Identity and trust: KYB, KYC and ongoing monitoring

A landscaping company in Texas, Greenline LLC, wants to take card payments through the scheduling software it already uses. It was formed in Delaware, has two owners and would like its first payout on Friday. Before the software company says yes, it needs to know whether Greenline is a real business that's allowed to do what it says, whether the people behind it are who they claim to be, and, once it's live, whether its money keeps behaving like a landscaping company's.

Each of those is a layer of this industry:

• KYB (know your business), the entity: does the company exist, is it in good standing, who owns and controls it, what does it actually do, and is that business allowed on your platform.
• KYC (know your customer) and UBO checks, the people: the person applying, the people who sign, the ultimate beneficial owners (the humans at the top of the ownership chain, UBOs for short) and whoever controls the company.
• KYT (know your transaction) and ongoing monitoring, the behaviour: transaction monitoring, re-screening against sanctions lists and the news, reviews on a schedule and when something changes, and reporting suspicious activity.

The business and its owners apply to your platform. You check them through verification vendors, which query the data sources: business registries, credit bureaus and other data brokers. Your sponsor bank (the licensed bank that holds the money for a fintech) or the card network sets the bar you must meet. Regulators examine the bank, which is how their expectations reach you. Suspicious activity gets reported to FinCEN in the US or FINTRAC in Canada, by you if you hold your own licence and by your bank if you don't.

What I'd want a new PM in this space to take away:

1. Thin data: KYB is mostly a data problem, and in my experience the data is thin more often than contradictory. Registries rarely disagree; they just say very little. A US state registry is a filing office: in most states it records what people file and can't check or reject it. It tells you a company exists, rarely who owns it, and almost never verifies anyone. Since 2025 the federal ownership database doesn't cover US companies either, so the platform builds its own ownership graph from what the applicant declares and has to keep it current. A clean match also proves less than it seems, because a hijacked company, where a fraudster has filed changes to a real business's record, matches the registry perfectly.
2. The bank's rulebook: on a sponsor bank, the bank's and the network's rules are the ones you actually work to. Most platforms that onboard businesses aren't banks. The legal duty to verify customers and report suspicious activity sits with the bank, which pushes it down to you by contract, and with the card networks' rules for payment facilitators. The regulator reaches you through the bank's consent order (a formal enforcement agreement). This is weaker for licensed money transmitters and for UK and EU firms, which regulators fine directly.
3. Monitoring: onboarding is a snapshot, and the big failures have been in monitoring. The largest penalties of 2024 to 2026 were for monitoring that wasn't switched on, alert backlogs and screening against part of a sanctions list. Growth tends to break monitoring before anything else, because onboarding scales with vendors and monitoring scales with people. People also cost more than checks: in the worked example in How the money moves, the data you pay for per check is a few percent of the yearly cost.
4. AI fraud and digital IDs: deepfake selfies, faked camera feeds and AI-made ID images sold for $15 are real; FinCEN warned banks about them in November 2024. Trust is moving toward layered signals and digital IDs, and in September 2026 US regulators said a signed digital credential, such as a mobile driver's licence, counts as government ID for opening an account. Documents plus a selfie, backed by bureau data, are still the base of almost every check, though. More in AI fraud and digital IDs.

So an identity program ends up as a data pipeline that never finishes, run to a bar someone else sets, where the expensive part starts after approval. It's hard for a few reasons. The truth sits in several places: existence in a registry, the tax ID at the IRS, ownership with the applicant, behaviour in your own ledger. Every country answers "who owns this company?" differently, and the US answer changed in 2025. And you get judged on what you missed, often years later, while the good customers you slowed down rarely come up.

Sponsor banks and the 2024 Synapse collapse are in B2B payments: spend management; sanctions, the travel rule and FINTRAC's penalties from the payments side are in B2B payments: cross-border payouts; brand vetting for business texting, a cousin of KYB, is in Phone numbers, messaging and voice.

The main players

The diagram shows roles; the mental map needs names. These are the companies and agencies I'd want to recognize in week one, layer by layer, in no particular order.

