How to Verify a Business Identity: A KYB Compliance Guide for Banks and Fintechs in 2027

What Is Business Identity?

Business identity in a compliance context is not about brand colors or company logos. It is the verified set of legal, structural, and ownership facts that prove a company is what it claims to be. For a bank or fintech onboarding a corporate customer, verifying business identity means confirming that the company legally exists, that its directors and beneficial owners are who they say they are, that the business is not controlled by sanctioned persons or politically exposed individuals, and that its stated activities match what it actually does. This guide addresses that gap directly.

What Business Identity Means in a Compliance and KYB Framework

Know Your Business (KYB) is the formal compliance process by which financial institutions verify the identity and risk profile of corporate customers. FATF's guidance on Recommendation 10 extends customer due diligence obligations to legal persons, companies, partnerships, trusts, and other corporate structures, not just individuals. Verifying a business identity is the foundational step of KYB.

A verified business identity consists of five components that together create a complete, compliance-grade picture of who the business is and whether the bank can safely serve it.

The Financial Action Task Force is explicit that verifying legal existence alone is insufficient. A shell company can have a valid registration number. A front company can have registered directors. What separates genuine business identity verification from a box-ticking exercise is the depth of UBO identification and the consistency check between the business's stated identity and its actual activity.

Regulatory Framework for Business Identity Verification in Africa

1. Nigeria

In Nigeria, business identity verification for banks and fintechs is governed by the Money Laundering (Prevention and Prohibition) Act, 2022 (MLPPA 2022) and the CBN AML/CFT/CPF Compliance Framework. Banks must verify company registration with the Corporate Affairs Commission (CAC), confirm the company's Tax Identification Number (TIN), and identify all beneficial owners as defined under the Companies and Allied Matters Act (CAMA) 2020. The beneficial ownership threshold in Nigeria is 5% for certain regulated sectors and 25% for standard CDD purposes.

For companies classified as Designated Non-Financial Businesses and Professions (DNFBPs), including real estate agents and dealers in high-value goods, banks must also verify SCUML registration. An absent or expired SCUML certificate is itself a compliance red flag that should trigger enhanced due diligence.

2. South Africa

In South Africa, business identity verification is governed by the Financial Intelligence Centre Act (FICA) and the Companies Act, 2008. Accountable institutions must verify company registration with the Companies and Intellectual Property Commission (CIPC), identify beneficial owners through the CIPC beneficial ownership register (live since 2023), and screen all directors and UBOs against PEP and sanctions lists. South Africa's 2023 FATF grey listing and subsequent exit in February 2025 have intensified supervisory scrutiny of corporate onboarding standards across all regulated institutions.

3. Ghana

In Ghana, the Anti-Money Laundering Act, 2020 (Act 1044) and the Bank of Ghana's AML/CFT/CPF Guidelines require banks to verify company registration with the Registrar General's Department (RGD) and cross-reference the RGD's beneficial ownership registry. The UBO threshold under Ghana's Companies Act, 2019 (Act 992) is 25% of shares or voting rights.

4. Kenya

In Kenya, business identity verification runs through the Business Registration Service (BRS) and the eCitizen platform. The Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and the Central Bank of Kenya's AML guidelines require banks and fintechs to identify beneficial owners and conduct PEP screening for all corporate customers. Kenya's advanced digital financial infrastructure, home to mobile money at scale, makes automated business verification both more achievable and more necessary than in markets with less digitized registries.

INTERESTING READ: What Is the Difference Between TIN and Tax ID?

How to Verify a Business Identity: The Step-by-Step KYB Process

Business identity verification, also called KYB (Know Your Business), requires confirming five things: that the company legally exists, who owns it, who the ultimate beneficial owners are at the natural person level, who is authorized to operate it, and whether its stated activities are consistent with its actual profile. Each step requires separate documentary evidence and cross-referencing against independent sources.

Step 1: Confirm Legal Existence and Current Status

The first step is verifying that the company is registered, currently active, and in good standing with the relevant national registry. This means pulling a current company extract, not accepting a copy of a registration certificate that may be years old. Company registries in Nigeria (CAC), South Africa (CIPC), Ghana (RGD), and Kenya (BRS) all provide searchable online databases. Banks must confirm the current registration status, registered business address, date of incorporation, and registered business activity codes.

A company that is dissolved, suspended, or struck off the register but whose principals are still seeking banking services is a direct red flag. Banks must confirm current active status, not just historical registration.

