# KYC / KYB

> Know Your Customer / Know Your Business

A regulatory obligation to verify the identity of every customer (KYC) or business (KYB) before opening an account. A pillar of anti-money-laundering, imposed on every fintech.

_Category: reglementation_

---

## Definition

**KYC** (_Know Your Customer_) and **KYB** (_Know Your Business_) cover the identity checks that a financial player must carry out before opening an account or entering into a business relationship.

KYC targets individuals, KYB legal entities. These processes are the operational building block of AML/CFT, imposed by the European AML directives and overseen in France by the ACPR and TRACFIN.

## KYC vs KYB

| | KYC (individual) | KYB (business) |
|---|---|---|
| Target | Individual | Legal entity |
| Documents | ID card, passport, proof of address | Kbis, articles of association, beneficial-ownership register |
| Verification | Identity, address, sanctions | Legal existence, directors, ultimate beneficial owners |
| Difficulty | Standardized (eIDAS, OCR, biometrics) | More complex (UBO register, multi-country) |
| Solutions | Onfido, Veriff, Sumsub | Pappers, Trulioo, Dun & Bradstreet |
| Turnaround | 30s to 5 min | 1 min to several days |

For a B2B fintech (Qonto, Pennylane), it is almost always combined KYB + KYC: you verify the company and its directors/UBOs.

## The 3 levels of due diligence

- **Simplified due diligence**: low risk, light checks, only after a risk assessment.
- **Standard due diligence**: the default regime — identity, address, activity, source of funds, regular updates.
- **Enhanced due diligence**: mandatory for PEPs, high-risk countries and atypical operations; increased documentation and validation by a compliance officer.

## Typical documents

KYC for individuals: a valid ID document, recent proof of address (or an equivalent eIDAS method), a biometric selfie with liveness, and proof of source of funds above certain thresholds.

KYB for businesses: a Kbis extract, up-to-date articles of association, the list of ultimate beneficial owners (UBOs holding more than 25% of the capital or voting rights, declared in the beneficial-ownership register), full KYC on each UBO, and proof of activity.

## The role of the beneficial-ownership register and UBOs

Since the 4th AML directive, every company declares its UBOs (_Ultimate Beneficial Owners_) in the national beneficial-ownership register. It is this register that makes it possible to trace the ownership chain and identify the "true owner", even through a cascade of holding companies. KYB therefore does not stop at the Kbis: it validates the identity of the UBOs and checks that none is sanctioned, a PEP or listed.

## What KYC / KYB are not

- **Not a one-off check**: the data is updated regularly (annually, more often for high-risk profiles).
- **Not SCA**: SCA proves "it really is me approving this operation"; KYC proves "I know who you are before opening an account".
- **Not reserved for banks**: every entity subject to AML/CFT is bound by it (PSP, EMI, CASP, insurers, real-estate agents, casinos, art dealers above thresholds).
- **Not fixed**: the 6th directive and the upcoming AML Package tighten the requirements in 2025-2027.

## In the PSD2 ecosystem

KYC / KYB is a prerequisite for any customer relationship in fintech, and a major source of friction in the onboarding funnel: every second saved without weakening compliance is a direct business lever.

```mermaid
flowchart TB
    subgraph KYC["KYC — Individual"]
        K1["Identity<br/>(ID card / passport)"]
        K2["Address<br/>(proof of address)"]
        K3["Selfie + liveness"]
        K4["Sanctions / PEP / AML/CFT"]
    end

    subgraph KYB["KYB — Business"]
        B1["Legal existence<br/>(Kbis, articles of association)"]
        B2["Ultimate beneficial owners<br/>(register / UBO > 25%)"]
        B3["KYC on each UBO"]
        B4["Activity<br/>(sector, funds)"]
    end

    DECISION["Acceptance /<br/>enhanced due diligence /<br/>refusal"]
    UPDATE["Regular updates<br/>(annual or + by risk)"]

    KYC --> DECISION
    KYB --> DECISION
    DECISION --> UPDATE
```

## Concrete examples

- **KYC for individuals**: Onfido (the global leader, used by Revolut, Qonto, Pennylane), Veriff, Sumsub, Trulioo, Jumio, IDnow — document OCR, liveness, scoring, sanctions screening.
- **KYB for businesses**: Pappers (the FR leader, INPI/beneficial-ownership data), Trulioo Business, Dun & Bradstreet; the INPI offers an official API for the beneficial-ownership register.
- **Qonto**: at account opening, Kbis + articles of association + full KYC on each director and UBO > 25% — 5 minutes to several hours depending on complexity.
- **Revolut Business**: continuous transaction monitoring; a sudden inflow of large foreign amounts triggers a compliance review.
- **Smooth onboarding vs friction**: a leading fintech completes KYC in under 5 minutes (OCR + liveness + screening), a traditional bank in 3 to 5 days — a major differentiator.
- **Cost**: €1 to €5 per individual KYC, €5 to €30 per KYB, plus continuous sanctions screening — significant at scale.
- **AML Package**: EU Regulation 2024/1620 creates AMLA (established in June 2024, operational in Frankfurt since July 2025, with direct supervision from 2028), harmonizes the rules into a directly applicable regulation, and tightens requirements (notably for crypto via MiCA).

## Sources

- [Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA)](https://www.amla.europa.eu/about-amla_en) — AMLA
- [Lutte contre le blanchiment et le financement du terrorisme](https://acpr.banque-france.fr/lutte-contre-le-blanchiment-et-le-financement-du-terrorisme) — ACPR
- [Registre des bénéficiaires effectifs (INPI)](https://data.inpi.fr/) — INPI

---

Source: https://openfinanceguide.com/en/glossary/kyc-kyb