Know-your-customer basics for B2B suppliers

Know your customer (KYC) and know your business (KYB) are terms from banking. They describe how financial institutions identify and verify the people and companies they serve. For a small B2B supplier, the same idea applies on a smaller scale: knowing enough about each buyer to show that they fit the customers you say you serve.

This page explains what KYC means for banks and payment providers, how that differs from what a supplier does, and how to keep records in proportion to your business.

What KYC means for banks

In the US, FinCEN's Customer Due Diligence (CDD) Rule applies to what it calls covered financial institutions: banks, mutual funds, brokers or dealers in securities, futures commission merchants, and introducing brokers in commodities. FinCEN says these institutions must maintain written policies and procedures designed to:

• identify and verify the identity of customers
• identify and verify the beneficial owners of legal entity customers, which FinCEN describes as any individual who owns 25 percent or more of the entity, and an individual who controls it
• understand the nature and purpose of customer relationships, so they can build customer risk profiles
• monitor on an ongoing basis to detect and report suspicious transactions, and keep customer information up to date on a risk basis

The CDD Rule is written for those institutions. It is a useful model of the questions a careful business asks about who it deals with, but it is not a description of what a supplier must do. Whether any specific rule applies to your business is a question for a qualified lawyer.

The KYC that applies to you as a merchant

The first KYC process most merchants meet is the one their payment provider runs on them. Stripe's support page on know-your-customer obligations says its regulators require it to collect and maintain information about account holders to prevent abuse of the financial system. The information typically covers the person who opens the account, the business, and anyone who ultimately owns or controls the business.

Stripe also asks account holders to promptly update their account with changes affecting them, their business activities, representatives, beneficial owners or principals, and says it may contact them from time to time to confirm the information is still accurate. In practice, that means describing what you sell, and who you sell to, accurately and keeping it current. What is know-your-business (KYB)? covers this side in more detail.

What KYC means for a small supplier

When a supplier talks about knowing its customers, it usually means something narrower than a bank program: checking that each buyer fits the business and research buyer profile it has set. The four ideas in the CDD Rule translate roughly like this:

• Identify. Who is the buyer, and which organization are they buying for?
• Verify, in proportion. Check the details that matter for your profile, such as the email domain, the organization's registration and the ship-to address. How to verify business and research buyers covers practical signals.
• Understand the purpose. Ask the buyer to confirm the products are for laboratory research, through a signed statement at checkout.
• Watch for change. A new ship-to address, a new organization name or a message about personal use is a reason to check again.

How a supplier's checks differ from a bank's

• A covered financial institution follows written procedures that federal rules require. A supplier sets its own buyer standard, ideally in writing.
• A bank identifies the beneficial owners of entity customers. A supplier is usually concerned with the organization and the buyer's role in it.
• A bank has reporting duties under the rules that apply to it. A supplier's main tool is holding or declining orders that do not fit its profile.

Screening international buyers

If you ship outside the US, export rules may be part of knowing your customer. The International Trade Administration's Consolidated Screening List combines restricted party lists from the Departments of Commerce, State and the Treasury, and the ITA advises that a potential match calls for additional due diligence before proceeding. Speak to a qualified lawyer about whether screening applies to your products and buyers.

Keeping records in proportion

Good buyer records are consistent, linked to the order, and limited to what you need. For each buyer, record:

• the details the buyer provided, and when
• what you checked and what you found
• the decision, the reason and who made it
• the research-use statement the buyer signed, and its version

A few principles help:

• One place. Keep buyer checks with the order they relate to, not in a mix of inboxes and spreadsheets.
• Limited access. Give access only to the people who need it, and log who changes what.
• No more than you need. Do not collect sensitive documents you have no use for.
• Retention is a decision. How long you keep records is a business and legal question. Ask a lawyer or accountant, then apply the answer consistently. See keeping compliance records: retention and access.

What this cannot do

Buyer checks show that you set a standard and applied it. They do not make you a bank, they do not replace your payment provider's own checks on your business, and they do not decide how any processor views your business. Claddr is compliance software, not a bank or payment processor. It checks buyer type, credentials and ship-to at checkout, records signed statements, and stores each step in a tamper-evident audit record, with owners, admins and compliance reviewers as separate roles and every admin action logged.