September 21, 2026

The KYB Document Checklist for Business Onboarding

Axle Team

Key takeaways

A defensible KYB checklist maps directly to the CDD Rule's four core requirements: verify the customer, verify beneficial owners, understand the relationship, and monitor it on an ongoing basis.
Beneficial ownership has two prongs. The 25 percent ownership prong gets the attention, but the control prong — one individual who runs the entity — is required for every legal entity customer and is where files most often fall short.
FinCEN's 2026 exceptive relief (FIN-2026-R001) narrows re-verification at each new account opening. It does not change what you collect at initial onboarding.
Collection isn't the bottleneck; the follow-up loop is. Publish per-document acceptance criteria so analysts stop bouncing files back to customers piecemeal.

Every BSA officer has seen the failure mode: a business account approved with a certificate of formation on file and nothing tying the entity to the humans behind it. A KYB checklist exists to prevent exactly that — and to prove to an examiner that your onboarding process is reasonably designed, not ad hoc.

A complete KYB checklist covers four evidence categories: proof the business exists (formation documents, EIN, registry good standing), proof of who owns it (beneficial owners at the 25 percent threshold plus one control-prong individual), proof of who runs the account (ID for officers and authorized signers), and context for how the account will be used (nature of business, expected activity).

The rest of this piece breaks each category down, flags the risk-based additions, and covers what changed in 2026.

The KYB checklist, category by category

The checklist below reflects what U.S. covered financial institutions collect under the CDD Rule (31 CFR 1010.230 for the beneficial ownership requirement). Adjust depth by risk tier — but every business customer file should have something in each category.

Entity existence — certificate of formation/incorporation, EIN documentation, certificate of good standing, registered address. Verifies the entity is real, active, and registered where it claims to be.
Ownership — ownership chart or cap table, beneficial ownership certification, ID for each 25%+ owner. Verifies who ultimately owns the entity, through however many layers.
Control — ID for one control-prong individual (CEO, CFO, managing member, or equivalent). Verifies who actually runs the entity.
Authority — board resolution or operating agreement naming signers, ID for authorized signers. Verifies the people opening and operating the account may do so.
Nature and purpose — business description, licenses where applicable, expected activity profile. Establishes what normal looks like, so monitoring can flag what isn't.

Why ownership documentation carries the file

The reason regulators care about the ownership rows more than any others is stated plainly in the FFIEC BSA/AML examination manual:

"Legal entities, whether domestic or foreign, can be used to facilitate money laundering and other crimes because their true ownership can be concealed." — FFIEC BSA/AML Examination Manual, Beneficial Ownership Requirements for Legal Entity Customers

Layered structures are where this gets operational. If your legal entity customer is owned by another entity, you trace up until you reach natural persons or confirm no individual crosses 25 percent. Document the trace — an examiner will want to see the path, not just the conclusion.

Don't skip the control prong

Even when no individual crosses the 25 percent line, the file is incomplete without a control person. The FFIEC manual is specific:

"Under the control prong, the beneficial owner is a single individual with significant responsibility to control, manage or direct a legal entity customer." — FFIEC BSA/AML Examination Manual

In practice this means every KYB file needs at least one verified natural person, no matter how diffuse the cap table is.

Where the checklist comes from: the CDD Rule

The checklist isn't arbitrary — it operationalizes FinCEN's CDD Rule. FinCEN's own summary:

"The CDD Rule has four core requirements. It requires covered financial institutions to establish and maintain written policies and procedures that are reasonably designed to: identify and verify the identity of customers; identify and verify the identity of the beneficial owners of companies opening accounts; understand the nature and purpose of customer relationships to develop customer risk profiles; conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information." — FinCEN, Information on Complying with the Customer Due Diligence (CDD) Final Rule

Note the last requirement. A KYB checklist that only fires at onboarding satisfies three of the four pillars. Ownership changes, status lapses, and new sanctions exposure all happen after day one — your refresh and trigger-based review process is part of the checklist, not an afterthought.

Risk-based additions: when standard KYB isn't enough

Standard collection is the floor. Escalate to enhanced due diligence when the file shows:

Complex or cross-border ownership structures, especially with entities in secrecy jurisdictions in the chain
Ownership or control touching PEPs or prior adverse media
High-risk industries — MSBs, crypto, gaming, private ATMs, cash-intensive retail
Mismatches between stated business purpose and expected activity, or between registry data and submitted documents

What EDD adds: source-of-funds and source-of-wealth evidence, deeper adverse media review, site visits or independent confirmation of operations, and senior-level approval. If your team runs these reviews manually today, see how Axle structures them on the enhanced due diligence reviews solution page.

What changed in 2026

In February 2026, FinCEN issued exceptive relief (FIN-2026-R001) from the requirement to identify and verify beneficial owners at each new account opening. The practical effect: less re-papering when an existing, verified legal entity customer opens an additional account.

Read the relief narrowly. It addresses repeat verification events — it does not thin out the initial KYB checklist, and it does not touch the obligation to keep beneficial ownership information current on a risk basis. Update your procedures to reference the ruling before an examiner asks why your practice diverges from your written policy.

A practitioner note on cycle time

Here's the pattern we see repeatedly: teams optimize document collection — better forms, portal reminders — while the actual cycle-time killer is the rejection loop. An analyst reviews a file three days after submission, finds the operating agreement unsigned, and the request goes back to a customer who has already mentally finished onboarding.

The fix is unglamorous: write per-document acceptance criteria into the KYB checklist itself. "Certificate of good standing" becomes "issued within 90 days, matching legal name exactly, from the state of formation." When acceptance criteria are explicit, first-touch review can reject once, completely, with every deficiency listed — instead of serially. Teams that do this cut the back-and-forth more than any collection tooling does. It's also what makes the process automatable: an AI agent can apply crisp acceptance criteria consistently; it can't apply criteria that live in a senior analyst's head.

FAQ

What documents are required for KYB verification?

At minimum: formation documents and EIN evidence proving the entity exists, a beneficial ownership certification identifying each 25 percent-plus owner and one control person, government ID for those individuals and for authorized signers, and enough business-purpose information to build an expected activity profile. Risk tier drives anything beyond that.

Is KYB legally required in the United States?

For covered financial institutions, yes — the CDD Rule requires identifying and verifying beneficial owners of legal entity customers, understanding the customer relationship, and maintaining ongoing monitoring. The beneficial ownership requirement sits at 31 CFR 1010.230.

How often should KYB information be refreshed?

The CDD Rule frames updating customer information as risk-based rather than fixed-calendar. Most programs pair periodic review cycles by risk tier with event-driven triggers — ownership changes, unusual activity, negative news — so the file reflects the customer you actually have, not the one you onboarded.

Business onboarding reviews are exactly the kind of document-heavy, criteria-driven work AI agents do well. Meet Justin, Axle's diligence analyst — it reviews onboarding documentation against your checklist, runs enhanced due diligence, and chases outstanding requirements so your analysts only touch the judgment calls. For a broader look at where agents fit in your program, start with the AI readiness playbook.

The KYB Document Checklist for Business Onboarding

More from the blog