For business customers

• Embedded model

This article provides a comprehensive summary of the required fields, document types, identity verification requirements, and applicable conditions for onboarding business customers (companies) to our platform.

To onboard a company to the BVNK platform, submit the following information.

Overview

Requirements differ along two dimensions:

• Jurisdiction: the BVNK entity that contracts with the customer:

  • US — System Pay Services (US), Inc., a Delaware-incorporated company (NMLS ID 2531294), registered as a Money Services Business with FinCEN and licensed as a money transmitter in various US states.
  • EU — System Pay Services (Malta) Ltd (C66961), authorised by the Malta Financial Services Authority (MFSA) as an Electronic Money Institution and as a Crypto-Asset Service Provider under MiCA (Regulation (EU) 2023/1114).

• Onboarding model:

  • BVNK-Managed: you provide documents and structured data, BVNK performs ID&V.
  • Partner-managed: you perform ID&V and pass verification metadata + risk attestations to BVNK.

  The applicable onboarding model depends on the type of business and the licensing setup of the Embedded Partner. Contact the BVNK Solutions team to confirm which model applies to your integration.

For the technical integration, payload structures, and endpoint reference, see the companion API Integration Guide.

Business entity information

BVNK-Managed

Company profile

Field	US	EU	Validation / why we collect it
Legal Entity Name company.name	✅	✅	Verified against business registry records. Must match formation documents exactly.
Registration Number company.registrationNumber	☑️	✅	Cross-referenced with the relevant national business registry. Optional for US if EIN is provided.
Entity Type company.entityType	✅	✅	Determines downstream document and ownership disclosure requirements. See the API reference for the list of supported entity types.
Incorporation Date company.incorporationDate	✅	✅	Entities incorporated <2 years ago may trigger additional scrutiny (business plan, SoW, supporting invoices).
Industry company.industryReference	✅	✅	UUID from Industry API (NAICS supported). Determines whether vertical-specific requirements apply. Refer to available Industry reference codes.
Tax ID company.taxNumber	✅	☑️	Mandatory for US entities (EIN). Verified against IRS records.
Tax Residence Country company.taxResidenceCountryCode	✅	❌	Mandatory for US entities. Establishes US tax nexus and triggers US-specific associate requirements.

Registered address

Field	US	EU	Validation / why we collect it
Street Address address.addressLine1	✅	✅	Verified against business registry.
City address.city	✅	✅	Part of full address verification.
Post / Zip Code address.postalCode	✅	✅	Part of full address verification.
State / Province address.stateCode	✅	❌	Required for US addresses.
Country address.countryCode	✅	✅	Decline if in a controlled or prohibited jurisdiction. To get the list of countries, use the Fetch Country Codes endpoint.
Operational Address company.operationalAddress	☑️	☑️	Required if different from registered address.

Business profile

The businessProfile object captures business context, CDD data, and nature-of-business information at customer creation.

Field	US	EU	Validation / why we collect it
Description businessProfile.description	✅	✅	Brief narrative of business activities. Used by Compliance to assess consistency with declared industry.
Website businessProfile.website	✅	✅	Reviewed for risk indicators, consistency with declared activity, and exposure to prohibited content.
Regulated Status businessProfile.isRegulated	✅	✅	Triggers requirement for AML Policy and Proof of Regulatory License if true.
Source of Funds businessProfile.sourceOfFunds	✅	✅	Structured enum. Documentary evidence may be requested during compliance review. See the API reference for the list of supported values.
Intended Use of Account businessProfile.intendedUseOfAccount	✅	✅	Screened for high-risk purposes (e.g. third-party money transmission). Must align with declared business model. See the API reference for the list of supported values.
Monthly Expected Volume businessProfile.monthlyExpectedVolumes	✅	✅	Volume range provided as a string enum (e.g. FROM_0_TO_10K). See the API reference for supported values. A UUID-based reference via the Volumes API (company.monthlyExpectedVolumesReference) will replace this field in a future release.

