Best KYB Providers for Financial Institutions: 8 Criteria for Choosing One

Last updated: September 2026

The best KYB providers for a bank or fintech are the ones that resolve beneficial ownership on the businesses it actually onboards, in the jurisdictions it onboards from. A strong provider also keeps each business's ownership record current, leaves a manual review queue the team can staff, and shows an examiner how each business was verified and who made the decision. The reliable way to tell providers apart on those points is to test them on your own past applications before signing.

This guide sets out eight criteria for choosing a KYB (know your business) provider, each with the questions to ask a provider and what a weak answer looks like. It also covers what the beneficial ownership rules require as of September 2026, because changes made in 2025 and 2026 affect what a provider has to support.

TL;DR

• Judge a KYB provider on your own applications: the businesses it matched, the owners it found and the cases it still sent to a person.

• A KYB provider works in three layers: the data sources it reaches, how it resolves an applicant to an entity and its owners, and the decision and record it leaves behind.

• The customer due diligence (CDD) rule, 31 CFR 1010.230, requires identifying each individual who owns 25% or more of the equity interests of a legal entity customer, plus one individual with significant responsibility to control, manage or direct it, and verifying their identities under risk-based procedures.

• FinCEN's exceptive relief of 13 February 2026 is optional. An institution that adopts it may limit owner identification and verification to a customer's first account, later triggers and its own ongoing due diligence, so a provider should keep the ownership record per customer and show when it was last confirmed.

• Corporate Transparency Act reporting now covers only foreign reporting companies, and as of 25 September 2026 no FinCEN source confirms that banks can check owners against FinCEN's database. The institution's own collection remains the control.

• Oscilar wrote this list and runs KYB checks using third-party data sources. The criteria name no providers.

The short answer: how to choose a KYB provider

To choose a KYB provider, run a sample of your own recent business applications through each candidate and compare four results: how many of the businesses it matched to a registered entity, whether it found the beneficial owners and the control person behind layered structures, how much still went to manual review, and whether the record of each decision would satisfy an examiner. Feature lists and coverage maps describe what a provider can do in general, while your own applications show what it does for the businesses you onboard.

How hard KYB is depends on your customer mix. At one end, a group risk and compliance director at a merchant acquirer said most of their merchants are sole proprietors, and that the legal entities they do onboard have very simple structures that lead straight to the beneficial owners. An institution that onboards holding companies and groups of related businesses needs far more from a provider's ownership resolution, so the same provider can suit one institution and fail another.

Oscilar wrote this list and runs KYB checks using third-party data sources and an institution's own data. Oscilar is not a registry data provider. The criteria below name no providers or products, and a later section applies the same criteria to Oscilar.

If you are still weighing how KYB differs from KYC, start with the difference between KYC and KYB. This guide assumes that distinction and goes straight to choosing a provider.

What a KYB provider actually does for you

A KYB provider checks that a business applicant is a real, registered entity, identifies the people who own and control it, and screens the business and those people so the institution can decide whether to onboard it. The work happens in three layers, and knowing which layers a provider covers tells you what you are buying:

• Data sources: business registries and other business data, such as formation records, status, filings and screening lists, reached directly or through partners.

• Resolution: matching the applicant's details to the right registered entity, then building the ownership chain from that entity to the individuals behind it.

• Decision and record: approving the application, stepping it up to further checks or sending it to a person, and keeping a record of what was checked and why.

Providers differ in how many of those layers they cover. Data providers sell registry and business data. Orchestration platforms connect several data sources and apply the institution's own rules and workflows, and review services take on the manual review. An institution can combine two or three kinds, which makes the contract question as important as the data question.

Without a provider, KYB is manual work. A director of risk and fraud at a shipping platform for small businesses, with no contract for business data, described verifying each business by searching the state registry for its name or employer identification number (EIN) to check its status, its incorporation date and any discrepancies. A provider replaces that search, and the useful question is how much of it the provider replaces for your applicants.

