> ## Documentation Index > Fetch the complete documentation index at: https://docs.iron.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Business > Onboard business customers using Iron's hosted Link flow or the programmatic Business API. Iron supports two methods for onboarding business customers through KYB (Know Your Business) verification. Both follow the same [onboarding lifecycle](/onboarding) and collect the same underlying compliance data. Create a `Link` identification and receive a URL. Your customer completes KYB verification in Iron's hosted interface. Iron handles the entire collection, review, and approval process. Submit all KYB data directly via the API with a `Business` identification. You collect and provide company info, beneficiaries, documents, and the compliance questionnaire programmatically. ## Hosted Link Flow The simplest way to onboard a business customer. You create a `Link` identification and Iron returns a URL where your customer completes the full KYB process through Iron's hosted interface. Iron is fully responsible for collecting all required information, performing verification, and deciding on approval. `POST /customers` ```bash theme={null} curl --request POST \ --header 'content-type: application/json; charset=utf-8' \ --header 'idempotency-key: ' \ --header 'x-api-key: ' \ --data '{"name": "acme_corp", "email": "admin@acme.com"}' \ --url 'https://api.sandbox.iron.xyz/api/customers' ``` The customer is created in `IdentificationRequired` status. `POST /customers/{id}/identifications/v2` ```bash theme={null} curl --request POST \ --header 'accept: application/json; charset=utf-8' \ --header 'content-type: application/json; charset=utf-8' \ --header 'idempotency-key: ' \ --header 'x-api-key: ' \ --data '{ "type": "Link" }' \ --url 'https://api.sandbox.iron.xyz/api/customers//identifications/v2' ``` The response includes a `url` field. Pass this URL to your customer to begin the hosted KYB flow. The customer opens the link and completes the flow in Iron's hosted interface, which collects company information, documents, beneficial ownership details, and the business questionnaire. Once the submission is complete, Iron reviews the data, performs verification, and decides on approval. Track progress via [webhooks](/webhooks) or by polling the identification status. Once KYB is approved, the customer status transitions to `SigningsRequired`. Retrieve required signings and present them to the customer, then mark them as signed. See the [onboarding lifecycle](/onboarding) for details. ## Programmatic Business API For partners who collect KYB data within their own application, you can submit all business verification data directly via the API. This requires an [outsourcing agreement](/outsourcing) with Iron. You collect the company information, beneficial ownership details, identity documents, and the compliance questionnaire, then submit everything in a single API call. `POST /customers` ```bash theme={null} curl --request POST \ --header 'content-type: application/json; charset=utf-8' \ --header 'idempotency-key: ' \ --header 'x-api-key: ' \ --data '{"name": "acme_corp", "email": "admin@acme.com"}' \ --url 'https://api.sandbox.iron.xyz/api/customers' ``` `POST /customers/{id}/identifications/v2` Submit the full KYB payload with `type: "Business"`. Company identity, beneficiaries, and documents are nested under `company_data` (company fields sit under `company_data.company_info`). The company `phone` and the submitting device's `ip_address` are top-level, and `questionnaire` carries a `type` discriminator (`Generic` for all company types except sole proprietorships, `SoleProp` for sole proprietorships). The example below shows a complete submission with one beneficial owner: ```bash Shell theme={null} curl --request POST \ --header 'accept: application/json; charset=utf-8' \ --header 'content-type: application/json; charset=utf-8' \ --header 'idempotency-key: ' \ --header 'x-api-key: ' \ --url 'https://api.sandbox.iron.xyz/api/customers//identifications/v2' \ --data-raw '{ "type": "Business", "phone": "+4930123456789", "ip_address": "203.0.113.42", "company_data": { "company_info": { "company_name": "Acme