KYB Review for Merchants: Before and After MID Approval

KYB is the check a bank or acquirer runs on the business itself: is the entity real, who owns and controls it, what does it sell, and what volume should be expected. It runs before the account opens and continues as monitoring once it does. Volume spikes, product changes, descriptor changes and ownership changes trigger a re-review. The file survives when every document, form and web page tells the same story and the signer answers when asked.

Know Your Business, or KYB, is the review a bank runs before opening a business account and an acquirer runs before issuing a merchant ID. Where KYC verifies a person, KYB verifies the business: that the entity exists and is in good standing, who owns and controls it, what it sells and whether it may sell it, whether any owner or signer appears on a sanctions or politically exposed persons list, and how much volume to expect. The review does not stop at approval. Monitoring keeps asking the same questions for as long as the account is open, and again whenever the file changes.

KYB and KYC are two different questions

KYC (Know Your Customer) asks whether a person is who they claim to be. KYB asks whether the business is real, lawful and coherent, and uses KYC as one input, applied to the owners and the authorized signer. The bank holds deposits, so it cares where money comes from, where it goes and whether the activity matches the stated business. The acquirer advances funds on card sales that can still be disputed, so it cares about products, refund policy, billing descriptor, ticket size and chargeback exposure. The KYC guide on this blog lists every touchpoint where identity documents are requested; the underwriting guide walks the acquirer's review step by step. Six checks appear in almost every KYB file.

The six checks inside a KYB review

Beneficial ownership: the question behind every form

Every institution in the chain asks who ultimately owns and controls the business. The bank asks under its customer due diligence obligations, at opening and at every refresh. The acquirer asks on the merchant application and checks the answer against the operating agreement, the bank letter and the identity documents. What fails files is rarely the answer itself. It is inconsistency: ownership described one way to the bank and another to the acquirer, an operating agreement naming people the application omits, a guarantor absent from the ownership section. Underwriters read these documents side by side; a mismatch is a reason to ask what else in the file is not what it seems.

On an IBOCore package, the IBO (Independent Business Operator) is the director and owner of record of the entity, the name on the EIN letter, the bank account and the merchant application, and the person the bank and the acquirer verify. Every IBO is a real, consenting US resident with a full KYC file, zero criminal record and a credit score of 650 or more, exclusive to one merchant and never used before. No identity documents are asked of the merchant: no KYC, no notary, no travel; merchants are reviewed on business proofs before they see the dashboard. How ownership and control are recorded for a given structure, including any federal reporting the entity owes, is a legal question IBOCore does not advise on; the legal framework guide on this blog covers it. The KYB rule is simpler: one answer, on every form, at every institution, for the life of the account.

Website and product review: the page the underwriter opens first

• Products and claims: every product fits the declared vertical and the MCC. Medical claims on health products, income promises on courses and anything on the prohibited list end the review.
• Terms, privacy and refund policy: visible before checkout and consistent with what the application says about refunds and delivery.
• Pricing and billing model: one-time prices, subscriptions, trials and continuity terms stated where the cardholder agrees to them. An undisclosed recurring charge is the shortest route to disputes.
• Descriptor, brand and contact details: the descriptor matches the brand on the site, the entity in the footer matches the application, and the customer service phone or email answers.

Sanctions, PEP screening and expected activity

Screening is automated and runs on every name and address in the file: owners, signers, the entity. The lists are OFAC's Specially Designated Nationals list, other sanctions programmes the institution follows, and commercial databases of politically exposed persons and adverse media. A true hit stops the file. A partial hit, common with frequent surnames, is cleared against the identity documents on file. A politically exposed person does not mean a decline; it means enhanced due diligence and a slower answer. Higher-risk addresses and customer geographies bring questions rather than automatic refusal.

Expected activity is the section merchants treat most casually and underwriters most seriously. The projected monthly volume, average and highest ticket, card-not-present share, refund rate and customer geography become the baseline of the account: the processing cap is set against it and the monitoring rules are tuned to it. A projection inflated to win a bigger cap is a promise the account is measured against from the first settlement.

After approval: monitoring, and what triggers a re-review

Once the merchant ID is live and settlements reach the bank account, the review moves from people to systems. The acquirer watches every batch against the baseline: volume, ticket distribution, refunds and credits, the chargeback and fraud ratios the card networks monitor, cardholder geography and the descriptor on each transaction. The bank watches the account: inbound settlements, outbound wires, counterparties, anything that does not fit a card-accepting business of the declared size. Both refresh the file periodically. Re-reviews are triggered by change and by contradiction.

