KYB in banking, short for Know Your Business, is the due diligence a bank runs before it will open an account or extend credit to a company. The bank has to confirm the business legally exists, understand how it operates, and identify the real people who own or control it. The requirement comes from the Bank Secrecy Act and federal anti-money-laundering rules, and every U.S. bank is obligated to maintain a written program to carry it out. For you as a business owner, KYB is the paperwork gauntlet between walking in the door and being able to move money.
What Your Business Has To Hand Over
Expect to arrive with a stack of documents. The bank needs enough on paper to confirm the company is real, formed properly, and operating where you say it is.
- Your full legal business name and Employer Identification Number, both matching IRS records exactly.
- Formation documents filed with your state: Articles of Incorporation for a corporation, Articles of Organization for an LLC, or the equivalent.
- Operating agreement or bylaws, which show who has authority to sign contracts and manage accounts on the company’s behalf.
- A physical street address, not a P.O. box. Banks verify this against third-party data to confirm the business actually operates somewhere.
- Any state or local licenses your industry requires.
If you’re applying for credit or the bank flags the account as higher risk during initial screening, plan to also produce recent financial statements such as a balance sheet and income statement. The bank uses those to test whether the activity you describe matches the economic reality of the operation.
Beneficial Ownership: The 25% Rule and the Control Person
The part of KYB that catches most business owners off guard is beneficial ownership. Federal regulations require the bank to identify and verify the actual humans behind every legal entity customer at account opening, and there are two prongs to it.
The first is ownership. Anyone who directly or indirectly owns 25% or more of the equity in the business is a beneficial owner. Ownership can run through intermediary companies or trusts, and the bank has to trace the chain back to a living person. If a trust holds 25% or more of the entity, the trustee is treated as the beneficial owner.
The second is control. The bank must also identify one control person: a single individual with significant responsibility to manage or direct the entity. The regulation lists roles like CEO, CFO, COO, President, Vice President, Treasurer, or Managing Member as examples, but anyone regularly performing similar functions qualifies, even with zero ownership stake.
For each beneficial owner and the control person, the bank collects the individual’s full legal name, home address, date of birth, and Social Security number (or an equivalent identification number for non-U.S. persons). That data feeds into the same background checks and watchlist screening the bank runs on the entity.
Whoever opens the account on behalf of the business has to certify that the beneficial ownership information is accurate. The certification typically uses a standard form prescribed in the regulations, and the person signing it is vouching for what’s disclosed. Misrepresenting who owns or controls the company is where businesses land in serious trouble.
Which Entities Skip the Beneficial Ownership Form
Not every business triggers the full beneficial ownership process. The regulation exempts entities that are already subject to heavy regulatory oversight and public disclosure elsewhere. If your business falls into one of these categories, the bank still verifies the entity itself, but it won’t ask you to fill out the beneficial ownership certification form:
- Publicly traded companies with securities registered under the Securities Exchange Act.
- Banks, credit unions, broker-dealers, and other regulated financial institutions.
- Bank and savings-and-loan holding companies.
- Investment companies and investment advisers registered with the SEC.
- State-regulated insurance companies.
- Public accounting firms registered under the Sarbanes-Oxley Act.
- Commodity market participants registered with the CFTC, including commodity pool operators and swap dealers.
- Certain foreign financial institutions based in jurisdictions where regulators already maintain beneficial ownership information.
- Non-U.S. government entities engaged only in governmental activities.
A bank can always ask for more information under its own risk-based policies, even for an exempt entity.
What the Bank Does With Your Information
Once you’ve submitted everything, the bank’s compliance team independently confirms what you’ve told them. They cross-reference your EIN against IRS records, check your entity’s standing with the state where it was formed, and use third-party data services to verify that your address corresponds to an actual business location. If the state registry shows the entity has been dissolved, suspended, or is not in good standing, the application will stall or die there.
The bank also runs the entity name, any trade names, and every identified beneficial owner through global sanctions and enforcement databases. The most consequential is the Specially Designated Nationals (SDN) list maintained by the Office of Foreign Assets Control.
