KYB verification: checking a business is real, not just registered

KYB verification is the work of confirming that a business customer is who it says it is. In practice that means three things: showing that the business exists and operates, identifying the people who own and control it, and screening the business and those people for sanctions and adverse media. KYB tooling is good at the first step: confirming that a company with a given name and number appears on a registry. Most of the risk sits in the rest.

This piece walks through each part, the point where each one usually stops short, and what it takes to close the gap. It uses one worked example throughout, the same one on our financial institutions page.

A company registry records what was filed with it. Filing is not the same as verification, and some registries say so outright.

The UK's Companies House is one. Its service information explains that it checks documents are complete and signed but has no power to verify what they say, and that a filing on the register "should not be taken to indicate that Companies House has verified or validated it". That is changing. Since 18 November 2025, new directors and people with significant control have had to verify their identity, with existing ones brought in over a transition that runs to late 2026. It is a real improvement, and what it verifies is the people named on a filing. It does not verify that the company trades.

In the US, companies are formed at state level, and formation agents let one street address serve as the registered office for a very large number of entities. A 2012 New York Times investigation found at least 285,000 businesses using a single building in Wilmington, Delaware, as their legal address. There is nothing wrong with that. It is how registered agents work. But it does mean that the address on a filing tells you where the paperwork goes, not where the business is.

So a registry match establishes that an entity with that name and number was formed and, usually, that it is still in good standing. It is necessary. It says nothing about whether the company trades, how long it has traded, or who is really behind it. A shelf company bought last month, a dormant entity reactivated for one purpose and a genuine twenty-year-old distributor all return the same clean match.

An operating business leaves traces it did not create for the purpose of passing a check. Those traces are what corroboration looks for.

The website is the obvious start, and the questions are about age and consistency rather than existence. When was the domain registered, and does that date sit sensibly against the incorporation date and the history the applicant describes? Does the site describe the same business as the application and the registry's activity code? Is the contact address the registered agent's address, or somewhere goods could plausibly be stored and shipped from?

Beyond the website, look for evidence that other people have dealt with the business over time: customer reviews that build up over years rather than arriving in a single week, job postings, and staff whose professional profiles predate the application and name the company. Trade directory listings and supplier mentions help, and so do filed accounts whose size fits the turnover the applicant expects to put through your platform.

Contradictions are more useful than confirmations. A company claiming ten years of trading on a domain registered this spring. A product catalogue made of stock photos with placeholder text still in the footer. A warehouse address that turns out to be a virtual office. None of these proves fraud. Each is a question the applicant can answer, and an honest business usually answers it easily.

"Not established" is a legitimate result. If the registry supports the legal identity and the website is real but nothing shows the business operating before this year, the finding is exactly that, and it should be recorded as an open question rather than rounded up to a pass or down to a fail.

Start with who counts. The usual definition of a beneficial owner is every individual who owns 25 percent or more of the business, plus one individual with significant responsibility to control or manage it. Definitions vary from country to country, and higher-risk customers often justify looking below the threshold.

Where the ownership information comes from matters as much as the threshold.

Public ownership registers help where they exist. The UK publishes people with significant control on the Companies House register, which is a useful start and carries the same caveat as everything else filed there. Elsewhere, what you can see varies a great deal from country to country, and for many companies there is no public register to check at all.

The practical consequence is that ownership usually arrives as a declaration from the customer, and the work is corroborating it. Follow each layer of the structure until it reaches a natural person or a documented dead end. A holding company is one more layer to follow, and one registered in another jurisdiction may have filings you cannot read, which is itself worth recording. Two patterns are worth watching for: nominee officers and directors supplied to fill every office on the public record, and a business that gives only a registered agent's address.

The most common error in this part is treating a shared name as a connection. The applicant's director and a director of some other company have the same name. That is a lead. It becomes a link when something besides the name matches: a date of birth where the registry publishes one, a service address, a co-director who appears on both, the same formation agent, the same correspondence address, or a signature pattern across filings. Until then it stays in the report as a name match, clearly labelled, and it does not go into the risk score as though it were a finding.