How they make money, and who's moving:

• Identity verification vendors charge per verification, a dollar or two at list price. The fast growers are private: Veriff says its revenue passed $100M and doubled in 2025, and Persona raised at a $2B valuation. The public incumbents, Mitek and GBG, grew by low single digits. Digital ID networks like ID.me and CLEAR grow alongside.
• KYB and business-data providers sell annual platforms plus a fee per lookup. Moody's KYC revenue grew by about a fifth in 2025, and Clearlake took Dun & Bradstreet private for $7.7B. The specialists report faster growth, but their figures are their own.
• Bureaus and risk-data companies earn on every check. LexisNexis Risk Solutions grew 8% in 2025, led by financial crime and identity. Buyers keep paying for signals: a private equity firm bought most of BioCatch at a $1.3B value.
• Sanctions data is a subscription business: screening is almost four-fifths of LSEG's risk intelligence revenue. ComplyAdvantage is the best-known fast grower.
• Transaction monitoring sells annual platforms priced by volume. NICE Actimize, the large-bank incumbent, made about $450M in 2024, and NICE was in talks to sell it in September 2026. Graph and AI challengers like Quantexa and Sardine are growing fast.
• Sponsor banks charge fintechs program fees and earn on deposits and card fees. The Bancorp's fintech fees grew by about a fifth in 2025; Coastal took on deposits from Evolve, a bank under a 2024 Fed order.
• Registries charge filing and search fees: Companies House took in about £240M in 2025-26, and Delaware charges $10-20 per online status check.

As of October 2026. Players change through acquisitions and funding rounds, so treat this as a map to check before you rely on it.

When Greenline signs up through its scheduling software, a KYB vendor like Middesk pulls its Delaware record and matches its EIN with the IRS. An identity vendor like Persona checks both owners, leaning on bureau data from a company like Experian. A screening provider like World-Check runs every name against sanctions lists. The sponsor bank, The Bancorp for example, set every threshold in that flow and audits a sample. After go-live a monitoring tool like Unit21 watches the payouts. Greenline signs one contract, and six or seven companies have a say in whether it gets paid.

How a business gets approved, step by step

Follow Greenline from application to monitoring. Most applications that stall go to manual review for documents. Approval is a snapshot: the checks continue for as long as the account is live.

1. Applied: legal name and trade names (a DBA, "doing business as"), entity type, state and date of formation, registration number, EIN (the US federal tax ID), addresses, website, what it sells, expected volume, the payout bank account, and the people: owners of 25% or more plus one person who controls the company, each with name, date of birth, address and ID number. Breaks: the applicant types the trade name where the legal name should go.
2. Business verified: find the right entity in the Delaware registry, and in Texas, where it's registered to operate. Check it's active and in good standing, look at recent changes, match the EIN to the legal name, classify the address and website, assign an industry code, check the prohibited lists, and build the ownership tree. Breaks: a name mismatch, an EIN that belongs to a parent company, a two-week-old LLC the vendor's copy of the registry hasn't caught yet, a foreign parent. These go to manual review, which usually means asking for documents: the articles of organization, the IRS letter confirming the EIN, an operating agreement, a bank statement.
3. People verified: each owner and the control person, by data checks first and a document plus selfie when the data isn't enough; sanctions and PEP screening (politically exposed persons) on the company and every person. Breaks: a thin credit file, an owner abroad with no Social Security number, an owner who won't take a selfie.
4. Approved, with limits: a risk rating and usually some limits: a volume cap, a rolling reserve (a share of each payout held back for a while), a delay on early payouts. Breaks: nobody revisits the limits.
5. Monitored, for as long as it's live: re-screening on every list update, transaction monitoring against what Greenline said it would do, a review when owners, bank accounts or volumes change, and a refresh on a schedule set by risk. Breaks: the expected activity captured at onboarding was wrong, so every alert is noise.

Two exits sit off that path. Manual review sends a case back to the main path once the documents arrive, or to a decline. Offboarding comes from monitoring: restrict the account, close it, return the money, file a suspicious activity report if there's reason to suspect something, and keep the records for five years.

Vendors say older KYB setups send 30-70% of applications to a human, and every document round trip loses applicants, so most stuck applications are sitting in manual review waiting on a document. The cost after approval is bigger still: in the worked example in How the money moves, ongoing monitoring and review are most of what the program costs in a year. That holds for a typical platform; a high-volume payment facilitator can spend more on review at onboarding instead.

The checks compared

List prices come from vendors' public pages; enterprise deals run lower, and the database and signal prices are my estimates, since bureaus don't publish theirs.

Then the question every business applicant raises: who counts as an owner, and where can you check it?

