KYC vs KYB: Identity Verification in Crypto & DeFi

What is KYC?

KYC — Know Your Customer — is the process of verifying that an individual is who they claim to be. A platform collects a person's name, date of birth, and address, checks a government ID document, and often a live selfie, then screens the person against sanctions and watchlists. It is the front door of any AML programme.

KYC exists so that financial services can attach a real, verified identity to an account before money starts moving. In crypto, that usually means uploading a passport or driving licence, taking a "liveness" selfie so the platform can match your face to the document, and confirming an address with a utility bill or bank statement. Behind the scenes the platform also checks that you are not on a sanctions list or flagged as a politically exposed person (PEP).

Importantly, KYC is not a one-time gate. A good programme keeps watching after onboarding — re-verifying when something changes and monitoring transactions for patterns that do not fit the customer it thought it knew. That continuous element is what turns a single ID check into genuine anti-money-laundering coverage.

What is KYB?

KYB — Know Your Business — verifies a company rather than a person. It confirms that the business legally exists, is in good standing, and is not sanctioned, then maps its ownership to identify the ultimate beneficial owners (UBOs) — the real people who control it. KYB typically runs KYC on each of those individuals too.

When a platform onboards a business — say a company that wants a corporate exchange account — a single ID check is not enough. The platform needs to know the legal entity is real (pulling company-registry records), that it is active and not dissolved, and critically, who ultimately stands behind it. Companies can be owned by other companies, trusts, or nominees, so KYB works down through that structure until it reaches flesh-and-blood people.

Those people are the ultimate beneficial owners. Many frameworks treat anyone holding roughly 25% or more of a company as a UBO worth identifying, although the exact threshold and definition vary by jurisdiction. Once the UBOs are identified, each of them is put through KYC. In other words, KYB wraps around KYC — it is the entity-level check that contains individual-level checks inside it.

KYC vs KYB: the key differences

The core difference is the subject: KYC verifies a person, KYB verifies a business and the people who own it. KYB is broader — it adds company-registry checks and the crucial extra step of identifying ultimate beneficial owners. Both feed the same goal: a compliant, sanctions-clean AML programme.

Here is how the two line up across the dimensions that matter most:

A useful mental model: KYB is KYC with an ownership map bolted on top. You still end up verifying real people at the bottom — you just have to work through the corporate structure to find them first.

Why crypto and DeFi platforms use them

Crypto exchanges and other virtual-asset service providers (VASPs) use KYC and KYB to meet anti-money-laundering and counter-terrorist-financing (AML/CFT) obligations. That means screening customers against sanctions and PEP lists, monitoring activity for suspicious patterns, and — under the FATF Travel Rule — sharing sender and recipient details on transfers above a threshold.

The underlying logic is the same one that has governed banks for decades: if you let anonymous actors move value, you make it easy to launder proceeds of crime, evade sanctions, or finance terrorism. Regulators therefore expect any business that touches customer funds to know who those customers are. For crypto, several pieces stack together:

• AML/CFT programmes. KYC and KYB are the identity foundation. On top sits transaction monitoring, record-keeping, and reporting of suspicious activity to the authorities.
• Sanctions & PEP screening. Customers are checked against sanctions lists and flagged if they are politically exposed persons — people whose position carries higher corruption risk — for enhanced scrutiny.
• The FATF Travel Rule. An international standard (Recommendation 16, extended to virtual assets in 2019) that asks VASPs to pass verified originator and beneficiary information alongside qualifying transfers, mirroring the rule for bank wires.
• VASP obligations. Exchanges, custodians, and many on-ramps are increasingly licensed or registered and carry duties much like traditional financial institutions.

Exact rules, thresholds, and even the definition of who counts as a VASP differ from country to country — and they keep changing. Treat the list above as the shape of the obligations, not a checklist for any single jurisdiction.