Coverage also has a contracting side. A product lead at a digital banking software provider was weighing whether to buy KYB data directly from a data provider or through a platform that resells it. That choice decides who holds the contract and who answers when a record is wrong.

Choosing a KYB provider is one part of a wider decision, and shortlisting onboarding software as a whole is a separate evaluation with its own criteria.

What the rules require, and what changed in 2025 and 2026

As of 25 September 2026, the rule a KYB provider has to support is the customer due diligence (CDD) rule of the Financial Crimes Enforcement Network (FinCEN), 31 CFR 1010.230, which has not been amended since 2017. What changed in 2025 and 2026 is when an institution has to repeat the work and what, if anything, it can check an owner's details against. The rule and those changes set the floor that every provider on your shortlist has to meet.

The rule itself still says to identify the beneficial owners of each legal entity customer at the time a new account is opened. Under the ownership prong, that means each individual who, directly or indirectly, "owns 25 percent or more of the equity interests" of the customer. Under the control prong, it means "a single individual with significant responsibility to control, manage, or direct" the customer. The institution must verify each owner's identity under risk-based procedures, to the extent reasonable and practicable, and it may rely on the customer's certification of who its owners are unless it knows of facts that would reasonably call that information into question.

That verification duty covers each owner's identity, and FinCEN's CDD rule FAQs say an institution "need not independently investigate the legal entity customer's ownership structure." A provider's ownership resolution still matters, because it is how an institution notices the facts that would call a certification into question.

FinCEN's exceptive relief of 13 February 2026, FIN-2026-R001, lets an institution limit beneficial owner identification and verification to three occasions: the customer's first account, any later time facts call the earlier information into question, and as needed under its own risk-based ongoing due diligence. On that third occasion, the institution may reuse earlier information if the customer confirms it is still current and the institution keeps a record of the confirmation. The relief is optional, FinCEN can revoke it, and FinCEN re-issued its CDD rule FAQs on 6 May 2026 to match. For an institution that adopts it, the ownership record is kept per customer and reused across that customer's accounts, which is why a provider has to keep that record and show when it was last confirmed.

Corporate Transparency Act reporting now covers only foreign reporting companies, meaning entities formed under foreign law and registered to do business in a U.S. state or tribal jurisdiction. FinCEN's interim final rule of 26 March 2025 exempted domestic companies and U.S. persons, and its final rule, effective 14 August 2026, made that permanent. As of 25 September 2026, no FinCEN source confirms that banks have been given access to FinCEN's beneficial ownership database for customer due diligence, and FinCEN describes the reporting rule and the CDD rule as serving different purposes under different legal authorities. The institution's own collection and verification under the CDD rule therefore remains the control, and the KYB provider has to carry it.

Examiners work from the FFIEC BSA/AML examination manual, whose beneficial ownership section dates from 2018 and has not been revised for the 2026 relief. Read it for what examiners expect: written risk-based procedures for verifying each beneficial owner's identity within a reasonable time after the account is opened, and procedures for obtaining and then updating beneficial ownership information for existing customers based on ongoing monitoring. Because the section predates the relief, it is not the guide to when identification is triggered. FinCEN's proposed AML/CFT program rule, still a proposal as of 25 September 2026, would move the CDD program elements within the regulations, and FinCEN says that change is not intended to alter existing obligations under 31 CFR 1010.230.

The rules therefore ask a KYB provider to capture both prongs for every legal entity customer, keep the ownership record per customer with the date it was last confirmed, and let the institution re-verify on a trigger without rebuilding the file from scratch.

The eight criteria, and how to use them

The eight criteria below follow the order in which a business application is handled: finding the business, resolving its owners, verifying and screening the people, keeping the record current, handling what the automated checks cannot, and leaving a record behind. Each criterion has the same three parts: what it is, what to ask a provider, and what a weak answer looks like.

Test every criterion on your own past applications, including the hardest structures you onboard, and not only on a provider's demonstration data. A provider that handles sole proprietors well may struggle with layered holding companies, and only your own applications show which kind of provider you are talking to.

