Key concepts

Products tend to blur the legal entity (the landscaper's LLC), the account on your platform (its two locations, each with its own payouts) and the person (an owner who also owns a second company you onboarded last year).

Keep them as separate records. One entity can have many accounts. One person can own several entities, sign for others and be a consumer customer too. When a fraud team asks "what else is this person connected to?", that link is the answer.

Identifiers are local, and none covers every small business:

An ownership link needs more than a percentage. Give each one a type (shares, votes, a right to appoint the board, a trust role, a nominee), a date and a source. Thresholds differ by a word: the US, Canada and the EU say 25% "or more"; the UK says "more than" 25%. An owner with exactly 25% is in scope in Toronto and out of scope in London.

On the people side, synthetic identities and account takeover both break the model. A synthetic identity breaks the assumption that a set of details belongs to one real person. Account takeover breaks the assumption that the person logged in is the person you verified.

One customer has a state in the registry, on your platform and in your alert queue, and these drift apart unless you connect them.

• The registry's: formed, active and in good standing, delinquent (a missed annual report or franchise tax), administratively dissolved or revoked, reinstated within a window each state sets, or gone.
• Your platform's: started, submitted, auto-verified or pending review or documents requested, approved (with limits) or declined, active, under review, restricted, offboarded. Add states nobody plans for: frozen for sanctions, and "keep open", when law enforcement asks you not to close an account.
• The alerts': new, in triage, escalated, case open, report filed, closed with no action.

A person's verification has a lifecycle too. Documents expire, addresses change, and in the EU from July 2027 customer information must be refreshed at least yearly for high-risk customers and every five years for the rest. Assurance also comes in levels.

If the landscaping company misses its Delaware annual report in March, the registry moves it to delinquent while your platform still says "active". Nothing is wrong yet, but if a fraudster later reinstates the company and changes its officers, you'd want to have seen both events, so subscribe to the registry's state changes where you can.

Watch one more state: "closed automatically". A US regulator's April 2026 order against a payments-heavy bank criticized alerts that closed themselves. No alert should close without a human or a validated model giving a reason.

Every fact has an owner, and the platform owns fewer than its dashboard suggests.

Your KYB record is a derived record. For each field it should say where the value came from, when you pulled it and whether it matched. That provenance is what sponsor banks and auditors ask for, and when an examiner asks why you approved someone, the source and date of each verified fact is your answer.

The case-management system is the record a regulator reads: who saw what, when, and why they closed it. Keep verification records five years in the US and Canada. A biometric law like Illinois's wants templates destroyed on a schedule, so the usual answer is to keep the results and delete the templates.

For banking-as-a-service the ledger is a record of its own. When Synapse, a middleware company between fintechs and banks, collapsed in 2024, its records and the banks' didn't reconcile, and end users were left short by tens of millions of dollars.

Law is only one of the kinds of rules that shape every decision.

• Law: the bank rules on customer identification and beneficial ownership in the US, Canada's PCMLTFR, the UK's money laundering regulations, the EU's AMLR from July 2027, and the INFORM Consumers Act for marketplaces.
• Network rules: Visa requires a payment facilitator (a payfac, a company that signs up merchants under its own card acceptance account) to check every applicant against its list of terminated merchants, and bans some industries outright unless the payfac is registered for high risk. Mastercard requires a check against MATCH, its list of terminated merchants, before onboarding.
• Your bank's policy: a prohibited and restricted business list, how deep KYB goes, which vendors you may use, how fast alerts must be worked, how often customers get refreshed.
• Your own policy: risk appetite and auto-approval thresholds.

Many hard calls aren't data questions at all. What counts as "control"? Do you onboard a company that's delinquent but can cure it? Is a registered agent's address, a virtual office or a UPS store acceptable? How far up a foreign ownership chain do you go? Write those calls down as policy, separate from the data, because that's where two platforms with the same vendors end up differing.

Visa's high-brand-risk list is a set of merchant category codes plus activities such as cyberlockers, skill games like daily fantasy sports, and buying crypto. A marketplace may not sign those merchants at all; only payfacs registered for high risk can.

Thresholds trade false accepts against false rejects. You tune them; your sponsor bank approves them.

Ownership changes over time, lists change daily, and the rules changed a lot in 2025 and 2026.

Inside your data, store dates on ownership, list versions and clocks. Canada's register records when someone became and stopped being a significant owner, and your graph needs valid-from and valid-to dates too. A sanctions screen is only as good as the list version it ran against. A US suspicious activity report is due 30 days from initial detection of the activity, and examiners argue about that detection date.

Picture the landscaper selling 30% of itself to a new investor in May. If your graph only holds the current owners, you can't answer the question an examiner will ask in December: who owned it when you paid out in June? Examiners keep coming back to what you knew and when, so date every ownership link, list version and review.

The standards are a patchwork, and most of them sit behind a vendor's API.

