Home/Research library/Compliance Slows Launches

Guide · KYC and KYB

KYC Explained

KYC Explained: What Merchants Need to Know About Individual Identity Verification A company cannot show a passport. Its people can. That simple fact explains why a business applying for payment processing may be asked for identity information about a founder, director, beneficial

Source-imported researchEditorial verification pending

Research draft awaiting independent review. This material was adapted from an existing research library. Provider-specific promotions have been excluded automatically; facts, regulatory requirements, and conclusions must be verified before the page is indexed publicly.

KYC Explained: What Merchants Need to Know About Individual Identity Verification

A company cannot show a passport.

Its people can.

That simple fact explains why a business applying for payment processing may be asked for identity information about a founder, director, beneficial owner, controller, or representative even though the merchant itself is a company.

The provider is not necessarily asking for “more company documents.” It is trying to establish something about a natural person connected to the business.

That is the most useful way to understand KYC.

KYC is best understood as verification of a relevant natural person's identity and relationship to the merchant—not as a generic government-ID upload requirement.

During merchant onboarding, the merchant company itself may undergo business verification while particular individuals connected to it undergo identity verification. Which people must be checked, what information is required, and how verification can be completed depend on jurisdiction, regulated activity, provider, acquiring or banking relationships, merchant structure, and risk.

The distinction matters operationally because a merchant that hears only “more KYC is needed” often responds by sending more documents without knowing which person—or which unresolved fact—the provider is actually trying to verify.

What does KYC mean?

KYC stands for Know Your Customer.

In payments and financial services, the term is commonly used for processes intended to establish and verify relevant customer identity information. In formal AML/CFT frameworks, the underlying obligations are often described more broadly as customer due diligence (CDD) rather than simply “KYC.”

FATF's standards are useful for understanding the principle. They establish an international CDD framework while leaving implementation to individual jurisdictions. FATF also defines identification data in terms of reliable, independent source documents, data or information—not simply possession of one particular paper document.

For merchants, this creates an important rule:

Do not start with “Which document do they want?” Start with “Whose identity or relationship are they trying to establish?”

Once that is clear, the evidence request usually makes more sense.

Why does a business undergo individual KYC?

Because a legal entity operates through people.

Consider a merchant company applying for payment processing.

The provider may need to understand the company through KYB—Know Your Business.

But the business relationship may also involve natural people such as:

the person submitting the application;

a beneficial owner;

a director;

a controller;

an account administrator;

an authorized representative.

Those roles are not interchangeable, and not every person necessarily requires the same verification.

KYC subject does not mean “customer” in the retail sense

The word customer can create unnecessary confusion.

A merchant may think:

Because the person being verified can be relevant to the business relationship without personally buying anything.

The KYC subject might be a natural person because that person:

owns or controls the merchant;

manages it;

is authorized to represent it;

administers the payment-provider account;

otherwise falls within the applicable verification requirements.

The merchant's end customer who buys a product is a different concept.

This article uses KYC subject to mean the natural person whose identity is being established in the merchant-onboarding context.

KYC and KYB are related, but they verify different subjects

This is the most important structural distinction.

KYC

Primary question:

Who is this person?

The subject is a natural person.

KYB

Primary question:

What is this business, and who owns, controls, or represents it?

The subject is primarily a legal entity and its business relationships.

A merchant onboarding process can therefore involve both:

Merchant company

→ KYB

Relevant beneficial owner

→ KYC where required

Director

→ potentially identity verification depending on the applicable requirements

Authorized representative

→ potentially identity verification plus an authority check

FATF's current glossary reinforces the person/entity boundary: a legal person is distinct from a natural person, while a beneficial owner of a legal person is ultimately one or more natural persons.

The detailed interaction between the two processes belongs in KYC vs KYB.

What does KYC actually verify?

A KYC process can involve several facts.

For a given person, the provider may need to establish information such as:

name;

date of birth;

nationality;

address where relevant;

identifying information;

relationship to the merchant.

