KYB data requirements
For the team that owns a company master and has to defend it.
A stewardship queue, a CRM after a migration or a merger, a supplier file before a payment run, counterparty onboarding that has to survive an audit. Read the argument here, take the takeaways at the foot into your next vendor conversation, and send us a file when you want the same measurement on your own rows.
Regulatory deadlines · 2,188 words · every figure carries the population it was measured over
11 min read, last revised . 6 questions answered at the foot.
all 19guides →how every figure here was measured →On this page
What a KYB file actually contains
The exact requirements are set by your own regulator, your risk appetite and the product being sold, and no vendor page is a substitute for your policy. What follows is the shape almost every KYB flow shares, grouped by what each group is for, with a note on which parts of it this product touches.
- Identity of the business: legal name, registration number with the register that issued it, legal form, registered address, incorporation date, register status, and any trading or previous names. This is the identity step, and it is where resolution sits.
- Identity of the people: directors, officers, and beneficial owners above whatever threshold applies, with the personal identifiers needed to distinguish one person from another. We do none of this, and the reason is in the scope section below.
- Ownership and control structure: the chain from the onboarded entity to its ultimate owners, with each edge's basis. We supply the corporate part of this and stop where the chain becomes a person.
- Screening: sanctions, politically exposed persons, and adverse media, against lists you licence. Not us, deliberately and permanently.
- Financial and commercial context: expected activity, source of funds, industry classification, and whatever the product requires. Not us, except that an industry classification crosswalked between schemes is lossy and we mark it as such.
- Evidence and retention: what was checked, against what source, on what date, by whom, kept for as long as the applicable duty requires. This is where a resolution receipt does real work.
Why the identity step is the one that propagates
Every other item in that list is computed against whichever entity was picked. Screening runs against a name. Ownership is walked from an entity id. Risk assessment scores a set of attributes belonging to a company. If the identity step chose the wrong company, every one of those conclusions is drawn correctly about the wrong subject, and the file looks exactly like a correct file.
That is the specific reason an identity error is more expensive than most data errors: it is not visible in the output. A missing beneficial owner leaves a gap somebody can see. A wrong entity produces a complete, internally consistent, confidently wrong file that will pass a quality review.
It matters a second time years later, when a supervisor asks for the evidence behind a customer due diligence decision and the file contains a name, a date and an analyst's initials. "An experienced analyst searched the register and picked this one" is a description of a process rather than evidence about a company.
Where resolution sits, and what it produces
One counterparty record in, one resolved registered entity out, with the register page cited, a calibrated confidence, and a receipt that reopens at a URL for as long as your retention policy keeps it. Where the evidence will not carry a decision, you get a ranked shortlist and the field that would settle it rather than a pick.
Take that last behaviour to your own risk committee before you scope anything. Where a register genuinely cannot separate two candidates on the evidence supplied, an analyst picking one is guessing with an audit trail attached. The resolver refuses instead: A match below 0.90 confidence is unrepresentable. The record comes back as an abstention with a ranked shortlist instead. The row lands in a review queue with a typed cause, and when a human settles it the verdict is recorded against the credential that made it, with the reviewer identity taken from the credential rather than from the request body.
A human-approved merge is also excluded from the automated population that every published accuracy figure is measured over, and it is withheld on replay. The consequence is that the published figures cannot be improved by counting decisions your own analysts made.
What this is not, stated before you scope it
KYB is a compliance context, and the products next to this one in it do all of the things below. This one does not, and month three of an integration is an expensive place to find that out.
- It is not sanctions or adverse media screening. There is no risk boolean anywhere in the data model and there must not be one: a screening hit is an assertion about a matcher, not a fact about a company, and writing one into a record as though it were a fact would manufacture a defamatory claim with a citation attached.
- It is not a credit reference agency. There is no score, no rating, no failure probability, no credit limit, no trade payment behaviour and no payment experience data — and no open equivalent of them exists, so they are not arriving later.
- It may not be used for eligibility decisions about individuals, including employment, credit and tenancy. That is a term of use rather than a preference.
- It does not resolve people. Ultimate beneficial ownership stops where the chain becomes a natural person: officer and control names published by the UK and French registers under open licences are stored, and every personal identifier that would let you disambiguate a person — date of birth, nationality, country of residence, personal address — is discarded at ingestion and never reaches storage.
- It is not a decision. It establishes which registered company a counterparty is; whether to onboard them is your judgement, made with your policy, and no field in the response should be read as a recommendation.
Ownership: what can be walked, and what is refused
Corporate ownership comes from the global LEI system's Level 2 relationship records and, for UK companies, from the persons-with-significant-control register. One hop by default and up to ten on request, cycle-safe and bounded, failing closed on ambiguous or name-only owners.
Two properties of that output matter for a KYB file. Control bands are published as bands: they are never multiplied and never converted to a midpoint, so an indirect percentage appears only where every hop carries an exact published figure, and otherwise the response states that the arithmetic was refused and why. And an incomplete walk is an absence of coverage rather than an absence of owners — we can say we found no parent, we cannot say there is no parent, and the response is built to express the difference.