Nature of Business Questionnaire

Previously required for business customers in v1. Deprecated in v2. All business context is now captured via the structured businessProfile fields above.

Associates

Associates are individuals linked to the business.

Business customers must include associated natural persons. The following minimum roles must be declared:

• One Authorised Signatory / Representative
• One Director (EU) or Control Person (US)
• At least one and all UBOs above the applicable threshold (25% for onboarding and CDD, 10% for EDD)

Associate roles

The following values are accepted in the associate roles field. Each associate must be assigned at least one role.

Role	Requirement	Validation / why we collect it
Authorised Signatory REPRESENTATIVE	✅ At least one	Person legally authorised to bind the company and execute agreements. If not a director, evidence of signing authority is required (Board Resolution, PoA, or Articles provision).
Director / Control Person DIRECTOR	✅ At least one	EU: verified against the company registry. US: person with significant management control. Sanctions, PEP, and adverse media screening applied.
UBO / Beneficial Owner BUSINESS_OWNER	✅ At least one above threshold	CDD threshold: ≥25%. EDD threshold: ≥10%. If no individual above threshold, the most senior executive must be designated as Person with Significant Control.
Account Representative ACCOUNT_REPRESENTATIVE	❌	Operational point of contact for the partnership.

The same person can hold multiple roles, for example, Authorised Signatory + UBO + Director.

Personal information (all associates)

Field	US	EU	Validation / why we collect it
First Name firstName	✅	✅	Must match government-issued ID exactly. Used for sanctions and adverse media screening.
Last Name lastName	✅	✅	Must match government-issued ID exactly.
Date of Birth dateOfBirth	✅	✅	Used for identity matching and screening disambiguation.
Nationality nationality	☑️	✅	US: required for Control Persons. EU: all nationalities including dual must be declared. Screened against prohibited nationality lists.
Country of Birth birthCountryCode	☑️	✅	US: required for Control Persons. Used for sanctions screening.
Country of Residence address.countryCode	✅	✅	To get the list of countries, use the Fetch Country Codes endpoint.
Email Address emailAddress	✅	✅	Primary communication channel for verification flows.
Residential Address address	✅	✅	Full address required. Must be a physical residential address.
State / Province address.stateCode	☑️	❌	Required for US addresses.

Tax identification (all associates)

Field	US	EU	Validation / why we collect it
Tax ID Number taxIdentification.number	✅	✅	SSN mandatory for US persons, verified against database. EU: national tax ID.
Tax ID Country taxIdentification.country	✅	✅	Establishes tax residency.

Identity verification (associates)

Under the BVNK-Managed model, raw documents are uploaded for BVNK to check via verification partners.

Check	US	EU	Validation / why we collect it
ID Document Upload	✅	✅	Front/back image of passport, national ID card, driver's license, or residence permit. Verified items: authenticity, data extraction, expiry, and name/DOB matching.
Selfie / Liveness Upload	✅	✅	Biometric selfie matched against ID document photo. Liveness detection prevents spoofing.
Address Document Upload	✅	✅	Utility bill, bank statement, or government correspondence dated within 3 months. Address must match declared residential address.

Individual CDD

When associates are onboarded as standalone individual customers (not in a business context), additional CDD fields apply.

Field	US	EU	Validation / why we collect it
Employment Status cdd.employmentStatus	✅	✅	Used to assess plausibility of declared source of funds. See the API reference for the list of supported values.
Source of Funds cdd.sourceOfFunds	✅	✅	High-risk sources trigger SoF documentary request. See the API reference for the list of supported values.
Intended Use of Account cdd.intendedUseOfAccount	✅	✅	Screened for high-risk use cases. See the API reference for the list of supported values.
Expected Monthly Volume cdd.expectedMonthlyVolume	❌	☑️ Questionnaire	EU BVNK-Managed: covered in questionnaire or defaults.
PEP Status cdd.pepStatus	☑️ Questionnaire	☑️ Questionnaire	Collected via questionnaire. Positive PEP triggers EDD.

