Skip to main content
Iron supports two methods for onboarding business customers through KYB (Know Your Business) verification. Both follow the same onboarding lifecycle and collect the same underlying compliance data.

Hosted Link Flow

Create a Link identification and receive a URL. Your customer completes KYB verification in Iron’s hosted interface. Iron handles the entire collection, review, and approval process.

Programmatic Business API

Submit all KYB data directly via the API with a Business identification. You collect and provide company info, beneficiaries, documents, and the compliance questionnaire programmatically.
The simplest way to onboard a business customer. You create a Link identification and Iron returns a URL where your customer completes the full KYB process through Iron’s hosted interface. Iron is fully responsible for collecting all required information, performing verification, and deciding on approval.
1

Create a business customer

POST /api/customers
The customer is created in SigningsRequired status under X-API-Version: 2026-08-01 or later, and in IdentificationRequired on earlier versions. See Create a new customer.
2

Present and sign the terms and conditions

Ask the business for its country, fetch the matching terms via GET /api/terms-and-conditions?country={ISO3}, and record acceptance via POST /api/customers/{id}/signings before creating the identification. The terms contain the data sharing agreement, so they come before KYB data collection. See Terms and Conditions.
3

Create a Link identification

POST /api/customers/{id}/identifications/v2
The response includes a url field. Pass this URL to your customer to begin the hosted KYB flow.
4

Customer completes hosted KYB

The customer opens the link and completes the flow in Iron’s hosted interface, which collects company information, documents, beneficial ownership details, and the business questionnaire.Once the submission is complete, Iron reviews the data, performs verification, and decides on approval. Track progress via webhooks or by polling the identification status.
5

Handle signings and activation

Once KYB is approved, Iron validates the signed terms against the verified region. If re-signing or other documents are needed, the customer status is SigningsRequired: retrieve required signings, present them to the customer, and mark them as signed. See the onboarding lifecycle for details.

​
Programmatic Business API

For partners who collect KYB data within their own application, you can submit all business verification data directly via the API. This requires an outsourcing agreement with Iron. You collect the company information, beneficial ownership details, identity documents, and the compliance questionnaire, then submit everything in a single API call.
1

Create a business customer

POST /api/customers
2

Present and sign the terms and conditions

Ask the business for its country, fetch the matching terms via GET /api/terms-and-conditions?country={ISO3}, and record acceptance via POST /api/customers/{id}/signings before creating the identification. See Terms and Conditions.
3

Create a Business identification

POST /api/customers/{id}/identifications/v2Submit the full KYB payload with type: "Business". Company identity, beneficiaries, and documents are nested under company_data (company fields sit under company_data.company_info). The company phone and the submitting device’s ip_address are top-level, and questionnaire carries a type discriminator (Generic for all company types except sole proprietorships, SoleProp for sole proprietorships). The example below shows a complete submission with one beneficial owner:
Iron validates the submission synchronously. A complete submission is created as Processed and moves into verification. A submission missing required documents or proofs of address is created as Pending with a resume URL instead of being rejected. See Incomplete Submissions. Track progress via webhooks or by polling the identification status.
4

Handle signings and activation

Same as the hosted flow. Once KYB is approved, Iron validates the signed terms against the verified region. If re-signing or other documents are needed, the customer status is SigningsRequired: retrieve required signings, present them, and mark them as signed to activate the customer.

