Yuliya Kazakevich
6 min read
October 28, 2026
Why KYB Exists
Key Takeaways
A company can be formed in Wyoming from a phone in under an hour, for less than the cost of dinner. Nobody at the state asks who owns it. By Thursday it has a bank account. That was true in 1990 and it's mostly true now, and the reason the rules around it look the way they do is simple: every one of them arrived after someone used exactly that kind of company to do something that made the news, and each rule fixed the last problem. Once you see that pattern the history reads differently, so I want to walk through it once before writing about what's broken.
1970: a paper trail
The Bank Secrecy Act passed in 1970 after hearings on cash moving through banks that kept no useful records and on Americans hiding money in accounts abroad. It asked banks to keep records and to report cash transactions over $10,000. Knowing the customer wasn't part of it. The point was a trail that investigators could follow after the fact, and for the next thirty years that's what compliance was, recordkeeping and reporting. Money laundering itself only became a federal crime in 1986.
2003: verify the customer
After September 11 it came out that the hijackers had opened US accounts with almost no friction. Section 326 of the PATRIOT Act told the Treasury to set minimum standards for identifying customers, and the Customer Identification Program rule took effect in 2003. For the first time a bank had to collect a name, an address, a date of birth or formation date, and an identification number, and then verify that the customer was who they claimed to be, from documents or from independent sources.
For a business, that meant verifying the business. Articles of incorporation, a business license, an EIN. The rule treated the entity as the customer and left the people behind it to each bank's judgment. This is the gap everything since has been trying to close, because an entity is a filing. In my experience most onboarding flows are still quietly built on the 2003 model: verify the entity, collect the documents, move on. The later rules got bolted on top.
2018: look through the entity
FATF had been pushing beneficial ownership since 2003 and graded the US badly on it in 2006 and again in 2016. FinCEN started drafting a rule in 2012. Then the Panama Papers landed in April 2016, eleven million documents showing how shell companies were used to hide owners from everyone, including their banks, and the final Customer Due Diligence rule followed in May, with a compliance date of May 2018. Four years of drafting and the scandal still got there first.
The CDD rule did two things. It made banks identify and verify the people behind a legal entity customer, anyone owning 25 percent or more and one person with control, and it added what everyone now calls the fifth pillar, understanding what the customer does and monitoring the relationship after the account opens. It also introduced the certification form, where the person opening the account signs that the ownership information is complete and correct. That form is the most underrated page in the rule. It's the one place the customer, under their own signature, tells you the picture is complete. I'll come back to it.
2021 to 2025: the government tries to hold the list
The Corporate Transparency Act was the next step, passed at the start of 2021 a few months after the FinCEN Files leak showed how little the existing reports were doing. Instead of every bank collecting ownership separately, companies would report their beneficial owners to FinCEN, and banks would eventually be able to check against that registry. Reporting opened in January 2024 with litigation already underway, and in March 2025 FinCEN issued an interim rule exempting every US-formed company. The registry that was meant to be the backstop now covers foreign companies registered to do business in the US and nothing else.
So in 2026 the picture is this. The obligation to know who's behind a business sits with the institution, there's no government list to check against, and in February 2026 FinCEN relaxed the timing, so verifying owners is required at the first account and after that on a risk basis. The timing got looser. The liability stayed where it was. I'd argue this is the most exposed position the industry has been in since 2018, and most teams haven't noticed because nothing in their flow changed.
KYB left the bank a long time ago
One piece of history that gets missed: banks were never the only ones doing this. Card network rules have required acquirers to underwrite their merchants for decades, and every payment facilitator, marketplace and issuer processor that came after inherited those rules through contract. The sponsor bank behind a fintech passes its own obligations down the chain. The INFORM Consumers Act put a version of it on online marketplaces by statute in 2023. If you run a program that onboards businesses, you're doing KYB because a bank, a network or a regulator behind you requires it, and when something goes wrong they're the ones who ask for the file. The programs I've seen struggle most are the ones that treat the bank's requirements as the bank's problem.
KYC, KYB and now KYA
The three get used interchangeably and they ask different questions.
KYC is about a person. Are you who you say you are, are you on a list, what do you want the account for.
KYB is about an entity, and an entity has no face and no passport. So you verify two layers. First that the entity exists and is in good standing, which is a registry question. Then who owns and controls it, which is KYC again, applied to each of those people after you've traced through whatever intermediate companies sit between them and the customer. Then you work out what the business does, because an LLC in good standing with clean owners can still be selling something your bank won't allow.
KYA is where the pattern from the first half of this post is about to repeat. An AI agent that places orders or moves money on behalf of a business isn't a customer. It has no identity in any legal sense. The questions are who the principal is, which is KYC or KYB as before, whether the principal authorized this agent, what it's allowed to do and within what limits, and whether you can show at the moment of the transaction that this particular action was inside that authority.
That's a question about permission, with identity underneath it. Both major card networks published frameworks for agent-initiated payments in 2025, and the hard part in each of them is the same, proving the authority, because the identity work was done when the principal was onboarded.
Treating KYA as KYC for software would do what the 2003 rule did to KYB, verify the thing in front of you and leave the question of who's behind it to someone else's judgment. We know how that ends, because we spent fifteen years fixing it.
Next in the series: what a good program looks like today, written as the checks I'd expect to see and the file a bank expects to be able to pull.
You might want to read these...
AiPrise
6 min read
KYB Compliance: 2026 Regulations You Should Know About
As organizations expand globally and face tighter regulations, adherence to Know Your Business (KYB) standards has become one of the most critical compliance layers for fintech, online marketplaces, and other companies that need to verify business customers before letting them perform financial transactions.
.png){kind=spacer}
.jpg)
.png)
.png)
.png)
.png)
AiPrise’s data coverage and AI agents were the deciding factors for us. They’ve made our onboarding 80% faster. It is also a very intuitive platform.
Head of Operations
See your full compliance picture in one place
Use AI agents and global data to review businesses and users faster and more accurately
