KYB · know your business
A business is a web of records and people. Check the web.
One registration number can't tell you who you're dealing with. KYB checks the business, the people who run and own it, and whether the person signing up may act for it, and then keeps watching for changes.
- RegistrationCompany or LLP record: active
Verified - PANBusiness PAN, holder type C
Verified - GSTINActive; PAN inside matches
Verified - DirectorsTwo directors named in the record
Verified - Beneficial ownersOne holder above 10%; one via another company
Review - Bank accountCurrent account in the company's name
Verified
Why a business needs more than one check
Verifying a person answers one question: is this who they say they are? Verifying a business raises several at once. Does it exist? Is it still active? What kind of entity is it? Who owns it, who runs it, and is the person in front of you allowed to sign for it? Is the bank account it gave you its own?
Each of those has its own record and its own check, and the answers have to agree with one another. Most of what KYB catches is not a fake business but a mismatch: the right company with the wrong bank account, or a genuine GSTIN given by someone with no authority to use it.
| KYC | KYB | |
|---|---|---|
| Verifies | A person | An organisation, and the people behind it |
| Core records | Identity documents | Registrations, PAN, GSTIN, constitution documents |
| People involved | The customer | Directors or partners, signatory, beneficial owners |
| Main question | Is this them? | Is this business real, and may this person act for it? |
What to check depends on what the business is
Different kinds of business are created differently, and so are proved differently. Start by establishing the entity type, because it decides every check that follows. The PAN's fourth character is a quick first signal.
| Entity | What proves it exists | Who acts for it | Watch for |
|---|---|---|---|
| Sole proprietorship | The owner's identity, plus evidence the business operates (registrations, GST where held) | The owner | No separate legal entity: the owner's PAN applies |
| Partnership firm | Partnership deed and the firm's PAN; registration where applicable | Partners, per the deed | Beneficial owners among partners |
| LLP | LLP registration record and the LLP's PAN | Designated partners | Changes in partners |
| Private or public company | Company registration record and the company's PAN | Directors, and signatories authorised by the board | Layered ownership through other companies |
| Trust or society | Trust deed or registration, and its PAN | Trustees or office-bearers | Who controls it in practice |
General guide. What your regulator or policy requires for each entity type may differ; regulated entities follow their KYC rules.
The registrations, and how they should agree
A company or LLP has a registration record with the Ministry of Corporate Affairs, a PAN, and usually one or more GSTINs. Each is checked on its own, and then against the others. The legal name should be the same on all of them; the PAN inside every GSTIN should be the business's PAN; the registration should be active.
When they don't agree, the reason is usually innocent (a trade name, a recent name change, a registration in another state), but it has to be found.
The people: who runs it, who signs, who owns
Directors or partners
The people the registration says run the business. Their names should appear in the record, and they're often the first people you KYC.
Authorised signatory
The person actually signing up. They need authority to act for the business, typically a board resolution or authorisation letter, and their own KYC.
Beneficial owners
The natural persons who ultimately own or control it, even through other companies. The hardest to find and often the most important.
Finding the beneficial owner
For RBI-regulated entities, the KYC Master Direction defines the beneficial owner of a company as the natural person or persons who, alone or together, or through other legal entities, have a controlling ownership interest (more than 10% of the shares, capital or profits) or who exercise control through other means, such as the right to appoint most of the directors. For a partnership firm, the test is more than 10% of capital or profits, or control through other means.
The phrase that makes it hard is “through other legal entities”. When a company is owned by another company, you follow the chain until you reach people.
Following the chain
- Kaveri Packaging Pvt Ltdthe business being onboarded
- 60% held by Kaveri Holdings Pvt Ltda company, not a person: keep going
- Kaveri Holdings: 70% held by A. RaoA. Rao's effective interest is about 42%: a beneficial owner
- 40% of the business held by S. Nair directlyabove 10%: a beneficial owner
The business's bank account
You'll pay this account, or collect from it, so it has to be the business's own. For a company or LLP, the bank's name for the account should be the registered legal name. For a proprietorship, the business name or the owner's name can both be legitimate; decide in advance which you accept.
An account in a director's personal name, or a relative's, isn't the business's account, however convenient it is for them. That's where payouts go missing. See bank account verification.
Company or LLP. Account name should be the registered legal name.
Partnership. Account in the firm's name.
Proprietorship. Business name or owner's name, per your policy.
Anyone else's name. Not accepted for the business.
Does it actually do what it says?
Registrations prove a business exists on paper. For marketplaces, payment businesses and lenders, the next question is whether it operates as described: a website that works, products that match its category, an address that is a real place of business, and volumes that make sense for its size.
