What is KYB? How to automate business verification with AI and web search

TL;DR:

• KYB (know your business) is how a company verifies a business customer, supplier or partner. It confirms the business is registered, finds the people who own and control it, and screens the business and those people against sanctions lists and negative news.
• Firecrawl Alexandria reaches the official sources with one API key. It covers Companies House, GLEIF, SEC EDGAR, the Delaware registry, the FCA register and the OFAC, UK and EU sanctions lists. Firecrawl /search finds adverse news, and Firecrawl /scrape reads the company's own legal pages.

KYB, short for know your business, is how a company verifies another business before it opens an account, signs a contract or pays an invoice. A KYB check confirms the business is registered and finds the people who own or control it. It then screens the business and those people against sanctions lists and negative news.

The term comes from financial services, where banks and payment companies verify business customers as part of anti-money laundering programs. Marketplaces, B2B software companies and procurement teams use the same checks on sellers, customers and suppliers. The stakes are rising: in Experian's 2026 U.S. Identity and Fraud Report, published in August 2026, 60% of businesses said their fraud losses had increased.

A KYB file usually answers four questions:

1. Does the business exist? A registry record with a legal name, registration number, status and registered address.
2. Who is behind it? Beneficial owners, directors and anyone with significant control.
3. Is it restricted? Sanctions list results for the company and its owners, plus politically exposed person (PEP) screening for the individuals.
4. What is it doing? Its website, its licences, and what the news says about it.

KYB verifies an organization, and KYC (know your customer) verifies an individual. The two overlap, because a KYB check ends with KYC on the people it finds. Once the registry names the beneficial owners and directors, each of them gets an identity check of their own.

KYB checks come from anti-money laundering rules. The Financial Action Task Force (FATF) sets the global baseline, and each country writes its own law on top of it. The exact checks vary by industry and country. These are the main sources and what each one says, with the dates of the latest changes.

• FATF Recommendations. Recommendation 10 covers customer due diligence and Recommendation 24 covers transparency and beneficial ownership of legal persons. FATF last amended the Recommendations in June 2026.
• United States. FinCEN's customer due diligence rule, 31 CFR 1010.230, defines a legal entity customer's beneficial owners as each individual who owns 25 percent or more of the equity, plus a single individual with significant responsibility to control the company. A February 2026 FinCEN exceptive relief order narrowed when covered institutions must collect this information. In May 2026 FinCEN reissued its CDD FAQs to match. Separately, a final rule effective August 14, 2026 exempts reporting companies from reporting U.S. person beneficial owners to FinCEN under the Corporate Transparency Act.
• European Union. The Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027 and sets one rulebook for customer due diligence across member states. The EU's Anti-Money Laundering Authority (AMLA) consulted on draft guidelines under it in 2026.
• United Kingdom. Identity verification for directors and people with significant control (PSCs) of UK companies became a legal requirement at Companies House on 18 November 2025. Companies House last updated that guidance on 30 July 2026.

A KYB process usually runs six checks, from a registry lookup and beneficial ownership through sanctions screening, adverse media and website checks. Each one answers a different question and reads a different source, so a single case can touch ten websites.

Firms that run KYB also repeat these checks after onboarding. Ownership changes, sanctions lists update and news breaks, so a check that passed in January can fail in June. AMLA consulted on draft guidelines for ongoing monitoring of business relationships between June and September 2026.

Manual KYB takes long because every check lives on a different site with its own search form, field names and update schedule. An analyst searches a registry and copies the company number into the ownership page. Then they retype owner names into three sanctions portals, run a news search and save a screenshot of each step as evidence.

Three things make this slow:

• Every registry is different. Companies House, the Delaware Division of Corporations and a Missouri or Georgia business search each return different fields. The Delaware search, for example, returns names and file numbers, and the entity details take a second lookup.
• Lists change often. We screened on October 27, 2026. The OFAC SDN list showed an update on October 21, the EU consolidated list file was published on October 23 with 6,269 records, and the UK sanctions list was generated on October 26. A result saved last week can be out of date.
• Names are fuzzy. A sanctions hit on a name still needs review. OFAC's own guidance on assessing a name match asks screeners to compare the other identifying details before treating an alert as a match. The collection work is repetitive and rule-based, which makes it the part worth automating. The judgment on a possible match stays with an analyst.