How verification works, step by step

Under the hood, both KYC and KYB follow a similar pipeline: collect information, verify it against a document or registry, screen the subject against sanctions and PEP lists, assign a risk score, then monitor on an ongoing basis. The difference is what gets collected and where the verification data comes from.

A typical onboarding flow looks like this:

1. COLLECT     Gather data — ID + selfie (KYC), or company
               details + ownership info (KYB)
2. VERIFY      Check the document/biometrics, or confirm the
               entity against a company registry
3. SCREEN      Run the subject against sanctions & PEP lists
4. RISK SCORE  Assign a risk rating; escalate to enhanced
               due diligence where risk is higher
5. MONITOR     Keep watching transactions and re-verify when
               circumstances change (ongoing monitoring)

For KYC, step 2 is largely automated — document authentication and face-matching happen in seconds. For KYB, step 1 and 2 are heavier: the provider pulls registry filings, maps the ownership tree, and then loops each identified UBO back through the KYC flow. Higher-risk cases in either path trigger "enhanced due diligence," which means more documents and human review. And step 5 never really ends — ongoing monitoring is what keeps a verified identity meaningful over time.

KYC, KYB & the decentralization question

Identity verification assumes there is an intermediary to perform it. Centralised exchanges and custodians clearly qualify. Genuinely decentralised protocols — code with no operator collecting funds — have no one positioned to run KYC, which is why obligations tend to land on the intermediaries around DeFi rather than the smart contracts themselves.

This mirrors the nuance we cover in our MiCA explainer: regulation generally targets identifiable issuers and service providers, not autonomous code. A useful test regulators apply is "who operates it?" — a slick app run by a company with a token treasury looks very different from a truly permissionless contract that nobody controls. Most teams sit somewhere on that spectrum, and where a given protocol lands shapes whether verification obligations attach.

The picture is also still moving. Standards bodies and lawmakers are actively studying how — or whether — to apply identity rules to decentralised finance, so today's answer is a snapshot rather than a settled position. If you want the surrounding context, our Stablecoins on Stellar piece covers how regulated, fiat-backed tokens flow through this same environment, and the Stellar DeFi guide maps the wider stack.

Where does WhaleHub fit? WhaleHub is a non-custodial yield optimiser, not an exchange and not a KYC/KYB vendor — it does not itself perform identity verification. You connect a wallet, stake AQUA, and receive BLUB as a liquid receipt whose value floats with the market; the protocol aggregates ICE voting power and auto-compounds Aquarius rewards while you keep control of your assets. The wallets, on-ramps, and exchanges you use to acquire assets in the first place are the parts of the journey where KYC typically applies.

Choosing a verification provider

If you run a platform that needs KYC or KYB, the provider you pick shapes both compliance and user experience. Look for broad document and country coverage, reliable biometric and liveness checks, sanctions and PEP screening, UBO discovery for business onboarding, ongoing monitoring, and Travel Rule support — balanced against onboarding drop-off and cost.

The market is crowded, and the right choice depends on who you onboard. A retail-only app leans on fast, high-conversion KYC; a platform serving companies needs deep KYB with automated UBO mapping across many registries. Practical things to weigh:

• Coverage. Which countries, document types, and languages are supported where your users actually are.
• Accuracy vs friction. Strong fraud detection that still lets genuine users through — abandonment is a real cost.
• Screening depth. Sanctions, PEP, and adverse-media checks, plus ongoing re-screening rather than a one-off pass.
• KYB & UBO. Registry connections and the ability to resolve layered ownership automatically.
• Travel Rule & monitoring. Support for VASP-to-VASP data sharing and continuous transaction monitoring.

If you are curious how programmable tokens underpin many of these on-chain flows, Soroban smart contracts explains the mechanics.

---

The short version: KYC answers "is this person real?" and KYB answers "is this business real, and who is really behind it?" Both are AML tools, both increasingly apply to the crypto intermediaries you pass through, and both are evolving. Remember UBOs, the collect-verify-screen-score-monitor pipeline, and the "who operates it?" test, and you have the shape of identity verification in crypto.