OFAC Screening
A bank cannot open an account for any person or entity on the SDN list. If someone on that list applies, the bank must block any funds submitted with the application, place them in an interest-bearing account, and report the blocked property to OFAC within 10 business days. There is no discretion involved. For potential matches that aren’t exact, OFAC recommends the bank conduct its own initial analysis, and if the match is reasonably close and the customer is located near the listed person, contact OFAC before blocking anything. OFAC specifically advises against blocking on a partial match alone.
Risk Rating and Enhanced Due Diligence
After verification and screening, the bank assigns a risk rating to the relationship. Federal examiners have been clear that no specific customer type automatically presents a higher risk of money laundering or terrorist financing; risk depends on the facts of each relationship. In practice, though, certain characteristics consistently draw closer attention: complex ownership structures layered through multiple entities, operations spanning countries with weak anti-money-laundering regimes, cash-intensive business models, and industries where the regulatory picture is unsettled.
A higher-risk rating doesn’t mean automatic rejection. It means enhanced due diligence: more documentation requests, more frequent reviews, and tighter transaction monitoring. Banks are required by statute to direct more attention and resources toward higher-risk customers, rather than applying the same level of scrutiny to every account.
Monitoring Continues After the Account Opens
KYB doesn’t end at account opening. The Customer Due Diligence rule requires banks to conduct ongoing monitoring for two purposes: identifying and reporting suspicious transactions, and keeping customer information updated on a risk basis.
The profile you provided at account opening becomes the baseline. If your business typically processes $50,000 a month and suddenly starts moving $500,000 with no clear explanation, the bank’s monitoring systems flag it. Depending on the circumstances, the bank may file a Suspicious Activity Report with FinCEN.
There is no fixed schedule requiring beneficial ownership updates every set number of years. Under a February 2026 FinCEN order, banks may limit their beneficial ownership re-verification to three scenarios: the initial account opening, any time the bank learns facts that call previously obtained information into question, and as needed based on the bank’s own risk-based due diligence procedures. When re-verification is triggered under the risk-based prong, the bank can rely on your previously submitted information as long as you certify or confirm it’s still accurate. If you can’t confirm that, the bank has to collect and verify everything from scratch.
Higher-risk accounts get re-verified more often; lower-risk accounts may go years without a formal update. Either way, tell your bank proactively when something significant changes, whether it’s an ownership shift, a new CEO, or a change in the nature of your operations. Waiting for the bank to spot it through monitoring is a good way to trigger scrutiny you’d rather avoid.
The Corporate Transparency Act Does Not Replace Bank KYB
The Corporate Transparency Act (CTA) originally created a separate federal requirement for most businesses to report beneficial ownership information directly to FinCEN. That generated a lot of confusion about how it overlapped with the KYB your bank runs.
As of March 2025, FinCEN revised its regulations to exempt all entities created in the United States from the CTA’s beneficial ownership reporting requirement. The definition of “reporting company” now covers only entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction. Treasury has also said it will not enforce penalties or fines associated with the BOI reporting rule against U.S. citizens or domestic companies. Foreign entities that still qualify as reporting companies and don’t meet an exemption must file with FinCEN; those registered before March 26, 2025, had to file by April 25, 2025, and foreign entities registered on or after that date have 30 calendar days from the effective date of their registration.
Here is the important part for anyone opening a business account: even though domestic companies no longer report beneficial ownership to FinCEN, the bank-level requirement under 31 CFR 1010.230 remains fully in effect. Your bank still has to identify and verify your beneficial owners at account opening. The CTA change removed a government filing obligation. It did not change what your bank asks for during KYB.
What Happens If KYB Goes Badly for Your Business
For businesses, the practical consequences of KYB failures are less about fines and more about access. If the bank can’t verify your beneficial ownership, or if the information it collects is inconsistent with what its checks turn up, it will decline the account. If problems surface after the account is already open, the bank may freeze or close it. And in an environment where every major bank runs continuous transaction monitoring, the worst outcome is having your account flagged for suspicious activity and reported to FinCEN. That creates a record that follows your business into every future banking relationship.
The way through KYB is preparation. Bring accurate formation documents, know exactly who owns 25% or more of the company, decide in advance who will be named as the control person, and be ready to certify all of it in writing.