KYB vs KYC

KYC asks whether a person is who they claim to be. A name, a date of birth, an address, a document number, sometimes a face. One human, one identity, and a government that issued the document you are checking against.

KYB asks whether there is a real business here, and whether it is the one on the application. That means the registration, the addresses it operates from, the people attached to it, and the lists any of them might appear on.

The two are not alternatives. Almost every KYB program runs KYC inside it, because you still have to identify the officers and beneficial owners as people. KYB is the layer above: the entity itself, and the evidence that it exists.

There is no passport for a company. What exists instead is a scatter of partial records: a legal name on a state filing, one or more brands, DBAs and trade names, a set of operating locations, and frequently several legal entities spread across several states. Nothing forces those records to agree with each other, and in practice they don't.

The applicant types the name on the sign, not the name on the Secretary of State filing. A verification step that reads only registrations treats that gap as a failure and sends a real business to a review queue. On Ramp's 4,000-application test, closing that gap moved match rate from 84% to 94%.

Then there is the deeper problem: a registration is self-reported. Filing one proves that a form was submitted and a fee was paid. It does not prove customers, revenue, premises, or staff. Matching a name to a filing clears the checkbox without telling a fraud team anything it can act on.

In the U.S., a covered financial institution has to identify its legal entity customers, verify them by documentary or non-documentary means, identify the beneficial owners and a control person behind them, screen the relevant parties against sanctions and watchlists, and keep records that someone can walk back through later.

The examiner's question is rarely “did you check?” It is “show me what you checked, and when.” That changes what a good KYB output looks like. A yes/no decision is not a record; an evidence file with dated, named sources is.

It also changes the cost model. Every case that arrives at a human without its evidence attached is paid for twice: once by the reviewer who assembles it, and again by the applicant waiting. Manual review is the most expensive part of onboarding.

Exact thresholds and required documentation vary by program, regulator, and product. Treat this section as the shape of the obligation, not as legal advice.

Enigma exposes the distinction as one endpoint with two products. Identify confirms a business is real, not merely registered — it is built for coverage and approval rates in marketplaces and high-volume sign-up flows, where a false decline is the expensive error.

Verify adds the full Secretary of State record: the corporate detail, the officers, the status, the filing history a regulated program is held to. Same resolution underneath, more of the record returned.

Choose by what your decision has to survive. A marketplace sign-up needs to clear real sellers fast. A bank opening a commercial account needs the filing itself, with the people attached, in a form an examiner can read. Both calls match on brands, DBAs, and legal entities, so neither one depends on the applicant knowing their own legal name.

That sentence is the whole argument for grading evidence instead of returning a bare yes. Verification comes back as a tier, describing how strong the proof is and who produced it.

A tier is a statement about evidence, not a verdict on the business. Tier 1 is not an accusation. Plenty of legitimate businesses are three weeks old and have nothing but a filing to show.

What the tier does is tell your policy engine what it is standing on. Thin files can be approved at low limits, or routed to a step-up, or revisited in ninety days when there is something to look at. Manual review gets reserved for the cases where thinness actually matters.