Ask every provider the same questions in writing and compare the answers side by side. Switching providers later is costly: a product team lead at a payments company said they wanted to be sure of their KYB choice and not have to change their mind, "because it's a huge integration and it's a huge initiative."

1. Registry and jurisdiction coverage for the businesses you actually onboard

What it is: Registry and jurisdiction coverage is the set of business registries and business data sources a KYB provider can reach for the entity types and jurisdictions you onboard from, and how current each source is. Coverage decides how much of a check the provider completes and how much still depends on documents from the applicant. A chief AML officer at a small-business payments fintech, who had been signing up to each registry separately to pull incorporation documents and certificates of status, framed the test this way: would a provider's data sources take over that step, or would the documents still have to come from the customer?

What to ask a provider:

• Run a sample of our business applications from recent months. Which businesses did you match to a registered entity, from which sources, and what did the applicant still have to upload?

• Which of our entity types and jurisdictions do you reach directly, which through partners, and how fresh is each source?

• Do we sign one contract with you, or separate contracts with registries and data providers? A technical product manager leading a KYB redesign at a payments company asked exactly this: "Do we need separate contracts with individual registries? Or just one contract with you?"

• Which identifiers do you need to match a business, and what happens when we do not collect them?

What a weak answer looks like: A coverage map or a list of registries with no match results on your own applications. Coverage that depends on identifiers you do not collect is another warning sign. In the words of a director of risk and fraud at a shipping platform for small businesses: "We just don't have EINs for users unless they magically decide to give it to us."

2. Beneficial-ownership resolution through real structures

What it is: Beneficial-ownership resolution is how a KYB provider works out who owns and controls a business: it follows the ownership chain through any layered entities to the individuals at the end of it, and it links the same person across the related businesses they own. As a principal at a small lender put it, they were "always, like, frustrated with figuring out beneficial ownership of LLCs."

Ownership often spans entities: one person can sit behind several businesses, and one business can own another. An SVP of commercial banking at a community bank asked whether ownership could be resolved across a client's related businesses, where one person owns some outright and shares others with a second owner. The same data model came up with a compliance operations lead at a B2B payments fintech: "We'll have our UBOs and they're connected to an entity, but they're not really like part of the entity."

The CDD rule's requirement covers beneficial owners and control persons. A compliance technology manager at a sponsor bank said the bank's fintech partners are "required to provide the data for all beneficial owners and control persons, not necessarily the custodians and authorized signers."

What to ask a provider:

• Show how you resolve an owner of several related businesses, including one where they share ownership with someone else.

• For each owner you return, which facts did you verify from a source, and which did you take from the customer's certification?

• How far through layered entities do you follow ownership, and what do you return when the chain stops at an entity you cannot see into?

• Do you capture both prongs of the rule for every legal entity customer: each individual with 25% or more of the equity, and the one individual with significant responsibility for control?

What a weak answer looks like: The officers listed at the registry, returned as if they were the owners. A provider that cannot say which facts came from a source and which came from the certification also leaves the institution unable to tell when a certification should be questioned.

3. Verifying the people behind the business

What it is: Verifying the people behind a business means confirming the identity of each beneficial owner and the control person, as the CDD rule requires, in the same flow as the business check, so that the business and its people end up in one record. Where the two checks meet, according to a credit and risk lead at a bank: "The overlap... is going to be on the business verification and the officer verification, make sure that we have the right individuals."

What to ask a provider:

• Show a business and its owners verified in one flow, with one result.

• How do you handle a person who owns several of the businesses we onboard: verified once and linked to each, or verified again every time?

• Which identity checks run on owners, and can they change with the risk of the business?

What a weak answer looks like: A separate KYC process for the owners with no link back to the business, which leaves an analyst to reconcile two files by hand. Identity verification software for individuals is a category of its own, and for KYB what matters is that the result for each person attaches to the business they own or control.