UBO-specific requirements

UBOs above the ownership threshold must complete identity verification.

Check	US	EU	Validation / why we collect it
Basic data + residential address	❌ (address)	✅	EU always requires full residential address. Sanctions, PEP, and adverse media screening applied.
ID Verification	✅	✅	US: SSN mandatory for US residents, verified against database. EU: full ID verification (document or metadata under Partner-managed).
Ownership threshold	25% (std) / 10% (high)	25% (std) / 10% (high)	Standard CDD: ≥25% ownership or voting rights. EDD (high-risk): ≥10%. Full ownership chain required if held through intermediaries.

Business documents (KYB)

Documents are uploaded via POST /onboarding/v1/applications/{id}/documents (company) or via Portal.

Entity documents

Document	US	EU	Why we collect it
Certificate of Incorporation	✅	✅	Confirms legal formation. Must show filing stamp or registration date. Legal name must match declared name.
Memorandum of Association	✅	✅	Confirms governance structure, powers, and objects of the entity.
Articles of Association	✅	✅	Confirms internal governance and signatory authority. Submitted as a separate document type; may be combined with Memorandum where jurisdictionally equivalent.
Source of Funds (Entity)	✅	✅	Bank statements (3 months activity) or equivalent.
Proof of Address (Entity)	✅	✅	Utility bill, lease, tax statement, or official government correspondence. Dated within 3 months. Required if operational address differs from registered.
Proof of Directorship	✅	✅	Official registry extract or certified register of directors. Not older than 6 months.
Corporate / Group Structure	✅	✅	Ownership chart showing all corporate shareholders through to UBOs. Certified by legal counsel or CA. Not older than 6 months.
Source of Wealth (Entity)	☑️	☑️	Triggered by high-risk rating or EDD. Audited accounts, financial statements, loan agreements, or bank statements showing capitalisation history.
Proof of Regulatory License	☑️	☑️	Required if entity operates in a regulated industry. Must be current and match declared jurisdiction.
Proof of Business Activity	☑️	☑️	Triggered when web presence is limited, entity is newly incorporated (<2 years), or nature of business is unclear.
Shareholder Ownership Doc	☑️	☑️	Required when ownership is complex (trusts, foundations, nominees, >3 layers, offshore entities).

Partner-managed

Company profile

Field	US	EU	Validation / why we collect it
Legal Entity Name company.name	✅	✅	Verified against business registry records. Must match formation documents exactly.
Registration Number company.registrationNumber	☑️	✅	Cross-referenced with the relevant national business registry. Optional for US if EIN is provided.
Entity Type company.entityType	✅	✅	Determines downstream document and ownership disclosure requirements. See the API reference for the list of supported entity types.
Incorporation Date company.incorporationDate	✅	✅	Entities incorporated <2 years ago may trigger additional scrutiny (business plan, SoW, supporting invoices).
Industry company.industryReference	✅	✅	UUID from Industry API (NAICS supported). Determines whether vertical-specific requirements apply. Refer to available Industry reference codes.
Tax ID company.taxNumber	✅	☑️	Mandatory for US entities (EIN). Verified against IRS records.
Tax Residence Country company.taxResidenceCountryCode	✅	❌	Mandatory for US entities. Establishes US tax nexus and triggers US-specific associate requirements.

Registered address

Field	US	EU	Validation / why we collect it
Street Address address.addressLine1	✅	✅	Verified against business registry.
City address.city	✅	✅	Part of full address verification.
Post / Zip Code address.postalCode	✅	✅	Part of full address verification.
State / Province address.stateCode	✅	❌	Required for US addresses.
Country address.countryCode	✅	✅	Decline if in a controlled or prohibited jurisdiction. To get the list of countries, use the Fetch Country Codes endpoint.
Operational Address company.operationalAddress	☑️	☑️	Required if different from registered address.

