What is KYB?

KYB (Know Your Business) is a term used in AML and compliance practice to describe the process of understanding and verifying a business customer. Its purpose is to determine what entity or entrepreneur the institution is entering into a relationship with, who may act on its behalf, what its ownership and control structure is, who its beneficial owner is, and what AML/CFT risks may be associated with the relationship.

KYB is not a separate procedure defined in the Polish AML Act. The regulations instead specify customer due diligence measures which, in the case of a business customer, require, among other things, identification and verification of the customer, identification of the beneficial owner and – in the case of relevant entities – understanding the ownership and control structure.

KYB therefore does not end with checking whether a company exists and what information appears in the register.

What does KYB involve?

KYB is intended to enable an obliged institution to understand who it is actually entering into a business relationship with. In simplified terms, the process can be presented as:

business customer → status and data → representation → ownership and control → beneficial owner → business profile → risk → decision.

In practice, KYB may include, among other things:

• establishing the customer’s data and legal form;
• confirming the existence and status of the entity or business;
• identifying persons authorised to act on behalf of the customer;
• checking the rules of representation;
• analysing the ownership and control structure;
• identifying the beneficial owner;
• understanding the type and profile of the business activity;
• understanding the purpose and nature of the relationship;
• assessing AML/CFT risk factors;
• documenting the findings and the decision made.

The scope of the process should correspond to the nature and risk of the customer. A simple entity operating locally, with a transparent ownership structure, may require a different scope of analysis than a group with several ownership layers, foreign entities, and a structure spanning multiple jurisdictions.

KYB should not be a mechanical checklist of documents. The information collected should make it possible to understand the customer and make a justified, documented decision regarding the relationship.

Representation, ownership and control – what needs to be established?

One of the most important elements of KYB is distinguishing between persons who represent the customer and persons who own or control it. These concepts are not equivalent. A person authorised to enter into an agreement on behalf of a company may be a member of its management board or an attorney-in-fact, but does not necessarily have to hold shares or exercise ultimate control over it. Conversely, a person who is an owner or beneficial owner may not participate in the day-to-day management or representation of the entity.

Therefore, the KYB process needs to answer several separate questions:

• what the customer is and what status it has;
• who can validly act on its behalf;
• who is included in the ownership structure;
• how control over the entity is exercised;
• who its beneficial owner is.

In more complex structures, it may be necessary to trace several levels of ownership or control. Merely identifying a direct shareholder that is another company may not yet answer the question of which natural person ultimately owns or controls the customer. The detailed rules for identifying a beneficial owner are best analysed separately under the topic of beneficial ownership.

Are KRS, CEIDG and CRBR sufficient for KYB?

Not always. KRS and CEIDG are important sources of information about customers conducting business activity. Depending on the type of customer, they may help establish or verify, among other things, its status, basic registration details, or information concerning representation. CRBR, on the other hand, provides information about beneficial owners reported by entities subject to the obligation to register. Registers, however, provide data, not a ready-made customer assessment.

In the case of a beneficial owner, an obliged institution cannot limit itself solely to reading the information contained in CRBR. It should also take appropriate steps to verify the beneficial owner and – in the case of a customer that is a relevant entity – establish its ownership and control structure.

Similarly, information concerning representation requires proper interpretation. Merely finding a person’s name in a register is not always sufficient to conclude that they can independently perform a specific act on behalf of the customer. The rules of representation, the scope of a power of attorney, or other circumstances may be relevant. If information obtained from different sources is inconsistent, the discrepancy should be clarified. Depending on the situation, information from the customer, corporate documents, or other reliable and independent sources may also be required.

KRS, CEIDG and CRBR are sources of information used in KYB. They do not replace analysis of the customer, its representation, ownership structure, or control.

KYB vs KYC – what is the difference?

KYC and KYB are closely related.

KYC (Know Your Customer) is a term that broadly refers to the process of understanding and verifying a customer.

KYB (Know Your Business), on the other hand, is an operational term used primarily when the customer conducts business activity or has an organisational structure requiring additional analysis.

KYC	KYB
understanding and verifying the customer	understanding and verifying a business customer
establishing data and identity	establishing the data and status of the entity or business
customer profile and risk	business profile and business customer risk
information concerning the customer	additionally, representation, ownership and control

In practice, these processes often overlap.

As part of KYB, it is also necessary to identify natural persons connected with the business customer – including persons acting on its behalf and beneficial owners – and apply appropriate identification or verification measures to them. The KYC/KYB distinction should therefore not be understood as two entirely separate procedures provided for by law.

The Polish AML Act does not use KYC and KYB as the names of two statutory processes. These are industry terms that help describe how customer due diligence measures are applied to different types of customers.

Put simply:

KYC concerns understanding the customer, while KYB extends this process to elements specific to a business customer – its business activity, representation, ownership structure, and control.

Does KYB need to be updated?

Yes.

KYB should not be treated as a one-off check performed only during onboarding.

During the relationship, the following may change, among other things:

• persons authorised to represent the customer;
• owners or shareholders;
• the ownership and control structure;
• beneficial owners;
• registration status;
• the profile or scope of business activity;
• geographic links;
• the way products or services are used;
• the customer’s risk level.

Therefore, information collected when the relationship is established should remain up to date, and material changes may require the customer to be reassessed. Ongoing monitoring of the relationship is also important. If the customer’s subsequent activity is inconsistent with the knowledge obtained during onboarding, it may be necessary to update the information or reassess the risk.

This does not mean that every business customer should undergo an identical reverification process at the same intervals. The scope and frequency of updates should take into account the identified risk and changes occurring within the relationship. KYB does not create a one-off snapshot of a company. Knowledge of the business customer should remain up to date throughout the entire relationship.