KYB and EDD: Know Your Business and Enhanced Due Diligence for Financial Services
KYB and EDD are the business-level and high-risk-tier components of the customer due diligence framework that financial institutions, payment operators, and fintech businesses must maintain as part of their AML compliance programs. KYB (Know Your Business) applies when a financial institution's customer is a business entity rather than an individual: it requires verifying the entity's legal existence, understanding its ownership structure, and identifying the real people who ultimately control and benefit from it. Enhanced Due Diligence (EDD) is triggered when a customer, counterparty, or transaction presents elevated money laundering or sanctions risk, requiring deeper investigation than standard due diligence procedures. Faisal Khan LLC advises businesses on KYB and EDD program design, connects them to KYB technology platforms, compliance consultants, and screening data providers, and helps build the customer due diligence framework that banking partners and regulators expect.
What KYB Involves
KYB is the process of verifying that a business customer is legitimate, understanding what it actually does, and identifying who ultimately owns and controls it. The FinCEN Customer Due Diligence (CDD) Rule, which took full effect in 2018, formalized beneficial ownership requirements for US banks and certain other covered institutions: for every legal entity customer, the institution must identify and verify the identity of any individual who owns 25% or more of the equity interests, as well as one individual who controls the entity (the control prong), regardless of ownership percentage.
Core KYB components include:
Business registration verification: Confirming that the entity is registered and in good standing in its jurisdiction of incorporation. Sources include state corporate registries, Companies House (UK), national registries in the EU, and commercial data providers.
Beneficial ownership identification: Collecting the names, dates of birth, addresses, and identity documents of all individuals who own 25% or more of the entity, plus the control person. Verifying their identities against the same standards applied to individual KYC customers.
Business purpose and source of funds: Understanding what the business actually does, how it generates revenue, why it needs the financial product or service, and where its funds originate. This contextual understanding is what allows the institution to identify when transactions are inconsistent with the stated business model.
Authorized representative verification: Verifying the identity and authority of the individual acting on behalf of the entity.
When EDD Is Triggered
Enhanced Due Diligence is the escalation layer that applies when a customer or transaction presents risk factors that standard due diligence cannot adequately address. EDD requires more information, more investigation, and typically more frequent review than the baseline CDD process.
Common EDD triggers include:
Politically Exposed Persons (PEPs): Individuals who hold or have held prominent public positions (heads of state, senior government officials, senior executives of state-owned enterprises, senior members of the military or judiciary) and their family members and close associates. PEPs are inherently higher-risk due to their access to public funds and potential for corruption. EDD for PEPs typically includes source of wealth verification, enhanced transaction monitoring, and senior management approval for onboarding.
High-risk jurisdictions: Customers located in or sending funds to countries identified as high-risk for money laundering, terrorist financing, or corruption (FATF grey list and black list countries, countries under targeted sanctions). EDD for high-risk jurisdiction exposure includes deeper source of funds investigation and enhanced ongoing monitoring.
High-risk business types: Certain business categories carry inherently higher AML risk: money services businesses, crypto exchanges, virtual asset businesses, casinos, offshore financial services, import/export businesses, cash-intensive businesses, and NGOs operating in conflict zones. Onboarding these business types as customers requires EDD regardless of the specific customer's profile.
Unusual transaction patterns: When a customer's transaction activity is inconsistent with their stated business profile, or when transaction monitoring generates alerts that standard investigation cannot resolve, EDD review is triggered. This may include requesting additional documentation, conducting site visits, or seeking senior management approval for continued service.
KYB for Crypto and Stablecoin Business Counterparties
VASP-to-VASP due diligence is a specialized form of KYB that has become a distinct area of crypto compliance. When a stablecoin payment operator or crypto exchange receives funds from or sends funds to another VASP (exchange, wallet provider, OTC desk), it must conduct due diligence on that counterparty as a business customer.