Entity-level CDD

For Partner-managed onboarding, additional business context is provided through structured CDD fields rather than the businessProfile object alone.

Field	US	EU	Validation / why we collect it
Monthly Expected Volume company.monthlyExpectedVolumesReference	✅	✅	UUID from Volumes API. Establishes baseline for transaction monitoring.
Intended Use of Account cdd.intendedUseOfAccount	✅	✅	Partner attests intended use. See the API reference for the list of supported values.
PEP Status, Entity cdd.pepStatus	✅	✅	Partner attests whether any person in the ownership or control structure is a PEP.

Partner risk attestation

Field	US	EU	Validation / why we collect it
Risk Score company.reliance.attestation.riskScore	✅	✅	Partner's customer-level risk rating. Input to BVNK's independent risk assessment. Possible values: LOW, MEDIUM, or HIGH.
EDD Completed company.reliance.attestation.eddCompleted	✅	✅	If false and BVNK rates the customer HIGH, BVNK-side EDD is triggered.

Associates

Associates are individuals linked to the business.

Business customers must include associated natural persons. The following minimum roles must be declared:

• One Authorised Signatory / Representative
• One Director (EU) or Control Person (US)
• At least one and all UBOs above the applicable threshold (25% for onboarding and CDD, 10% for EDD)

Associate roles

The following values are accepted in the associate roles field. Each associate must be assigned at least one role.

Role	Requirement	Validation / why we collect it
Authorised Signatory REPRESENTATIVE	✅ At least one	Person legally authorised to bind the company and execute agreements. If not a director, evidence of signing authority is required (Board Resolution, PoA, or Articles provision).
Director / Control Person DIRECTOR	✅ At least one	EU: verified against the company registry. US: person with significant management control. Sanctions, PEP, and adverse media screening applied.
UBO / Beneficial Owner BUSINESS_OWNER	✅ At least one above threshold	CDD threshold: ≥25%. EDD threshold: ≥10%. If no individual above threshold, the most senior executive must be designated as Person with Significant Control.
Account Representative ACCOUNT_REPRESENTATIVE	Optional	Operational point of contact for the partnership.

The same person can hold multiple roles, for example, Authorised Signatory + UBO + Director.

Personal information (all associates)

Field	US	EU	Validation / why we collect it
First Name firstName	✅	✅	Must match government-issued ID exactly. Used for sanctions and adverse media screening.
Last Name lastName	✅	✅	Must match government-issued ID exactly.
Date of Birth dateOfBirth	✅	✅	Format: YYYY-MM-DD. Used for identity matching and screening disambiguation.
Nationality nationality	☑️	✅	US: required for Control Persons. EU: all nationalities including dual must be declared. Screened against prohibited nationality lists.
Country of Birth birthCountryCode	☑️	✅	US: required for Control Persons. Used for sanctions screening.
Country of Residence address.countryCode	✅	✅	To get the list of countries, use the Fetch Country Codes endpoint.
Email Address emailAddress	✅	✅	Primary communication channel for verification flows.
Residential Address address	✅	✅	Full address required. Must be a physical residential address.
State / Province address.stateCode	☑️	❌	Required for US addresses.

Tax identification (all associates)

Field	US	EU	Validation / why we collect it
Tax ID Number taxIdentification.number	✅	✅	SSN mandatory for US persons, verified against database. EU: national tax ID.
Tax ID Country taxIdentification.country	✅	✅	Establishes tax residency.

US Partner-managed (SSN)

When SSN is provided under US Partner-managed, ID metadata fields become optional.

Identity verification (associates)

Under the Partner-managed model, verification metadata is passed confirming the partner has performed ID&V.

Check	US	EU	Validation / why we collect it
ID Metadata reliance.identityDocumentMetadata	☑️	✅	Type, number, expiry date, issuing country, IDV timestamp. Confirms the partner has performed document verification. US: optional if SSN has been provided.
Biometric / Liveness Metadata reliance.biometricLiveness	❌	✅	Liveness timestamp confirms partner performed biometric check.
Address Verification Metadata reliance.addressVerification	✅	✅	Type: DOC (documentary) or NON_DOC (database/electronic). US: confirm residential address is valid and not a PO Box. EU: full address verification required.

