Identity and trust: KYB, KYC and ongoing monitoring

How it works

5 min read · Chapter 2 of 10

How a business gets approved, step by step

A business from application to monitoring. Most applications that stall go to manual review for documents. Approval is a snapshot: the checks continue for as long as the account is live, and for a typical platform that's where most of the cost sits.

Follow the landscaping company from application to monitoring. Most applications that stall go to manual review for documents. Approval is a snapshot: the checks continue for as long as the account is live.

Applied: legal name and trade names (a DBA, "doing business as"), entity type, state and date of formation, registration number, EIN (the US federal tax ID), addresses, website, what it sells, expected volume, the payout bank account, and the people: owners of 25% or more plus one person who controls the company, each with name, date of birth, address and ID number. What can go wrong: the applicant types the trade name where the legal name should go.
Business verified: find the right entity in the Delaware registry, and in Texas, where it's registered to operate. Check it's active and in good standing, look at recent changes, match the EIN to the legal name, classify the address and website, assign an industry code, check the prohibited lists, and build the ownership tree. What can go wrong: a name mismatch, an EIN that belongs to a parent company, a two-week-old LLC the vendor's copy of the registry hasn't caught yet, a foreign parent. These go to manual review, which usually means asking for documents: the articles of organization, the IRS letter confirming the EIN, an operating agreement, a bank statement.
People verified: each owner and the control person, by data checks first and a document plus selfie when the data isn't enough; sanctions and PEP screening (politically exposed persons) on the company and every person. What can go wrong: a thin credit file, an owner abroad with no Social Security number, an owner who won't take a selfie.
Approved, with limits: a risk rating and usually some limits: a volume cap, a rolling reserve (a share of each payout held back for a while), a delay on early payouts. What can go wrong: nobody revisits the limits.
Monitored, for as long as it's live: re-screening on every list update, transaction monitoring against what the business said it would do, a review when owners, bank accounts or volumes change, and a refresh on a schedule set by risk. What can go wrong: the expected activity captured at onboarding was wrong, so every alert is noise.

Two exits sit off that path. Manual review sends a case back to the main path once the documents arrive, or to a decline. Offboarding comes from monitoring: restrict the account, close it, return the money, file a suspicious activity report if there's reason to suspect something, and keep the records for five years.

Vendors say older KYB setups send 30-70% of applications to a human, and every document round trip loses applicants, so most stuck applications are sitting in manual review waiting on a document. The cost after approval is bigger still: for a typical platform on a sponsor bank, ongoing monitoring and review are most of what the program costs in a year (see How companies of different sizes use it). A high-volume payment facilitator can spend more on review at onboarding instead.

The checks compared

Check	What it proves	Rough cost (Oct 2026)	Good customers it fails	How fraud beats it
US state registry lookup	The company exists, and its status	Cents to a few dollars; Delaware charges $10-20 a status check	Sole proprietors (often not registered), brand-new companies	A hijacked or freshly formed company matches perfectly
EIN and name match (IRS)	The tax ID belongs to that legal name	Often bundled; only companies that file 1099s can ask the IRS directly	Trade names, recent name changes	A real EIN paired with its real name
Ownership check	Who owns 25% or more, and who controls	Mostly analyst time	Holding companies, funds, foreign parents	Nominees, or stakes kept just under the threshold
Bureau or database match	Name, date of birth, SSN and address appear together in records	Roughly $0.20-1 (estimate)	Thin files, newcomers, people who moved or changed name	Synthetic identities built to match
SSA's eCBSV	SSN, name and date of birth match Social Security's records	About $0.50, prepaid in annual tiers	Typos and name changes (most mismatches)	A stolen real identity passes
Phone, email and device signals	Phone tenure, email age, device reputation, human or bot	Cents	Prepaid phones, new devices, privacy browsers	SIM swaps, device farms, aged emails bought in bulk
Document plus selfie and liveness	The person matches a genuine-looking ID and is really there	About $1-2 at list price	Poor cameras, worn cards, some faces more than others	Deepfakes fed through a virtual camera; AI-made documents
Passport chip read	Data signed by the issuing government	More (needs a mobile SDK)	No NFC phone, or no chip in the document	Very hard to forge; taking over the account later
Mobile driver's licence or other signed credential	Data signed by the issuer and bound to a device	Low per check	Most people can't present one online yet	Taking over the phone or wallet
Bank login (Interac in Canada)	A bank already verified this person	A fee per check	No eligible bank account	Taking over the bank login