Step 2: Map the Ownership Structure

After confirming legal existence, the bank must obtain and verify the complete ownership structure of the company. This means identifying every shareholder, their ownership percentage, and the nature of their interest, whether direct or through intermediate holding entities. Where a shareholder is itself a company, the mapping must continue up the chain until natural persons are reached. FATF Recommendation 24 is explicit: beneficial ownership transparency requires reaching the natural persons at the apex of the ownership structure, regardless of how many layers of corporate entities sit between them and the registered company.

The complexity of this step is where most manual KYB processes break down. A Nigerian holding company with four shareholders, two of which are themselves Mauritius-registered holding entities, requires ownership mapping through potentially six or seven separate entities before the natural persons at the top are identified. Automated UBO mapping tools reduce this from days to minutes.

Step 3: Identify and Verify Ultimate Beneficial Owners (UBOs)

The UBO identification threshold across African markets is generally 25% of ownership or voting rights, consistent with FATF Recommendation 24. Once UBOs are identified, they must be verified as individuals, their identity documents checked, their faces matched through biometric verification where non-face-to-face onboarding applies, and their details checked against the bank's liveness detection system to prevent synthetic identity fraud.

Where no individual meets the 25% ownership threshold, which occurs in companies with broad, distributed shareholding, the bank must identify the senior managing official who exercises effective control as the deemed UBO. Leaving this field blank or substituting the company secretary is not acceptable under any African AML framework currently in force.

Step 4: Screen Directors, UBOs, and Associates Against PEP and Sanctions Lists

Every identified director, authorized signatory, and UBO must be screened against global and domestic watchlists before onboarding is completed. Minimum screening coverage should include the OFAC Specially Designated Nationals (SDN) list, UN Security Council consolidated sanctions list, the EU consolidated sanctions list, domestic PEP registers (EFCC in Nigeria, FIC in South Africa), and adverse media from local and regional news sources.

For Nigerian corporate customers, this means screening against the EFCC's designated persons list and confirming that none of the company's principals appear in ongoing EFCC or ICPC investigations. For South African customers, screening must cover the SAPS Asset Forfeiture Unit's watchlist and any FSCA enforcement actions. PEP-linked companies require enhanced due diligence, senior management approval, and enhanced ongoing monitoring as a matter of regulatory requirement, not discretion.

Step 5: Verify Business Activity and Assess Risk

The final step in business identity verification is confirming that the company's declared activity is consistent with its actual profile. A company registered as a trading business whose account immediately receives large international wire transfers from unrelated jurisdictions is presenting a profile inconsistency that demands explanation. Banks must assess the nature and purpose of the intended business relationship, expected transaction volumes and types, the geographic footprint of the business, and any sector-specific licensing requirements.

Sector-specific checks are particularly important in Africa. A company operating in real estate in Nigeria needs a current SCUML certificate. A company engaged in financial services needs a CBN or SEC Nigeria license. A mining company in Ghana needs a license from the Minerals Commission of Ghana. An unlicensed operator in a regulated sector is both a compliance risk and a red flag for potential misuse of the banking relationship.

A Real-World Scenario: When Business Identity Verification Fails

A fintech platform in Lagos onboards a logistics company using a valid CAC registration certificate and a director's ID card. The company's stated purpose is domestic cargo transportation. Within three months, the account begins receiving high-value international wire transfers from entities in Dubai and Hong Kong, then immediately dispersing funds to multiple personal accounts across five Nigerian states.

A post-incident review reveals that the company's registered directors are nominees, individuals paid to hold directorships on behalf of undisclosed principals. The actual beneficial owners are individuals who appear on the EFCC's watchlist for connection to a procurement fraud investigation. The SCUML registration that should have been required for the company's financial services-adjacent activities was never obtained and never checked.

The fintech's business identity verification process failed at steps three and five. The CAC extract confirmed legal existence. The director's ID confirmed one layer of the structure. But the beneficial ownership mapping was never completed, the PEP and watchlist screening covered only the registered director and not the actual controllers, and the business activity assessment never questioned the mismatch between a domestic logistics company and international wire receipts. Youverify's KYB Verification Platform automates all five steps in a single workflow, including automated UBO mapping, SCUML verification, and multi-list PEP screening to prevent exactly this type of onboarding failure.

READ ALSO: 300+ Crypto Firms Licensed in South Africa: What They Did to Pass FSCA Compliance

Documents Required for Business Identity Verification by Market

The specific documents required for business identity verification vary by jurisdiction. The table below sets out the standard document set for the four largest African compliance markets. Note that these are minimum requirements; high-risk sectors and EDD cases require additional documentation.

