A business can have a working website, a real phone number, and a logo that looks professional — and still not exist as a legal entity anywhere. That gap is exactly what Know Your Business checks exist to close. A KYB check isn't one lookup. It's a stack of separate data sources. Each one answers a different question, and together they add up to a single decision: open the account, or don't.
Most people picture verification as one database lookup and a green light. Real KYB doesn't run that way. Here's what actually happens underneath, source by source.
Where the Paper Trail Starts: State and National Registries
Every company begins its legal life with a filing. In the US, that filing sits with a state government, usually the secretary of state's office in whichever state the business incorporated. The filing records the company's legal name, its registration date, its status — active, dissolved, revoked, in good standing or not — and often its registered agent. More than a million businesses are registered in Delaware alone, many with no physical office in the state at all. Outside the US, other bodies do this job: Companies House in the UK, the Handelsregister in Germany, ASIC in Australia.
For years, checking this meant opening a browser, typing the company name into a state website, and reading the result yourself. That doesn't scale past a handful of applications a day. Compliance teams now pull this record programmatically through a secretary of state API, which returns the registration data in a structured format a system can check on its own — no analyst required for the straightforward cases.
This is the foundation layer. If a company doesn't show up in state records, or its status reads "administratively dissolved," everything built on top of that check is worthless. A registry lookup is usually the first gate a KYB process runs, and the one most likely to end things early if something's wrong.
Why the Same Check Looks Different in Every Country
The registry layer sounds simple until you try to run it globally. US state registries vary in what they publish and how current it is — some update within a day, others lag by weeks. Many countries don't maintain a free, searchable public registry at all, and the data has to come from paid commercial providers who aggregate it, sometimes imperfectly.
This unevenness is why a KYB program built for one country rarely works unchanged in another. A US business might clear registry checks in seconds. A business registered in a country with a thin digital paper trail might need a document review instead, simply because no database exists to query. Anyone building or buying a verification process needs to know which gap they're dealing with before they can decide how to close it.
Who Actually Owns the Company
A registration record tells you a company exists. It doesn't tell you who's behind it. That's a separate question, and in the last decade it's become the one regulators care about most.
Beneficial ownership data identifies the real people who own or control a business — typically anyone holding 25% or more of the company, or anyone with significant decision-making power regardless of their stake. Some countries maintain public ownership registries: the UK's People with Significant Control register, for example. Many don't. In those cases, the data comes from the company itself, through incorporation documents, shareholder agreements, or a form the business fills out during onboarding.
Ownership also gets layered on purpose. A US business might be owned by a holding company in Delaware, which is owned by another entity in a different jurisdiction, which is owned by an individual three steps removed from the name on the application. Untangling that chain is most of the actual work in a beneficial ownership check — the last step, naming a person, is usually the easy part.
This layer matters because shell companies are built to obscure exactly this. A business can be legally registered, fully compliant on paper, and still exist only to hide who's really moving money through it. Ownership data is how you catch that — not by finding a red flag, but by finding out there's no real answer to "who owns this."
Sanctions, Watchlists, and Politically Exposed People
Once you know who owns and runs a company, you check those names — and the company's name — against government and international watchlists. This includes sanctions lists like OFAC's in the US and the EU's consolidated list, along with UN Security Council designations. It also includes politically exposed person screening: flagging owners or directors who hold, or recently held, government positions, since that population carries a higher corruption and bribery risk.
This isn't a courtesy check. Doing business with a sanctioned entity carries real legal exposure, sometimes criminal exposure, for the company that missed it. The data sources here are maintained and updated by governments directly, and a serious KYB process re-screens against them continuously, not just once at onboarding. A director who was clean in January and gets sanctioned in June needs to surface in June, not at the next renewal cycle a year later.
Adverse Media and Court Records
Sanctions lists catch what governments have already formally acted on. They miss everything still working its way through investigation, litigation, or reporting. That's what adverse media screening is for.
This layer scans news archives, court filings, and regulatory enforcement actions for a company's name, or the names of its owners, alongside fraud, money laundering, or other financial crime. A business can be nowhere near a sanctions list and still be the subject of an active fraud investigation reported by a regional newspaper. Adverse media is how that story reaches the compliance team instead of staying buried in a local court docket.
It's also the noisiest data source in the stack. Common names generate false matches constantly — a search for "John Smith, director" returns hundreds of unrelated news hits. A serious process needs a way to disambiguate, matching on more than just a name, and giving a human the final call on genuine hits rather than auto-rejecting on volume alone.
Tax IDs and Financial Verification
Alongside identity and ownership, a KYB check usually confirms a company's tax registration — an EIN in the US, a VAT number in the EU — against the relevant tax authority's records. A mismatch here is a strong signal that something in the application doesn't add up, whether that's a typo or something more deliberate.
Financial verification often layers on top: business credit bureau data from providers like Dun & Bradstreet or Experian Business, which tracks payment history, credit lines, and years in operation. None of this is identity verification exactly. It's a picture of whether the business behaves like a business — paying vendors, maintaining credit, operating continuously — rather than existing purely on paper.
Original Documents, When the Registries Fall Short
Registries and databases cover a lot, but not everything. Some jurisdictions keep thin digital records. Some small or newly formed businesses haven't been indexed by any third-party data provider yet. In those cases, KYB relies on documents submitted directly by the company: articles of incorporation, business licenses, board resolutions authorizing a signatory to act on the company's behalf.
These get checked for authenticity — tampering, inconsistent formatting, mismatched dates — the same way an ID document gets checked in a personal identity flow. It's a slower, more manual layer of the process, and it's usually reserved for cases where the automated data sources came back thin or unclear.
A Check, Not a Checkpoint
One mistake shows up constantly in how people think about KYB: treating it as something that happens once, at signup, and never again. Companies change. Ownership changes hands. A director gets added, or sanctioned, or steps down after an investigation goes public. A business that looked clean twelve months ago might not look clean today.
That's why the stronger versions of this process re-run key checks on a schedule, or in response to a trigger — a new UBO filing, a sanctions list update, a change in registered agent. The data sources don't change. What changes is treating them as something to check once versus something to keep watching.
What Happens When the Sources Disagree
Data sources conflict more often than people expect. A registry might list a company as active while its tax filings have lapsed. A beneficial ownership form might name one person while a corporate registry filing names another. Business names get shortened, misspelled, or trademarked under a different legal entity than the one operating day to day — "Joe's Coffee LLC" doing business as a completely different brand is routine, not suspicious, but a system checking names alone can't tell the difference on its own.
Good KYB processes don't treat a conflict as an automatic rejection. They treat it as a reason to look closer. Sometimes that means pulling a second data source to break the tie — checking a business license against the registry filing that disagrees with the ownership form. Sometimes it means a person reviews the file directly, because no combination of databases can explain why a company operating for fifteen years shows a formation date from last year. The volume of conflicts a team can handle by hand is exactly why the earlier, cleaner sources — registries, tax IDs — carry so much of the weight. Every case resolved automatically at that stage is one less case landing on a reviewer's desk.
Why the Sources Have to Work Together
None of these sources tells the whole story alone. A clean registry match with an unverifiable owner is not a passing check. A verified owner with a live sanctions hit is not a passing check either. KYB works because it treats each source as a partial answer and only clears a business once enough of them line up.
That's also where the process breaks down when it's built badly. A KYB program that leans entirely on one data source — registry data, say, without ownership or sanctions screening — has a hole big enough for exactly the kind of business it was supposed to catch. The businesses most worth worrying about aren't the ones that fail every check. They're the ones built carefully enough to pass most of them, and caught only where the sources are actually connected to each other.
