The KYB process, step by step: 9 steps from registry check to monitoring
Louise Toulemonde
October 8, 2026
The KYB (know your business) process is the sequence of checks you run before taking on a company as a customer: confirm the company exists, identify who acts for it, map who owns and controls it, verify and screen those people, understand the business, assess the risk, decide and keep the file current. In the EU, each step maps to a customer due diligence measure in Articles 20 to 26 of the Anti-Money Laundering Regulation.
Most KYB files should clear in one pass. If yours don't, the problem is your process, not your customers: on Dotfile, 87% of ownership structures with a recorded source were built from a single source, and only 1 in 8 used two or more. The order of the steps decides which kind of file you are holding, and how long the rest will take.
KYB is the customer due diligence a regulated firm performs on a business customer; the definition, the law behind it and how it differs from KYC are in what is KYB. This page is the process.
KYB process checklist: the 9 steps
| Step | What you do | Legal basis (EU AMLR) |
|---|---|---|
| 1. Collect identifiers | Legal name, registration number, country | Article 22(1)(b) |
| 2. Verify the company in the register | Existence, status, legal form, address, representatives | Article 22(1)(b) and (6) |
| 3. Verify who acts for the company | Legal representatives and signatories | Articles 20(1)(i) and 22(1)(b)(iii) |
| 4. Map the ownership structure | Every corporate shareholder, up to people | Article 20(1)(b) |
| 5. Identify and verify the UBOs | Calculate stakes, test control, verify identity | Articles 20(1)(b), 22(7) and 52 to 54 |
| 6. Screen the company and its people | Sanctions, PEPs, adverse media | Article 20(1)(d) and (g) |
| 7. Understand the business | Activity, purpose and intended nature of the relationship | Article 20(1)(c) and (e) |
| 8. Assess the risk and decide | Risk level, enhanced due diligence if needed, approval | Article 20(2) |
| 9. Monitor and update | Ongoing monitoring, periodic and event-driven reviews | Articles 20(1)(f) and 26 |
All articles refer to Regulation (EU) 2024/1624.
1. Collect identifiers
Start with what uniquely identifies the company: its legal name, registration number and country of incorporation (Article 22(1)(b), Regulation (EU) 2024/1624). A name alone is not an identifier; two companies can share it in the same country.
2. Verify the company in the official register
Company verification is confirming, from an official register, that the company exists, is active and matches what the customer declared: legal form, registered address, date of incorporation, legal representatives. Pull the extract from the register of the country of incorporation and keep its date. A declared address that differs from the register is a question to ask, not a typo to fix.
3. Verify who acts for the company
The person filling in your onboarding form must be entitled to act for the company. Article 20(1)(i) asks you to verify that anyone who claims to act for the customer is authorised to, and to identify and verify that person, with the legal representatives recorded under Article 22(1)(b)(iii) (Regulation (EU) 2024/1624). Check them against the legal representatives listed in the register, or against a power of attorney, and run an identity check on them like any individual customer.
4. Map the ownership structure
The ownership structure is the map of who owns and controls the company, from its direct shareholders up through every holding company. Article 20(1)(b), Regulation (EU) 2024/1624 asks you to understand it, not just to list names. This is the step that decides the shape of the rest of the file. A company held only by people needs one register. A company held through a foreign holding needs a second register, sometimes a third.
5. Identify and verify the UBOs
Calculate each person's total stake by multiplying along chains and adding across them, test control separately, then verify each beneficial owner's identity and compare your findings with the central register (Articles 22(7) and 52 to 54, Regulation (EU) 2024/1624). Discrepancies must be reported within 14 calendar days (Article 24(1)). The UBO verification process guide covers this step in detail.
6. Screen the company and its people
Screen the company, its legal representatives and every UBO against sanctions lists, check the people for politically exposed person status and run adverse media on a risk basis. Article 20(1)(d), Regulation (EU) 2024/1624 explicitly extends sanctions checks to the beneficial owners. Our AML screening guide covers lists, matching and false positives.
7. Understand the business
Collect what the company does and why it wants the relationship: activity, expected volumes, countries, the purpose and intended nature of the business relationship (Article 20(1)(c) and (e), Regulation (EU) 2024/1624). The answer is what later transactions are judged against.
8. Assess the risk and decide
Combine the findings into a risk level: jurisdictions, industry, ownership complexity, screening results, delivery channel. High risk triggers enhanced due diligence. Then a person decides, and the decision is recorded with the evidence behind it. Article 20(2), Regulation (EU) 2024/1624 sets the extent of the measures "on the basis of an individual analysis of the risks", so the risk assessment also justifies why a low-risk file was handled quickly.
9. Monitor and update
KYB does not end at approval. Article 20(1)(f), Regulation (EU) 2024/1624 requires ongoing monitoring, and Article 26 caps the time between updates at 1 year for customers under enhanced due diligence and 5 years for the rest, with an update whenever relevant circumstances change. Watching the register for changes of representatives or shareholders turns a calendar review into an event-driven one.
Worked example: two companies, two paths
Two fictional applicants arrive on the same morning.
| Step | Atelier Rive SARL (France) | Maple Logistics SAS (France) |
|---|---|---|
| Register check | Active, details match | Active, details match |
| Ownership structure | Two individuals, 60% and 40% | 70% held by a Dutch holding, itself held by a UK company; 30% by an individual |
| Registers consulted | 1 | 3 |
| UBOs | Both shareholders | The individual direct shareholder at 30%, plus one person at the top of the chain at 45.5%; a third person at 24.5% is not a UBO on ownership alone |
| Screening | Both shareholders and the signing director, plus the company | Both UBOs and the signing director, plus the three companies in the chain |
| Path | Standard due diligence, one pass | Ownership review across three countries before the risk decision |
Same process, same 9 steps. The ownership structure is what makes one file a single pass and the other a research project, which is why it belongs early, before screening and risk, and not at the end.
What the data says about the KYB process
A KYB process that sends every file through the same review is built for the 16.2% and makes the 83.8% wait.
- Most files clear in one pass: 87% of ownership structures come from a single source.
- Five in six have no corporate shareholder, so steps 4 and 5 collapse into one.
Frequently asked questions
What are the steps of the KYB process?
Collect identifiers, verify the company in the register, verify who acts for it, map the ownership structure, identify and verify the UBOs, screen the company and its people, understand the business, assess the risk and decide, then monitor and update.
What is the difference between KYC and KYB?
KYC verifies an individual. KYB verifies a business, and runs a KYC check on each person it finds behind the business: representatives and beneficial owners. Our guide to KYB meaning covers the basics.
How long does the KYB process take?
For a company held only by individuals with clean data in one register, a single pass. Time grows with the number of registers the ownership structure crosses and the documents needed when a register is incomplete.
What documents does the KYB process collect at each step?
Usually a registry extract, the articles of association, a share register or shareholder list when the registry gives no percentages, identity evidence for representatives and UBOs plus anything enhanced due diligence requires, such as proof of source of funds.
Is KYB a legal requirement?
For obliged entities under EU anti-money laundering rules, yes: customer due diligence on business customers is required by Article 13, Directive (EU) 2015/849 today and by Article 20, Regulation (EU) 2024/1624 from 10 July 2027.
Where Dotfile fits
Dotfile runs the KYB process in one case: company data from official registers and data providers, ownership unravelling across countries, identity verification and AML screening on every person found, a risk engine for the risk level and company monitoring for changes after approval. The decision stays with the analyst who signs the file.
Ready for Anywhere?
Verify any business, enter any market, defend every decision. Every signal orchestrated, every decision traceable, from one platform.