KYC and KYB explained: what a payments provider checks, why, and what happens to your documents

You have uploaded a trade licence, a passport, an ownership chart and a utility bill, and the account is still not open. Nobody will tell you which item is the problem. The reason is usually not the one applicants assume, and this article sets out what is being checked, by whom, and against what.

It is written for the person filling in the form, not for a compliance officer.

Key takeaways

Question	Short answer
What is KYC?	Verifying the identity of a person, including that the person exists, is who they claim to be, and is not on a sanctions or watch list.
What is KYB?	The same exercise applied to a company, plus establishing who ultimately owns and controls it.
Who requires it?	The law of the jurisdiction the provider is regulated in. For TrillioniPay that is Canada, under the PCMLTFA, supervised by FINTRAC.
Why does it feel more intrusive than opening a bank account locally?	Cross-border providers screen against several international sanctions regimes rather than one, and re-screen on a schedule.
What causes most delays?	Documents that do not reconcile with each other, and ownership structures that stop short of a named human being.
How long are the records kept?	At least five years under Canadian rules, and the provider has no discretion to delete them earlier.

What the rules require, and who requires them

Two words describe the same underlying obligation applied to two different subjects.

Know Your Customer (KYC) applies to a person. It establishes identity, and it establishes that the person is not subject to sanctions and is not a politically exposed person whose account requires additional scrutiny.

Know Your Business (KYB) applies to an entity. It establishes that the company legally exists, what it does, where it trades, and who ultimately owns and controls it. That last part is the hard one, and it is where most applications stall.

The international baseline comes from the Financial Action Task Force, whose Recommendation 10 sets out customer due diligence as a standard that member jurisdictions implement in their own law. That is why the requirements feel similar in Canada, the European Union and the Gulf while the details differ.

Trillioni Pay Inc. is registered with FINTRAC as a money services business in Canada, and Canadian law is what binds it. Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, a registered MSB must maintain a compliance programme with a designated compliance officer, written policies and procedures, a documented risk assessment, employee training and a review of the programme's effectiveness every two years. It must verify the identity of persons and entities for prescribed transactions, confirm beneficial ownership for entities, determine whether a client is a politically exposed person, monitor business relationships on an ongoing basis, and report suspicious transactions, large cash transactions and electronic funds transfers to FINTRAC. Records must generally be kept for at least five years (FINTRAC, checked September 2026).

None of that is discretionary, and no provider can waive it for a customer it likes.

What is being checked

Verification is four separate exercises that arrive as one form.

Existence. Does the company exist in the register it claims to be registered in, under the name and number given, and is it in good standing? This is checked against the register, not against the document you uploaded.

Identity. Is each named individual a real person, and is the document genuine? Modern checks combine document authentication with a liveness check, which is why you are asked to move your head on camera rather than upload a photograph.

Ownership and control. Who ultimately owns the company, traced through every holding entity until the chain reaches named human beings? TrillioniPay applies a 25% beneficial ownership threshold, in line with the standard used across Canadian and European regimes. Directors and anyone else with effective control are captured separately, because control and ownership are not always the same people.

Screening. Every individual and entity is checked against sanctions and watch lists. TrillioniPay screens against the United Nations consolidated list, Canada's Global Affairs sanctions listings, the OFAC Specially Designated Nationals list maintained by the United States Treasury, the European Union consolidated list and the United Kingdom's OFSI list. Screening happens at onboarding and then on a repeating schedule, weekly, monthly or quarterly depending on the risk rating assigned to the customer.

That last point is worth dwelling on. You are not screened once. Lists change, and a name added to a list after you opened your account will be picked up at the next screening cycle.

Where the checks are run

TrillioniPay runs identity and business verification through Sumsub, a specialist verification platform that provides KYC, KYB, transaction monitoring and AML screening to more than 2,000 companies across financial services, digital assets and regulated marketplaces.

Using a specialist platform for this has two consequences that favour the applicant.

The checks are performed against source registries and document databases rather than by eye, which means a valid document is usually cleared in minutes rather than sitting in a queue.

And the platform is independently audited. Sumsub holds a SOC 2 Type II attestation, first issued in November 2022 following an audit by BARR Advisory, P.A., and re-audited annually (Sumsub, checked September 2026). SOC 2 Type II is an attestation that controls over security and confidentiality operated effectively across an observation period, rather than existing on paper on a single day.

The decision on your application is TrillioniPay's. The verification technology is Sumsub's. Those are different things, and no provider should present a vendor's certification as its own. TrillioniPay's own security posture, and the certifications held by its platform provider, are set out in the security article.

What you will be asked for

The list varies by entity type and by market. This is the shape of it for a trading company in Egypt, Morocco, Algeria or the Gulf.