The exact fields are context-specific.

But the process should not be confused with a data-entry exercise.

A useful conceptual flow is:

Identity claimed

→ information supplied

→ evidence supplied

→ evidence assessed

→ other information compared

→ independent source checked where appropriate

→ mismatch resolved

→ verification outcome

The uploaded brief explicitly requires this distinction between document collection and verification.

A passport is evidence, not the verification outcome

Suppose the merchant uploads a passport.

What has happened?

The provider has received an identity document.

That does not automatically mean every relevant identity question is resolved.

The provider may still need to determine whether:

the document relates to the person being checked;

the identifying information agrees with the application;

the evidence is usable under the applicable procedure;

information conflicts with another source;

the person's relationship to the merchant has been established;

another required check remains outstanding.

This is why merchants should avoid treating these four statuses as synonyms:

submitted

received

verified

approved

They describe different stages.

FATF's digital-identity guidance makes the same broader conceptual point from another direction: CDD identity verification can use appropriately reliable digital identity systems, illustrating that verification is about obtaining sufficient confidence in identity rather than mechanically collecting one traditional document format.

Identity and relationship are also different facts

Imagine a passport conclusively establishes:

Person A is Person A.

That does not establish:

Person A owns Merchant Ltd.

Nor does it establish:

Person A is authorized to submit this application for Merchant Ltd.

Those are different verification questions.

A useful merchant model separates:

Identity

Who is this person?

from:

Relationship

Why is this person relevant to the merchant?

and, where necessary:

Authority

Can this person legitimately act for the merchant in this context?

This distinction prevents merchants from responding to a relationship problem with an identity document.

A clearer identity document cannot prove corporate ownership by itself.

Who may need KYC during merchant onboarding?

There is no defensible global rule that every director, owner, employee, or representative always undergoes the same KYC process.

Potential subjects depend on the applicable arrangement.

Several roles commonly explain why a person appears in the onboarding process.

The individual merchant

If the merchant relationship is with a natural person rather than a company, the individual can be the customer being identified and verified.

That is conceptually straightforward:

customer = natural person

The more complicated cases begin when the merchant is a legal entity.

A beneficial owner

The business is the merchant.

But an onboarding process may need to establish who ultimately owns or controls it.

FATF defines a beneficial owner of a legal person as the natural person or persons who ultimately own or control the customer, including ultimate effective control. It also makes clear that beneficial ownership can operate through an ownership or control chain rather than only through direct shareholding.

Once a relevant natural person is identified through ownership/control analysis, that person's identity may need verification under the applicable framework.

This article deliberately does not define a universal ownership percentage.

The questions:

Who qualifies as a UBO?

and:

What percentage applies?

belong in Ultimate Beneficial Owner Requirements and require jurisdiction-specific sourcing.

A director

A director may be relevant because of the person's legal management or representation role.

But:

director does not automatically mean owner.

A person can be:

a director but not a beneficial owner;

a beneficial owner but not a director;

both;

neither.

That distinction is important enough to have its own article: Director Verification.

Here, the KYC point is simply that a director is a natural person whose identity may become relevant separately from verification of the company itself.

A controller

Ownership and control do not always produce the same answer.

Depending on the applicable framework, an individual can be relevant because of effective control even where straightforward share ownership does not tell the whole story.

The detailed determination of control belongs in the beneficial-ownership content.

Once the natural person has been identified as relevant, KYC concerns verification of that person's identity.

An authorized representative

The employee completing a PSP application may own no shares and hold no directorship.

They might simply be authorized to act for the merchant.

That introduces two questions:

Who is this person?

and:

Are they authorized to act for this company?

A government ID can help with the first.

It does not automatically solve the second.

The brief explicitly requires identity versus authority to remain separate.

One individual can appear in several roles

Real companies rarely map cleanly to one person per verification category.

The founder may be:

director + beneficial owner + authorized representative

Another company may have:

Beneficial Owner A

owns the business but takes no operational role.

Director B

manages the legal entity but owns no shares.

