What is KYC? KYC and KYB verification explained

The short answer

KYC, short for know your customer, is how banks and other regulated businesses confirm who a customer is and judge the risk they pose, before and during the relationship. A US bank must collect at least your name, date of birth, address and an ID number, verify them, and keep watching the account. KYB, know your business, applies the same checks to a company and the people who own and control it.

If you have opened a bank account, signed up for a payment app or applied to sell on a marketplace, you have been through KYC, probably without hearing the name. It is why you were asked to photograph your driver’s license, hold your phone up to your face, or list everyone who owns a quarter or more of your company. This guide explains what the rules actually require, what happens to the photos you upload, what a business is asked to prove, and how to tell a real verification request from a scam that imitates one.

What KYC means

KYC is not one check but four layers that build on each other:

Customer identification. Collecting who you are (name, date of birth, address, an ID number) and verifying it against documents or reliable records.
Customer due diligence. Understanding what the relationship is for and how risky it is, and, for a company, who owns and controls it.
Enhanced due diligence. Deeper checks for higher-risk customers: where their money comes from, senior approval, closer monitoring.
Ongoing monitoring. Watching activity over time and updating what is known when something changes.

KYC and KYB side by side
	KYC	KYB
Who is checked	A person	A company, and the people who own or control it
Typical evidence	Government ID, sometimes a selfie, name, date of birth, address, ID number	Registry record, legal name and number, address, owners of 25 percent or more, one person in control
Who must do it	Banks and other regulated financial firms	The same firms when the customer is a business; marketplaces, for their high-volume sellers

What US law requires

Customer identification

The Bank Secrecy Act, as amended by the USA PATRIOT Act, is the foundation. Section 326 of the PATRIOT Act led to the Customer Identification Program rule, which since 2003 has required banks to collect, before opening an account, at least four things: your name, date of birth, address and an identification number. For a US person that number is a taxpayer ID, usually a Social Security number; for others it can be a passport or other government ID number.

The bank must then “form a reasonable belief that it knows the true identity of each customer”, either with documents, such as a driver’s license or passport, or by checking the details against other reliable sources. It must keep the records for five years and tell you it is doing this, which is why so many account forms carry the same line: “Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account.”

Beneficial owners

FinCEN’s Customer Due Diligence rule, which banks have had to follow since May 2018, adds the business side. When a company opens an account, the bank must identify each person who owns, directly or indirectly, 25 percent or more of it, plus one person with significant control, such as the chief executive or managing member. That is between one and five people, each with a name, address, date of birth and ID number. The bank may rely on the company’s own certification of who they are.

What changed in 2025 and 2026

June 2025. FinCEN let banks take a customer’s taxpayer ID number from a reliable third-party source instead of always asking the customer for it.
February 2026. Banks no longer have to identify a business’s owners again every time it opens a new account: only at the first account, when something calls the earlier information into question, or when their risk-based procedures require it.
August 2026. FinCEN permanently ended beneficial ownership reporting under the Corporate Transparency Act for US companies and US persons. Only foreign companies registered to do business in the US still report.

One common confusion: the end of those reports to FinCEN does not change what your bank asks for. Banks still collect beneficial ownership information under the Customer Due Diligence rule. And there is no fixed US schedule for refreshing it; FinCEN says updates are driven by risk and events, not the calendar.

KYC outside the United States

Most countries’ rules trace back to the FATF Recommendations, the international standard against money laundering. Recommendation 10 asks financial institutions to carry out due diligence when a relationship starts, for one-off transactions above USD or EUR 15,000, when they suspect money laundering, and when they doubt what they were told before, verifying identity “using reliable, independent source documents, data or information.” If they can’t, they should not go ahead.

The European Union is replacing its patchwork of national rules with a single regulation that applies from 10 July 2027. It keeps the 25 percent ownership threshold, requires customer information to be updated at least every year for higher-risk customers and every five years for the rest, and sets five years as the standard time to keep records before deleting them. A new EU Anti-Money Laundering Authority, based in Frankfurt, will directly supervise up to 40 of the largest financial firms from 2028.

What happens when you verify your identity online

Most online identity checks combine several of these steps, and the system or a person decides on the combination:

The document. You photograph your ID. Software reads it, checks that the format, fonts, security features and machine-readable lines are consistent, and that it hasn’t expired.
The face. You take a selfie or a short video. It is compared with the photo on the ID, and a liveness check looks for signs of a real person in front of the camera rather than a printed photo, a screen or a mask.
The records. Your name, date of birth, address and ID number are compared with other data sources. The US government’s own sign-in service, Login.gov, for example, asks for photos of your ID, your Social Security number and a phone number, sometimes a selfie, and offers in-person verification at participating Post Offices.
The lists. Your name is screened against sanctions lists and, for some services, lists of politically exposed people.
A person, when it matters. Unclear or high-risk cases go to a human reviewer.