Corp", "registration_number": "12345678", "country": "DE", "incorporation_date": "2020-06-15", "legal_address": "Friedrichstraße 123, 10117 Berlin", "postal_address": "Friedrichstraße 123, 10117 Berlin", "address": { "street_1": "Friedrichstraße 123", "city": "Berlin", "state": "Berlin", "zip_code": "10117", "country": "DE" }, "email": "info@acme.com", "tax_identification_number": "DE123456789", "website": "https://www.acme.com", "company_type": "LimitedLiabilityCompany" }, "beneficiaries": [ { "roles": ["Director", "UltimateBeneficialOwner"], "share_percentage": 100, "beneficiary_info": { "type": "Person", "first_name": "Jane", "last_name": "Smith", "date_of_birth": "1985-03-22", "email_address": "jane@acme.com", "phone_number": "+4915112345678", "tax_identification_number": "12345678901", "tax_jurisdiction_country_code": "DE", "birth_place": { "place": "Munich", "state": "Bavaria", "country": "DE" }, "address": { "street_1": "Unter den Linden 42", "city": "Berlin", "state": "Berlin", "zip_code": "10117", "country": "DE" }, "identity": { "identity_country_code": "DE", "identity_document_type": "Passport", "identity_document_front": "", "selfie": "", "selfie_collected_at": "2026-07-01T12:00:00Z", "nationality": "DE" }, "proof_of_address": "" } } ], "documents": [ { "type": "IncorporationCert", "country": "DE", "file": "" }, { "type": "IncorporationArticles", "country": "DE", "file": "" }, { "type": "ShareholderRegistry", "country": "DE", "file": "" }, { "type": "DirectorsRegistry", "country": "DE", "file": "" } ] }, "questionnaire": { "type": "Generic", "business_details": { "industry_type": "InformationTechnologyAndSoftware", "business_model_description": "B2B SaaS platform for supply chain management", "main_business_countries": ["DE", "FR", "NL"], "has_licenses_or_registrations": false, "requires_aml_program": false, "estimated_annual_revenue": "From1MTo10M" }, "source_of_funds": { "source_of_funds": "VcPrivateEquity", "source_of_funds_description": "Series B venture round led by a European growth fund", "customer_funds_handling_details": "Receives payments into its own account only; does not hold or transmit customer funds" }, "planned_activities": { "purpose_and_intended_use": "ReceivingBusinessIncome", "estimated_monthly_volume": "FiftyToOneHundredThousand", "estimated_monthly_transactions": "TenToTwentyFive", "sends_funds_on_customer_behalf": false } } }' ``` ```python Python theme={null} import requests import base64 from pathlib import Path API_KEY = "" CUSTOMER_ID = "" BASE_URL = "https://api.sandbox.iron.xyz/api" def encode_document(file_path: str) -> str: return base64.b64encode(Path(file_path).read_bytes()).decode() response = requests.post( f"{BASE_URL}/customers/{CUSTOMER_ID}/identifications/v2", headers={ "accept": "application/json; charset=utf-8", "content-type": "application/json; charset=utf-8", "idempotency-key": "", "x-api-key": API_KEY, }, json={ "type": "Business", "phone": "+4930123456789", "ip_address": "203.0.113.42", "company_data": { "company_info": { "company_name": "Acme Corp", "registration_number": "12345678", "country": "DE", "incorporation_date": "2020-06-15", "legal_address": "Friedrichstraße 123, 10117 Berlin", "postal_address": "Friedrichstraße 123, 10117 Berlin", "address": { "street_1": "Friedrichstraße 123", "city": "Berlin", "state": "Berlin", "zip_code": "10117", "country": "DE", }, "email": "info@acme.com", "tax_identification_number": "DE123456789", "website": "https://www.acme.com", "company_type": "LimitedLiabilityCompany", }, "beneficiaries": [ { "roles": ["Director", "UltimateBeneficialOwner"], "share_percentage": 100, "beneficiary_info": { "type": "Person", "first_name": "Jane", "last_name": "Smith", "date_of_birth": "1985-03-22", "email_address": "jane@acme.com", "phone_number": "+4915112345678", "tax_identification_number": "12345678901", "tax_jurisdiction_country_code": "DE", "birth_place": { "place": "Munich", "state": "Bavaria", "country": "DE", }, "address": { "street_1": "Unter den Linden 