KYB (know your business, the verification of a company and its owners) is the process a regulated provider runs before it lets a company move money through it. It establishes that the company exists, that it does what it says it does, that the people behind it are who they claim to be, and that nothing about any of them appears on a sanctions or adverse-media list.
For a fintech buying payments infrastructure, KYB is the first real thing that happens after the contract, and it is usually the step that decides whether the launch date holds. This post covers what gets collected, where the beneficial ownership thresholds come from, how KYB differs from KYC (know your customer, the verification of an individual), what happens after onboarding, and where the delay actually comes from. A VASP (virtual asset service provider, the FATF term) is one of the businesses obliged to run it, and the VASP explainer covers the rest.
What KYB collects
The entity. Registration documents, the company number, the registered address, the articles of incorporation, proof that the company is active rather than dormant or struck off. In Brazil this centres on the CNPJ (the Brazilian company taxpayer ID) record.
The ownership chain. Who owns the company, and who owns those owners, until the chain reaches natural persons. A holding structure across three countries is normal and is why this step takes time.
The controllers. Directors, officers and anyone with authority to bind the company or direct its money, verified as individuals.
The business itself. What it sells, to whom, in which countries, expected volumes, the source of the funds it will move, and the rails it needs. This is the part applicants tend to treat as a formality and providers treat as the core of the file.
The screening. Sanctions lists, politically exposed person checks and adverse media, run on the entity and on each verified individual, then repeated on a schedule for as long as the relationship lasts.
A provider issuing a named virtual account to a customer does it only after this file is complete, which is why an account number cannot be handed out on the first call.
Where the 25 percent rule comes from
Two numbers show up in almost every KYB questionnaire, and both are written into law rather than invented by the provider.
In the United States, 31 CFR 1010.230 requires a covered financial institution to identify the beneficial owners of a legal entity customer under two prongs: each individual who owns 25 percent or more of the equity interests, and one single individual with significant responsibility to control, manage or direct the company, such as an executive officer or senior manager.
The European Union lands on the same threshold. Regulation (EU) 2024/1624 states that holding 25 percent or more of the shares or voting rights or other ownership interest in general establishes beneficial ownership of a corporate entity, and defines a beneficial owner as the natural person who ultimately owns or controls the entity.
Brazil requires the same outcome through a different door. Law 9.613 of March 3, 1998, the anti-money-laundering statute, obliges the institutions it covers to identify their clients and keep the records current, with the detail set by the competent authority, which for virtual asset service providers is the Central Bank under the framework of Law 14.478/2022 and Resolutions 519, 520 and 521 of 2025.
The practical reading: the control prong is the one applicants forget. A company with no shareholder above 25 percent still has to name someone.
KYB and KYC are not the same work
KYC verifies a person: identity document, liveness, address, screening. It is largely automatable and often finishes in minutes.
KYB verifies a structure, and a structure does not hold up a document to a camera. It requires reading corporate registries in several countries, following ownership through entities that may themselves be owned by entities, and then running KYC on every natural person the chain produces. A single company can generate a dozen individual verifications.
That asymmetry explains most of the frustration. A founder who watched their own identity check finish in ninety seconds expects the company check to behave the same way, and it cannot. It also explains why providers ask for the ownership chart first: until that chart exists, nobody knows how many individual checks the file will need, or how many registries have to be read in how many languages.
What happens after the file is approved
Onboarding is the beginning of the obligation, not the end of it. Providers are required to keep the record current, refresh it periodically, and re-examine it when something changes: a new controller, a new country, a jump in volume, a change in the type of counterparty being paid.
Ongoing monitoring runs alongside it, and it is where an RFI (request for information, a compliance hold that asks for a document before a transaction clears) comes from. A payment stops, a document is requested, the payment resumes. A provider that cannot tell a client which transaction is held and why is failing an operational duty rather than a regulatory one, and it is worth asking to see that flow during evaluation. The supported countries page lists where the checks apply.
My worst onboarding was one where nothing was wrong. A client with a holding company in one country, an operating company in another and two investors with shares held through a fund spent about four weeks in our queue, and I spent a good part of it apologising to a founder who had done everything asked of them. What we learned reading the file afterwards is that we had asked for documents one layer at a time: we would receive the ownership chart, then ask for the fund's register, then ask for the fund manager's letter, each round trip costing days. We now send the full document list for the structure the applicant describes on day one, including the layers we can see coming, and we tell them which items usually take longest to obtain. The regulatory requirement did not change. We stopped making the client discover it in instalments.
When KYB is not the thing holding you up
When the application is incomplete. Most of the elapsed time in a slow onboarding is waiting for the applicant, not reviewing, and providers are bad at saying so plainly.
When the delay is a licensing question. A flow that needs an authorization the provider does not hold in that country is not a due diligence problem, and no amount of documentation solves it. That answer should come in the first call.
When the real blocker is the banking partner. Providers sit on banking relationships, and a partner bank can have its own restrictions on a sector or a country. A client entitled to know this rarely hears it.
When the business model itself is out of appetite. Some sectors are declined on policy. A clear early no is worth more than a polite four-week maybe.
What KYB looks like on Lumx
Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.
Verification is part of the global payments product rather than a separate vendor the client integrates. A fintech onboards itself, and can onboard its own end customers through the same stablecoin API, which is what a platform serving businesses in several countries needs. Status changes arrive as events, so a client's product can show its own user where the file stands instead of emailing to ask. Held transactions carry the reason and the document requested.
Verified on September 25, 2026. Operational context, not legal, tax, or investment advice.
Cover photo: Peter Nguyen on Unsplash.
How long does KYB take?
For a simple company with a clear owner, days. For a group with holding companies, funds or owners in several countries, weeks. The elapsed time is driven by how fast documents arrive and how many natural persons the ownership chain produces, not by review time.
Who counts as a beneficial owner?
Under the United States rule, any individual owning 25 percent or more of the equity, plus one individual with significant responsibility to control or manage the company. The European Union uses the same 25 percent threshold. A company with no large shareholder still has to name someone under the control test.
What is the difference between KYB and KYC?
KYC verifies an individual and is often finished in minutes. KYB verifies a company and the structure above it, then runs KYC on every natural person that structure produces. One company can require many individual checks.
Does KYB end once I am approved?
No. The provider has to keep the file current, refresh it periodically and review it when something material changes, such as a new controller, a new country or a large change in volume. Ongoing monitoring of transactions continues for as long as the relationship does.