• Registries. Companies House offers a free API (600 requests every five minutes) and a streaming API that pushes changes as they happen; it's the cheapest major registry to build on. Corporations Canada has an API and open data. Most US states offer web search pages, some bulk data and per-lookup fees, so vendors scrape or license.
• Tax IDs. IRS TIN Matching takes up to 25 pairs at once interactively or 100,000 in bulk, but only for payers who file 1099s.
• SSNs. SSA's eCBSV answers yes or no on SSN, name and date of birth, with the person's consent.
• Documents. ICAO 9303 for passports (the machine-readable zone and the chip), the barcode on the back of US driver's licences, ISO/IEC 18013-5 and 18013-7 for mobile driver's licences in person and online.
• Liveness. ISO/IEC 30107-3 tests presentation attacks: a mask, a printout or a screen held to the camera. Injection attacks, where a fake video feed replaces the camera, are a separate problem with a newer standard. Web capture is easier to inject into than a mobile SDK. A "certified liveness" check usually means it resists masks and printouts and says nothing about faked camera feeds, so ask which attacks it was tested against.
• Identity levels. NIST SP 800-63-4 (August 2025) for US government, not binding on fintechs but marketed to; eIDAS's "substantial" and "high" in the EU.
• Codes. MCC (ISO 18245, the card networks' merchant category) and NAICS (the government's industry codes) don't map one to one; a new NAICS version is proposed for data from January 2027.

A business approval runs through a chain, and the platform sits in the middle of it.

Information flows through the chain too. FinCEN sends banks lists of law-enforcement subjects every two weeks (a 314(a) request), and banks answer only with matches. Institutions with an AML program requirement can share information with each other under 314(b). A platform without one can't join, so if you aren't a regulated institution yourself, your bank is both your rule-setter and your only window into what other institutions know.

Separate the layers, because each binds a different party and has a different enforcer.

Which layer reaches you depends on what you are. For most US platforms on a sponsor bank, the one that binds you day to day is the contract with the bank. A payfac gets its KYB requirements from the network and its bank; the bank rules themselves bind the bank. A marketplace has INFORM directly: once a seller makes 200 sales and $5,000 in a year, you have 10 days to collect and verify its bank account, tax ID and contact details, and sellers above $20,000 must show their identity to buyers. A B2B software company that doesn't move money may have no legal KYB duty at all, and checks for fraud and trust.

Beneficial ownership is where the four jurisdictions split most:

• US. The Corporate Transparency Act was meant to give FinCEN a register of every company's owners. An interim rule in March 2025 and a final rule effective August 14, 2026 cut it to foreign companies: about 28,000 instead of the 32.6 million FinCEN once expected. FinCEN is deleting the data it had on US people. Banks still collect owners under their own rule, so the change mattered less to platforms than the headlines suggested: their ownership checks always came from the bank.
• Canada. Federal companies must file their significant owners with Corporations Canada, publicly since January 2024. Most Canadian companies are incorporated in a province instead, and only Quebec has a public register of its own. Since October 1, 2025, firms that report to FINTRAC must flag mismatches on high-risk federal companies within 30 days.
• UK. The register of people with significant control has been public for years. Since November 18, 2025 Companies House checks the identity of directors and owners itself. Between 6 and 7 million people have to verify by November 17, 2026, and by the end of June just over half of directors had.
• EU. In 2022 the EU's top court struck down public access to ownership registers on privacy grounds, and several countries closed theirs. The 2024 directive reopens them to people with a "legitimate interest". From July 10, 2027 the AMLR sets one method across the EU: multiply percentages down each chain of ownership, add them across chains, and count control by other means.

Most of the work in this team lives in exceptions, and several of them run on someone else's clock. The restrict, review, close and report paths are where examiners look and where good customers get hurt, so it pays to design them before the happy path.

Lookbacks are the expensive one. The Fed's 2024 order against Evolve Bank & Trust required a review of its fintech partners' wires over six months for missed reports; the FDIC told Sutton Bank to re-run identity checks on every prepaid customer since mid-2020. If your bank gets one, your operations team does the work.

A fraudster can reinstate a dissolved company, name themselves an officer and apply to your platform, and the registry match will be perfect. The way back starts with the victim business asking the state to fix the record, which in some states needs a court.

The regulator fines the licensed party, which pushes the cost down by contract until it reaches someone who can't push further.

Illinois's biometric law is the one people underestimate: $1,000 per negligent violation and $5,000 per intentional one, with a right to sue. Since a 2024 amendment, repeated scans of one person count once, but class sizes still make it costly: Onfido settled for $28.5M. Financial institutions are exempt, and courts have extended that to some of their vendors; a marketplace or gig platform doesn't get the shield.

If the landscaping company is really a front and $80,000 of stolen card payments flow through it before you catch on, the cardholders' banks charge the payments back, the acquirer collects from you, and you can't collect from a company that's gone. Every relaxed setting (auto-approval, instant payouts, skipped selfies) is also a decision about who absorbs that kind of loss, and it belongs in the spec and the contract.