More on how the four fit together in Regulatory layering.

Choosing what to check: five questions

1. Who holds the legal duty? A bank, a licensed money transmitter, a marketplace under the INFORM Consumers Act, or nobody, because you're a B2B software company checking for fraud reasons. That sets your floor, and if there's a bank, its program sets the bar.
2. How fast can money leave? Instant payouts and instant credit lines put the loss right after onboarding, so check more up front. A product where money moves slowly can approve with limits and lean on monitoring.
3. Who are your applicants? Most US small businesses have no employees (about 30 million of 36 million), and many are sole proprietors with no registry record at all. For them the work is the person and what the business really does. The ownership graph starts to matter with mid-market and cross-border customers.
4. Where are they from? It depends on where they were formed and where the owners live. A Delaware check costs money per lookup, a UK company is free to query, EU ownership registers are mostly closed to you, and an owner abroad has no SSN and no US credit file.
5. What must you prove? Your bank or network will ask. Sponsor banks and auditors want to see, for every field, which source it came from and when. If you can't show that, it doesn't count as checked.

My defaults: for people, data checks come first and a document plus selfie is the step-up when the data isn't enough. For businesses I'd pull the registry record, the EIN match and the change history, since a match on its own says little. Store the ownership graph with dates and sources. Approve with limits and relax them on good behaviour. Subscribe to registry changes where you can. Size the monitoring team for next year's volume, and spend on what happens after approval at least as carefully as on the front door.

What's different here

How the money moves

The platform pays for almost everything. Vendors charge per check, per profile or per year; the sponsor bank charges program fees on top and keeps a veto; the customer pays in time, which shows up as churn; and regulators charge for failure.

A year of KYB and monitoring for 1,000 businesses

Say Greenline's platform approves 1,000 businesses in year one on a sponsor bank, from 1,300 applications. Each business has about two people to check besides the company. All figures are ranges built on assumptions, rounded.

The checks you pay for one by one are a few percent of the total, which is why I'd budget identity as headcount rather than as a price per check. People and platforms are the rest, and monitoring (ongoing screening, transaction monitoring and most of the fixed cost) is most of it. The swing factor is alerts: halving false positives on 2,000 alerts saves about $35,000. At 10,000 businesses the fixed cost spreads and the cost per business falls to roughly $80-200.

The shape depends on the business. A payfac taking 10,000 applications a month spends far more on onboarding review, where the manual review rate decides everything. And a large bank's corporate onboarding is a different product: one vendor put it at about $2,600 and three months per corporate client in 2023.

Why do false positives cost so much? Large US banks' numbers from 2017 show roughly 16 million alerts producing 640,000 reports, so about 4% of alerts led to a report. For sanctions name hits, the true-match rate rounds to zero. Most of a monitoring team's day is clearing alerts that were never going to matter. The industry total for financial-crime compliance in the US and Canada was about $61B a year in a vendor-commissioned study, and labour was the biggest part.

Who holds the power

Power here follows who can stop you onboarding. As I read it, the regulator sets the floor, the partner sets the bar, and one partner's consent order can reset the bar for everyone on that bank.

• The sponsor bank holds the veto. It sets risk appetite, prohibited businesses, vendors, alert deadlines and exits, and it can override your decision to keep a customer. When its regulator issues an order, its rules change for every fintech on it at once: Evolve's 2024 order required the Fed's approval before any new fintech partner or product.
• Card networks set the payfac rules, run MATCH and fine the acquirer, which fines you.
• Regulators set the floor and reach most platforms through the bank. Licensed firms meet them directly: Block paid $80M to 48 state regulators and $40M to New York's regulator in 2025, with no bank in between.
• Data brokers hold coverage. Whether a person with a thin credit file can be verified without a document is decided by bureau data.
• Registries are gaining power where the state verifies at the source. Companies House stopped about 27,000 suspicious filings in 2025-26.
• Wallet makers (Apple, Google, Samsung) decide whether a verifier can read a mobile driver's licence.
• Applicants hold the truth and the documents, and they leave if you're slow.

How the rules work

What's written and what's enforced differ, and in 2025-2026 the US and Europe moved in opposite directions.