42", "city": "Berlin", "state": "Berlin", "zip_code": "10117", "country": "DE", }, "identity": { "identity_country_code": "DE", "identity_document_type": "Passport", "identity_document_front": encode_document("passport-front.jpg"), "selfie": encode_document("selfie.jpg"), "selfie_collected_at": "2026-07-01T12:00:00Z", "nationality": "DE", }, "proof_of_address": encode_document("proof-of-address.pdf"), }, } ], "documents": [ { "type": "IncorporationCert", "country": "DE", "file": encode_document("registration.pdf"), }, { "type": "IncorporationArticles", "country": "DE", "file": encode_document("articles.pdf"), }, { "type": "ShareholderRegistry", "country": "DE", "file": encode_document("shareholders.pdf"), }, { "type": "DirectorsRegistry", "country": "DE", "file": encode_document("directors.pdf"), }, ], }, "questionnaire": { "type": "Generic", "business_details": { "industry_type": "InformationTechnologyAndSoftware", "business_model_description": "B2B SaaS platform for supply chain management", "main_business_countries": ["DE", "FR", "NL"], "has_licenses_or_registrations": False, "requires_aml_program": False, "estimated_annual_revenue": "From1MTo10M", }, "source_of_funds": { "source_of_funds": "VcPrivateEquity", "source_of_funds_description": "Series B venture round led by a European growth fund", "customer_funds_handling_details": "Receives payments into its own account only; does not hold or transmit customer funds", }, "planned_activities": { "purpose_and_intended_use": "ReceivingBusinessIncome", "estimated_monthly_volume": "FiftyToOneHundredThousand", "estimated_monthly_transactions": "TenToTwentyFive", "sends_funds_on_customer_behalf": False, }, }, }, ) identification = response.json() print(identification) ``` ```typescript TypeScript theme={null} import fs from "fs"; const API_KEY = ""; const CUSTOMER_ID = ""; const BASE_URL = "https://api.sandbox.iron.xyz/api"; function encodeDocument(filePath: string): string { return fs.readFileSync(filePath).toString("base64"); } const response = await fetch( `${BASE_URL}/customers/${CUSTOMER_ID}/identifications/v2`, { method: "POST", headers: { accept: "application/json; charset=utf-8", "content-type": "application/json; charset=utf-8", "idempotency-key": "", "x-api-key": API_KEY, }, body: JSON.stringify({ type: "Business", phone: "+4930123456789", ip_address: "203.0.113.42", company_data: { company_info: { company_name: "Acme Corp", registration_number: "12345678", country: "DE", incorporation_date: "2020-06-15", legal_address: "Friedrichstraße 123, 10117 Berlin", postal_address: "Friedrichstraße 123, 10117 Berlin", address: { street_1: "Friedrichstraße 123", city: "Berlin", state: "Berlin", zip_code: "10117", country: "DE", }, email: "info@acme.com", tax_identification_number: "DE123456789", website: "https://www.acme.com", company_type: "LimitedLiabilityCompany", }, beneficiaries: [ { roles: ["Director", "UltimateBeneficialOwner"], share_percentage: 100, beneficiary_info: { type: "Person", first_name: "Jane", last_name: "Smith", date_of_birth: "1985-03-22", email_address: "jane@acme.com", phone_number: "+4915112345678", tax_identification_number: "12345678901", tax_jurisdiction_country_code: "DE", birth_place: { place: "Munich", state: "Bavaria", country: "DE", }, address: { street_1: "Unter den Linden 42", city: "Berlin", state: "Berlin", zip_code: "10117", country: "DE", }, identity: { identity_country_code: "DE", identity_document_type: "Passport", identity_document_front: encodeDocument("passport-front.jpg"), selfie: encodeDocument("selfie.jpg"), selfie_collected_at: "2026-07-01T12:00:00Z", nationality: "DE", }, proof_of_address: encodeDocument("proof-of-address.pdf"), }, }, ], documents: [ { type: "IncorporationCert", country: "DE", file: encodeDocument("registration.pdf"), }, { type: "IncorporationArticles", country: "DE", file: encodeDocument("articles.pdf"), }, { type: "ShareholderRegistry", country: "DE", file: encodeDocument("shareholders.pdf"), }, { type: "DirectorsRegistry", country: "DE", file: encodeDocument("directors.pdf"), }, ], }, questionnaire: { type: "Generic", business_details: { industry_type: "InformationTechnologyAndSoftware", business_model_description: "B2B SaaS platform for supply chain