None of these is a formula. They're questions a reviewer asks when something in the records looks thin, such as a company registered last month that expects very large volumes, or a website that doesn't mention what the business says it sells.
Signals that deserve a closer look
| Signal | Could be innocent because | Ask for |
|---|---|---|
| Legal name differs across records | A recent name change or a trade name | The change record, or which name is legal |
| Signatory isn't a director | A finance manager with delegated authority | The board resolution or authorisation |
| Ownership runs through several companies | A normal group structure | The ownership chain to natural persons |
| Bank account in a personal name | A proprietor, legitimately | For companies: an account in the company's name |
| Very new business, very large expected volume | A well-funded start-up | Business plan, contracts or funding evidence |
| GSTIN recently cancelled | The business restructured | Its current registration |
Documents businesses are usually asked for
Records you can check online answer many questions, but some things only a document shows: who is authorised to sign, what a partnership deed says about control, or who the trustees are. Ask for documents to answer a specific question, not by default.
| Document | Answers | Usually from |
|---|---|---|
| Certificate of incorporation or registration | The business exists; its legal name and type | Companies, LLPs, registered firms |
| Constitution documents (memorandum and articles, partnership deed, LLP agreement, trust deed) | Who controls it and how decisions are made | All entities except proprietorships |
| Board resolution or authorisation letter | The signatory may act for the business | Companies, LLPs, trusts |
| PAN and GST registration | Tax identity and registrations | Most businesses |
| Shareholding or ownership details | Who the beneficial owners are | Companies and firms |
| Bank statement or cancelled cheque | The account is the business's own | When an automated check isn't conclusive |
| Proof of address | Where it operates | When records don't show a current address |
General guide, not a checklist for any regulator. What a regulated entity must collect is set by its KYC rules.
Designing a KYB flow
Businesses expect KYB to take longer than an individual's sign-up, but not to repeat themselves. The best flows collect a few identifiers, look up everything they can, and only then ask for documents to fill the gaps.
Say at the start what the business will need, and who in their organisation should do it. The person who signs up is often not the one who has the board resolution.
- 1Identifiers firstLegal name, PAN, GSTIN, registration number.
- 2Look up and cross-checkRegistration status, PAN type, the PAN inside each GSTIN, the directors on record.
- 3The signatoryTheir KYC, and proof of their authority.
- 4OwnersBeneficial owners, following ownership through other companies.
- 5Bank accountIn the business's name, checked before the first payout.
- 6Decide and recordApproved, pending a document, or referred for review, with reasons.
When someone signs up on the business's behalf
Accountants, consultants and employees often complete sign-ups for the businesses they work with. That's normal, and it's also how businesses get signed up without their knowledge. The question isn't whether the person is a director, but whether the business has authorised them.
Ask for that authorisation in writing from someone who clearly has the power to give it, send confirmations to contact details you took from the business's own records rather than from the person signing up, and make sure a director knows the account exists.
Sole proprietors: the case that breaks most KYB flows
A large share of small businesses are sole proprietorships, and they fit awkwardly into a KYB flow built for companies. There's no registration record with directors, no business PAN (the owner's personal PAN is used), and the business name may appear only on a GST registration or a shop licence.
Handle them as their own path: the owner's KYC, plus evidence that the business exists and operates, plus a bank account in the business name or the owner's. Decide in advance which evidence you accept, so a proprietor isn't asked for a certificate of incorporation they can't have.
Identity. The owner's KYC.
The business exists. Evidence such as a GST registration or other registration or licence in the business name.
PAN. The owner's personal PAN, fourth character P.
Bank account. In the business name or the owner's, per your policy.
KYB doesn't end at onboarding
Businesses change. Directors resign, owners sell, registrations lapse and bank accounts change. A business that passed every check a year ago can look quite different today, and the moments it changes are when problems start.
Re-check on events and on a schedule. Events: any change of bank account, signatory or ownership that the business tells you about, or that a check reveals. Schedule: in line with the risk you've assigned the relationship.
Bank account change
Re-verify before the next payout, with the call-back check.
New signatory
New authority document and their own KYC.
Ownership change
Redo the beneficial-owner work.
Registration cancelled or suspended
Pause and ask; don't just keep paying.
Who runs KYB, and why
Marketplaces
Before sellers list products and receive settlements.
Finance teams
Before a new supplier is added to the payment run.
Lenders
Before business loans or credit lines are sanctioned.
B2B platforms
Before extending trade credit or onboarding corporate customers.