4. Screening the business and its people, with relevance you control

What it is: Screening in KYB means checking the business, its owners and its officers against sanctions lists, politically exposed person (PEP) lists and adverse media, and for some institutions against legal filings as well. A useful screen lets the institution decide what counts as relevant. A head of compliance and MLRO at a merchant acquirer said a fine for a driving offense would not concern them, while embezzlement or fraud would, "because, you know, we're doing financial services."

What counts as business screening also varies by use case. An underwriting and servicing lead at a small-business lender asked whether a provider's screening would include "judgments, tax liens, UCCs," the filings their team already reviews.

What to ask a provider:

• What does your business screening cover: sanctions, PEP lists, adverse media, and legal filings such as judgments, tax liens and UCC filings?

• Does screening run on the business, each owner and each officer, or only on the business?

• Can we set what counts as relevant adverse media for our risk appetite, and see why each result was raised?

What a weak answer looks like: Every mention treated as a hit, with no way to set relevance, so the few results that matter are buried under the many that do not. Screening that stops at the business and never reaches the people behind it is just as weak.

5. Keeping the record current after onboarding

What it is: Keeping the record current means rescreening a business and its people when lists change, re-verifying owners when something calls the earlier information into question, and updating owner information from ongoing monitoring. The FFIEC examination procedures ask examiners to determine whether a bank has adequate risk-based procedures for updating customer information, including beneficial owner information, and an institution that adopts FinCEN's February 2026 relief keeps one ownership record per customer across that customer's accounts. A group risk and compliance director at a merchant acquirer described the rescreening half: "When the sanctions, PEP or adverse media provider actually updates their list, the names are automatically rescreened."

Keeping the record current also means the result reaches the teams that act on it later. A signal raised during onboarding often stops there and never reaches transaction monitoring or the compliance team, which leaves those teams working from an older picture of the business.

What to ask a provider:

• How do you keep the ownership record per customer, and show when each owner was last confirmed?

• What triggers a re-verification, and can we set our own triggers?

• When a customer confirms that earlier ownership information is still current, how is that confirmation recorded?

• Are owners and officers rescreened when a list or media source updates, and does the result reach our monitoring and compliance teams?

What a weak answer looks like: A one-time check at onboarding, rebuilt from scratch at every new account, with no date showing when the ownership information was last confirmed.

6. The manual review it leaves behind

What it is: The manual review a KYB provider leaves behind is every application that still needs a person, whether the provider's data could not resolve the business, a check failed, or your policy sends that kind of case to review. Providers differ in how many of those cases remain on your applications and in how the documents for them are collected and checked. Those cases also need somewhere to go, such as an analyst queue or case management for onboarding reviews that shows why each case was opened.

For the team doing it, manual review is a document chase. A founder and CEO at a consumer payments fintech listed what their team requests from a business when a check goes to review: "EIN letter, articles of incorporation, certificate of good standing, utility bill, anything, proof of address, proof of incorporation, proof of like the company exists?"

The documents then have to be checked against the application and the registry. An onboarding and risk team member at a merchant acquirer described the fallback: "If our KYB fails, we go out and we request things like articles of incorporation." They also asked whether a provider could extract the key details and "see if it matches what we have on the application or corroborate with what's there on registries."

A failed check is not always a warning sign. A product manager at a BaaS program manager said that because it is "pretty simple to, like, you know, upload your articles of incorporation," failures are usually "more like errors than they are [fraud]." A provider that lets an applicant or an analyst correct a mistyped name or number without restarting the application keeps those cases short.

A clean check is still no proof of a real business. An SVP of financial crimes strategy at a large regional bank asked whether any tool could look at submitted articles of incorporation and tell that "this was mocked up." Walking through a live application that the existing document and KYB flow had approved, an onboarding and compliance lead at a fintech concluded: "It's a shell company. So we'll probably be rejecting it."

Automating review is more likely to change how consistently your policy is applied than who you approve. A VP of risk transformation at a merchant acquirer attributed approval rates to risk appetite: "That's really a policy thing, right? ... It's an appetite." The same executive said the gain from automation is consistency: "The humans are inconsistent in the application of the policy, right?"