The US is loosening the paperwork and keeping the penalties. The ownership register shrank to foreign companies. October 2025 guidance dropped automatic 90-day reviews of continuing activity and the need to document decisions not to file a report. FinCEN's April 2026 proposal for AML programs would limit enforcement over upkeep failures to "significant or systemic" ones, and counts AI tools as evidence that a program works. An August 2025 executive order took reputation risk out of bank supervision and put exits on political grounds under scrutiny. Even so, the big penalties kept coming, as the table below shows.

Canada raised the stakes. Maximum FINTRAC penalties rose 40-fold in March 2026, and FINTRAC issued a record 35 penalty notices worth over CAD 247M in 2025-26, mostly against money services businesses.

The EU tightened. From July 10, 2027 the AMLR fixes refresh cycles (one year for high risk, five for the rest), how ownership is calculated, what data you collect on each person (including place of birth and nationality, which US rules don't ask for), and a draft standard makes a government digital ID the preferred way to verify people remotely.

The triggers tell you more than the amounts do. Almost every case here is a program that grew faster than its monitoring, and a weak identity check on its own rarely shows up.

What mistakes cost

Mistakes here get paid for in several ways.

• Growth. A consent order on your sponsor bank can freeze new onboarding and new products for months while the regulator approves each one.
• Remediation. Lookbacks, re-verifying existing customers and outside consultants often cost as much as the fine, and the fintech's team does the work. I'd rank this as the costliest one, because when a monitoring program can't keep up, the fix lands on every customer at once.
• Fraud losses. TransUnion put lenders' exposure to suspected synthetic identities on new US accounts at about $3.3B in the first half of 2025. Whoever extended the credit owns it.
• Lost customers. Every document request loses applicants, and over-correction after an order (mass exits) hurts good customers, which since 2025 also draws regulatory attention in the US.
• Penalties and lawsuits. From FTC penalties under INFORM to biometric class actions to billion-dollar bank cases. People are exposed too: TD's case brought prosecutions of employees, and FinCEN started paying whistleblowers up to 30% of sanctions over $1M in 2026.

AI fraud and digital IDs

My verdict as of October 2026: the AI fraud is real and growing, the regulators have moved toward cryptographic credentials, and almost nobody can present one online yet. I'd build in layers, treating the document as one weak signal among many, and get ready for signed credentials without waiting for them.

What's real

• FinCEN's November 2024 alert. From 2023 into 2024, FinCEN saw more reports of deepfakes: AI-altered or AI-generated images on driver's licences and passports, combined with stolen or invented personal data to build synthetic identities that "successfully opened accounts" and then moved money for criminals. The detail that matters for product: most were caught on re-review after the account showed odd behaviour rather than at onboarding. FinCEN flagged third-party webcam plugins and applicants claiming "technical glitches" to dodge live checks.
• Forgery as a service. An online service sold AI-generated ID images for $15 in early 2024, and journalists used one to pass a crypto exchange's check.
• Injection attacks. Instead of holding a mask to the camera, the attacker replaces the camera feed with a virtual camera and plays a deepfake. Entrust, whose latest report covers over a billion verifications, says deepfake selfies rose by more than half in 2025 and are about one in five biometric fraud attempts. Vendors' percentages are measured on their own traffic, so they tell you the direction more than the size.
• Uneven accuracy. In the US Department of Homeland Security's tests of remote identity checks, reported in 2026, only 5 of 16 selfie-to-ID systems met all its goals. For the median system, an impostor who looked similar to the real person was about 11 times more likely to be wrongly accepted than a random one.
• Mules and takeovers. These come after onboarding. In the UK, Cifas counted 78,000 account takeover cases in 2025, almost a fifth of its database, and mule cases rose by about two-thirds in the first half of 2026.

What's not there yet

• Mobile driver's licences. 21 states and Puerto Rico issue them, with over 8 million credentials, and about 45% of Americans live where one is available. Few states let people present them online, and the Northeast, Texas and Florida don't issue them yet.
• The EU wallet. Every member state must offer one by December 24, 2026, and banks must accept it on request about a year later. One consultancy expects only 8 to 12 of the 27 to be ready by the end of 2026.
• The UK. It dropped plans for a mandatory national digital ID for right-to-work checks in January 2026; digital checks are still coming, through certified private providers.
• Losses. Onboarding fraud is a slice. The FBI logged about $21B of reported internet crime losses in 2025, and investment scams were about half of scam losses.