Individual CDD

When associates are onboarded as standalone individual customers (not in a business context), additional CDD fields apply.

Field	US	EU	Validation / why we collect it
Employment Status cdd.employmentStatus	✅	✅	Used to assess plausibility of declared source of funds. See the API reference for the list of supported values.
Source of Funds cdd.sourceOfFunds	✅	✅	High-risk sources trigger SoF documentary request. See the API reference for the list of supported values.
Intended Use of Account cdd.intendedUseOfAccount	✅	✅	Screened for high-risk use cases. See the API reference for the list of supported values.
Expected Monthly Volume cdd.expectedMonthlyVolume	❌	✅	EU Partner-managed: object {amount, currency} mandatory.
PEP Status cdd.pepStatus	✅	✅	Partner must attest status (e.g. NOT_PEP). Positive PEP triggers EDD.

Director-specific requirements

Directors are collected and verified against the company registry. Verification depth depends on risk level.

Check	US	EU	Validation / why we collect it
Basic data (name, DOB, nationality, residence)	✅	✅	Cross-referenced against the company's registry of directors. Sanctions, PEP, and adverse media screening applied to all directors.
Residential Address	❌	✅	EU: required for high-risk customers under EDD.
ID Verification Metadata	❌	✅	EU: required for high-risk customers under EDD.

UBO-specific requirements

UBOs above the ownership threshold must complete identity verification.

Check	US	EU	Validation / why we collect it
Basic data + residential address	❌ (address)	✅	EU always requires full residential address. Sanctions, PEP, and adverse media screening applied.
ID Verification	✅ (SSN mandatory)	✅	US: SSN mandatory for US residents, verified against database. EU: full ID verification (document or metadata under Partner-managed).
Ownership threshold	25% (std) / 10% (high)	25% (std) / 10% (high)	Standard CDD: ≥25% ownership or voting rights. EDD (high-risk): ≥10%. Full ownership chain required if held through intermediaries.

Business documents (KYB)

Documents are uploaded via POST /onboarding/v1/applications/{id}/documents (company) or via Portal.

Entity documents

Document	US	EU	Why we collect it
Certificate of Incorporation	✅	❌	Confirms legal formation. Must show filing stamp or registration date. Legal name must match declared name.
Memorandum of Association	❌	❌	Confirms governance structure, powers, and objects of the entity.
Articles of Association	❌	❌	Confirms internal governance and signatory authority. Submitted as a separate document type; may be combined with Memorandum where jurisdictionally equivalent.
Source of Funds (Entity)	☑️	☑️	Attestation sufficient at CDD level. Documentary evidence required under EDD — see Company EDD.
Proof of Address (Entity)	❌	✅	Utility bill, lease, tax statement, or official government correspondence. Dated within 3 months. Required if operational address differs from registered.
Proof of Directorship	❌	❌	Official registry extract or certified register of directors. Not older than 6 months.
Corporate / Group Structure	❌	❌	Ownership chart showing all corporate shareholders through to UBOs. Certified by legal counsel or CA. Not older than 6 months.
Proof of Regulatory License	❌	❌	Required if entity operates in a regulated industry. Must be current and match declared jurisdiction.
Proof of Business Activity	❌	❌	Triggered when web presence is limited, entity is newly incorporated (<2 years), or nature of business is unclear.
Shareholder Ownership Doc	❌	❌	Required when ownership is complex (trusts, foundations, nominees, >3 layers, offshore entities).

Partner-managed philosophy

Under Partner-managed, BVNK relies on the partner's KYB programme. The minimum doc set reflects what BVNK still needs for its own records and regulatory obligations (e.g. Certificate of Incorporation for US Partner-managed under MTL requirements; Proof of Address for EU Partner-managed under MiCA).

