Definition
KYC (Know Your Customer) and KYB (Know Your Business) cover the identity checks that a financial player must carry out before opening an account or entering into a business relationship.
KYC targets individuals, KYB legal entities. These processes are the operational building block of AML/CFT, imposed by the European AML directives and overseen in France by the ACPR and TRACFIN.
KYC vs KYB
| KYC (individual) | KYB (business) | |
|---|---|---|
| Target | Individual | Legal entity |
| Documents | ID card, passport, proof of address | Kbis, articles of association, beneficial-ownership register |
| Verification | Identity, address, sanctions | Legal existence, directors, ultimate beneficial owners |
| Difficulty | Standardized (eIDAS, OCR, biometrics) | More complex (UBO register, multi-country) |
| Solutions | Onfido, Veriff, Sumsub | Pappers, Trulioo, Dun & Bradstreet |
| Turnaround | 30s to 5 min | 1 min to several days |
For a B2B fintech (Qonto, Pennylane), it is almost always combined KYB + KYC: you verify the company and its directors/UBOs.
The 3 levels of due diligence
- Simplified due diligence: low risk, light checks, only after a risk assessment.
- Standard due diligence: the default regime — identity, address, activity, source of funds, regular updates.
- Enhanced due diligence: mandatory for PEPs, high-risk countries and atypical operations; increased documentation and validation by a compliance officer.
Typical documents
KYC for individuals: a valid ID document, recent proof of address (or an equivalent eIDAS method), a biometric selfie with liveness, and proof of source of funds above certain thresholds.
KYB for businesses: a Kbis extract, up-to-date articles of association, the list of ultimate beneficial owners (UBOs holding more than 25% of the capital or voting rights, declared in the beneficial-ownership register), full KYC on each UBO, and proof of activity.
The role of the beneficial-ownership register and UBOs
Since the 4th AML directive, every company declares its UBOs (Ultimate Beneficial Owners) in the national beneficial-ownership register. It is this register that makes it possible to trace the ownership chain and identify the "true owner", even through a cascade of holding companies. KYB therefore does not stop at the Kbis: it validates the identity of the UBOs and checks that none is sanctioned, a PEP or listed.
What KYC / KYB are not
- Not a one-off check: the data is updated regularly (annually, more often for high-risk profiles).
- Not SCA: SCA proves "it really is me approving this operation"; KYC proves "I know who you are before opening an account".
- Not reserved for banks: every entity subject to AML/CFT is bound by it (PSP, EMI, CASP, insurers, real-estate agents, casinos, art dealers above thresholds).
- Not fixed: the 6th directive and the upcoming AML Package tighten the requirements in 2025-2027.
In the PSD2 ecosystem
KYC / KYB is a prerequisite for any customer relationship in fintech, and a major source of friction in the onboarding funnel: every second saved without weakening compliance is a direct business lever.
Concrete examples
- KYC for individuals: Onfido (the global leader, used by Revolut, Qonto, Pennylane), Veriff, Sumsub, Trulioo, Jumio, IDnow — document OCR, liveness, scoring, sanctions screening.
- KYB for businesses: Pappers (the FR leader, INPI/beneficial-ownership data), Trulioo Business, Dun & Bradstreet; the INPI offers an official API for the beneficial-ownership register.
- Qonto: at account opening, Kbis + articles of association + full KYC on each director and UBO > 25% — 5 minutes to several hours depending on complexity.
- Revolut Business: continuous transaction monitoring; a sudden inflow of large foreign amounts triggers a compliance review.
- Smooth onboarding vs friction: a leading fintech completes KYC in under 5 minutes (OCR + liveness + screening), a traditional bank in 3 to 5 days — a major differentiator.
- Cost: €1 to €5 per individual KYC, €5 to €30 per KYB, plus continuous sanctions screening — significant at scale.
- AML Package: EU Regulation 2024/1620 creates AMLA (established in June 2024, operational in Frankfurt since July 2025, with direct supervision from 2028), harmonizes the rules into a directly applicable regulation, and tightens requirements (notably for crypto via MiCA).