​
Incomplete Submissions

A Business submission does not need to be complete to be accepted. When required company documents or beneficiary proofs of address are missing, Iron creates the identification with status: "Pending" and returns a resume URL in the url field. Complete submissions are created as Processed directly.
A 201 response does not mean the submission was complete. Check status on the returned identification: Processed means Iron has everything it needs, Pending means items are missing and url carries the resume link.
Sandbox approves business submissions at creation regardless of completeness. The Pending resume flow occurs in production only.
Redirect the business to the url. It opens a hosted flow that collects only the missing items. When the flow finishes, the identification advances to Processed, an identification status webhook fires, and the standard flow continues: Processed → PendingReview → Approved / Declined. A submission is held at Pending when:
  • A required document group is missing for the company’s region. See Company Documents.
  • A required beneficiary proof of address is missing. See Required Information by Party Type.
  • A beneficiary of a US company (except sole proprietorships) provides an accepted identity document type other than Passport or DriverLicense.
These validations still reject the request with 400:
  • More than 4 company documents
  • A document that is not valid base64, exceeds 3 MB, or has an invalid country code
  • A document the verification provider cannot process, such as a corrupted file. The response includes the rejection detail. Fix the file before retrying. One exception: an error naming a blocked duplicate upload means the file is fine and a retry succeeds.
  • A share_percentage outside 0-100, or combined UltimateBeneficialOwner shares above 100 for any company in the structure
  • A missing tax_identification_number for a Director or UltimateBeneficialOwner person beneficiary of a non-US company, or for the proprietor of a sole proprietorship in any country. The error identifies the beneficiary by its zero-based index in the beneficiaries array.
  • A ResidencePermit identity document
  • Invalid attestation data: more than one attesting party, an attesting party without the Director role or nested below the root, a missing or future attested_at, or beneficial-ownership data the generated CDD certification cannot render. See Company Documents.
400 responses on this endpoint return the reason as a plain string:

​
Example Scenarios

The following examples show the company_data.beneficiaries array for common ownership structures. All other fields (company_data.company_info, company_data.documents, questionnaire) remain the same as the full example above. The person objects below are abbreviated: a real submission also carries identity, tax_identification_number, and proof_of_address per beneficiary, as in the full example.
A company with a majority shareholder/director and a minority UBO:
When a legal entity owns or controls the company, give it the Shareholder role and pass a business beneficiary_info: an object with a single company_data field. It carries the full data for that entity: its company_info, its own beneficiaries, and its own documents. The natural persons who are UBOs through the corporate chain appear inside the nested entity:
Each corporate owner carries its own company_data.documents and beneficiaries. The same document groups and beneficiary requirements apply at every level of the structure. The natural persons who ultimately own 25%+ through the chain must appear as UBOs.

​
Business API Field Reference

The request envelope has four top-level fields beyond type:
These fields live under company_data.company_info.
The company_data.beneficiaries array contains one or more CompanyBeneficiary objects representing UBOs, directors, representatives, or corporate shareholders. Each business level holds up to 5 beneficiaries and at most one business beneficiary, and businesses nest at most two levels below the root company. The Director role is only valid on person beneficiaries, and each nested business beneficiary must include at least one person with the Director role. Requests outside these bounds are rejected with 400.

​
CompanyBeneficiary

The beneficiary_info field takes one of two shapes: PersonBeneficiaryInfo for an individual, or BusinessBeneficiaryInfo for a corporate owner, which carries a nested company_data. Unlike questionnaire, this object has no type discriminator: Iron detects the variant from the fields you send.

​
PersonBeneficiaryInfo

Used when the beneficial owner is a natural person.

​
BeneficiaryIdentity

The identity object on a person beneficiary.

​
BusinessBeneficiaryInfo

Used when a beneficial owner is a legal entity (corporate shareholder). It carries a full company_data with the same shape as the top level, so the same information is collected at every level of the corporate structure.
Each corporate owner carries its own company_data.documents and beneficiaries. The same document groups and beneficiary requirements apply at every level of the structure. The natural persons who ultimately own 25%+ through the chain must appear as UBOs.

​
BirthPlace

​
Address

The company_data.documents array contains up to 4 CompanyDocParams objects. Each document is uploaded as a base64-encoded file. Documents are optional at submission: an incomplete set for the company’s region holds the identification at Pending with a resume URL. See Company Documents for the groups required per region.