Enhanced due diligence

Enhanced due diligence (EDD) requirements apply when the BVNK customer risk rating is HIGH and EDD has not been completed by the Embedded Partner (reliance.attestation.eddCompleted: false).

Company EDD

Requirement	US	EU	What we accept
Company Source of Wealth	✅	✅	Loan agreements, financial statements, tax returns, bank statements, or commercial database verification (e.g. Creditsafe).
Source of Funds (Entity)	✅	✅	Document required when EDD applies (replaces the CDD attestation sufficient for standard risk).
Director & UBO Address Verification	❌	✅	Commercial database check or documentary evidence (utility bill, bank statement).
UBO Source of Wealth	❌	✅	Tax returns, investment portfolio statements, share certificates, or open-source research.
Verification of Professional Activity	❌	✅	Payslips, employment contracts, invoices (if self-employed), or open-source review.
Proof of Entity Address	✅	❌	Bank statement or other documentary evidence showing the entity's physical address.

Review process

Application review

BVNK reviews applications once all required data, documents, and associate verification have been submitted. Onboarding completes automatically when all conditions are satisfied — there is no separate “submit” call. See the API Integration Guide (Section 10) for completion mechanics.

Decisioning

Applications result in one of three outcomes: VERIFIED, REJECTED, or remain in SUBMITTED state pending additional information. BVNK sends webhook notifications at each status transition.

Requests for information (RFI)

When BVNK requires additional information, a consolidated RFI is issued. To minimise RFIs:

• Submit all formation, ownership, and address documents upfront.
• Clearly substantiate the nature of business, especially where web presence is limited.
• For regulated entities, include AML policy and license documentation with the initial submission.
• Pre-screen business physical addresses for virtual or registered agent addresses.

Best practices

• Pre-screen addresses. Confirm the physical address is not a virtual office or registered agent. Wyoming and Delaware addresses in particular require scrutiny.
• Collect ownership attestation early. Have the control person certify UBOs above the threshold to avoid follow-up document requests.
• Document the nature of business. Ensure the website or supporting documents substantiate what the business does. For new businesses, provide a business plan or pitch deck.
• Source of funds upfront. Proactively submit bank statements showing 3 months of transactional activity for BVNK-Managed; provide attestation for Partner-managed CDD.
• Web presence. If the business has limited or no web presence, attach invoices, contracts, marketing materials, or bank statements as supplementary evidence.
• Use structured businessProfile fields. The Nature of Business Questionnaire is deprecated in v2 — all business context is captured via structured fields.

Appendix

Non-MTL US States

Additional mandatory requirements apply to business customers whose operational address (or registered address, where no operational address is declared) falls in a US state not covered by BVNK's Money Transmitter License (MTL), and where crypto capability for customers has been enabled on the account.

Associates

The following field is mandatory for all associates linked to the business, including Authorised Signatories, Control Persons, and UBOs:

Field	Allowed values
company.associates.person.estimatedYearlyIncome	INCOME_0_TO_50K, INCOME_50K_TO_100K, INCOME_100K_TO_250K, INCOME_250K_TO_500K, INCOME_500K_TO_750K, INCOME_750K_TO_1M, INCOME_ABOVE_1M

Entity

The following fields are mandatory at the entity level when businessProfile.isRegulated is true:

Field	Notes
businessProfile.regulatorInformation.regulatorName	Name of the regulatory body. Must be explicitly collected and submitted.
businessProfile.regulatorInformation.regulatorJurisdiction	Jurisdiction in which the entity holds its licence. Must be explicitly collected and submitted.
businessProfile.regulatorInformation.regulatorRegisterNumber	Registration or licence number issued by the regulator. Must be explicitly collected and submitted.

Partner-Managed

The above requirements are subject to bilateral agreement. Contact your BVNK integration manager to confirm which fields apply to your programme.

BVNK's onboarding orchestration surfaces these fields at the point of customer creation where applicable. You do not need to determine eligibility in your integration.