KYC Requirements for Corporates: What Businesses Must Provide in the US, EU and UK

Corporate KYC, often called Know Your Business or KYB, answers two questions: is this company real, and who is really behind it? A bank or other regulated firm needs to confirm the entity exists, then identify the people who own and control it, and verify those people's identities.

The core idea is the same in the US, EU and UK, but the details differ in ways that matter when you build onboarding or prepare documents: thresholds, how ownership is calculated, what happens with trusts, and whether a public register can be relied on. This guide covers those details from the rule text. For individuals and the wider picture, see our overview of KYC requirements.

What a company is usually asked for

Exact lists depend on the firm and the jurisdiction. Based on what the rules name, expect to provide:

• Proof the entity exists: for example certified articles of incorporation, a government-issued business license, a partnership agreement or a trust instrument
• Company details: legal name, registered address and principal place of business, and a registration or tax number
• Ownership: who owns the company, directly and through other entities, often with a structure chart
• Control: directors and the senior people who run it
• Identity details for those individuals: the same data as an individual customer, usually with an identity document

How the rules compare

United States

Who must be identified

31 CFR 1010.230 requires covered financial institutions to identify and verify each individual who owns 25 percent or more of the equity interests of a legal entity customer, and a single individual with significant responsibility to control, manage or direct it. A note to the rule puts the maximum at four people under the ownership prong and one under the control prong. The same person can fall under both.

FinCEN's FAQs make clear this reaches through structures: institutions must obtain the identities of individuals who meet the definition "either directly or indirectly through multiple corporate structures", and the customer should identify its ultimate owners and "not 'nominees' or 'straw men'". Institutions may also collect information on people below 25 percent.

How ownership is calculated

The US rule states no formula, but the FAQs give a worked example. An individual with 30% indirect ownership through one company qualifies. Another with 20% through one company and 16⅔% through a second has 36⅔% in total and also qualifies, while people with only 16⅔% do not. So holdings through different chains are added together.

The certification form is optional

FinCEN's form is not mandatory. The FAQs are direct: "There is no requirement that covered financial institutions use the Certification Form." The rule allows either the Appendix A form or collecting the same information another way, provided the individual opening the account certifies its accuracy to the best of their knowledge. That means a digital flow can capture the certification in its own screens.

The information comes from the person opening the account, who need not be a beneficial owner. The institution may rely on what it is told, provided it has no knowledge of facts that would reasonably call the information into question.

Verifying the individuals

Verification follows the same elements as for individual customers, except that the institution may use photocopies or other reproductions of documents. If an owner is not present, the FAQs say identity can be verified through a copy of a valid document or by non-documentary means.

When checks must be repeated

The rule's text says "at the time a new account is opened". FinCEN's order FIN-2026-R001 of 13 February 2026 lets institutions instead limit identification and verification of owners to the first account, to when they know facts that reasonably call the information into question, and to what their risk-based procedures require. A business opening a second account at the same bank may therefore not be asked again, but that remains the bank's choice.

Trusts, exclusions and exempt accounts

• Trusts. Where a trust owns 25 percent or more, the beneficial owner under the ownership prong is the trustee. For several trustees, the FAQs expect verification of at least one.
• Excluded customers. The rule excludes 16 categories, including regulated financial institutions, SEC-registered issuers, registered investment companies and advisers, and state-regulated insurers.
• Control prong only. Entities established as nonprofit corporations or similar and filed with the State authority, and pooled investment vehicles operated or advised by a financial institution that is not excluded, need a control person only.
• Exempt accounts. Certain point-of-sale retail credit up to $50,000 is exempt from the beneficial ownership requirement, as are postage, insurance premium finance and equipment finance accounts where the institution pays the provider directly. None of these is exempt from CIP. The last three lose the exemption if they are transaction accounts that can pay or receive from third parties, and if a cash refund is possible, owners must be identified and verified at the initial remittance or at the refund.

Records

Identifying records are kept for five years after the account is closed, and verification records for five years after they are made.

Reporting to FinCEN is a separate matter

Beneficial ownership reporting under the Corporate Transparency Act is different from what a bank asks. A final rule effective 14 August 2026 keeps domestic companies exempt from reporting. Foreign companies registered to do business in the US remain in scope, but need not report US-person owners. A US company can be exempt from filing and still be asked for beneficial owners by its bank.