​
CompanyDocParams

​
Upload requirements

  • Maximum file size: 3 MB per document (after base64 decoding)
  • Maximum 4 documents per company. The limit applies separately to the root company and to each nested business beneficiary. More than 4 is rejected with 400.
  • Encoding: standard base64 (no data:application/pdf;base64, prefix)
  • Supported formats: PDF, JPEG, PNG

​
Document types

The BusinessQuestionnaire object is a required compliance questionnaire structured into three sections. Each section collects specific regulatory information about the business. Set type to Generic for all company types except sole proprietorships, or SoleProp for sole proprietorships.

​
business_details

Industry classification and operational information about the company.industry_type values: Agriculture, Automotive, BankingAndFinancialServices, ConstructionAndRealEstate, CryptocurrencyAndBlockchain, CryptocurrencyMining, DecentralisedFinance, NftPlatforms, CryptoPaymentProcessors, CryptoWalletProviders, CryptoExchanges, CryptoCustodyServices, EcommerceAndOnlineMarketplaces, EducationAndTraining, EnergyAndUtilities, EntertainmentAndMedia, GamingAndEsports, HealthcareAndPharmaceuticals, HospitalityAndTourism, InformationTechnologyAndSoftware, Insurance, LegalAndProfessionalServices, LogisticsAndTransportation, ManufacturingAndIndustrial, MetaversePlatforms, MiningAndNaturalResources, NonProfitAndCharitable, RetailAndWholesaleTrade, Telecommunications, VentureCapitalAndPrivateEquity, CasinosAndGambling, MoneyServiceBusinesses, SocialMediaAndNetworking, CrowdfundingPlatforms, RegTech, Otherestimated_annual_revenue values:

​
planned_activities

Information about the company’s intended account use and expected transaction patterns.purpose_and_intended_use values: ReceivingBusinessIncome, BusinessPurchasesAndExpenses, EmployeeAndContractorPayouts, EcommerceSales, TreasuryManagement, PaymentIntermediary, Investments, TaxPlanning, AssetProtection, Otherestimated_monthly_volume values:estimated_monthly_transactions values:

​
source_of_funds

Information about where the company’s funds originate.source_of_funds values: BusinessRevenue, ShareholderFunds, VcPrivateEquity, AssetSale, IcoProceeds, CryptoActivityProceeds, LoanProceeds, Other

​
Standard KYB Requirements

​
Company Information

  • Country
  • Company name
  • Registration number
  • Company registration address
  • Company operations address
  • Type of entity
  • Date of registration
  • Website
  • Company email
  • Tax ID

​
Company Documents

Company documents fall into four groups. Which groups you need depends on where the root company is registered and its type. The same required set applies at every business level: the root company and each nested business beneficiary, even when a nested entity is registered in a different country. A submission missing a required group is created as Pending with a resume URL. It is not rejected. See Incomplete Submissions.
US companies (except sole proprietorships) can satisfy the Legal Presence group without an IncorporationArticles document. Designate one root person beneficiary holding the Director role as the attesting party: set attesting_party: true and attested_at on them, after presenting the collected beneficial-ownership information to them for confirmation. Iron generates a CDD certification (31 CFR 1010.230) from the submitted data and files it in place of the incorporation articles. This path requires a share_percentage on every UBO, at least one UBO at 25% or more, an SSN for each listed US person (a tax or identity document number otherwise), and at most two levels of beneficiaries. A submission that cannot produce the certification is rejected with 400.
Accepted document types:
  • Incorporation certificate (IncorporationCert)
  • Excerpt from a state company registry (StateRegistry)
  • Certificate of good standing (GoodStandingCert)
Accepted document types:
  • Shareholder registry (ShareholderRegistry)
  • Statement of information (InformationStatement)
  • Trust agreement (TrustAgreement)
  • Certificate of incumbency (IncumbencyCert)
The document must list all shareholders with their ownership percentages (totaling 100%), be dated within the last 12 months, and signed by a director unless publicly available.KYC checks: Each UBO with 25%+ ownership and all company directors must complete KYC (Proof of ID + Proof of Address) and be individually approved before onboarding. If there is no UBO who owns 25%+, all UBOs with 10%+ ownership must be verified.KYB checks: Apply to all legal entities in the ownership chain. For each additional entity, the same information is required unless ownership can be verified through open sources.
Accepted document types (any that contains information about appointed directors):
  • Director registry (DirectorsRegistry)
  • Trust agreement (TrustAgreement)
  • Statement of information (InformationStatement)
  • Certificate of incumbency (IncumbencyCert)

​
Business Questionnaire

Upload Source of Funds document is only required for Euro 3rd party payout.

