KYB for platforms that onboard businesses: ownership, control and ongoing review

Know-your-business (KYB) checks are where many cross-border and stablecoin programmes slow down. Business customers are harder to verify than individuals. Their documents vary by country, their ownership can run through several layers of companies, and the people who control them may not be the people who own them. For an exchange, OTC desk or payment platform, KYB is also where much of the risk assessment happens, because business accounts often move larger amounts than personal ones.

This guide sets out what the standards ask for and how to turn that into an onboarding process.

What the standards ask for

The Financial Action Task Force's guidance on beneficial ownership of legal persons, published in March 2023, explains the revised Recommendation 24. Its starting point is that authorities need adequate, accurate and up-to-date information on who ultimately owns or controls a company. Financial institutions are one source of that information. The guidance supports a multi-pronged approach: company registers, beneficial ownership registers and information held by the company and by institutions all play a part.

Two principles from the guidance shape KYB in practice:

• Ownership and control are different tests. A person can control a company through voting agreements, board appointments or other means without holding a large shareholding. Onboarding should ask about both.
• Information goes stale. Beneficial ownership is not a one-time fact. Ownership changes, directors resign and companies restructure. Information needs to be kept current.

In the EU, the European Banking Authority's ML/TF risk factor guidelines describe how firms should assess customer, product, channel and geographic risk. In January 2024 the EBA extended them to crypto-asset service providers, with effect from 30 December 2024. The amended guidelines also cover banks and financial institutions whose customers are crypto-asset service providers. They highlight higher risk where those providers are not authorised under MiCA.

Turning standards into an onboarding flow

A workable KYB flow usually covers six areas:

1. Legal existence. Registration details, registered address and status from an official register where available.
2. Ownership and control. The full chain to the natural persons who own or control the business, with evidence for each layer. Pay particular attention to nominee arrangements and complex structures.
3. Key people. Directors and authorised signatories, with identity verification for those who will operate the account.
4. Business activity and expected flows. What the business does, where its customers and suppliers are, and the currencies, assets and volumes it expects. This becomes the baseline for monitoring.
5. Source of funds and, where relevant, source of wealth. Especially for businesses funding the account with digital assets.
6. Screening. Sanctions, politically exposed persons and adverse media, for the entity and its key people.

Crypto exposure is a risk factor, not a reason to refuse

Businesses that touch digital assets are not all the same. A payroll company that pays some contractors in stablecoins is a different risk from an unlicensed exchange. The EBA guidelines ask firms to assess risk based on factors such as the type of crypto-asset service, the use of self-hosted addresses and whether a counterparty is authorised. Treating all digital-asset activity the same way can mean either missing real risks or turning away legitimate customers.

The FATF's 2025 targeted update found that jurisdictions still struggle to identify the people behind virtual-asset service providers and to manage offshore providers. Checking a counterparty's licence or registration in the register of its home market is a basic but important step.

Keeping the file current

Onboarding is the start of the relationship, not the end of KYB:

• Trigger reviews on change. Prompt a review when a business reports a new owner, director, activity or market, or when its transactions move away from the expected profile.
• Schedule reviews by risk. Review higher-risk businesses more often.
• Make it easy to update. Let customers upload new documents in the product rather than by email, and keep a dated record of every change.
• Explain what you need and why. Clear requests get faster answers. Explaining the reason for a request is also part of treating customers fairly.

Where Axora fits

Axora is a financial technology platform. Verification and compliance review tools are available to approved programmes inside the onboarding and operations workflow. Responsibility for KYB decisions follows the programme model. Through the licensed partner network, the named operator or provider that holds the permission applies its own policy. An independent institution applies its own.

Next steps

• Compliance & Operations
• Explore Axora products: Platform
• See solutions by business type: Solutions
• For developers: Developers
• Talk to us: Contact