The reason to insist on that distinction is that a KYB file records conclusions. "No ultimate beneficial owner identified" and "the ownership chain could not be walked past this entity" have completely different implications for what an analyst does next, and a system that renders both as an empty field has made the second one invisible.
The identifier a register asks for
Where an onboarding flow or a supervisory register requires a specific identifier, one call returns every identifier system the resolved company is known by — the crosswalk — each separately cited with its licence tier and freshness, together with the systems that were asked and came back empty. Four different empty states are distinguished: a wired source supplies the scheme and had no value, no wired source supplies the scheme at all, the scheme was not checked, or the source was unavailable. Four remediations, four words.
For a compliance register that distinction is the whole point. "The global LEI system holds no LEI for this provider" is a finding about the provider and generates an action; "nothing in this deployment supplies that scheme" is a finding about the tooling and generates a different one. A crosswalk that returned an empty field for both would make the register look identically incomplete in two situations that are not alike.
Evidence and retention
Every resolution persists its features, thresholds, cited evidence with source URLs, the adjudicating model id and prompt version where one ran, the pipeline version, and a re-run of the score from the stored features. It reopens at a URL. That is the artefact a supervisor is asking for when they ask how you concluded this was the counterparty, and it is produced automatically rather than reconstructed afterwards.
Receipts are also queryable as a population rather than one at a time, filtered by pipeline version, threshold and date — so "show me every identity decision taken under the threshold we have since raised" is a question with an answer rather than a project.
Retention defaults to 2,555 days, which is seven years, for decisions, records and usage, and 365 days for open review items. Seven years is chosen to clear the five-year duty under the money laundering regulations comfortably; below about five years a KYB customer loses what they are legally required to produce. One operational fact to plan for rather than assume: nothing purges itself. Every retention window is a scheduled job an operator has to run, and an unscheduled deployment keeps everything indefinitely.
What the assurance conversation will find
Two things a regulated buyer will ask about early, answered here so the first call is short.
There are no certifications. No SOC 2. It has not been started. No independent external validation of the accuracy figures. Every fixture is one we built. No production customer holdout. The evidence is internal. For some regulated buyers that is the end of the conversation, and it is better to establish it now than in month three of a procurement.
The measured registers are narrower than most vendors' claimed coverage and are stated per register rather than per region: the United Kingdom, the United States via Colorado and via SEC filers, France and Norway. Where a counterparty sits outside those, the cascade can still retrieve and adjudicate, and the evidence behind the confidence is thinner — and a compliance register is the wrong place to accept an unmeasured claim. Treat those rows as a review queue rather than as answers.
The input shapes a KYB queue actually contains
A counterparty supplying its own registration number or LEI decides deterministically: 100% (317/317) on the live-adjudicated fixture of 2026-08-29, with the identifier checked for register shape rather than string equality and an LEI checked against its published checksum before it is trusted at all.
A legal name plus a registered address resolves on the postcode: 98.74% (313/317). A correspondence address is context rather than an identifying signal and is treated as such, which matters because a KYB application form frequently collects one and labels it as the other.
A legal name plus a country measured 98.42% (312/317) on the GB fixture, and that number does not travel: Companies House is 99.53% unique on names and SIRENE is 67.96%. The same shape from a French applicant is a different problem.
A trading name from a marketing site or an application form is matched as a register fact where the register publishes trading and previous names, and as an ordinary name where it does not — in which case it lands in the shortlist tier. On the stub-adjudicated gate fixture, a name-only record put the true company at rank one for 151/205 (74%) and in the top three for 205/205 (100%). Recall is a property of the list, not of the winner. 74% is far below the 0.90 acceptance floor, so no row of that shortlist may be offered as a match, quoted as an accuracy number, or folded into an accepted-match count.
What to take away
- A KYB file has six groups of requirements and identity resolution is one step in the first. Screening, scoring, source of funds and the decision itself are not here and are not coming.
- An identity error is the expensive kind because it is invisible: every later conclusion is drawn correctly about the wrong company, and the file passes quality review.
- Where the evidence cannot separate two candidates, the resolver refuses rather than picking. 0.90 is enforced in code on the online, batch and replay paths.
- Ownership stops where the chain becomes a person, control bands are never multiplied into a midpoint, and an incomplete walk is reported as coverage rather than as an absence of owners.
- Four distinct empty states are returned for a missing identifier, because "no LEI exists for this provider" and "nothing here supplies that scheme" are different findings with different remedies.
- Retention defaults to seven years to clear the five-year money laundering duty, and nothing purges itself — every window is a job an operator has to schedule.
- There is no SOC 2, no ISO 27001, no independent external validation and no customer holdout. For some regulated buyers that ends the conversation, and it should end it on the first call.
Those takeaways hold for anybody's data. The number for yours comes out of your own rows — a few hundred of them, with the matches you already have beside them.
Start freePrefer to put it to a person? Talk to us instead →
Where this article is applied
2 pages name this method as the working behind what they claim.
