Business Entity Verification (KYB): What a Check Should Include

Know Your Business sounds like a product category; in practice it is a short list of questions about a company, its EIN, its address and its owners. Lenders, payment platforms and marketplaces answer them from a handful of sources, and this post lists them.

Updated October 28, 2026.

What KYB Is For

KYB is the business equivalent of identity verification. Before you lend to a company, move money for it, or let it sell on your platform, you confirm that the business exists, that its identifiers belong to it, and that you're allowed to deal with it. Regulated institutions have formal obligations; fintechs, marketplaces and payment platforms often adopt the same checks to cut fraud.

This post covers businesses you onboard as customers or counterparties. For the vendor side, where you're paying the business and filing 1099s, see Vendor Validation: Why TIN Matching Alone Is Not Enough and the Vendor Onboarding Checklist.

Key takeaways

  • KYB is five questions: legal name and EIN, registration and standing, address, sanctions, and owners.
  • Each question has a different source; an EIN lookup, state records, address validation and sanctions lists are not interchangeable.
  • IRS TIN Matching fits only when the business is also a payee you will report on.
  • Since FinCEN's March 26, 2025 interim final rule, U.S.-formed companies do not report beneficial owners to FinCEN, so owner data comes from the business itself.
  • Registration status and sanctions lists change, so rescreen on a schedule and keep one record per business.

The Core Checks

1. Legal name and EIN Does the EIN the business gave you belong to the legal name on the application? A mismatch catches DBAs used in place of the legal name, parent-company EINs, typos, and synthetic businesses built on a borrowed EIN.

2. Registration and good standing Is the entity registered with a state, and is it active? A dissolved or forfeited company shouldn't be onboarding.

3. Address Is the address a real, deliverable location, and is it consistent with the registration? Virtual offices and mismatched states are worth a second look.

4. Sanctions and watchlists Is the business, or anyone controlling it, on OFAC or other sanctions lists? This is a legal requirement for anyone making or facilitating payments.

5. Beneficial owners Who owns and controls the business? Regulated institutions collect and screen beneficial owners, and the owners also need to pass sanctions screening. Since FinCEN's March 26, 2025 interim final rule, U.S.-formed companies and U.S. persons are exempt from beneficial ownership reporting; only certain foreign-formed companies registered to do business in the U.S. still report. Owner information for a domestic company therefore has to come from the business itself, usually through a certification at onboarding. See The Corporate Transparency Act in 2026.

The sanctions check on the owners is not optional. Under OFAC's 50 percent rule, an entity owned 50 percent or more, directly or indirectly, by one or more blocked persons is itself blocked even though its own name appears on no list.

Which Source Answers Which Question

Question Source
Does the EIN belong to this company? EIN-to-legal-name lookup
Is the company registered and active? State business registration records
Is the address real? Address validation
Is the company or an owner sanctioned? OFAC and other sanctions lists
Is the EIN valid for a payee you'll issue a 1099 to? IRS TIN Matching

One note on that last row: IRS TIN Matching is meant for payers confirming the TINs of people and businesses they pay and report on. It fits when the business you're onboarding is also a payee, such as a seller on a marketplace or a contractor on a platform. For a pure KYB check where you aren't paying the business, use an EIN lookup instead.

Where KYB Checks Go Wrong

  • Accepting the DBA as the legal name. The check passes on the wrong entity.
  • Screening only at onboarding. Sanctions lists and registration status change; rescreen periodically.
  • Name-only sanctions screening. Without address or country, common names produce noise and real hits get dismissed.
  • Separate tools with separate records. When every check lives in a different system, there's no single record of what was verified and when.

Most findings fall into a handful of patterns, and the right response is usually the same each time.

Finding Likely cause What to do
EIN returns a different legal name DBA given instead of the legal name, a parent's EIN, or a typo Ask which legal entity is applying; recheck with the corrected name or EIN
Legal name matches, but state registration is inactive Dissolved, forfeited for unpaid fees, or re-formed under a new entity Request a current certificate of good standing before approval
Address does not validate Typo, virtual office, mail drop Confirm the operating address and compare with the registration
Possible sanctions match on a common name False positive Compare country, address, date of birth and identifiers; document the clearance
Possible sanctions match where the details line up Real hit, or an owner who is a blocked person Stop onboarding and escalate; do not move money
Owner certification missing or incomplete Applicant does not know the rule, or is avoiding it Hold the application until owners are named and screened

Rescreening belongs on a calendar: monthly across the whole customer base as a baseline, weekly for higher-risk populations, and again whenever a list you rely on updates or the business changes its name, owners or bank details.

A Practical Onboarding Flow

  1. Collect legal name, EIN, address and owners at signup
  2. Confirm the legal name associated with the EIN
  3. Confirm registration and active status
  4. Validate the address
  5. Screen the business and its owners against sanctions lists
  6. Route mismatches and possible hits to review instead of auto-approving
  7. Keep one timestamped record of every result

How TIN Comply Helps

TIN Comply covers the core KYB checks in one call:

It runs in the portal, in bulk, or through the API inside your onboarding flow, with every result logged and exportable.

Start a free trial and run a business through the full check.

Bottom Line

KYB comes down to five questions: legal name and EIN, registration, address, sanctions, and owners. Answer them from the right sources, rescreen over time, and keep one record of what you checked.

This article is for informational purposes only and does not constitute legal advice. Regulated institutions should follow their own BSA/AML program requirements.

Related