A data model that matches the web
KYB goes wrong in systems that store a business as a single row with a name and a GSTIN. A business is an entity with several registrations, several people in different roles, and one or more bank accounts, and each of them has its own check and its own date.
Modelling it that way makes monitoring possible: when a GSTIN is cancelled or a director changes, you know exactly which record to re-check and which decisions depended on it.
| Record | Linked to | Checked |
|---|---|---|
| Entity | Legal name, type, registration number | At onboarding; on change |
| Registrations | PAN, each GSTIN by state | At onboarding; periodically |
| People | Directors or partners, signatory, beneficial owners, each with a role | KYC as your policy requires |
| Authority | Resolution or letter naming the signatory | When the signatory changes |
| Bank accounts | Account in the entity's name | Before first payout; on change |
Not every business needs the same depth
Platforms that onboard thousands of small businesses can't review every one like a bank reviewing a corporate borrower, and they don't need to. Most use tiers: a light check that lets a business start with low limits, and deeper checks that apply as volume, value or risk grows.
The tier boundaries are your risk decision, and for regulated entities they sit inside the rules they must follow. What matters is that the triggers are written down and automatic, so a business can't grow into a high-risk position without anyone looking again.
| Tier | Checks | Moves up when |
|---|---|---|
| Start | PAN, GSTIN where held, bank account in the business's name | Volume or payout value passes your first threshold |
| Standard | Plus registration record, signatory authority, directors | Higher limits requested, or a risk signal appears |
| Enhanced | Plus beneficial owners, operations review, documents | Large volumes, higher-risk category, or cross-border activity |
Illustrative tiers; thresholds and required checks are your policy, and your regulator's where applicable.
What's the most common KYB failure?
Mismatches rather than fakes: a trade name on the form and a legal name in the records, a signatory with no written authority, or a bank account in a director's personal name. Most are fixed with one document or one corrected field.
Is a GST certificate enough to verify a business?
It's a useful record, but on its own it proves a registration exists, not that the person signing up may act for the business or that the bank account is the business's. Pair it with the checks on people and the account.
Can KYB be fully automated?
Much of it can: looking up registrations, PAN and GSTIN, cross-checking names, verifying the bank account. Authority documents, ownership chains through other companies and anything that doesn't match usually still need a person.
How long does KYB take?
From minutes, when the business's identifiers look up cleanly and the signatory is a director, to days, when documents or ownership chains need a person to review them. Telling businesses up front what they'll need is the single biggest factor.
Do I need to verify every director?
Not always every one. Many policies verify the signatory and the beneficial owners in full, and confirm the other directors against the registration record. Regulated entities follow their rules on whose KYC is required.
What if a business is owned by a foreign company?
The same principle applies: follow ownership until you reach natural persons. It usually takes longer, because the records are in another country, and the documents you accept for foreign entities should be decided in your policy in advance.
What is KYB?
KYB (know your business) is verifying a business before you work with it: that it exists and is registered, what kind of entity it is, who runs and owns it, that the person dealing with you may act for it, and that its bank account is its own.
How is KYB different from KYC?
KYC verifies a person. KYB verifies an organisation and the people behind it: directors or partners, the authorised signatory, and the beneficial owners. KYB usually includes KYC on some of those people.
What is a beneficial owner?
The natural person who ultimately owns or controls a business. For RBI-regulated entities, the KYC Master Direction defines it for a company as a natural person with a controlling ownership interest (more than 10% of shares, capital or profits) or who exercises control through other means, and uses a more-than-10% test for partnership firms too.
Does a sole proprietorship need KYB?
A sole proprietorship isn't a separate legal entity: the business and the owner are the same person. Checks combine the owner's KYC with evidence that the business exists, such as its registrations and a bank account in the business's or owner's name.
How often should a business be re-verified?
Whenever something material changes (a new director, a new bank account, a cancelled registration) and periodically in line with your risk policy. For RBI-regulated entities, periodic updation follows the risk categories in the KYC Master Direction.
Which KYB checks does Peneu provide?
Which business checks are available through Peneu, and which records they draw on, is confirmed during onboarding. Your onboarding policy and any regulatory obligations remain yours.
Official sources
- RBI — Master Direction – KYC, 2016 (updated 14 Aug 2025)Beneficial owner definitions for companies and partnership firms; applies to RBI-regulated entities.
- CBIC / GST Council — GST Registration under GST Law (flyer)GSTIN contains the PAN of the legal entity.
Last reviewed . Examples, amounts and screens marked illustrative are not Peneu figures.