VASP counterparty due diligence includes: verifying the VASP's license or registration status in its home jurisdiction, assessing the quality of the VASP's AML program (often through a standardized questionnaire like those developed by FATF or the VASP Due Diligence Working Group), reviewing the VASP's blockchain analytics risk profile (using tools like Chainalysis to assess the risk profile of transactions flowing through the VASP's wallets), and ongoing monitoring of the relationship.
Financial institutions and well-run crypto businesses increasingly refuse to maintain relationships with VASPs that cannot demonstrate adequate compliance programs. The reputational and regulatory risk of facilitating transactions through an unvetted VASP is significant, particularly as regulators scrutinize the "chain of custody" of compliance across the VASP ecosystem.
KYB Technology and Data Sources
Effective KYB at scale requires technology infrastructure that can automate data collection, verification, and screening across large volumes of business onboarding:
Corporate registry APIs: Direct connections to official business registries in major jurisdictions enable automated verification of entity status, registered address, and registered officers.
Beneficial ownership databases: Data providers like Dun & Bradstreet, Bureau van Dijk (Orbis), and OpenCorporates aggregate corporate ownership data across jurisdictions. No single database covers all jurisdictions, and self-reported ownership data is not always current or accurate.
Sanctions and watchlist screening: Automated screening of business entities and their beneficial owners against OFAC SDN, EU consolidated list, UN sanctions, OFSI (UK), and other jurisdiction-specific lists.
Adverse media screening: AI-powered news and web monitoring tools flag negative news associated with a business entity or its owners (criminal proceedings, fraud allegations, regulatory enforcement, association with financial crime).
PEP databases: Specialized data providers maintain databases of politically exposed persons and their relatives and close associates (RCAs). Screening beneficial owners against PEP databases is a core EDD requirement.
Frequently Asked Questions
What is the difference between KYC and KYB? KYC (Know Your Customer) typically refers to individual customer identity verification: confirming that a person is who they claim to be, using identity documents and verification processes. KYB (Know Your Business) refers to verifying a business entity's legal existence, ownership, and business purpose. Both are components of customer due diligence; KYB applies when the customer is a legal entity rather than a natural person.
Does my business need to conduct KYB if I only serve individual consumers? If your only customers are individual consumers with no business accounts, formal KYB is not applicable to your direct customer relationships. However, you still need to conduct KYB-equivalent due diligence on your own service providers, banking partners, and counterparties. And if any consumer customer's behavior suggests they may be acting on behalf of a business (funneling business transactions through personal accounts), enhanced scrutiny is warranted.
How do I handle KYB for businesses in jurisdictions with limited corporate registry transparency? Some jurisdictions have limited or unreliable corporate registry data (many African and Middle Eastern jurisdictions, some offshore centers). When registry data is unavailable or unreliable, best practice is to rely on alternative verification methods: certified copies of incorporation documents, lawyer or notary attestation, third-party commercial data providers, and enhanced direct diligence of the business and its owners. For high-risk jurisdictions with poor registry transparency, EDD is typically the default.
How often must KYB information be refreshed? KYB information must be refreshed at least at the periodic review cycle defined in the institution's CDD procedures (typically annually for standard-risk business customers, more frequently for higher-risk relationships), and event-triggered review must be conducted when material changes occur (ownership changes, significant adverse media, regulatory action, transaction patterns inconsistent with the documented business profile).
Build a KYB and EDD Program That Satisfies Modern Compliance Standards
KYB and EDD are where the rubber meets the road in financial services compliance: they are the processes that distinguish compliant financial institutions from those that are used as conduits for money laundering and sanctions evasion. Faisal Khan LLC advises businesses on KYB and EDD program design, helps build the procedures, workflows, and escalation processes that make due diligence operational rather than theoretical, connects businesses to the technology platforms, data providers, and compliance consultants that make KYB scalable, and helps businesses understand and meet the KYB and EDD standards that banking partners and regulators apply. If your KYB and EDD program needs to be built or substantially upgraded, we can help you get there.