Employee C

submits the payment-provider application with delegated authority.

All three can be relevant for different reasons.

This is why the merchant's first question should be:

Which role is the provider asking us to establish for this person?

Without that information, “KYC documents” becomes an ambiguous bucket.

What evidence can support identity verification?

The exact evidence depends on jurisdiction and provider requirements.

Possible inputs can broadly fall into three categories.

Self-declared information

Information supplied by the person or merchant, such as:

full legal name;

date of birth;

nationality;

address;

role.

Declaration tells the provider what is being claimed.

It does not necessarily verify the claim.

Documentary evidence

Identity documents or other evidence can support the claimed information.

Do not generalize from that into:

“Every PSP accepts these three identity documents.”

Independent evidence

Where applicable, the provider may compare information against sources outside the merchant's submission.

FATF's terminology explicitly centers reliable, independent source documents, data or information in identification data.

Document collection versus verification

Consider two onboarding records.

Record A

Passport received: Yes

Record B

Person: A

Role: Authorized representative

Identity information: supplied

Evidence: assessed

Application information: consistent

Authority: established through applicable process

Mismatch: none outstanding

Verification status: complete

Record B tells an operator much more.

The difference is not the number of documents.

It is the number of unresolved facts.

That is why mature compliance operations should think in terms of verification states, not document piles.

The KYC Verification Map

A useful way to organize merchant-side KYC is to create one verification record for every relevant person.

Step

Merchant question

Example output

Role

Who is this person in relation to the merchant?

Director

Reason

Why does that role require verification in this case?

Applicable onboarding requirement/provider policy

Identity information

What facts need to be established?

Name, DOB, etc., as applicable

Evidence

What supports those facts?

Appropriate identity evidence

Independent source

Can/should information be corroborated elsewhere?

Relevant independent source where available

Mismatch

What conflicts or remains uncertain?

Name transliteration difference

Resolution

What explanation/evidence resolves it?

Additional corroboration

Outcome

Is this person's required verification complete?

Verified / further review required

The framework comes directly from the editorial brief's required asset.

The operational advantage is simple:

Instead of saying:

“The merchant's KYC is incomplete.”

the onboarding team can say:

“The authorized representative's identity is established, but the relationship/authority question is still unresolved.”

That creates a much more actionable request.

A verification map for three people

Consider a hypothetical merchant.

Merchant: Northstar Commerce Ltd.

Three people appear during onboarding.

Person

Role

Identity question

Separate relationship question

Person A

Beneficial owner

Is A who the application says?

Does ownership/control analysis establish A as relevant?

Person B

Director

Is B who the registry/application says?

Does B hold the claimed directorship?

Person C

Authorized applicant

Is C who they claim?

Is C authorized to act for Northstar Commerce Ltd.?

The point is not that all three necessarily require identical checks.

It is that three individuals can generate three different verification relationships.

One passport-upload request should never be treated as a generic substitute for mapping those relationships.

What happens when identity information does not match?

A mismatch is not automatically evidence of fraud.

Suppose:

Application: María José Hernández

Independent source: Maria Jose Hernandez

That could reflect transliteration or formatting.

Or:

Application address: New address

Identity-related records: Previous address

The person may recently have moved.

Or the discrepancy may require further evidence.

The correct compliance response is not:

mismatch = fraud

and not:

mismatch = ignore it.

It is:

detect → understand → corroborate → resolve or escalate.

The brief specifically requires legitimate mismatches to be treated as investigation prompts rather than automatic adverse conclusions.

Common KYC delays are often relationship problems disguised as document problems

The wrong person's evidence was supplied

The request concerns the beneficial owner.

The merchant uploads the applicant employee's ID.

The document may be perfectly valid.

It answers the wrong question.

The person's role is unclear

The merchant provides identity evidence but never explains whether the individual is:

owner;

director;

representative;

controller.

The identity may be clear while the relevance remains unclear.

Identity and company information do not reconcile

The person's name appears differently across:

application;

corporate filing;

identity evidence;

authorization record.