• Volume spikes: processing well above the projection, or a sudden jump in daily volume, ticket size or transaction count. Unexplained growth looks like a different business running through your account.
• Product or vertical changes: new products, a new category, a move from one-time sales to subscriptions or trials. The MCC and the risk pricing were set for the business that was underwritten.
• Descriptor and brand changes: a new descriptor, DBA, domain or rebrand. Cardholders stop recognising the charge, disputes rise, and the acquirer traces them to the change.
• People and entity changes: a new owner, signer, address or settlement account restarts the KYB questions. An unannounced change is read as concealment.
• Ratio movements and external hits: chargeback, fraud or refund ratios approaching network thresholds, a new MATCH record, a sanctions or adverse media match, cardholder complaints.
• Unusual settlement behaviour: refunds without matching sales, many identical amounts, activity outside the declared geography, funds leaving to counterparties that do not fit the business.

A re-review is the original review with a shorter deadline: a document request, updated statements, a site check, a call with the authorized signer. A file that answers quickly and consistently usually returns to normal; one that answers late, or with contradictory documents, moves to reserves, a lower cap and eventually closure. Silence always fails.

Keeping the file consistent over time

1. Keep one master copy of the file: formation documents, EIN letter, identity documents, bank letter, operating agreement, the application as submitted, the projections, the descriptor and the site copy.
2. Announce changes before making them. New product line, price structure, billing model, descriptor or domain: tell the acquirer first, with the reason.
3. Keep the site and the application aligned; close the gap before monitoring finds it.
4. Keep the signer reachable and briefed, able to describe the business, products, volumes and refund policy on a call, with identity documents renewed before they expire.
5. Use the bank account for the business only: settlements in, suppliers and operating costs out. Personal transfers and unrelated counterparties invite a bank-side review.
6. Grow through the file, not around it. Ask for a higher cap with statements in hand. A second brand or a different billing model is a different business to an underwriter; give it its own entity and MID.

That last rule is why IBOCore's conditions read the way they do. One IBO per merchant, never shared, and honest classification at purchase: a subscription or continuity business belongs on the Grey Hat plan, and a misclassified package is suspended, because an undisclosed billing model is what a re-review finds. The package delivers a file that is consistent by construction: an LLC or C-Corp incorporated in the director's home state, an EIN issued to that entity, a bank account opened in its name, and the director's government ID, proof of address, articles, operating agreement and EIN letter, all matching. The verticals IBOCore does not onboard (adult content and cam, online gambling, pharmacy and Rx, firearms and ammunition, crypto exchanges and custody, anything fraudulent) never reach a product review on an IBOCore package.

Questions merchants ask

Does KYB start over when I move to a new acquirer?

Yes. Each acquirer runs its own KYB and each bank its own due diligence; neither inherits the other's file. The new institution asks the same six questions, queries MATCH on the entity and every principal, and compares the new application with your previous processing statements. A terminated last account has to be explained before anything else is read.

Do I have to tell the acquirer before I change my website?

Before any change that alters what was underwritten: products, category, pricing model, billing frequency, descriptor, brand or domain. A redesign or a new banner needs no notice. The test is whether a cardholder or a monitoring analyst would see a different business. If yes, send the change and the reason in writing first. An announced change is reviewed; a discovered one is acted on.

How long does a KYB review take?

It depends on the institution, the vertical and the completeness of the file. With an IBOCore package the entity, the director, the bank account and the documents are delivered the same day the payment confirms, and acquirer onboarding then typically takes 3 to 10 business days. That is the acquirer's timeline, not a promise of approval. A missing statement or a site that does not match the application is the usual reason it runs longer.

Compliance touchpoints that survive audit

Clean setups disclose beneficial ownership, file BOI, use genuine IDs, and keep the IBO informed of website and descriptor changes. Processors re-scan for prohibited products, undisclosed aggregation, and transaction laundering. Violations land on MATCH and kill future MID applications.

• AML / CDD: customer due diligence on the merchant entity.
• PEP screening: politically exposed persons get enhanced review.
• OFAC / SDN: sanctions lists checked on owners and signers.
• Website compliance: refund policy, terms, pricing visible before checkout.

Compliance shortcuts that trigger MATCH

Fake guarantors, borrowed SSNs, cloaked websites, and third-party processing through your MID are the fastest paths to MATCH listings. Recovery requires legal work and years of delay. Disclose, document, and keep the IBO in the loop.

FAQ: quick answers

How fast can I get an IBO package on IBOCore?

Available inventory ships the same day after payment. You receive Articles, EIN letter, registered agent details, bank onboarding pack and signer contact through your merchant dashboard. Processor onboarding typically follows over the next one to two weeks.

Where can I look up payment-processing jargon?

Use the Resources glossary on IBOCore (/resources) for 580+ definitions: MID, chargeback ratio, MATCH, rolling reserve, MCC, RDR, KYB and high-risk vertical vocabulary.