KYC vs KYB: verifying the person and the company behind a commercial deal

Ask a broker whether they've run KYC on a client and most will say yes without hesitation. Ask whether they've separately run KYB on the company behind that client, and the answer is often a pause. The two get conflated constantly, and on commercial deals, where the borrower is almost always a corporate entity, that confusion is exactly where due diligence gaps open up.

KYC and KYB aren't the same check wearing different names. They answer different questions, need different evidence, and both need to be done properly before a deal progresses.

What KYC actually verifies

Know Your Customer is about the individual: is this person who they claim to be, and are there any red flags, sanctions exposure, adverse media, politically exposed person status, attached to them personally. For a commercial finance deal, KYC applies to every individual applicant, guarantor, and anyone identified as a beneficial owner of the corporate borrower.

Standard evidence is a valid photo ID plus proof of address, increasingly gathered through electronic verification rather than certified paper copies, cross-checked against sanctions and PEP databases. None of that is unusual to most brokers. It's the individual-level check most people mean when they say 'KYC'.

What KYB adds, and why it is not optional

Know Your Business verifies the company itself: does it legally exist, is it trading as claimed, who owns and controls it, and does its structure make sense for the deal in front of you. On a commercial finance application, the borrower is very often a limited company or LLP, sometimes several layers of holding structure deep. A structured client onboarding flow should expose that structure before the deal progresses. Checking the director's passport tells you nothing about whether the company has a beneficial owner sitting behind an offshore holding entity that nobody has mentioned.

A proper KYB check covers:

• Confirming the company's registration, status and registered office via Companies House, including checking it hasn't been recently dissolved or struck off and re-registered.
• Mapping the full ownership chain, not just the first layer of shareholders shown on the filing.
• Cross-referencing the PSC register to identify anyone with significant control — typically more than 25% ownership or voting rights, or the right to appoint/remove the majority of the board.
• Verifying that directors and PSCs named on the record match the individuals who have actually been through KYC.
• Checking filing history for anything that doesn't fit the story — a dormant company suddenly seeking a large facility, for instance.

Where the two checks meet: beneficial ownership

The point where KYC and KYB genuinely overlap is beneficial ownership. KYB tells you who the beneficial owners are on paper; KYC is then run on each of those individuals. Skip the KYB step and you can end up running excellent identity checks on the wrong people, a company secretary and a nominee director, say, while the person actually controlling the business and the funds never gets verified at all.

This is particularly relevant on deals involving special purpose vehicles, which are standard in development and bridging finance. An SPV set up for a single project may have thin trading history and an ownership structure that only makes sense once you trace it back to the parent group or the individual sponsor. Treating the SPV as the end of the enquiry, rather than the start of it, is one of the more common gaps we see.

Trusts, partnerships and layered structures

Not every borrower is a straightforward limited company. Trusts, LLPs, and multi-jurisdictional group structures all need a slightly different approach. Trusts require identifying settlors, trustees and beneficiaries; overseas parent companies may need equivalent checks run against their home register, where one exists and is accessible. There's no universal shortcut here. Each structure needs someone to actually work through it rather than accept a diagram provided by the client at face value.

Sanctions and PEP screening apply to both checks

Sanctions and politically exposed person screening sit inside both KYC and KYB, not just one or the other. On the individual side, that means screening every director, guarantor and beneficial owner identified. On the business side, it means checking whether the company itself, or any parent entity in its ownership chain, appears on a relevant sanctions list, something that can be easy to miss if screening tools are only configured to check named individuals.

This matters more than it used to. Ownership structures involving overseas holding companies have become more common in commercial property and development finance, and a screening process built only around UK individuals will miss exposure sitting a layer or two further up the chain. Building both checks into the same due diligence process, rather than running KYC and KYB screening through separate tools, closes that gap.

The deals that cause the most trouble later are rarely the ones with an obviously dodgy applicant. They're the ones with an ownership structure nobody quite finished tracing.

Building KYC and KYB into one workflow, not two

The practical mistake many brokerages make isn't skipping either check, it's running them as separate, disconnected processes. KYC gets done by whoever handles onboarding paperwork; KYB, if it happens at all, gets left to whoever is packaging the application, often much later and sometimes only because the lender asks for a structure chart. By that point, if something doesn't stack up, the deal has already absorbed hours of work.

The fix is sequencing: run KYB first, or at least in parallel, so you know who the beneficial owners actually are before you finalise which individuals need KYC. Pulling company data directly from Companies House through integrations rather than relying on a client-supplied structure chart removes a layer of self-reporting risk and speeds up the parts of this that are genuinely mechanical, company status, filing history, registered PSCs, so your team's time goes into the parts that need judgement, like an ownership chain that doesn't quite add up.

This connects directly to the broader anti-money laundering obligation covered in our piece on AML checks for commercial finance brokers: KYC and KYB are the mechanics that feed a proper customer due diligence file, not a separate compliance exercise running alongside it.

What good evidence looks like

For each deal, a reviewer should be able to see, without having to ask anyone: the individuals checked and the evidence used; the corporate entity checked and its Companies House record at the time; the beneficial ownership chain as understood, including anyone who required KYC as a result; and a note on anything that needed extra digging, with the outcome. That last point matters more than people expect. A file that shows you asked a hard question and resolved it is stronger evidence of a working control environment than a file with no questions in it at all.

• Company register extract and PSC data, dated at time of check.
• Full beneficial ownership chain, including intermediate holding entities.
• Individual ID verification for every person identified through the KYB process.
• A written note resolving any discrepancy between the client's stated structure and the register.

Keeping the two checks aligned as a deal changes

Deals shift shape between enquiry and completion more often than people admit: a guarantor gets added, a shareholding changes hands, an SPV gets restructured to bring in a co-investor. Each of those changes can affect both the KYC and KYB picture, and it's easy for the due diligence file to fall out of step with the deal as actually structured by the time it completes. Building in a simple checkpoint before completion, has anything changed in the ownership or the individuals involved since onboarding, catches most of these before they become a problem, and it costs far less time than reopening a completed file to answer a question a lender or auditor raises later.

Ongoing monitoring, not just a one-off check

KYC and KYB are usually framed as onboarding tasks, but the obligation doesn't end at completion. Ownership changes and sanctions lists are updated more often than most brokers assume, and a file that was clean at completion can be out of date within months on longer-term facilities.

A proportionate approach sets a review trigger, a further advance, a guarantor change, or a fixed periodic review for higher-risk structures, rather than re-running full checks on a fixed calendar. A connected compliance workflow can keep those triggers and their evidence on the client record. This sits alongside the FCA's Consumer Duty expectation that a firm keeps its understanding of the client current, and a re-check of the PSC register at renewal catches ownership changes a client won't always volunteer.

Get the sequencing right and this stops being two separate compliance burdens and becomes one coherent picture of who you're actually doing business with, which is the entire point of the exercise and the reason both checks exist at all.