The issue needs resolution rather than another arbitrary document.

An ownership layer has not yet been resolved

The merchant believes Person A should undergo KYC.

But the provider cannot yet establish whether Person A is actually the relevant natural person because an intermediate company remains unresolved.

In that case the bottleneck is not really KYC.

It is ownership mapping.

The appropriate next resource is Beneficial Ownership Verification or Corporate Structure Verification, not another passport upload.

Evidence cannot support the claimed information

The submission may be:

unreadable;

incomplete;

outdated for the applicable provider requirement;

inconsistent;

otherwise unsuitable for the specific check.

The important qualifier is applicable provider requirement.

There is no globally safe rule such as:

“Identity documents must always have X months remaining.”

Specific acceptance criteria need current provider/jurisdiction verification.

Who actually controls a KYC delay?

This question matters because “compliance is delaying us” is often too vague to manage.

A delay might currently sit with:

Merchant

Required person's information is missing.

Provider

The evidence has been supplied but has not yet been reviewed.

Merchant and provider

A request was ambiguous, so the merchant sent evidence that did not resolve the question.

External source

Independent verification or registry information is unavailable or inconsistent.

Earlier KYB/ownership stage

The provider cannot yet identify the natural person whose KYC must occur.

The operational question should be:

Which unresolved person/fact is on the critical path to payment activation?

That is more useful than measuring how many documents are “in the KYC folder.”

KYC completion rate can be useful—but define the denominator

For operational teams, several metrics may help.

KYC completion rate

Possible form:

relevant people completing required KYC

÷ relevant people requiring KYC

Define what counts as complete.

Do not mix:

evidence submitted;

identity verified;

exception approved.

Document resubmission rate

Possible form:

KYC subjects requiring at least one evidence resubmission

÷ KYC subjects submitting documentary evidence

A high rate may identify:

unclear requests;

poor evidence quality;

confusing UX;

merchant misunderstanding.

It does not automatically identify merchant error.

Identity mismatch rate

Possible form:

subjects with a defined material identity discrepancy

÷ subjects undergoing the applicable identity comparison

Define “material discrepancy.”

Otherwise the metric can become meaningless.

Time to verify relevant person

Measure from a defined starting event to a defined verification outcome.

Separate:

merchant response time;

provider review time;

external waiting time;

where data permits.

Do not publish an industry benchmark without comparable definitions.

Manual-review rate

Possible form:

subjects requiring human exception review

÷ subjects entering the applicable KYC process

The objective should not necessarily be zero.

FATF's current standards emphasize proportionality and the risk-based approach, including changes made in 2025 to encourage appropriately simplified measures in lower-risk contexts.

A more useful operational objective is:

automate routine verification where appropriately reliable, and focus human judgment on real exceptions.

KYC can include screening context without becoming a sanctions article

Individual identity can matter to other compliance questions.

For example, once the provider establishes who a person is, that identity can potentially be relevant to separate checks involving politically exposed persons or applicable sanctions regimes.

These are not reasons to turn this article into a screening manual.

FATF defines PEPs around individuals entrusted with specified prominent public functions, and its guidance connects effective PEP controls with effective customer due diligence.

The key sequence is:

First establish whose identity is relevant.

Then apply whatever additional checks are required under the applicable framework.

Do not casually label an individual “high risk” merely because they occupy a role.

KYC requirements vary because the underlying obligations vary

Two providers may ask the same merchant for different information.

That does not necessarily mean one is “doing KYC correctly” and the other is not.

Requirements may differ because of:

jurisdiction;

regulated entity involved;

acquiring or banking relationship;

payment methods;

merchant structure;

applicable risk assessment;

provider policy.

FATF itself states that its Recommendations are international standards that countries adapt to differing legal, administrative and financial systems. The current Recommendations were most recently amended in June 2026.

Therefore, avoid global statements such as:

“Every director needs KYC.”

“Every beneficial owner is anyone above 25%.”

“Every provider requires a passport.”