The applicant feels every one of these reviews. A compliance director at a small-business neobank said manual review "has a massive impact on the customer experience" when applicants expect instant answers. For a product manager at a BaaS program manager, "the primary criteria that determines, I think, our choice here is the user experience that we provide."

What to ask a provider:

• On our own applications, what share went to manual review, and for what reasons?

• How are documents requested, collected and checked against the application and the registry, and by whom?

• Can an applicant or an analyst correct a data error without restarting the application?

• When a case goes to review, does the analyst see why it was raised and what has already been checked?

What a weak answer looks like: A provider that treats manual review as your problem and gives no view of why cases were raised. A promise of a higher approval rate is another warning sign, because approval rate follows your policy; what automation should improve is how consistently that policy is applied.

7. The record an examiner can reconstruct

What it is: The decision record is what an institution can show an examiner for each business it onboarded: the sources checked and what they returned, the owners identified and how each was verified, the customer's certification, who made the decision and why, and when the ownership information was last confirmed. The CDD rule requires identification records, including any certification, to be kept for five years after the account closes, and verification records for five years after they are made. Because an account can close long after onboarding, the record also has to survive the end of a provider contract.

The reason behind each decision has to reach the person handling the case as well. An analyst in the queue should see the reason codes and attributes behind each result, alongside the result itself.

What to ask a provider:

• Show us the full record for a business approved several months ago, as an examiner would see it.

• Which sources were checked for that business, with what result and on what date?

• Where are the customer's certification and any later confirmation that its ownership information is still current?

• Who or what made each decision, whether a rule, a model or a person, and where is the reasoning stored?

• How long do you keep records, and can we export them in full?

What a weak answer looks like: A pass or fail flag without sources, reasons or the name of the person who decided, or a record that exists only for as long as the contract does.

8. How it fits your workflow and your other providers

What it is: Workflow fit is whether a provider's KYB checks can change with the applicant, feed one record that the fraud and compliance teams share, and work alongside the other data providers an institution uses. A technical product manager leading a KYB redesign at a payments company described the first need: "We need verification flow to be dynamic. For example, we want to create different verification templates depending on the industry, risk level, country or other parameters."

One shared record matters as much as flexible checks. Describing fraud and compliance teams that reviewed the same application separately, a chief compliance officer at a small-business payments fintech said: "It turns out we're asking the customers the same questions because we have no, like, one source of truth."

Using several data providers means someone has to build and maintain the routing between them. One engineer at a consumer payments fintech described routing domestic businesses to one data provider, with a second as backup, and international businesses to a third. A compliance director at a small-business neobank described a long effort to build a waterfall across verification partners, and a day when part of the onboarding flow broke and every application went to manual review. An SVP of financial crimes strategy at a large regional bank said they had hoped for an orchestration layer where many verification vendors plug in and the rules can be changed quickly.

Each added provider also brings its own integration work. A technical product owner for fraud and identity platforms at a large regional bank said some vendors "may not integrate well," and that when one did not, "we had to drop it and move to something else." Identity verification shows the same pattern, and the reasons managing multiple KYC providers creates problems apply to KYB data providers too.

For a fintech with a sponsor bank, the KYB standard may be set by the bank. A product manager at a BaaS program manager said: "We have a process dictated by our sponsor bank. We as program manager are in charge of completing it and that's it."

What to ask a provider:

• Can our risk team change which checks run by industry, risk level and jurisdiction without waiting for an engineering release?

• Who builds and maintains the routing between data providers, and what happens to applications when one provider is down?

• Do fraud and compliance work from one record of the business, or does the applicant answer the same questions twice?

• For a fintech, does the flow meet our sponsor bank's KYB standard, and can the bank see the record?

What a weak answer looks like: New data sources that each need an engineering project, and changes to the flow that wait for a release. Another warning sign is an applicant answering the same questions twice because two teams keep separate files.