Automated checks are fast: Stripe’s identity service, for one, says results normally arrive within a few minutes. No regulator publishes a standard turnaround, and checks that go to a person take longer.

How strong is “verified”?

NIST, the US standards body, grades identity proofing in three levels in its Digital Identity Guidelines, revised in July 2025. IAL1 and IAL2 can both be done remotely; IAL2 requires stronger evidence and verification. IAL3 requires an in-person session with a trained agent and at least one biometric, such as a fingerprint or face image.

Deepfakes and injection attacks

Fraudsters now try to fool selfie checks with AI-generated faces and video, or by injecting fake footage straight into the camera feed. FinCEN warned banks in November 2024 that reports of deepfake media in fraud were rising, with red flags such as a photo inconsistent with the customer’s stated age or a third-party webcam plugin used during a live check. NIST is candid that liveness detection helps but that “even these mechanisms are not sufficient to address all possible cases of these kinds of attacks.” That is why serious verification layers several signals, and why a human review still matters.

How KYB works for a business

When a bank, payment provider or marketplace verifies your business, expect to provide:

The legal name and registration number.Exactly as they appear on the registry record, with the state or country of formation.
Formation documents.Articles of incorporation or organization, or a certificate of good standing.
The registered and operating addresses.Where the business is registered, and where it actually works.
The owners and the person in control.Everyone with 25 percent or more, plus one person with significant control, each with ID details.
What the business does.Often a website, a description, the expected volume of payments.

The checker then confirms the company in the official registry, verifies the people behind it as individuals, screens the company and its owners against sanctions lists, and looks for a real operating presence. Marketplaces have their own duty: since June 2023 the US INFORM Consumers Act has required them to collect and verify bank, contact and tax details from high-volume sellers, those with 200 or more sales and $5,000 or more in revenue in a 12-month period.

Sanctions, politically exposed people and extra checks

US sanctions bind every US person and company, not only banks, and the liability is strict: a business can be penalized even if it didn’t know. Ownership counts too. Under OFAC’s 50 percent rule, a company owned 50 percent or more, together, by sanctioned people is treated as sanctioned itself, even if it isn’t on any list. Anyone can search the lists with OFAC’s free Sanctions List Search.

A politically exposed person is someone with a prominent public role, or their family and close associates. FATF asks for enhanced checks on foreign ones, including senior approval and an understanding of where their wealth comes from. US regulators have said they do not treat US public officials as politically exposed persons and require no extra steps just for the label, while the EU’s rules cover domestic ones too.

How to tell a real KYC request from a scam

Because everyone is used to “verify your account” messages, criminals send fake ones. In 2025, people reported losing nearly $1 billion to scammers impersonating businesses, and bank impersonators caused the highest losses, according to the FTC.

A message, text or call tells you your account will be frozen unless you “complete KYC” now.
The link goes to a site other than the one you normally use, or arrives by text, WhatsApp or Telegram.
Someone asks you to email or message photos of your ID or a selfie to a person.
You are asked for a password, a one-time code or a card PIN. Identity checks don’t need them.
The check costs money, or you are told to move funds to a “safe” account.

The safe habit is simple: never start verification from a link in a message. Open the app or type the company’s address yourself, and do it there if the request is real.

Your data: what is kept, and for how long

Verification collects some of the most sensitive data you have, so it is fair to ask how it is handled. US banks must keep identification records for five years, and OFAC now requires some sanctions-related records to be kept for ten. Under the EU’s new regulation, five years is the standard before deletion.

Biometric data has extra protection in some places. Illinois’ Biometric Information Privacy Act requires written notice and a written release before a business collects a scan of your face, and destruction once the purpose is met or within three years of your last interaction. In the EU, the GDPR treats biometric data used to identify you as a special category that needs an exception, such as your explicit consent. Before you upload, it is reasonable to ask who will see your documents, how long they will be kept and how to have them deleted.

Why networks and marketplaces verify people too

Outside regulated finance and marketplaces, KYB is generally not a legal duty. Many platforms verify anyway, because fraud is expensive and trust is the product: people told the FTC they lost about $16 billion to fraud in 2025, the most on record. A verified identity doesn’t make someone honest, but it removes the cheapest tricks, the fake name, the borrowed face, the company that doesn’t exist, and gives everyone a real person to hold to account.

How Trulinq verifies members. Trulinq is not a bank and isn’t required to run KYC. We verify because a network is only as trustworthy as its members: a government ID is matched to the person behind the account, the business’s registration number is checked against public registries, its website and contact details are confirmed as active, and a person on our review team signs off, usually within 2 business days.

Your documents are stored privately, never shown on your profile, and you can ask us to delete them. See exactly what the stamp means

What is KYC? Identity and business checks, explained