KYB vs KYC: Why Verifying Businesses Is Harder

If KYC is "is this person who they say they are," KYB is "is this entity what it claims to be, and who actually controls it?"

It is harder for three reasons:

1. A company is a legal fiction. There is no face to scan.
2. Companies can own companies that own companies. Ownership graphs can be five layers deep before you reach a human.
3. Some jurisdictions actively help bad actors hide that ownership chain.

The three layers of KYB

A real KYB workflow has three distinct layers:

• Existence verification. Does this company exist in a corporate registry? Is it in good standing? When was it incorporated? What's its registered address?
• Beneficial ownership mapping. Who are the humans that ultimately control this entity? UBO is usually defined as anyone owning >25% of the company, plus anyone with effective control regardless of equity.
• Risk screening. Are the company itself, its directors, or its UBOs on sanctions lists? Adverse media? PEP lists?

Why the data is fragmented

There is no global corporate registry. Every country has its own, with wildly different quality:

Country	Registry	Quality
UK	Companies House	Free, structured, machine-readable. The gold standard.
US	State-level (Delaware, Wyoming, etc.)	Patchy. Some states require beneficial ownership disclosure (CTA), some don't.
Singapore	ACRA	Excellent — paid but comprehensive.
Cayman Islands	General Registry	Limited public information by design.

The Corporate Transparency Act (and why it matters)

The US passed the CTA in 2021. Starting January 2024, most US-formed entities must report their beneficial owners to FinCEN. This was supposed to end the era of anonymous shell companies in Delaware.

In March 2025, the Treasury Department announced it would only enforce CTA against foreign entities — meaning US shell companies remain functionally anonymous to anyone without a subpoena.

For your KYB workflow, this means: do not rely on FinCEN BOI for US entity ownership. Use commercial registry data and ask the entity to attest to ownership themselves.

The "shell company" pattern

The classic structure used to obscure ownership:

Operating Company (US)
  └── owned by Holding Co (Delaware LLC, single member)
        └── owned by IBC (BVI)
              └── owned by Trust (Jersey)
                    └── beneficiary: ???

Each layer is legal. None of them, in isolation, is a problem. Together, they form a structure where determining the human controller requires either subpoena power or specialized investigative firms.

If your KYB workflow encounters a structure that looks like this, the right answer is usually: require additional documentation, or decline. Not "approve and hope."

What good KYB looks like

1. Start with the entity's legal name + jurisdiction. Look it up in the registry.
2. Pull the officers and registered owners. Compare against sanctions lists.
3. For each owner that is itself an entity, recurse. Stop at humans or at hop limit.
4. Ask the entity to attest to its UBOs. Compare attestation to registry data.
5. Flag discrepancies for manual review.

None of this is hard to describe. All of it is hard to do in production at scale, which is why the KYB tooling industry exists.