What is Know Your Business KYB Verification for SaaS?

Know Your Business (KYB) verification is a compliance check a business does on its business counterpart to verify a company’s identity, registration, ownership, and controlling information. A KYB check typically requires a SaaS company to provide a series of documents such as articles of incorporation, proof of registration, etc. It is worth mentioning here that whether a KYB check is a legal requirement for your business or you are merely carrying out a policy of your payment or financial provider, all that will be determined based on the role, place of operation (jurisdiction), and nature of transactions (business relationship) of the company involved.

While KYB focuses on the business, KYC targets the people involved in the company and identifies and verifies an individual. Anti-money laundering regulations use a broader approach to customer due diligence (CDD) that encompasses both natural and juridical persons; either of which can be the subject of CDD.

For a company customer, due diligence may include confirming legal existence, understanding ownership, identifying beneficial owners, and verifying the person acting on its behalf.

A regulated SaaS business is not always required to manage KYB for each business customer it acquires. Regulated payment providers or other business partners of the SaaS company may require the company to perform KYB checks. Alternatively, one of the company’s fraud prevention and risk management policies requires the company to manage business-level verification of its customers. The subjects of the checks may be corporations, limited liability companies, partnerships, non-profits, and other kinds of registered organizations. Of course, the nature of documents that could be requested or needed from a company would differ depending on the particular kind of organization and the laws of the country where the organisation is registered, though they usually include:

• Proof of registration or incorporation of the business
• The official address of the business
• Proof of business registration or tax identification number
• Information related to shareholding and management
• The identity and other details of the business representative who makes official decisions and conducts the business

An Ultimate Beneficial Owner (UBO) is a person who, through a legal entity, controls or owns a company. Control may stem from direct or indirect ownership, voting rights, or other forms. Jurisdictions may have minimum ownership set as indicators of control, but a set figure alone is not sufficient to define beneficial ownership. A UBO check will expose the individual who, directly or through several layers, controls a legal entity. When ownership is split by a structure, a UBO check helps trace the true owner. UBO identification with reasonable measures can be part of the customer onboarding process under AML/CFT frameworks.

A KYB check usually begins by gathering information for matching an organization against the profile created during onboarding. Depending on the provider and risk assessment, requested data may include:

• Registered business name and registration number
• Incorporation or registration date
• Registered address and business activity
• Directors or other controlling persons
• Owners
• Tax identification or VAT番号

A corporate registry is a legal repository or database of information about registered entities, an entity’s formal name, and registration details. KYB staff can compare company information they receive against registry information, using it as a third-party reference. Beneficial ownership data may be kept in the same registry, another register, or an officially designated mechanism; the registry may also have rules regulating third-party access to this information.

Before doing KYB, determine why it’s needed and who will handle it. If verified by a payment or Merchant of Record provider, evaluate what information the SaaS company should provide. If the SaaS company decides on KYB, set clear rules on the amount of data they will need, the different levels of risk assessments, the escalation path, and what to do with the records before they get onboarded. For companies under ongoing customer due diligence, any change in the company’s status, ownership, or control may trigger a post-onboarding re-verification.