Where the rules moved

Biometric privacy

A selfie check collects biometrics, and that has its own law. Illinois requires written consent before you collect and a published retention schedule (see Liability allocation). Texas lets only the attorney general sue, but Meta and Google settled for well over a billion dollars each. Colorado and Washington have laws too. If an applicant refuses a selfie, which business owners often do, you need another path: data checks with manual review, a document only, or a digital credential.

Questions to ask an identity vendor

1. Which attacks was your liveness tested against: masks and printouts, or injected camera feeds too?
2. How do you defend web capture, where injection is easiest?
3. What are your false-reject rates by age, skin tone and camera quality, and who measured them?
4. Can you read a mobile driver's licence or a passport chip, and in which flows?
5. Where are images and templates stored, and for how long?

What usually goes wrong

Words that mean something else here

What surprised me

Placeholders in your voice, drafted from the earlier guides. Rewrite each with your own moment.

"KYB is a lookup." In the telco guide, the brand check for business texting was an exact match on EIN and legal name, and typos failed it. KYB looks like that with more fields, but a hijacked company passes the match perfectly. The match tells you the record exists, and the change history tells you whether to trust it.

"Ownership is public data." In the US there's no register to query for US companies, and since August 2026 there won't be one. The platform builds the ownership graph itself, dates it and keeps it current.

"The regulator is my counterparty." In spend management I learned fintechs rent a sponsor bank's charter. They also inherit its exam findings: one bank's consent order changed the onboarding rules for every fintech on it in a week.

"Approval is the finish line." I designed onboarding as the product. The money and the failures are in what comes after: alerts, reviews, refreshes, a team sized for last year's customers.

"A selfie is proof." A certified liveness check is certified against masks and printouts. A faked camera feed is a different attack, and the document itself is now the weakest signal in the stack.

Sources

Undated entries were read on October 3, 2026; "search result" means seen only as a search snippet.

US rules and regulators

• Cornell LII: 31 CFR 1020.220, customer identification, 31 CFR 1020.100, definitions, 31 CFR 1010.230, beneficial owners, 12 CFR 21.11, suspicious activity reports, 31 CFR 1020.320, bank reports
• FinCEN: Beneficial ownership information reporting; Alert on deepfake media (Nov 2024); 314(a) fact sheet (Sep 2026); PEP interagency statement (Aug 2020, search result)
• OCC, Fed, FDIC, NCUA and FinCEN: FAQs on verifiable digital credentials (Sep 2026)
• Federal Reserve: Evolve order (Jun 2024)
• IRS, TIN Matching (Aug 2026); eCBSV fees, Federal Register (Apr 2025, search result); SSA, eCBSV (search result)
• NIST, SP 800-63A-4 identity assurance levels (Aug 2025)
• FTC, INFORM Consumers Act guidance
• NASS, Business filing fraud report (Jul 2026)
• Delaware Division of Corporations, online status and certificates
• SBA Office of Advocacy, 2025 small business profiles (search result); OMB, NAICS 2027 proposal (Jul 2026, search result)
• DOJ, TD Bank case (search result); Illinois IDFPR and CSBS, Block multistate action (Jan 2025, search result)

Canada

• FINTRAC: Beneficial ownership requirements; Methods to verify identity; Changes to the regime; 2025-26 enforcement results (Jul 2026); PEP FAQ (search result)
• ISED, federal ownership filing announcement (Jan 2024, search result); Corporations Canada, data services (search result)
• Quebec's register, via Doane Grant Thornton (search result); British Columbia, corporate ownership transparency (search result)
• Interac verification service, via BMO (search result)

UK and EU

• Companies House: Annual report 2025 to 2026; identity verification for PSCs (Jan 2026); streaming API (search result); GOV.UK, identity verification rollout and people with significant control (search results)
• GOV.UK, OfDIA 2026 annual report (Jul 2026)
• FCA: Monzo fine, Starling fine, Barclays fine (2024-2025, search results)
• Cifas, Fraudscape 2026 and six-month update (search results)
• EUR-Lex: AMLR, Regulation (EU) 2024/1624; eIDAS 2, Regulation (EU) 2024/1183
• AMLR Article 26 and AMLA's draft due-diligence standard, Article 7, Springlex copies (2026)
• eucrim, AMLD6

Card networks and identifiers

• Visa, Payment Facilitator and Marketplace Risk Guide (Apr 2021); Mastercard, Quick Reference Booklet (search result)
• GLEIF, The LEI in numbers, Q2 2026 (search result)

