KYC vs KYB: Know Your Customer, Know Your Business (2026)

KYC vs KYB is the difference between verifying a person and verifying a business. Know your customer (KYC) confirms an individual’s identity and screens them for risk. Know your business (KYB) confirms that a company exists, understands what it does, and identifies the people who own or control it, who then go through KYC themselves.

In 2026, KYB is where payment onboarding wins or loses time. The EU is about to apply a single anti-money laundering rulebook, the United States has narrowed its company ownership register, and card schemes hold acquirers responsible for every merchant they bring in. For PSPs, PayFacs and platforms that onboard thousands of sub-merchants, a fast and defensible KYB process is both a compliance duty and a conversion lever.

What is the difference between KYC and KYB?

KYC applies customer due diligence to a natural person; KYB applies it to a legal entity. Both come from the same international standard: the FATF Recommendations, which ask financial institutions to identify their customers, understand the purpose of the relationship and, for companies, identify the beneficial owners. In the EU, the rules are now set by the Anti-Money Laundering Regulation (EU) 2024/1624, known as AMLR.

A few related notions appear in every onboarding file:

• AML: anti-money laundering, the rules that stop criminal money from entering the financial system.
• CTF: counter-terrorist financing, often grouped with AML as AML/CFT.
• CDD and EDD: customer due diligence, and the enhanced version required when risk is higher.
• UBO: the ultimate beneficial owner, a natural person who owns or controls the company, directly or through other entities.
• PEP and sanctions screening: checks against lists of politically exposed persons and sanctioned names.

KYB does not replace KYC. It adds a layer: first the company, then the people behind it. A sole trader is a borderline case, since the business and the person are the same, and most providers run KYC with a few business checks.

In payments, KYC mostly concerns the paying side and individual account holders: wallet users, prepaid card holders, freelancers paid through a platform. KYB concerns the accepting side: every company that receives card payments through an acquirer, a PSP or a PayFac. A marketplace often needs both, KYC on individual sellers and KYB on professional ones, inside the same onboarding flow.

KYC vs KYB: what does each check involve?

The two processes share their tools but not their scope. KYC answers “who is this person?”; KYB answers “what is this company, and who is behind it?”.

• Identity: for KYC, an identity document, a selfie or liveness check and sometimes a proof of address. For KYB, a registry extract showing the legal name, number, address and status.
• Control: KYB lists directors and legal representatives, then traces ownership through holding structures to each UBO.
• Activity: KYB looks at what the company sells, its website, its terms and refund policy, its expected volumes and the merchant category code it should receive.
• Screening: both run sanctions, PEP and adverse media checks, on the person for KYC and on the company, its directors and its UBOs for KYB.
• Bank account: KYB verifies that the payout account belongs to the business.
• Refresh: both are repeated over time, more often when risk is higher.

How does KYB work for merchant onboarding?

For a merchant that wants to accept cards, KYB is a sequence of checks shared between the onboarding party and the acquirer. A typical flow looks like this:

1. Application: the merchant fills in a form with company details, activity, website, expected volume and average ticket.
2. Registry check: the company is matched against the official business register to confirm it exists and is active.
3. Ownership: directors and UBOs are identified, usually every person holding 25% or more or exercising control.
4. KYC on people: each UBO and legal representative goes through identity verification.
5. Screening: company and people are checked against sanctions, PEP and adverse media lists, and against scheme databases of terminated merchants.
6. Business review: the website, products, terms and refund policy are reviewed, and an MCC is assigned.
7. Risk decision: the file gets a risk score, limits, and sometimes a reserve or a delayed payout.
8. Acquirer approval: depending on the model, the acquirer approves each file or relies on the PayFac’s decision within agreed rules.
9. Monitoring: volumes, disputes and changes of ownership are followed for as long as the merchant processes payments.

The order matters less than the evidence. Each step should produce a record: which register was queried and when, which documents were checked, which screening hits were cleared and by whom. When an acquirer or a card scheme reviews a portfolio, it asks for this trail, not for a summary. Small merchants can often pass the first steps in minutes when the data comes from registries, while complex ownership structures can still take days of manual review.

KYC and KYB in numbers (2026)

Dates and thresholds frame what onboarding teams must collect.

