KYC vs KYB vs CDD: What MSBs Need to Know Before Approaching a Banking Partner

KYC, KYB and CDD Are Related — But They Are Not the Same Thing

A Canadian MSB approaching a bank or other financial institution will often hear "KYC," "KYB" and "CDD" used as though they are three separate boxes to check. In practice, the terms overlap, industry usage varies from one institution to the next, and all three concepts can appear within the same onboarding or periodic review.

A useful, plain-English way to think about the three terms:

• KYC asks: Who are the relevant people?
• KYB asks: What is this business, and who owns or controls it?
• CDD asks: What risk does the overall customer relationship present, and do we understand it well enough to proceed?

This is a teaching framework to make the concepts easier to work with — not a formal statutory definition. FINTRAC's own guidance does not divide compliance obligations into three legal categories called KYC, KYB and CDD; it uses specific concepts such as verifying the identity of a person, verifying the identity of an entity, beneficial ownership, business relationships, and risk assessment. Understanding how the industry shorthand maps onto those concepts is what actually helps an MSB prepare.

What Is KYC?

"Know Your Customer" (KYC) is industry shorthand for identifying and verifying the individuals connected to a business relationship. In the context of an MSB approaching a bank, this can involve identifying and verifying people such as directors, beneficial owners, authorized representatives, or other control persons — though not every individual is necessarily verified in every circumstance, and the specific requirements depend on the relationship and the institution's own process.

The exact methods used to verify a person's identity, and when verification is triggered, are governed by specific FINTRAC rules rather than by "KYC" as a defined legal term. For the detailed methods, triggers and recordkeeping requirements, see FINTRAC identity verification requirements.

What Is KYB?

"Know Your Business" (KYB) is widely used industry shorthand for understanding and verifying the business or entity itself, rather than an individual person. In banking, KYB verification can involve confirming:

• Legal existence and registration
• Business name and address details
• Directors, where relevant
• Ownership and control structure
• Business activities and services offered
• Registration or licensing status, where relevant (for example, FINTRAC registration for an MSB)

It's worth being precise here: FINTRAC's official guidance does not use "KYB" as a defined statutory term. Its formal language refers to verifying the identity of an entity, along with related obligations around beneficial ownership and business relationships. "KYB" is a useful, widely understood industry label for that work — not a separate legal regime layered on top of it.

What Is Customer Due Diligence (CDD)?

Customer due diligence (CDD) is the broader concept. It draws on the information gathered through KYC- and KYB-type steps, then goes further to build an overall picture of the relationship: why it's being opened, what the business actually does, who ultimately owns or controls it, what activity is expected, what geographic or corridor exposure exists, and what risk factors are present. That broader picture is what determines whether standard due diligence is sufficient or whether enhanced review is warranted, and how the relationship should be monitored going forward.

CDD is not simply a third method of checking identity — it's the process of interpreting identity and entity information alongside everything else a financial institution needs to understand about the customer relationship. For the detailed components of a bank's CDD review of an MSB, see what a bank's CDD review of an MSB involves.

KYC vs KYB vs CDD: The Difference at a Glance

This table is a conceptual explanation to aid understanding. Actual legal obligations and institutional workflows vary.

How KYC, KYB and CDD Fit Together When a Bank Reviews an MSB

A simplified way to see how the pieces connect:

Person information → Business information → Ownership/control → Purpose and expected activity → Risk assessment → Follow-up where needed

In reality, this isn't always a strict, linear sequence. A financial institution may collect person-level and business-level information in parallel rather than working through it as separate stages. What stays consistent is the relationship between the parts: KYC and KYB-type steps supply inputs — who the people are, what the business is — and CDD is the broader process of using those inputs, alongside other information, to understand and assess the relationship as a whole.

Why an MSB Can Pass Identity Checks and Still Face More Questions

Verifying the identity of the relevant people and confirming the entity's legal existence answers only part of what a financial institution needs to know. Passing identity and entity verification does not, by itself, resolve questions a bank may still have about:

• The business model and how it actually generates revenue
• Expected transaction flows and volumes
• Geographic or corridor exposure
• Ownership complexity, such as layered or foreign structures
• The types of customers the MSB expects to serve
• Product or service risk
• The strength of the MSB's own AML controls

An MSB shouldn't treat completed identity or entity verification as a guarantee of anything further in the review — it's an input into a broader risk assessment, not the endpoint of one.

What Should an MSB Have Ready Before Approaching a Banking Partner?

This is practical preparation relevant to the KYC/KYB/CDD distinction specifically — not a full banking-readiness checklist.

• Current corporate records
• A clear, consistent ownership and control structure
• Accurate FINTRAC registration information, where applicable
• Identity information for the relevant individuals connected to the business
• A clear description of your services and business model
• An expected customer and transaction profile
• Key geographic or corridor exposure
• Current AML and risk-assessment documentation

For the wider process of finding and applying for banking, see banking for a Canadian MSB or PSP.

Common KYC, KYB and CDD Misunderstandings for MSBs

"If my company is registered with FINTRAC, KYB is already complete."FINTRAC registration confirms your MSB has met a regulatory registration requirement. It is a separate process from a financial institution's own review of your business as its customer, which the institution conducts under its own risk framework.

"KYC and KYB are the same thing."They're closely related but focus on different subjects — people versus the business itself — and institutions vary in how strictly they separate the two.

"CDD just means checking ID."Identity and entity verification are inputs into CDD, not a substitute for the broader relationship and risk assessment it involves.

"If the beneficial owners are verified, the bank has everything it needs."Verified ownership answers one part of the picture. A financial institution may still need information about business activity, expected transactions, and risk exposure before it has what it needs to assess the relationship.

"A completed review at one bank means another bank will reach the same conclusion."Each institution applies its own risk framework and operating model, so a favourable outcome with one financial institution doesn't determine the outcome with another.

The Bottom Line

KYC, KYB and CDD are best understood as related layers of understanding rather than interchangeable labels or a fixed statutory sequence. A bank reviewing an MSB needs a clear picture of the relevant people, the business itself, and the broader risk and purpose of the relationship — and the practical goal for the MSB is consistency across all three. Where the gaps are more structural than a single missing document, it may be worth reviewing your AML compliance program rather than addressing each request in isolation.

Frequently Asked Questions

Can a bank ask for additional information after KYC and KYB checks are complete?

Yes. Identity and entity verification answer only part of a financial institution's broader customer and risk assessment. Depending on the relationship, business model, risk factors and the institution's own process, further information may still be requested even after individuals and the entity have been verified.

Can KYC, KYB and CDD happen at the same time during onboarding?

They can. These are useful conceptual distinctions rather than a mandatory sequence, and real onboarding workflows are not necessarily linear — person-level verification, entity verification and broader due diligence may be collected and assessed in parallel rather than as strictly separate stages.

Can a change in ownership mean an MSB needs to provide updated KYC or KYB information?

It can. A change in ownership, control, or other relevant entity or person information may trigger a requirement to provide updated information or verification, depending on applicable obligations and the specific financial institution's process for keeping customer information current.

Is KYC only for individual customers?

"KYC" is often used broadly in industry language to describe onboarding checks generally, but person-level identity verification and entity verification are governed by distinct requirements under FINTRAC guidance, with different methods and triggers for each.

Why does a bank ask about both my MSB and its owners?

Business/entity information and person-level ownership or control information serve different purposes — one establishes what the business is and does, the other establishes who stands behind it. A financial institution may need both to form a complete risk picture.

Sources referenced

• FINTRAC — Methods to verify the identity of persons and entities
• FINTRAC — guidance on beneficial ownership and business relationships under the PCMLTFA and associated regulations