Yuliya Kazakevich
8 min read
November 2, 2026
What Good KYB Looks Like Today, From the Bank's Seat
Key Takeaways
The request from the bank arrives on a Wednesday: send us the full file on this customer by Friday. The checks were done, everyone remembers the account being approved, and the only place the reasoning exists is in the head of an analyst who left in March. I've watched some version of this happen more than once, and the program was never missing the checks. It was missing the record.
So this post is the practical version of the last one: what a business onboarding program checks, in what order, and what the file has to contain when someone asks for it. To keep it concrete I'll use one customer, invented for this post. Northgate Supply LLC, a Texas company selling restaurant equipment online, applying for a card program. Owned 40 percent by its founder, Dana Reyes, and 60 percent by a Delaware holding company.
One thing to settle before the walkthrough. "What does good look like" has at least three answers depending on who's asking. The sponsor bank and its examiner want a file that holds up. Dana wants a decision this week without sending the same document twice. The growth team wants Dana approved before she tries a competitor. All three are legitimate and they pull in different directions. This post takes the bank's answer, because it's the one that doesn't negotiate, and the other two have to fit inside it. The next post takes Dana's.
I'm also using a US company because it keeps the example clean. The checks are the same anywhere, the sources aren't, and I'll flag where that matters.
Before the first customer
A program starts with paper. A written procedure that says what gets checked, against which sources, who can approve what, and what triggers enhanced due diligence. A risk model with its inputs and weights written down. A list of industries you won't take and a list you'll take with extra work. An examiner reads these before they look at a single file, and every file is then judged against them. A check you ran that your procedure doesn't mention counts for less than you'd expect, and a check your procedure promises that you skipped is a finding. This is the part most fintech programs write last, and it should be written first.
The entity
Northgate's application says Northgate Restaurant Supply. The Texas Secretary of State has Northgate Supply LLC, formed in 2019, and the record shows a tax forfeiture because a franchise tax report was filed late. The EIN on the application is one digit off from what the IRS match returns.
None of that is fraud. The trade name is on the website, the forfeiture clears when the report is filed, and the EIN is a typo. The check is the right one, verify the business against the registry where it was formed, legal name, registration number, formation date, status, registered address, tax ID against the IRS. What matters is what the procedure does with a mismatch. "Didn't match" needs its own path, which is a question to the customer and a re-check, and that path has to be separate from "failed." Most flows send both down the same chute, and that's where good customers go to die. It's the subject of the next post.
This is also the step that changes most outside the US. A Secretary of State record and an IRS match are a luxury. In some countries the registry is a PDF that updates quarterly, in others it holds no ownership information at all, and the file has to say which registry was used and what it can and can't tell you.
The people
Dana Reyes owns 40 percent, so she's a beneficial owner. The holding company owns 60 percent, and a holding company isn't a person, so you keep going. It turns out to be owned half and half by Dana's brother and sister, which puts each of them at 30 percent of Northgate, so both are beneficial owners too. Dana is the managing member, which makes her the control person. Three people to verify, each the way you'd verify any individual: name, date of birth, address, ID number, against documents or independent data. The 25 percent line is the floor the rule sets, and good programs lower it for higher-risk customers, 10 percent is common, because a structure built to keep everyone under 25 is itself a signal.
Two things make this step defensible. The first is that the chain is written down, the chart that gets from Northgate to three named people through one intermediate company, so a reviewer can follow it. The second is Dana's own certification that these three are everyone. The CDD rule gave banks a form for it and many banks still use one. A lot of fintech flows don't, because once documents replaced forms nobody put the signature back. I'll get to that in post three.
Screening
The entity and each of the three people, against OFAC and whichever other sanctions lists you're obliged to check, PEP lists, and adverse media. Dana's brother shares a name and a birth year with a politician in another country. The hit gets cleared on date of birth and location, and the reason it was cleared is written next to the hit, because an examiner sampling the file will ask why a PEP match was waved through and "the analyst knew" is not an answer.
Rescreen everyone on a schedule after onboarding. And remember the 50 percent rule: an entity owned 50 percent or more by blocked persons is itself blocked even when it appears on no list, which is one more reason the ownership chart has to be complete.