Category	Typical documents
The company	Certificate of incorporation or commercial registration, trade licence, tax card, articles of association, and any amendments to shareholding
Ownership	Shareholder register or equivalent, plus a structure chart tracing ownership through every intermediate entity to named individuals
Individuals	Passport or national ID for each beneficial owner at or above 25%, each director and each authorised signatory, plus proof of residential address
The business itself	A description of what the company trades, its main countries of supply and sale, its expected monthly volumes, and its main counterparties
Evidence of activity	Recent invoices, contracts, bills of lading or bank statements demonstrating the trade described
Source of funds	Where the money entering the account comes from, and how the business generates it

The last two are the ones applicants underestimate. A provider is required to understand the purpose and intended nature of the relationship, and a description like "general trading" satisfies nobody. Specific beats general every time: what you buy, from which countries, what you sell, to whom, and roughly what that is worth each month.

What causes a hold or a decline

In order of how often it happens.

Documents that do not reconcile. The registered name on the trade licence differs from the name on the bank statement. The shareholding on the chart does not match the shareholder register. A director resigned and the register was never updated. Each of these is a small administrative gap and each one stops the file.

An ownership chain that does not terminate. A structure that runs through a holding company in a second jurisdiction, then a nominee, then a trust, has to be traced to human beings. If the applicant cannot supply that, the provider cannot open the account, whatever the applicant's own standing.

A screening alert. Most alerts are false positives, caused by a common name or a transliteration of an Arabic name that resembles a listed one. A false positive is resolved with a date of birth, a nationality and an identity document, and it is not an accusation. It is a name collision, and it is why the additional identifiers are requested.

Activity outside what the provider can serve. Some activities and some jurisdictions are excluded by policy rather than by judgement of the applicant. TrillioniPay publishes the list, with reasoning, rather than declining without explanation. You can check yours before applying on the eligibility page.

A mismatch between the stated business and the evidence. A company describing itself as a machinery importer whose documents are all consultancy invoices will be asked about the difference. That is enhanced due diligence, not suspicion, and answering it plainly resolves it.

What you can do about it

Assemble the pack before you apply rather than in response to requests, and reconcile the documents against each other first. Names, numbers and dates should agree across every file, and where they do not, include the document that explains why.

Draw the ownership chart yourself, all the way to named individuals with their percentages, and include the entities that hold 0% but exercise control. A chart the applicant has drawn is faster to verify than one the provider has to reconstruct.

Describe the business in operational language rather than in categories. Ranges are fine, and are better than a precise figure you cannot evidence.

And if a screening alert comes back, treat it as a data question. Supply the identifiers that distinguish you from the listed party and the alert clears.

How TrillioniPay applies it

Onboarding runs in stages: application, identity and business verification, screening, compliance review, then account activation. Verification is remote. A designated compliance officer, reporting to the Board, owns the decision.

TrillioniPay applies enhanced due diligence to politically exposed persons and to customers connected with higher-risk jurisdictions, monitors transactions on an ongoing basis, files suspicious transaction reports to FINTRAC within the statutory period, retains records for five years, and commissions an independent review of the programme annually.

Two things TrillioniPay does that are less common are worth naming, because they change what the process feels like from the applicant's side. It publishes the markets and activities it cannot serve, so an applicant can find out before spending a week on documents. And it gives a reason when it declines, within the limits the law allows. Some reasons cannot be shared, and where that is the case TrillioniPay says so rather than implying a commercial decision.

TrillioniPay is a Canadian FINTRAC-registered money services business. It is not a bank. Account and payment infrastructure is provided through regulated financial partners.

Frequently asked questions

Why does a payments provider need more from me than my local bank did? Your local bank screens against one national regime. A cross-border provider screens against several, and has to satisfy the regulator of the jurisdiction it is registered in as well as the rules that apply to its partners.

Is a screening alert an accusation? No. The overwhelming majority are name collisions, and they are resolved with identifiers that distinguish you from the listed party.

What happens to my documents after the account opens? They are retained for at least five years under Canadian record-keeping rules, held under the provider's data protection obligations, and are not deleted on request during that period. That retention is a legal requirement rather than a policy choice.

Do I need to redo this every year? Not the whole process. You will be re-screened on a schedule set by your risk rating, and asked to refresh documents when they expire or when your ownership changes. Telling your provider about a change in shareholding before they find it is the difference between an update and a review.

I was declined elsewhere. Does that count against me? Not in itself, and TrillioniPay does not have access to another provider's decision. What matters is whether your structure, your activity and your markets fall inside published eligibility rules.

Who is Sumsub, and why are they involved? Sumsub is the verification platform TrillioniPay uses to run identity and business checks. They perform the verification. TrillioniPay makes the decision and remains responsible for it.

Sources

Financial Action Task Force, Recommendation 10 on customer due diligence. Checked September 2026.
FINTRAC, money services business obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act: registration, compliance programme, identity verification, beneficial ownership, reporting and five-year record retention. Checked September 2026.
Sumsub, SOC 2 Type II attestation, audited by BARR Advisory, P.A., November 2022, re-audited annually. Checked September 2026.
TrillioniPay AML/CFT Policy v1.0, August 2026: screening lists, 25% beneficial ownership threshold, risk-based re-screening cadence, enhanced due diligence triggers and onboarding stages.