Those claims erase the exact jurisdiction and policy differences merchants need to understand.

Law and provider policy are not interchangeable

A provider may request identity information because of:

applicable legislation;

regulation;

regulatory guidance;

bank or acquirer requirements;

network or payment-method requirements;

provider policy;

risk-based additional diligence.

Without evidence, an article should not convert:

“Provider X asks for this”

into:

“the law requires this everywhere.”

More documents do not automatically mean better KYC

Compliance quality should not be measured by the size of the upload folder.

Collecting unnecessary personal information can increase:

merchant friction;

security exposure;

privacy obligations;

review workload.

The better question is:

Which information is justified by the verification objective and applicable requirement?

If Person A's identity is already established through an accepted process, collecting unrelated documentation merely because it is available may add no useful confidence.

Data minimization should be considered alongside compliance obligations, not against them.

Sensitive identity evidence should be handled as sensitive data

KYC can involve:

government identification;

residential information;

birth data;

financial information;

ownership information.

Merchants should use the provider's designated secure collection method rather than casually sending sensitive documents through uncontrolled channels.

Exact retention, access, transfer and privacy requirements remain jurisdiction- and provider-specific.

KYC is not necessarily finished forever after launch

A natural person's verification can become relevant again if the merchant relationship changes.

For example:

a new beneficial owner is identified;

a new representative is appointed;

a relevant director changes;

previously verified information materially changes;

another applicable review is triggered.

The complete framework for this belongs in Ongoing Merchant Monitoring.

The foundational KYC lesson is that identity verification relates to a continuing merchant relationship, not merely a one-time upload page.

How merchants should respond to a KYC request

When a request arrives, do not begin by opening a folder called KYC Documents.

Start with four fields.

Person

Whose identity is being checked?

Role

Why is that person connected to the merchant?

Fact

What needs to be established?

Identity?

Relationship?

Authority?

Another specific requirement?

Outstanding evidence or discrepancy

What exactly prevents the verification outcome from being completed?

That turns:

“Please send more KYC.”

into something operationally useful:

“We need to verify the identity of the representative who submitted the application and separately resolve their authority to act for Merchant Ltd.”

or:

“Ownership analysis identified Person B as a relevant beneficial owner; Person B's identity verification remains outstanding.”

Those are solvable tasks.

“More KYC” is not.

The final merchant takeaway

KYC is easiest to understand when merchants stop thinking about the document and start thinking about the person.

A government ID is not KYC by itself.

It is evidence.

The verification process asks:

Who is this person?

Then, where relevant:

Why is this person connected to the merchant?

And sometimes:

Are they authorized to act for it?

The merchant can reduce preventable onboarding friction by making those relationships explicit before repeatedly sending documents:

person

→ role

→ reason for verification

→ identity information

→ supporting evidence

→ independent corroboration where appropriate

→ mismatch resolution

→ verification outcome

When a KYC request stalls a launch, the most useful question is therefore not:

“Which document do you still need?”

It is:

“Which person's identity or merchant relationship remains unverified, and what specific fact must be established to complete that check?”

That is the difference between treating KYC as document collection and managing it as identity verification.

This article provides general information and does not constitute legal, regulatory, compliance, tax, accounting, or financial advice. KYC and KYB requirements vary by jurisdiction, regulated activity, provider, financial institution, merchant structure, and risk profile. Merchants should verify current requirements with qualified advisers, relevant authorities, and their payment providers or acquirers.

🙂 🙂 🙂 🙂 🙂 🙂 🙂 🙂 🙂

C. ORIGINAL ARTICLE ASSET — NOT PART OF THE ARTICLE

KYC Verification Map

Recommended publication graphic/table:

Layer

Question

Merchant record

Person

Who is being verified?

Full identity reference

Role

Why are they connected to the merchant?

UBO / director / representative / individual merchant

Requirement

Why does this person require verification?

Applicable legal/provider/risk basis

Identity facts

What must be established?

Defined fields

Evidence

What supports those facts?