Firecrawl Alexandria gives AI agents and scripts structured data from official sources through the same Firecrawl API key, MCP server and CLI they use for search and scraping. For KYB, that means registries, LEI records, filings and government sanctions lists come back as fields with a source URL, instead of HTML from a search form.

An agent finds a tool for free, reads its inputs and listed price in credits, then calls it. Providers are paid under agreement when agents pull their data, and teams pay with Firecrawl credits at each tool's posted price. The Companies House and OFAC, UK and EU sanctions tools are each listed at 5 credits a call.

These are the KYB jobs we ran through Firecrawl Alexandria on October 27, 2026:

The catalog also covers US federal contractor registrations on SAM.gov, state registries such as Georgia and Missouri, and beneficial ownership and company registers in Latvia and Slovakia.

KYB is one use. Firecrawl Alexandria groups its providers into categories, and each one supplies a different kind of data:

For the wider picture of provider data for AI agents, see Firecrawl Alexandria's launch post and our guide to AI data enrichment.

Firecrawl /search runs the open-web parts of a KYB check. With sources: ["news"] and a time filter, it returns recent news about a company for adverse media review. With a site: query, it finds the page where a company states its own legal name and registration number.

Three Firecrawl features fit the rest of the open-web work:

• Firecrawl /scrape reads a page into Markdown or structured JSON. Its highlights format returns the page's own sentences that match a query, verbatim, which makes a quotable piece of evidence for a case file.
• The Firecrawl Government Index searches US federal, state and local statutes, regulations and court opinions. A compliance team can pull the text of a rule, such as 31 CFR 1010.230, from the eCFR instead of a summary. Searches are free and work without an API key.
• Firecrawl /monitor reruns searches or page checks on a schedule and alerts by webhook, email or Slack when something changes. Its web-scale mode reruns web searches and alerts on results that appeared since the last check and match a goal, which suits ongoing adverse media checks.

For search settings by job, including due diligence, our post on the best search API by use case has a full table.

The same Firecrawl /search, Firecrawl /scrape and Firecrawl Alexandria calls run from nine official SDKs, the REST API and the Firecrawl CLI. They also run from an MCP server for AI assistants, agent frameworks and no-code tools.

Keyless mode lets you try Firecrawl /search and Firecrawl /scrape from the CLI or MCP server, and the Government Index from the CLI or API, with no API key. Firecrawl Alexandria provider calls run with a Firecrawl API key. Teams with procurement requirements can review the enterprise page and security documentation.

Keeping KYB current means rerunning the checks when a source changes rather than on a fixed annual date. Firecrawl /monitor reruns news searches and watches company pages on a schedule. The sanctions providers in Firecrawl Alexandria expose publication status and change feeds, so a pipeline can tell when a list was republished.

A practical setup looks like this:

1. Store the results. Save each check's result with its source and the time it was read, keyed by company number.
2. Watch the lists. Call the sanctions providers' source_status or publications capabilities daily, and rescreen your customer names when a list changes.
3. Watch the news. Create a web-scale Firecrawl /monitor with queries for each high-risk customer and a goal that describes adverse media.
4. Watch the company. Put the customer's legal and about pages on a page monitor, so a change of registered address or company name raises an alert.
5. Rerun the registry check when any of the above fires, and send the difference to an analyst.

The fastest way to try the open-web checks is keyless. Run npx firecrawl-cli@latest or connect the keyless MCP server at https://mcp.firecrawl.dev/v2/mcp, then search the news for a company or scrape its legal page. Keyless mode is capped per IP address per day. A free account adds 1,000 credits a month, which covers Firecrawl Alexandria registry and sanctions calls for a first set of companies.

For related reading, see our comparison of company enrichment APIs, the guide to data connectors for AI agents and the Firecrawl /search reference.