What the business does
An entity in good standing with clean owners can still be selling something your bank won't underwrite. So: the website and any storefront, the product, the industry and merchant category, expected volumes and countries, and whether the activity needs a license. Northgate's site sells ovens and walk-in fridges to restaurants, mostly in Texas and Louisiana, no license required, and the volumes on the application are in line with a business that size. The question is whether what the business says it does matches what you can see it doing, and whether that fits your bank's appetite. Here it does. When it doesn't, that's usually the most serious finding in the file, and the one that gets the least attention at onboarding.
Documents
For Northgate: the Texas certificate of formation, the operating agreement showing the 40/60 split, the holding company's shareholder register showing the siblings, and a voided check for the payout account. Documents prove that facts exist: this company was formed on this date, these people appear on this filing. They're evidence for the checks above. A folder of PDFs with no record of what was concluded from them is the most common weakness I see in files, and it's common because collecting documents feels like doing the work.
The decision
Northgate rates medium: layered ownership, a registry status that needed clearing, a PEP hit that needed clearing. Medium under the written model means a second reviewer, and the file says who both reviewers were, what they looked at, and why they approved. Low risk goes through on the standard checks. Higher risk gets enhanced due diligence, which means more of the above and a second pair of eyes, and the trigger comes from the written model, so two analysts with the same facts reach the same place. Exceptions are allowed, and every exception is written down with who approved it and why.
After the account opens
Verification is a snapshot. Northgate's Texas status flips back to active after the late report is filed, and that update should land in the file on its own. If the holding company gets sold next year, the ownership chart is wrong and nobody told you. So: periodic refresh on a risk-based schedule, event-driven refresh when something changes (a registry status update, a sanctions hit, activity that doesn't match what was expected), and transaction monitoring against the profile set at onboarding. FinCEN's February 2026 relief made the timing of owner re-verification risk-based. It didn't make it optional. It made it yours to defend.
[Insert GIF here: "yuliya kyb series - post 2 - what the bank pulls - gif 1". Delete this line after uploading.]
The file
This is what the bank expects to be able to pull for Northgate by Friday, and what an examiner will sample:
- Which checks ran, against which sources, on which dates
- What came back, including the name mismatch, the forfeiture and the EIN typo, and how each was resolved
- The ownership chart, three people through one holding company, and how each person was verified
- Screening results, including the PEP hit and the reason it was cleared
- Dana's certification that the ownership picture is complete
- The risk rating with its inputs, the decision, both reviewers and the rationale
- Any exception, who approved it and on what basis
- Monitoring and refresh history since opening, including the status change
And at the program level: QA sampling of analyst decisions, training records, independent testing, and oversight of vendors. The last one catches people out. If a vendor ran the check, the output is still your decision, and the bank will ask you, not the vendor, how it got there.
The bank will also ask for numbers, and a program that can't produce them looks like it isn't managing itself. Time from application to decision, by risk tier. The share of applicants approved with no human touch. How often you ask for documents and how often the request was avoidable. QA error rate. How many screening hits turned out to be real. None of these are hard to count, and I've rarely seen a fintech program that counts all of them.
Where this leaves most programs
Most programs run most of these checks on a customer like Northgate. The weak points tend to be the same ones: the ownership chain stops at the holding company, there's no certification from the customer, the documents sit in the file without conclusions, and the rationale lives in the analyst's head. These are process gaps first, and at any real volume the record I've described doesn't exist without tooling built to produce it. The next post is about the customers these programs lose along the way, and it turns out to be the same list of weak points seen from Northgate's side of the screen.
You might want to read these...
AiPrise
6 min read
KYB Compliance: 2026 Regulations You Should Know About
As organizations expand globally and face tighter regulations, adherence to Know Your Business (KYB) standards has become one of the most critical compliance layers for fintech, online marketplaces, and other companies that need to verify business customers before letting them perform financial transactions.
.png){kind=spacer}
.jpg)
.png)
.png)
.png)
.png)
AiPrise’s data coverage and AI agents were the deciding factors for us. They’ve made our onboarding 80% faster. It is also a very intuitive platform.
Head of Operations
See your full compliance picture in one place
Use AI agents and global data to review businesses and users faster and more accurately