Research and surveys

• BPI, Getting to effectiveness
• LexisNexis Risk Solutions and Forrester, True cost of compliance (Feb 2024, vendor-commissioned)
• DHS remote identity validation results, via idtechwire (Mar 2026)
• A vendor's payments KYB case study (Apr 2026, vendor); a bank-onboarding vendor's KYC trends report (2023 data, vendor)
• SSA eCBSV pilot results, via SentiLink (Apr 2021, vendor)
• Entrust 2026 Identity Fraud Report (Nov 2025, search result, vendor)
• TransUnion synthetic identity exposure, via Banking Exchange (Nov 2024) and TransUnion's H1 2025 report (search result)
• Route Fifty, mobile driver's licences (Aug 2026); b2trust, eIDAS 2 status (Apr 2026)

Company results and releases (the main players)

• Identity verification: Entrust, see the fraud report above; Persona, Series D (Apr 2025, search result); Veriff, revenue release (Dec 2025) and plans; Socure, Effectiv acquisition (Oct 2024, search result); Incode, valuation (Dec 2021, search result) and DHS test results (2026, vendor); GBG, FY26 results (2026, search result); Mitek, FY2025 results (Dec 2025, search result); ID.me, funding (Sep 2025, search result); CLEAR, 10-Q (Q3 2025, search result); Sumsub, pricing; Stripe, Identity (search result)
• KYB and business data: Moody's, FY2025 10-K (search result); Dun & Bradstreet, FY2024 10-K (search result) and Clearlake, acquisition completed (Aug 2025, search result); Middesk, about (search result) and matching docs; Trulioo, US KYB growth (Oct 2025, search result, vendor); Kyckr, FY2026 results (Jul 2026, search result, vendor); Baselayer, Series A (Aug 2026); Middesk, Vendr pricing data (Feb 2026)
• Bureaus and risk data: Experian, FY26 results (May 2026, search result); TransUnion, FY2025 10-K (search result); RELX, 2025 results (Feb 2026, search result); BioCatch, Permira acquisition (Sep 2024, search result); Prove, Portabl acquisition (Jan 2025, search result)
• Sanctions data: LSEG, Risk Intelligence investor webinar (Jun 2025); ComplyAdvantage, Vendr pricing data (Feb 2026)
• Transaction monitoring: NICE Actimize sale, Calcalist (Sep 2026); Quantexa, Series F (2025, search result); Hawk, Series C (Apr 2025, search result); Sardine, Series C (Feb 2025, search result); Unit21, Vendr pricing data (2025)
• Sponsor banks: The Bancorp, FY2025 10-K (search result); Coastal Financial, 4Q25 results (Jan 2026, search result); Lead Bank, Series B (Sep 2025, search result)

Law firms and press

• Orrick, FinCEN lifts ownership reporting (Sep 2026); DLA Piper, CDD exceptive relief (Mar 2026, search result) and Canada AML bills (Mar 2026); American Banker, FinCEN moves to rewrite due diligence (Sep 2026)
• MoFo, last four TIN digits order (Jul 2025, search result); King & Spalding, SAR FAQs (Oct 2025); Gibson Dunn, AML program proposal and mid-year AML 2026; Mayer Brown, debanking executive order (Aug 2025, search result)
• Law Debenture, directors still unverified (2026); William Fry, EU court ruling on ownership registers (search result); Noerr, AMLR ownership rules; Linklaters, EU digital company law (May 2025, search result); Hogan Lovells, AMLA consultation
• McDermott, first INFORM case (2025, search result); Sidley, BIPA amendment retroactive (Apr 2026, search result); Orrick, Onfido BIPA settlement (May 2023); Katten, BIPA and financial institutions (search result); Texas Tribune, Meta settlement (Jul 2024, search result); Hunton, Google settlement (search result); BCLP, biometric laws tracker (search result)
• Banking Dive on Block and New York and Piermont and Sutton (2024-2025); Fortune, TD Bank (Oct 2024, search result)
• Cointelegraph, AI-generated IDs pass KYC (Feb 2024, search result); The Register, UK digital ID climbdown (Jan 2026, search result); Alston & Bird, FBI IC3 2025 report (2026, search result); APP reimbursement first year, Bratby (search result)