Where Oscilar fits, judged on the same criteria

As its page on business onboarding and KYB checks describes, Oscilar orchestrates KYB checks and enhanced identity checks using an institution's own databases and third-party data sources connected through a partner marketplace, so its coverage under criterion 1 depends on the sources an institution connects.

On the manual review left behind and on workflow fit (criteria 6 and 8), Oscilar's step-up verifications trigger enhanced due diligence and additional verification steps when they are needed. Oscilar's AI-driven case management prioritizes onboarding cases and gives a natural language explanation of why each case was created. With Oscilar, an institution can backtest a new onboarding workflow on historical data before it goes live, run A/B tests, and monitor false positives, approval rates and its own KPIs afterwards.

On the record an examiner can reconstruct (criterion 7), Oscilar keeps a full audit trail per decision with stored reasoning, human-in-the-loop by design. Chartis Research named Oscilar to the 2026 FCC50, with category wins for Agentic AI Innovation and Low-Code/No-Code Customization. The recognition does not rank KYB providers, and it is no substitute for testing Oscilar on your own applications like any other provider.

The eight criteria at a glance

The table pairs each criterion with the question that tests it and the answer that should give you pause.

Use the middle column as the script for every provider conversation and the last column to judge the answers.

Frequently asked questions

What should buyers evaluate when comparing KYB providers?

Buyers comparing KYB providers should evaluate eight things: registry and jurisdiction coverage for their own applicants, beneficial-ownership resolution through layered structures, verification of the people behind each business, screening with relevance they can set, how the record is kept current, the manual review left behind, the decision record an examiner can reconstruct, and fit with their workflow and other data providers. The most reliable comparison runs every provider on the same sample of the buyer's own past applications.

Which evaluation criteria matter most for regulated financial institutions?

For a regulated financial institution, the criteria that matter most are the ones an examiner will look at: capturing both prongs of the CDD rule for every legal entity customer, keeping beneficial owner information updated from ongoing monitoring, and a record showing how each business was verified and who decided. Beneficial-ownership resolution comes next, because it is how an institution notices facts that call a customer's certification into question.

Can banks verify beneficial owners against FinCEN's database?

No source confirms that they can. As of 25 September 2026, no FinCEN source confirms that banks have been given access to FinCEN's beneficial ownership database for customer due diligence, and since FinCEN's final rule took effect on 14 August 2026, only foreign reporting companies report their beneficial owners to FinCEN. A bank's own collection and verification of beneficial owners under the CDD rule, 31 CFR 1010.230, remains the control.

Do banks still have to identify beneficial owners at every new account?

Not if they use FinCEN's exceptive relief of 13 February 2026, FIN-2026-R001, which is optional and revocable. Under the relief, a bank may limit beneficial owner identification and verification to the customer's first account, any later time facts call earlier information into question, and its own risk-based ongoing due diligence. A bank that does not adopt the relief keeps identifying beneficial owners at each new account, as the CDD rule itself still requires.

How should you test a KYB provider before signing?

Test a KYB provider on a sample of your own recent business applications, including the hardest ownership structures you onboard, and run every candidate on the same sample. Measure how many businesses each one matched to a registered entity, how many owners and control persons it found, the share of applications it sent to manual review and the reasons, and the completeness of each decision record. Ask what happens when a registry is wrong or out of date, because the answer shows how the provider handles the cases where you most need help.

How does Oscilar measure up against these criteria?

Oscilar orchestrates KYB checks and enhanced identity checks using an institution's own data and third-party data sources, and it is not a registry data provider, so its coverage depends on the sources an institution connects. It offers step-up verifications, AI-driven case management that explains why an onboarding case was created, backtesting of new onboarding workflows on historical data, and a full audit trail per decision with stored reasoning, human-in-the-loop by design. Because Oscilar wrote this guide, test it on your own applications as you would any other provider.

The best KYB provider for your institution is the one that performs on your own applications: it finds the owners behind the structures you actually see, keeps that record current, leaves a review queue your team can staff and produces a record an examiner can follow. Oscilar's approach to business onboarding is one option to put through that test alongside any other provider you are considering.