US state registry lookup

What it proves: The company exists, and its status
Rough cost (Oct 2026): Cents to a few dollars; Delaware charges $10-20 a status check
Good customers it fails: Sole proprietors (often not registered), brand-new companies
How fraud beats it: A hijacked or freshly formed company matches perfectly

EIN and name match (IRS)

What it proves: The tax ID belongs to that legal name
Rough cost (Oct 2026): Often bundled; only companies that file 1099s can ask the IRS directly
Good customers it fails: Trade names, recent name changes
How fraud beats it: A real EIN paired with its real name

Ownership check

What it proves: Who owns 25% or more, and who controls
Rough cost (Oct 2026): Mostly analyst time
Good customers it fails: Holding companies, funds, foreign parents
How fraud beats it: Nominees, or stakes kept just under the threshold

Bureau or database match

What it proves: Name, date of birth, SSN and address appear together in records
Rough cost (Oct 2026): Roughly $0.20-1 (estimate)
Good customers it fails: Thin files, newcomers, people who moved or changed name
How fraud beats it: Synthetic identities built to match

SSA's eCBSV

What it proves: SSN, name and date of birth match Social Security's records
Rough cost (Oct 2026): About $0.50, prepaid in annual tiers
Good customers it fails: Typos and name changes (most mismatches)
How fraud beats it: A stolen real identity passes

Phone, email and device signals

What it proves: Phone tenure, email age, device reputation, human or bot
Rough cost (Oct 2026): Cents
Good customers it fails: Prepaid phones, new devices, privacy browsers
How fraud beats it: SIM swaps, device farms, aged emails bought in bulk

Document plus selfie and liveness

What it proves: The person matches a genuine-looking ID and is really there
Rough cost (Oct 2026): About $1-2 at list price
Good customers it fails: Poor cameras, worn cards, some faces more than others
How fraud beats it: Deepfakes fed through a virtual camera; AI-made documents

Passport chip read

What it proves: Data signed by the issuing government
Rough cost (Oct 2026): More (needs a mobile SDK)
Good customers it fails: No NFC phone, or no chip in the document
How fraud beats it: Very hard to forge; taking over the account later

Mobile driver's licence or other signed credential

What it proves: Data signed by the issuer and bound to a device
Rough cost (Oct 2026): Low per check
Good customers it fails: Most people can't present one online yet
How fraud beats it: Taking over the phone or wallet

Bank login (Interac in Canada)

What it proves: A bank already verified this person
Rough cost (Oct 2026): A fee per check
Good customers it fails: No eligible bank account
How fraud beats it: Taking over the bank login

List prices come from vendors' public pages; enterprise deals run lower, and the database and signal prices are my estimates, since bureaus don't publish theirs.

Then the question every business applicant raises: who counts as an owner, and where can you check it?

	US	Canada	UK	EU
Owner threshold	25% or more, plus one control person	25% or more of shares or votes, or control	More than 25%, or significant control	25% or more from July 10, 2027; can drop to 15% for higher-risk types
Public register	None for US companies; FinCEN's database now covers only about 28,000 foreign companies	Federal companies only, public since January 2024; Quebec has its own	Yes, the PSC register (people with significant control)	National registers, closed to the general public since a 2022 court ruling
Who verifies	The bank, which pushes it down to you	You confirm by a different method; report mismatches on high-risk federal companies within 30 days	Companies House verifies directors' and owners' identity since November 2025	You; registers gain powers to check
Next change	FinCEN rewrite of the ownership rule, under White House review since September 17, 2026	British Columbia's register (launch unconfirmed)	Identity checks mandatory for everyone after November 17, 2026	AMLR applies July 10, 2027; EU Company Certificate from July 2028

Owner threshold

US: 25% or more, plus one control person
Canada: 25% or more of shares or votes, or control
UK: More than 25%, or significant control
EU: 25% or more from July 10, 2027; can drop to 15% for higher-risk types

Public register

US: None for US companies; FinCEN's database now covers only about 28,000 foreign companies
Canada: Federal companies only, public since January 2024; Quebec has its own
UK: Yes, the PSC register (people with significant control)
EU: National registers, closed to the general public since a 2022 court ruling

Who verifies

US: The bank, which pushes it down to you
Canada: You confirm by a different method; report mismatches on high-risk federal companies within 30 days
UK: Companies House verifies directors' and owners' identity since November 2025
EU: You; registers gain powers to check

Next change

US: FinCEN rewrite of the ownership rule, under White House review since September 17, 2026
Canada: British Columbia's register (launch unconfirmed)
UK: Identity checks mandatory for everyone after November 17, 2026
EU: AMLR applies July 10, 2027; EU Company Certificate from July 2028

More on how the four fit together in Regulatory layering.