KYB in banking, short for Know Your Business, is the due diligence process a bank runs before it will open a commercial account or extend credit to your company. The bank has to confirm the business is real, legally formed, in good standing, and traceable to the actual humans who own or control it. The requirement comes from the Bank Secrecy Act and federal anti-money-laundering regulations, which obligate every bank to maintain a written program for identifying business customers and the people behind them.
If you are preparing to open a business account, the smoothest path is knowing in advance what documents you need, who in your ownership structure the bank will want to see, and what the bank will do with the information once you hand it over.
What Your Business Needs To Provide
Walking into a bank to open a commercial account means walking in with paperwork. The bank needs enough to confirm your business exists, operates legally, and is who it claims to be.
At a minimum, come prepared with:
- Your full legal business name and Employer Identification Number, both matching IRS records exactly.
- Formation documents filed with your state: Articles of Incorporation for a corporation, Articles of Organization for an LLC, or the equivalent.
- Operating agreements or bylaws, which show who has authority to act for the company, sign contracts, and manage accounts.
- A physical street address, not a P.O. box. Banks verify the address against third-party data to confirm the business actually operates somewhere.
- Any state or local licenses and permits your industry requires.
If you are applying for credit, or if initial screening flags your business as higher risk, you may also be asked for recent financial statements such as balance sheets and income statements. The bank uses those to check whether the account activity you describe matches the economic reality of your operation.
Beneficial Ownership: The 25 Percent Rule and the Control Person
The most scrutinized part of KYB is identifying the real people behind the business. Federal regulations require banks to identify and verify the beneficial owners of every legal entity customer at account opening, and a beneficial owner falls into one of two categories.
The first category is ownership. Anyone who directly or indirectly owns 25 percent or more of the equity in the business is a beneficial owner. Ownership can run through intermediary companies or trusts; the bank has to trace the chain back to a living person. If a trust holds 25 percent or more, the trustee is treated as the beneficial owner.
The second category is control. The bank must also identify one control person, meaning a single individual with significant responsibility to manage or direct the entity. The regulation points to roles such as CEO, CFO, COO, President, Vice President, Treasurer, or Managing Member, but anyone who regularly performs similar functions qualifies, even with no ownership stake at all.
For every identified beneficial owner and the control person, the bank collects the individual’s full legal name, home address, date of birth, and Social Security number (or an equivalent identification number for non-U.S. persons). That personal data feeds into the same background checks and watchlist screening applied to the entity itself.
Whoever opens the account on behalf of the business has to certify that the beneficial ownership information is accurate. The certification can come through a standard form prescribed in the regulations or through another method, but the person signing it is vouching for what has been disclosed. Misrepresenting who owns or controls the company is where businesses get into serious trouble.
Which Businesses Skip the Beneficial Ownership Form
Not every business triggers the full beneficial ownership process. The regulation exempts entities already subject to heavy regulatory oversight and public disclosure, on the theory that another regulator is already keeping track of who owns and controls them.
The exempt categories include:
- Publicly traded companies with securities registered under the Securities Exchange Act.
- Regulated financial institutions, including banks, credit unions, and broker-dealers.
- Bank and savings-and-loan holding companies.
- Investment companies and advisers registered with the SEC under the Investment Company Act or Investment Advisers Act.
- State-regulated insurance companies.
- Public accounting firms registered under the Sarbanes-Oxley Act.
- Entities registered with the CFTC, including commodity pool operators and swap dealers.
- Certain foreign financial institutions in jurisdictions where regulators already maintain beneficial ownership information.
- Non-U.S. government entities engaged only in governmental activities.
If your business is exempt, the bank still verifies the entity itself, but it won’t make you fill out the beneficial ownership certification. It can always ask for more under its own risk-based policies.
How the Bank Verifies What You Submitted
Once your documents are in, the bank’s compliance team confirms the information independently. They do not simply take your word for it.
Compliance typically cross-references your EIN against IRS records, checks the entity’s standing with its state of formation, and uses third-party data to confirm the physical address matches a real business location. If the state registry shows your entity has been dissolved, suspended, or is not in good standing, that is a red flag that will stall or kill the application.
The bank also runs the entity name, any trade names, and every identified beneficial owner through global sanctions and enforcement databases. The most consequential is the Specially Designated Nationals (SDN) list maintained by the Office of Foreign Assets Control.