Is this your file?
The article is for anyone. The measurement behind it is worth commissioning for one kind of team.
Teams with a company master they have to defend — an MDM or stewardship queue, a CRM after a migration or a merger, a supplier file before a payment run, or counterparty onboarding that has to survive an audit.
Buying breadth as the product: we hold a fraction of an incumbent’s records and are not building a global company graph. Entity Bind resolves companies and organisations only. It does not resolve people, vessels, bank-account ownership, sanctions exposure, emissions or geolocation, and its results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.
Sources
The papers, regulators and registers this article quotes, each with the caveat that travels with it.
- Companies House register search
The register the United Kingdom figures were measured on. A name-uniqueness share is a property of the register, not of any resolver.
- Open Government Licence v3.0
The instrument Companies House publishes under. It is what makes those facts storable and resellable rather than return-only.
- Annuaire des Entreprises
The keyless government search route to the SIRENE universe. What it cannot fix is that a third of French companies share their exact name.
- Licence Ouverte 2.0 (Etalab)
The licence SIRENE data is reused under. It permits free reuse, including commercial reuse, with attribution.
- GLEIF, “The Legal Entity Identifier (LEI)”
The operator of the system, describing the twenty-character code and the four ISO 17442 principles it adheres to. It is GLEIF's account of the standard rather than the standard's own text.
Internal fixtures only. The historical 2026-08-29 per-tier recording covers 317 GB companies with identifier-rich arrivals seeding the catalogue first; the context tier includes country and registered-town prose. Its legacy replay has no full-prompt-verified calls and cannot certify current calibration. The September 5 CI reports cover 1,176 labelled pairs and 705 records over 250 companies using offline stubs. These are not independent customer holdouts or live production validation; the 99% minimum-input product target remains unmet. Scope is company and organisation identity only — not people, vessels, bank-account ownership, sanctions or emissions. Results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.
Figures read off the product repository on 2026-09-05. The per-tier rates come from the live-adjudicated 317-company recording of 2026-08-29; the gate figures come from the stub-adjudicated continuous-integration run and are a floor rather than a ceiling. The two are never averaged. Entity Bind holds no SOC 2, no ISO 27001 and no other certification, and claims none. Every figure, with the population it was measured over and the method behind both recordings, is set out on the accuracy page. The retention, erasure, tenancy and sub-processor detail a security review asks for is under Trust and security, with where assurance stands: no external validation of the accuracy figures and no customer holdout.
The same measurement, on your own rows.
Create your workspace, verify your email and run your first company file. The Free plan needs no card. Create API keys in your workspace when you need an integration.
300 credits. No card.
For a guided review of your file, explore the Merge Safety Sprint →
The questions this article answers
What data does a KYB check require?
Six groups: the identity of the business (legal name, registration number with its register, legal form, registered address, incorporation date, status, trading and previous names); the identity of its directors and beneficial owners; the ownership and control structure; screening against sanctions, politically exposed person and adverse media lists; financial and commercial context including expected activity and source of funds; and the evidence and retention record behind all of it. The exact requirements are set by your regulator and your policy, not by a vendor page.
Is Entity Bind a KYB product?
It is the identity layer underneath one. Establishing which registered company a counterparty is, with cited evidence and a reopenable receipt, is one step of a customer due diligence process — the step most often performed by an analyst in a browser and recorded as a name in a field. Screening, risk assessment, source of funds, ongoing monitoring and the onboarding decision are not here.
Can you screen against sanctions lists?
No, and it is not on the roadmap: it is a deliberate boundary rather than a gap. There is no risk boolean anywhere in the data model and there must not be one: a screening hit is an assertion about a matcher rather than a fact about a company, and writing one into a record as though it were a fact would manufacture a defamatory claim with a citation attached. The nearest thing we would consider is corporate entity screening assurance over lists you already licence — checking that the entity your screening tool matched is the entity you meant — and even that is scoped to organisations rather than people. Complete person-name screening needs a different ontology, different data and a different evaluation, and none of our accuracy language would transfer to it.
Do you identify beneficial owners?
The corporate part of the chain, and it stops where the chain becomes a natural person. Officer and control names published by the UK and French registers under open licences are stored; every personal identifier that would let you disambiguate a person is discarded at ingestion and never reaches storage. An incomplete walk is reported as an absence of coverage rather than as an absence of owners, because for a KYB file those are different conclusions.
How long is the evidence kept?
Decisions, records and usage default to 2,555 days — seven years — and open review items to 365 days. Seven years clears the five-year duty under the money laundering regulations comfortably. The windows are settings you can change in either direction, and nothing purges itself: every retention window is a scheduled job an operator has to run.
Do you have SOC 2 or ISO 27001?
No. No SOC 2. It has not been started. There is also no independent external validation of the accuracy figures. Every fixture is one we built. and no production customer holdout. The evidence is internal. What can be sent in the same week is the assurance material that exists, the sub-processor list, and a straight answer on the paperwork that does not.