​
Associated Parties

Example: Business Customer → owned by Company A → John Smith owns Company A → Company A is Shareholder, John Smith is UBO.

​
Required Information by Party Type

  • First name
  • Last name
  • Middle name
  • Date of birth
  • Email
  • Contact number
  • Nationality
  • Percentage of ownership
  • Tax ID: SSN for US persons, otherwise a national TIN. Required when the root company is registered outside the US, and always for a sole proprietor. Optional for beneficiaries of US companies.
  • Address details
  • Proof of Address, not older than 90 days, when required (see the note below)
Proof of address for person beneficiaries depends on the root company’s registration country. Non-US companies: every person beneficiary provides one. US companies: only person beneficiaries whose only role is Shareholder. US sole proprietorships: none. A missing required proof of address holds the identification at Pending with a resume URL.

​
Identity Verification / Liveness Check

For business customers, there are typically 2-3 types of people to identify, depending on whether an authorized representative is appointed:
Accepted identity documents are Passport, NationalId, and DriverLicense. ResidencePermit is rejected. Beneficiaries of US companies (except sole proprietorships) need a Passport or DriverLicense: another accepted type is not rejected, the identification is held at Pending with a resume URL to collect the right document.

​
Sole Proprietor Onboarding

Sole proprietors use the same onboarding paths as any other business. Pass company_type: "SoleProprietorship" to the Hosted Link flow or the Programmatic Business API. The Hosted Link flow automatically adapts its UI to the smaller sole-proprietor data set. The Programmatic API uses the same wire schema as any business: by convention, the proprietor is submitted as a single beneficiary with the UltimateBeneficialOwner role at 100% share. For sole proprietors, set questionnaire.type to "SoleProp". This is a simplified variant of the business questionnaire with fewer required fields.
Sole proprietorships need one company document: the incorporation certificate (IncorporationCert). US sole proprietors do not provide a beneficiary proof of address. Non-US sole proprietors can omit it at submission and supply it through the resume URL.
The hosted sole-proprietor flow walks the customer through four verification steps:
1

Company data

  • Country
  • Company name
  • Incorporated on
  • Registration number
  • Website
  • Custom field: Doing Business As
2

Questionnaire

Sole Proprietor Information (sets questionnaire.type to "SoleProp").
3

Company documents

  • Certificate of incorporation or registration
4

Associated parties (UBOs)

The proprietor as a single UBO:
  • First name
  • Last name
  • Date of birth
  • Email
  • Phone
  • TIN

​
Enhanced KYB Due Diligence

Business customer risk is defined through a customer risk rating process, calculating the risk score based on different factors: geography, industry, use of product, expected activities, legal form, etc.

​
Appendix

​
Prohibited Industries

The following business activities are prohibited from using Iron’s services to ensure alignment with regulatory expectations and Iron’s risk appetite.
  • Adult entertainment and dating services (dating apps, matchmaking sites, coaching/advice providers)
  • Sexual services (anything which implies sex as a service)
  • Marijuana/Cannabis/CBD industry (including cannabis paraphernalia)
  • Production or trade in tobacco (cigarettes, cigars, e-cigarettes, vapes, vape liquids) - vape hardware not included
  • Production or trade in weapons and munitions, including explosives and nuclear weapons
  • Arms/Defense/Military
  • Private military/Security contractors
  • Car dealers
  • Antique brokers
  • Jewellery or watch dealers
  • Precious metal and/or gem dealers
  • Pre-paid cards
  • Religious organizations
  • Multi-Level Marketing (MLM) structures
  • Financial pyramid or Ponzi schemes, matrix programs, and other similar schemes
  • Unlicensed Forex/Binary Options
  • Drugs, as well as chemicals used to manufacture synthetic drugs
  • Commercial activity which infringes on copyrighted material
  • Alternative medicines (e.g. homeopathy)
  • Financial services (loan lenders, payday loans companies, debt/credit consolidation companies, debt collection agencies)

