are re-checked on the server at submission, so a merchant cannot submit a light file for a high-risk category. Each merchant works on a frozen copy of its form version, so editing your policy never changes a file under review.

Your team then reviews with a risk level, low, medium or high, set per merchant, approving or challenging each document. For each payment partner you build a partner file: what it sees, under which labels, with its document requirements mapped to the merchant's documents. The acquirer reviews on its own track and decides. The same category and risk data later informs how you route the merchant's transactions and what you follow in your analytics dashboards.

NORBr Onboard does not check a passport against a database, screen a name against a sanctions list or decide that a merchant may process. Those stay with your identity-verification vendor, your compliance team and your partner. It collects their answers once, keeps them in structure and shows them to everyone concerned, which, in the words of NORBr's CEO, divides onboarding time by two at a minimum. The companion article on cutting merchant onboarding time in half shows that effect on the timeline.

What should set the depth of a sub-merchant review?

The acquirer that returned the file on Thursday was not applying a different rule. It was reading a different depth of the same file, and that depth should have been set by the merchant's third answer, not by the reviewer's fourth day.

What else do operators ask about KYB and KYC depth?

Does NORBr Onboard verify identity documents itself?

No. NORBr Onboard does not check a passport against a database or screen a name against a sanctions list. Those checks stay with the operator's identity-verification vendor and compliance team. The platform collects the answers and documents once, keeps them in a structured file and shows them to each party concerned, under the operator's brand.

Is liveness detection a legal requirement for KYC?

No. The EU AML Regulation sets two verification routes for a person: an identity document, or an electronic identification means at the substantial or high assurance level under eIDAS. Liveness detection is a vendor feature inside the first route, applied where the risk level or the payment partner asks for it.

Can a merchant submit a light file for a high-risk category?

Not when the switch is built into the questionnaire. In NORBr Onboard, conditional logic opens the full KYC section when an answer such as the MCC, the country or the declared volume crosses the operator's threshold, and conditions are re-checked on the server at submission, so editing the form in the browser does not bypass them.

Why can an acquirer decline a file the operator approved?

Because two due-diligence tracks run on every sub-merchant. The operator reviews against its own obligations and risk appetite, and the acquirer underwrites against its scheme and regulatory position, which can be stricter. Scheme rules hold the acquirer responsible for payment facilitators and sponsored merchants, so its decision governs whether the merchant processes.

NORBr Onboard gives PayFacs, PSPs, ISOs and ISVs one white-label file per merchant where KYB, KYC and the risk tier are structure, not attachments. Talk to us about running sub-merchant onboarding under your brand.