Business Identity Verification Red Flags Compliance Officers Must Know

Not every problem in business identity verification is immediately obvious. Some of the most serious compliance risks emerge from patterns and inconsistencies rather than outright document fraud. The following are the most common red flags encountered during corporate onboarding in African markets.

1. Nominee directors with no verifiable professional history: Directors who appear across multiple unrelated companies as registered signatories, whose LinkedIn or professional background does not match their claimed role, or who cannot explain the company's business activities when contacted.
 

2. Circular ownership structures: Company A owns Company B, which owns Company A, or structures that loop back on themselves without arriving at a natural person. These are deliberate obfuscation techniques and require mandatory escalation to the compliance team.
 

3. Missing or expired sector licenses: A company operating in a regulated sector (financial services, real estate, gaming, or healthcare) without a valid current license from the relevant regulator is either operating illegally or misrepresenting its activities. Either scenario requires investigation before onboarding.
 

4. Inconsistent company age and claimed financial profile: A company incorporated 60 days ago that presents audited accounts showing ₦500 million in revenue over the past three years. The timeline is impossible. This type of inconsistency in the business identity package signals document fabrication.
 

5. Offshore holding entities with no apparent business rationale: Shareholders or UBO-layer entities incorporated in Mauritius, Seychelles, the BVI, or the Cayman Islands, where the underlying business is entirely domestic. Offshore ownership of a domestic Nigerian SME is not inherently suspicious, but it requires explanation and EDD.
 

6. Reluctance to provide UBO documentation: Any business customer that delays, deflects, or provides repeated changes to the ownership structure declared during onboarding is presenting a significant red flag. Under MLPPA 2022 in Nigeria and FICA in South Africa, the bank has the right and obligation to decline the relationship if satisfactory UBO documentation is not provided.

Why Manual Business Identity Verification Is No Longer Sufficient

A 2026 survey of compliance professionals found that 44% of regulated institutions still run fully manual KYB processes. The consequences of this are well-documented: slow onboarding timelines, inconsistent decision quality across markets, and an inability to keep pace with changing sanctions designations and registry updates.

For African banks and fintechs operating across multiple markets, manual business identity verification is operationally unsustainable. A compliance team conducting manual CAC searches, CIPC extractions, RGD checks, and SCUML validations for every corporate onboarding case while simultaneously running PEP screening, adverse media checks, and UBO mapping cannot maintain the throughput required by a growing business without either sacrificing quality or scaling headcount indefinitely.

Automated KYB platforms address this by providing real-time registry integrations, automated UBO mapping through corporate ownership chains, and simultaneous multi-list screening in a single API call. Youverify's Customer Onboarding Solution delivers this for African markets: CAC, CIPC, RGD, and BRS integration; SCUML and PPRA validation; biometric UBO verification; and multi-list PEP and sanctions screening in a single workflow that produces a complete, audit-ready business identity verification record.

Conclusion: Building a Business Identity Verification Process That Works

Business identity verification is not a one-step document check. It is a structured, five-stage process  legal existence, ownership mapping, UBO identification and verification, PEP and sanctions screening, and business activity assessment  that together produce a compliance-grade picture of who a corporate customer really is. For banks and fintechs across Africa, this process must align with the specific regulatory requirements and company registries of each market they operate in.

The consequences of getting this wrong are not abstract. Regulatory fines, license actions, and reputational damage follow from inadequate business identity verification, and the level of supervisory scrutiny from the CBN, BoG, FIC South Africa, and CBK has never been higher. Manual processes cannot deliver the consistency and speed that modern corporate onboarding volumes require.

Automating business identity verification with native registry integrations, automated UBO mapping, and real-time multi-list screening is not a competitive advantage. It is the operational baseline that regulators now expect. Youverify's KYB Verification Platform delivers exactly this for African financial institutions, covering CAC, CIPC, RGD, and BRS integrations alongside SCUML and PPRA validation, biometric UBO verification, and an audit-ready compliance record for every onboarding decision.

Take the next step. Book a free demo of Youverify's KYB Solution to see how banks and fintechs across Africa are automating business identity verification from company registration checks to UBO mapping and PEP screening in a single platform.

About the Author

Victoria Okere is a writer at Youverify with expertise in AML/CFT regulatory frameworks and KYB compliance across Sub-Saharan Africa. She specializes in translating complex business verification requirements into actionable guidance for banks, fintechs, and compliance officers operating across West and Southern African markets.