OFAC Screening and the SDN List
A bank cannot open an account for any person or entity on OFAC’s SDN list. If a listed person applies, the bank must block any funds submitted with the application, hold them in an interest-bearing account, and report the blocked property to OFAC within 10 business days. Providing financial services to a blocked person is a prohibited transaction, full stop.
For potential matches that are not exact, OFAC recommends the bank conduct its own initial analysis and, if the match is reasonably close and the customer is near the listed person geographically, contact OFAC before blocking anything. OFAC specifically advises against blocking a transaction based on a partial match alone without first discussing it with the agency.
Risk Rating and Enhanced Due Diligence
After verification and screening, the bank assigns a risk rating to the relationship. Federal examiners have been clear that no specific customer type automatically presents a higher risk of money laundering or terrorist financing; risk depends on the facts of each relationship.
Certain characteristics do consistently draw closer attention: complex ownership structures with multiple layers of entities, operations in countries with weak anti-money-laundering regimes, cash-intensive business models, and industries where the regulatory picture is unsettled. A business rated higher risk isn’t rejected automatically, but it faces enhanced due diligence, which usually means more documentation requests, more frequent reviews, and tighter transaction monitoring.
Banks are required by statute to direct more attention and resources toward higher-risk customers rather than applying identical scrutiny to every account. That risk-based approach is built into the law itself.
What Happens After the Account Opens
KYB does not end at account opening. The Customer Due Diligence rule requires banks to conduct ongoing monitoring, both to identify and report suspicious transactions and to keep customer information current on a risk basis.
The profile you provided at account opening becomes the baseline. If your business normally processes $50,000 a month and suddenly starts moving $500,000 with no clear explanation, the monitoring system will flag it. Depending on the circumstances, the bank may file a Suspicious Activity Report with FinCEN.
There is no fixed regulatory schedule requiring the bank to re-verify beneficial ownership every set number of years. Under a February 2026 FinCEN order, banks may limit re-verification to three scenarios: the initial account opening, any time the bank learns facts that call previously obtained information into question, and as needed under the bank’s own risk-based due diligence procedures. When re-verification is triggered under the risk-based prong, the bank can rely on your previously submitted information as long as you certify or confirm it is still accurate. If you cannot confirm it, the bank has to collect and verify beneficial ownership information from scratch.
In practice, higher-risk accounts get re-verified more often, while lower-risk accounts may go years between formal updates. Any significant change in your business, such as a change in ownership, a new CEO, or a shift in the nature of your operations, should be reported to your bank proactively. Waiting for the bank to discover it through monitoring is a good way to trigger scrutiny you would rather avoid.
Does the Corporate Transparency Act Replace Bank KYB?
No. The Corporate Transparency Act originally required most businesses to report beneficial ownership information directly to FinCEN, separate from any bank relationship, and that created a lot of confusion about overlap with bank-level KYB.
As of March 2025, FinCEN revised its regulations to exempt all entities created in the United States from the CTA’s beneficial ownership reporting requirement. The definition of “reporting company” now covers only entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction. Treasury has also announced it will not enforce penalties or fines under the BOI rule against U.S. citizens or domestic companies. Foreign reporting companies registered before March 26, 2025, had to file by April 25, 2025; those registered on or after that date have 30 calendar days from the effective date of their registration.
Here is the piece businesses most often miss: even though domestic companies no longer file beneficial ownership reports with FinCEN, the bank-level requirement under 31 CFR 1010.230 is still fully in effect. Your bank still has to identify and verify your beneficial owners at account opening. The CTA change ended a government filing obligation; it did not change what the bank asks for during KYB.
What Goes Wrong When KYB Breaks Down
For a business, the practical consequences of KYB problems are less about fines and more about access. If a bank cannot verify your beneficial ownership, or gets inconsistent information from different sources, it will decline the account. If problems surface after the account is open, the bank may freeze or close it. And with continuous transaction monitoring now standard at every major bank, the worst outcome is having your account flagged for suspicious activity and reported to FinCEN, which leaves a record that follows your business to every future banking relationship.
The way to avoid all of this is straightforward. Keep your state registration current and in good standing. Make sure the legal name and EIN on your documents match IRS records exactly. Know who your 25-percent-plus owners are, trace the chain through any intermediate entities, and be ready to name one control person. Tell the bank about ownership and leadership changes when they happen, not when the bank finds out on its own.