European Union

The Anti-Money Laundering Regulation (EU) 2024/1624 applies from 10 July 2027. Until then, national laws implementing Directive (EU) 2015/849 apply, and their baseline ownership indicator is more than 25%. Under the AMLR:

• Company data (Article 22). Legal form and name, registered office and principal place of business if different, country of creation, names of legal representatives and, where available, registration number, tax number and Legal Entity Identifier, plus the names of nominee shareholders or directors.
• The calculation (Article 52). Unlike the US rule, this one states the formula: multiply holdings along each chain, then add the results from the chains. All levels of ownership count, and Article 54 changes this where control and ownership mix across layers. The Commission may later set a lower threshold, generally up to 15%, for higher-risk categories.
• Control (Article 51). People who control through other means must be identified independently of, and in parallel with, those who hold ownership interests.
• Nobody qualifies (Article 22). After exhausting all means, or where there are doubts, record that no beneficial owner was identified, then identify and verify all senior managing officials and keep records of the steps and difficulties. If verifying would tip off the customer about those doubts, do not verify them; record the steps taken instead.
• Registers (Articles 22 and 24). Firms must verify owners through identity documents or reasonable measures, and also consult central registers. They must report discrepancies within 14 calendar days of detecting them. For minor errors and some outdated data, a firm may ask the customer for more information instead. If it concludes the register is wrong, it must invite the customer to correct it within 14 calendar days and report the discrepancy itself if the customer does not. This option is not available in higher-risk cases.

Companies have their own duties too. Article 63 requires legal entities created in the Union to hold adequate, accurate and up-to-date beneficial ownership information and provide it to obliged entities applying due diligence. Changes go to the central register without undue delay and within 28 calendar days. AMLA's draft standards, dated 30 September 2026, add detail on information about intermediate entities in an ownership chain, such as legal form, jurisdiction and nominees. They are still drafts.

United Kingdom

The Money Laundering Regulations 2017 set the UK rules.

• The threshold is different. Regulation 5 refers to more than 25%, so exactly 25% does not meet the ownership limb, though that person can still qualify through the control limbs. It would meet the US rule and the AMLR.
• Company information. Regulation 28 requires firms to obtain and verify the company's name, number, registered office and, if different, principal place of business, and to take reasonable measures to determine and verify its governing law and constitution, directors and senior persons, and to understand its ownership and control structure.
• Listed companies. Regulation 28(5) disapplies the governing-law, constitution, directors, ownership-structure and beneficial-owner requirements for a company listed on a regulated market. Name, number and address must still be obtained and verified.
• Companies House is not enough. Regulation 28(9) says the beneficial owner requirements are not met by relying solely on information delivered to the registrar.
• Discrepancies. Under regulation 30A, firms dealing with customers on these registers must collect a register excerpt before establishing the relationship, or establish that there is no such information, and report material discrepancies, including ones found during later due diligence.
• Trusts. Regulation 6 lists the settlor, trustees, beneficiaries and any individual with control over the trust. The US trustee rule answers a narrower question: who counts when a trust owns 25% or more of a legal entity customer.

What this means for corporate onboarding

These are our recommendations from delivery work, not legal requirements.

• Store the ownership graph, not a flat list. Percentages need to be calculated through chains, and the threshold differs by country.
• Treat the threshold as configuration. "25% or more" and "more than 25%" produce different answers at exactly 25%.
• Reuse what you already know. Under the 2026 US order, a repeat business customer need not always restart. Show them what is on file and ask them to confirm it, if your policy allows.
• Plan for chasing documents. Corporate onboarding is rarely one session. Your flow needs saved progress and clear requests for missing items.

At Itexus we built a digital onboarding platform for a Top-7 US credit union that covers SME and retail account opening with automated KYC and KYB, and a MENA wealth platform using Sumsub for KYC and KYB. To compare vendors, see our list of KYC service providers.

This article is general information and not legal advice. Requirements depend on your license and jurisdictions, so confirm your obligations with qualified counsel. Regulatory status was checked on 6 November 2026.

Frequently Asked Questions

What documents are needed for corporate KYC?

Usually proof the entity exists, such as certified articles of incorporation or a business license, company details and identifiers, ownership and control information, and identity details for the people concerned. Each firm sets its own list within the applicable rules.

Who counts as a beneficial owner of a company?

Generally, a person who owns or controls it. In the US that means 25 percent or more of equity interests plus one person with significant responsibility to control, manage or direct it. The EU's AMLR uses 25% or more from July 2027, and the UK uses more than 25%, each alongside control tests.

What is the difference between KYC and KYB?

KYC usually means verifying individuals. KYB applies the idea to companies: confirming the business exists and identifying the people who own and control it. Those individuals then go through identity checks of their own.

Is the FinCEN certification form mandatory?

No. FinCEN's FAQs say there is no requirement to use it. The rule allows collecting the same information another way, provided the individual certifies its accuracy to the best of their knowledge.

Can a bank just use a public register such as Companies House?

Not on its own in the UK, where regulation 28 says firms cannot rely solely on information delivered to the registrar. Under the EU's AMLR, consulting central registers is required, on top of verification through identity documents or other reasonable measures.