• 25%: the shareholding or controlling interest that triggers UBO status under the EU AMLR, according to a July 2026 Baker McKenzie analysis, which also notes that lower thresholds can apply in sectors with higher money laundering risk.
• July 10, 2027: the date from which the AMLR’s harmonized framework for identifying and disclosing UBOs applies across the EU, replacing national transpositions of the previous directives.
• 25% and one controller: the US customer due diligence rule, in force since May 2018, requires covered financial institutions to identify each owner of 25% or more and one individual with significant control, as set out in 31 CFR 1010.230.
• March 21, 2025: the day FinCEN issued an interim final rule removing beneficial ownership reporting for US companies, so only foreign entities registered in the US must still file. Banks and PSPs still have to collect UBO data themselves.
• 40: the number of FATF Recommendations, the global baseline that national AML laws, and therefore every KYC and KYB policy, are built on.

What are the risks and limits of KYC and KYB?

The checks protect the payment chain, but they have costs and blind spots.

• Drop-off: every document request loses applicants. Long KYB forms are a main reason small merchants abandon onboarding.
• Patchy registries: company registers differ by country in content, cost and update speed. Ownership data is often self-declared.
• Complex ownership: chains of holdings, trusts and foreign entities make UBO tracing slow and manual.
• Point-in-time view: a file approved in January says little about a business that changed owners or products in June.
• False positives: name screening flags many innocent matches, which need human review.
• Data protection: identity documents are sensitive personal data. Collecting more than needed creates a privacy risk.
• Shared liability: when a sub-merchant turns out to be fraudulent, the PayFac, the acquirer and sometimes the ISO all face losses and scheme penalties.

KYC and KYB: what changes for PSPs, PayFacs and platforms

For an operator, KYB is a product: a form, a workflow, a decision engine and a file that an acquirer can audit. Five areas matter most.

Who performs KYB

With an ISO model, the acquirer runs KYB on each merchant. A PayFac signs sub-merchants itself and is contractually required by its acquirer to perform KYC and KYB, even where the law does not name it directly, as a Venable analysis of payment facilitators explains. The two models are compared in PayFac vs ISO, and a platform that sells as merchant of record avoids sub-merchant KYB but takes on the full liability of the sale.

Onboarding design

Collect the minimum at sign-up, then ask for more only when volume or risk justifies it. Registry lookups and document reading can replace many uploads, and each step should leave an audit trail the acquirer can review. Forms that adapt to the country, the legal form and the activity cut drop-off. In NORBr, the onboarding workflow runs the KYB and approval steps for sub-merchants and referred merchants, and KYB forms and questionnaires let operators configure what each merchant is asked. Practical ways to shorten the process are discussed in merchant onboarding: KYB in half the time.

Several acquirers, one file

An operator working with several acquirers should not ask merchants for the same documents twice. A single KYB file, shared with each acquirer in the format it expects, is the approach described in multi-acquirer merchant onboarding.

Country rules

Registers, identity documents and ownership rules change from one market to the next. In the United Kingdom, for instance, company data comes from Companies House and its register of people with significant control, as covered in the guide to payment methods in the United Kingdom.

Risk-based decisions

Not every merchant needs the same depth of review. A risk-based approach sets the level of checks by activity, country, expected volume and delivery model: a local bakery with low tickets and immediate delivery is not reviewed like a business that takes payments months before delivering. The outcome is not only yes or no. Operators can approve with a monthly volume cap, a delayed first payout or a reserve, and lift these limits once the merchant has a clean history.

ISOs, introducers and referrals

When merchants arrive through a reseller, the KYB file has to be complete before it reaches the acquirer. An ISO usually collects documents for the acquirer, while an introducer only passes on a lead, as explained in gateway, PSP, acquirer and aggregator. In both cases, the party that signs the merchant owns the KYB decision and must be able to show how it was made.

Ongoing monitoring

KYB does not end at approval. Changes of ownership, a new website, a jump in ticket size or a rise in disputes should reopen the file. Operators who connect onboarding data to transaction monitoring catch problems before the acquirer does.

For a discussion of where identity checks are heading, the Payments Library lists The Future of KYC Compliance podcast, episode 14. The #TheShot episode From partner to PayFac: the real journey shows what taking over sub-merchant onboarding means in practice.

Is investing in KYB worth it in 2026?

Yes. Onboarding is the first experience a merchant has with a payment provider, and the first line of defense for the acquirer. What it means by player:

• PSPs: a reusable KYB file per merchant speeds up new acquirer connections and new markets.
• PayFacs: KYB is a contractual duty and a source of liability. Automation and clear audit trails are what keep acquirers comfortable.
• ISOs: faster, cleaner files sent to the acquirer shorten time to first payment and reduce rejected applications.
• ISVs and platforms: embedded onboarding turns payments into a feature; a clumsy one turns it into a support ticket.

KYC verifies a person and KYB verifies a business and the people who own it, and operators that run both as a fast, monitored workflow onboard more merchants with less risk.