Our field brief on tracing hidden beneficial owners behind shell companies goes further into the layered structures this part runs into.

Sanctions and politically exposed person screening is list-based, and it is the part of KYB with the most mature tooling. Adverse media is different. It searches unstructured news and records for negative coverage of the business and its owners, and its main failure is volume.

The volume comes from matching names. A search for a company name returns every article about every business with a similar name, and a search for a director returns every person who shares theirs. Industry guidance on negative news screening describes discounting a hit as a false positive where the names differ significantly or where secondary identifiers such as a date of birth or a date of incorporation do not match.

The fix is to resolve the entity before treating a hit as relevant. For a business, that means checking the jurisdiction, the registration number, the named directors, the dates and the industry in the article against the customer. For a person, it means the identifiers the article carries, which is often not many. A hit that survives resolution then needs weighing by what it actually says: an allegation, an investigation, a charge and a conviction are four different things, and a single report repeated by ten outlets is still one report.

Keep three things separate in the file: the article, the reasoning for why it does or does not refer to your customer, and the analyst's conclusion. When anyone reviews the case later and asks why it was cleared, that separation is what answers them.

The case below is a composite, and the business in it is invented.

Brantholm Trading applies for a merchant account as an industrial equipment distributor. The KYB API returns a clean registry match: the legal name on the application matches the filing, the company is active, the registered office is on file.

Corroboration. The trading website exists and has a product catalogue and contact details, which fits the application. Nothing yet shows how long the business has been trading, so operating history goes down as not established.

Ownership. The filing names one direct shareholder, Brantholm Holdings, and one director, Alex Morgan. The holding company is a second layer to follow. The director's name also appears on another company's filing. Nothing else on the two filings matches yet, so it is recorded as a name match to review, not as a connection.

Adverse media. One article describes a commercial dispute involving Brantholm Trade BV. The name is close, but the article's company is registered in a different jurisdiction from the applicant and none of its named people appear on Brantholm Trading's filing. Resolved as a different entity, with the reasoning kept beside the article.

What comes out is a legal identity that checks out, an operating history that is not yet established, an ownership structure followed one layer down with one unresolved name, and an adverse media hit that was about someone else. That gives the analyst a short, specific list of what to ask the customer for, before anyone has decided anything.

Not every business customer needs every step at full depth, and a KYB programme that treats a local bakery like an offshore payment processor will be slow for the bakery and no safer for it.

The usual approach is to set depth by risk. Registry, ownership declaration and screening for everyone. Deeper corroboration and full ownership tracing when something raises the risk: a high-risk industry, owners or parents in other jurisdictions, a structure more complex than the business seems to need, answers that do not fit the evidence, or expected volumes that do not fit the size of the company.

New businesses are legitimately thin. A company incorporated last month has no trading history to find, and treating youth as a red flag rejects every genuine startup. For a new business, ask for different evidence: the founders' own histories, signed contracts, a lease.

Small businesses may have almost no online presence. Many sole traders and trades businesses have no website and never will.

Registries differ a great deal in what they publish and how current it is, and some jurisdictions publish very little. A thin result from a thin registry says more about the registry than the company.

Names collide, and transliteration makes it worse. A name written in another script can be spelled several ways in Latin letters, and common names generate matches no amount of tuning removes. Resolution by other identifiers is the only real answer.

And KYB goes stale. Ownership changes, directors resign, a dormant company is sold. A check that was right at onboarding describes that moment, not the customer you have today, so it is worth running again when something changes: a new owner or director, a jump in volume, or anything that calls the earlier picture into question.

A KYB API confirms that an entity is registered and that its documents are genuine, and it should stay in your stack. Sixtyfour works on the questions a registry match leaves open. Starting from what the application already contains, the agent researches the business's operating footprint, follows directors, shareholders and connected entities across filings, and puts potentially relevant adverse media beside the identifiers that support or weaken the match. Every finding carries its source, and anything it could not establish is reported as open rather than filled in. It adds investigative context to your screening and case review. It is not transaction monitoring and it does not make the decision.