​
Business Ownership and Constitutional Documents

To comply with Iron’s KYB requirements, all businesses must provide clear, official documentation that reliably verifies their complete ownership structure, ultimate beneficial owners (UBOs), controlling individuals, and confirms the existence and ongoing operations of the legal entity. If the entity does not have individual beneficial shareholders, we will need to confirm the individuals who significantly control the entity instead, such as its directors and officers. Supported entity types:
  • Sole Proprietorships
  • Partnerships
  • LLCs & Corporations
  • Trusts
  • Nonprofits
  • DAOs
  • Cooperatives

​
Required Documentation per Entity Type

  • Official sole proprietorship license or registration document clearly naming the sole proprietor and confirming active operation
  • Recent tax filings or official government-issued documents linking the proprietor to business operations
  • Partnership agreements officially certified or notarized, detailing partners and ownership shares
  • Officially issued partnership registration certificates clearly listing partners and their shares
  • Articles of Incorporation or Articles of Organization issued by the official business registry, clearly listing shareholders/members
  • Official shareholder/membership register or certified extracts from commercial registries clearly indicating owners and ownership percentages
  • Share certificates officially verified or notarized
  • Recent audited financial statements (for publicly traded or regulated entities), confirming the company’s operations and ownership
  • Official trust deed or certificate clearly identifying trustees, settlors, protectors (if applicable), and beneficiaries
  • Notarized trustee affidavit clearly verifying trustee identity, roles, and authorities
  • Official formation documents (e.g., Articles of Incorporation) clearly listing controlling individuals (e.g., directors or board members)
  • Government-issued or officially filed annual reports or governance documents confirming ongoing operations and key individuals
  • Official governance documents or independently audited membership agreements clearly outlining membership, control mechanisms, and operational status
  • Official formation documents clearly identifying cooperative members
  • Independently certified membership ledgers or agreements clearly indicating members and voting rights

​
Document Verification Standards

All provided documents must be issued by an official governmental authority and, where applicable, certified by a notary public, lawyer, auditor, or similar independent professional, with Apostille certification where applicable.
  • Must be officially issued by governmental authorities
  • Must be verifiable online through an official registry or database (if not possible, must be independently certified)
  • Apostille certification or equivalent legalization required where applicable
  • Self-generated or internally-produced documents are NOT acceptable
  • Must clearly display the full legal name and registration code of the business entity
  • If ownership structure involves more than two layers, a clear organizational chart with ownership percentages is required
  • Must be recent (issued within the past three months)
  • Documents not in English must include certified translations

​
Requirements for Regulated Entities

Entities that operate under regulatory supervision must provide additional documentation to confirm their licensing status and compliance with AML/CFT regulations.

​
Regulatory Licenses and Authorizations

A valid license or authorization issued by the relevant financial regulator or supervisory authority permitting the entity to conduct its business activities. If the license or authorization is not publicly accessible online, it must be certified by the issuing authority or a notary public.

​
AML/CFT Policy and Procedures

A copy of the entity’s internal AML/CFT policy, outlining its approach to:
  • Customer due diligence (CDD) and enhanced due diligence (EDD)
  • Transaction monitoring processes
  • Suspicious activity reporting procedures
  • Sanctions screening and PEP checks
  • The policy must be approved by senior management and aligned with the applicable jurisdiction’s AML laws and regulations
  • Licenses and authorizations must be verifiable online (if not, must be certified by the issuing authority, a notary public, or a licensed legal/audit professional)
  • The submitted AML/CFT policy must be an officially approved internal document (not a draft or template)