Accepted evidence

Independent check

What can corroborate them?

Reliable source where appropriate

Mismatch

What does not reconcile?

Specific discrepancy

Resolution

What will resolve it?

Evidence/explanation/action

Outcome

Is required verification complete?

Complete / review / unresolved

Operational status design

Do not use one status called:

KYC pending

Prefer:

Person identified

Evidence received

Identity verified

Relationship verified

Authority resolved, where relevant

Exception review

Complete

This preserves the brief's distinction between collection and verification.

A. BRIEF INTERPRETATION — NOT PART OF THE ARTICLE

Article-owned question: Which natural people connected to a merchant may need identity verification, and what fact is each check meant to establish?

Verification subject: A relevant natural person, potentially an individual merchant, beneficial owner, director, controller, or authorized representative depending on the applicable framework and provider requirements.

Verification objective: Establish that the person is who they claim to be and understand the relevant relationship between that individual and the merchant.

Key distinction: identity evidence is not the same as verified identity. Collection is one step; comparison, independent checking where appropriate, discrepancy resolution, and a verification outcome can follow.

Editorial position: Before gathering more “KYC documents,” the merchant should identify whose identity is being checked, why that person is relevant, and which fact remains unresolved.

Evidence anchor: A passport request is not merely document collection. It is evidence being used toward establishment of a natural person's identity and, separately where relevant, their connection or authority in relation to the merchant.

Final merchant decision: Who actually needs to be verified, and what specific fact must the evidence establish for each person?

FATF's current Recommendations, amended in June 2026, provide the international AML/CFT standard but explicitly recognize that countries implement it through different legal and operational frameworks. FATF's glossary also defines identification data around reliable, independent source documents, data or information. That supports a globally framed article without pretending one KYC procedure applies everywhere.

D. SEO PACKAGE — NOT PART OF THE ARTICLE

KYC Explained: What Merchants Need to Know About Verification

Alternative

What Is KYC? Individual Identity Verification for Merchants

KYC Explained: What Merchants Need to Know About Individual Identity Verification

Meta description

KYC explained for merchants: learn who may need identity verification during payment onboarding, what KYC actually establishes, how evidence is checked, and why KYC is different from KYB.

Suggested URL slug

/solve/compliance-slows-launches/kyc-kyb/kyc-explained/

KYC explained

Secondary keywords

what is KYC

know your customer

KYC requirements

KYC verification

merchant KYC

payment KYC

customer identity verification

KYC process

Useful semantic additions:

individual identity verification

KYC merchant onboarding

natural person verification

KYC documents

KYC vs identity verification

beneficial owner KYC

director KYC

merchant representative verification

KYC verification process

Related entities

Article excerpt

KYC during merchant onboarding is not simply a passport-upload exercise. It is the process of establishing the identity of a relevant natural person—and understanding why that individual matters to the merchant relationship. This guide explains who may need verification, what evidence does and does not prove, and where preventable KYC delays arise.

Final cluster differentiation check

Field

KYC Explained

Verification subject

Natural person

Primary question

Who is this person and why are they relevant to the merchant?

Evidence anchor

Passport/document is evidence, not verification itself

Assumption challenged

“KYC is submitting a government ID”

Article format

Individual verification map

Primary distinction

Identity vs relationship/authority

KYC/KYB boundary

Person vs legal entity

UBO boundary

No universal threshold or identification methodology

Director boundary

Director status does not imply ownership

Primary operational failure

Merchant responds to unclear KYC request with more unrelated documents

Original asset

KYC Verification Map

Merchant action

Identify person → role → unresolved fact → evidence → resolution

Conclusion

Manage KYC as verification of specific people and facts, not a document-upload queue

The article's distinct intellectual center is therefore: before asking which KYC document to provide, identify the natural person being verified and the exact identity, relationship, or authority fact the provider still needs to establish.

Need help narrowing down payment options?

Answer a few questions about your business and compare the capabilities that matter to you.

Explore matching options ↗