management", main_business_countries: ["DE", "FR", "NL"], has_licenses_or_registrations: false, requires_aml_program: false, estimated_annual_revenue: "From1MTo10M", }, source_of_funds: { source_of_funds: "VcPrivateEquity", source_of_funds_description: "Series B venture round led by a European growth fund", customer_funds_handling_details: "Receives payments into its own account only; does not hold or transmit customer funds", }, planned_activities: { purpose_and_intended_use: "ReceivingBusinessIncome", estimated_monthly_volume: "FiftyToOneHundredThousand", estimated_monthly_transactions: "TenToTwentyFive", sends_funds_on_customer_behalf: false, }, }, }), } ); const identification = await response.json(); console.log(identification); ``` Iron validates the submission synchronously. A complete submission is created as `Processed` and moves into verification. A submission missing required documents or proofs of address is created as `Pending` with a resume URL instead of being rejected. See [Incomplete Submissions](#incomplete-submissions). Track progress via [webhooks](/webhooks) or by polling the identification status. Same as the hosted flow. Once KYB is approved, retrieve and present required signings, then mark them as signed to activate the customer. ### Incomplete Submissions A Business submission does not need to be complete to be accepted. When required company documents or beneficiary proofs of address are missing, Iron creates the identification with `status: "Pending"` and returns a resume URL in the `url` field. Complete submissions are created as `Processed` directly. A `201` response does not mean the submission was complete. Check `status` on the returned identification: `Processed` means Iron has everything it needs, `Pending` means items are missing and `url` carries the resume link. Sandbox approves business submissions at creation regardless of completeness. The `Pending` resume flow occurs in production only. Redirect the business to the `url`. It opens a hosted flow that collects only the missing items. When the flow finishes, the identification advances to `Processed`, an identification status [webhook](/webhooks) fires, and the standard flow continues: `Processed` → `PendingReview` → `Approved` / `Declined`. A submission is held at `Pending` when: * A required document group is missing for the company's region. See [Company Documents](#company-documents). * A required beneficiary proof of address is missing. See [Required Information by Party Type](#required-information-by-party-type). * A beneficiary of a US company (except sole proprietorships) provides an accepted identity document type other than `Passport` or `DriverLicense`. These validations still reject the request with `400`: * More than 4 company documents * A document that is not valid base64, exceeds 10 MB, or has an invalid country code * A document the verification provider cannot process, such as a corrupted file. The response includes the rejection detail. Fix the file before retrying. One exception: an error naming a blocked duplicate upload means the file is fine and a retry succeeds. * A `share_percentage` outside 0-100, or combined `UltimateBeneficialOwner` shares above 100 for any company in the structure * A missing `tax_identification_number` for a `Director` or `UltimateBeneficialOwner` person beneficiary of a non-US company, or for the proprietor of a sole proprietorship in any country. The error identifies the beneficiary by its zero-based index in the `beneficiaries` array. * A `ResidencePermit` identity document * Invalid attestation data: more than one attesting party, an attesting party without the `Director` role or nested below the root, a missing or future `attested_at`, or beneficial-ownership data the generated CDD certification cannot render. See [Company Documents](#company-documents). `400` responses on this endpoint return the reason as a plain string: ```json theme={null} "Beneficiary share_percentage must be between 0 and 100" ``` ### Example Scenarios The following examples show the `company_data.beneficiaries` array for common ownership structures. All other fields (`company_data.company_info`, `company_data.documents`, `questionnaire`) remain the same as the full example above. The person objects below are abbreviated: a real submission also carries `identity`, `tax_identification_number`, and `proof_of_address` per beneficiary, as in the full example. A company with a majority shareholder/director and a minority UBO: ```json theme={null} "beneficiaries": [ { "roles": ["Director"], "beneficiary_info": { "type": "Person", "first_name": "Jane", "last_name": "Smith", "date_of_birth": "1985-03-22", "email_address": "jane@acme.com", "phone_number": "+4915112345678", "identity_country_code": "DE", "nationality_country_code": "DE", "tax_jurisdiction_country_code": "DE", "birth_place": { "place": "Munich", "state": "Bavaria", "country": "DE" }, "address": { "street_1": "Unter den Linden 42", "city": "Berlin", "state": "Berlin", "zip_code": "10117", "country": "DE" } } }, { "roles": ["UltimateBeneficialOwner"], "share_percentage": 60, "beneficiary_info": { "type": "Person", "first_name": "Max", "last_name": "Müller", "date_of_birth": "1978-11-05", "email_address": "max@acme.com", "phone_number": "+4915198765432", "identity_country_code": "DE", "nationality_country_code": "DE", "tax_jurisdiction_country_code": "DE", "birth_place": { "place": "Hamburg", "state": "Hamburg", "country": "DE" }, "address": { "street_1": "Königstraße 10", "city": "Hamburg", "state": "Hamburg", "zip_code": "20095", "country": "DE" } } }, { "roles": ["UltimateBeneficialOwner"], "share_percentage": 40, "beneficiary_info": { "type": "Person", "first_name": "Sophie", "last_name": "Weber", "date_of_birth": "1990-07-14", "email_address": "sophie@acme.com", "phone_number": "+4915155556666", "identity_country_code": "DE", "nationality_country_code": "DE", "tax_jurisdiction_country_code": "DE", "birth_place": { "place": "Frankfurt", "state": "Hessen", "country": "DE" }, "address": { "street_1": "Goethestraße 8", "city": "Frankfurt", "state": "Hessen", "zip_code": "60313", "country": "DE" } } } ] ``` When a legal entity owns or controls the company, give it the `Shareholder` role and set `type: "Business"` in `beneficiary_info`. The business variant carries a full `company_data` for that entity: its `company_info`, its own `beneficiaries`, and its own `documents`. The natural persons who are UBOs through the corporate chain appear inside the nested entity: ```json theme={null} "beneficiaries": [ { "roles": ["Director"], "beneficiary_info": { "type": "Person", "first_name": "Jane", "last_name": "Smith", "date_of_birth": "1985-03-22", "email_address": "jane@acme.com", "phone_number": "+4915112345678", "identity_country_code": "DE", "nationality_country_code": "DE", "tax_jurisdiction_country_code": "DE", "birth_place": { "place": "Munich", "state": "Bavaria", "country": "DE" }, "address": { "street_1": "Unter den Linden 42", "city": "Berlin", "state": "Berlin", "zip_code": "10117", "country": "DE" } } }, { "roles": ["Shareholder"], "share_percentage": 100, "beneficiary_info": { "type": "Business", "company_data": { "company_info": { "company_name": "Acme Holdings GmbH", "registration_number": "HRB987654", "country": "DE", "incorporation_date": "2015-01-10", "legal_address": "Kurfürstendamm 50, 10707 Berlin", "postal_address": "Kurfürstendamm 50, 10707 Berlin", "address": { "street_1": "Kurfürstendamm 50", "city": "Berlin", "state": "Berlin", "zip_code": "10707", "country": "DE" }, "email": "info@acme-holdings.com", "tax_identification_number": "DE987654321", "website": "https://www.acme-holdings.com", "company_type": "LimitedLiabilityCompany" }, "beneficiaries": [ { "roles": ["Director", "UltimateBeneficialOwner"], "share_percentage": 100, "beneficiary_info": { "type": "Person", "first_name": "Max", "last_name": "Müller", "date_of_birth": "1978-11-05", "email_address": "max@acme-holdings.com", "phone_number": "+4915198765432", "tax_jurisdiction_country_code": "DE", "birth_place": { "place": "Hamburg", "state": "Hamburg", "country": "DE" }, "address": { "street_1": "Königstraße 10", "city": "Hamburg", "state": "Hamburg", "zip_code": "20095", "country": "DE" } } } ], "documents": [ { "type": "IncorporationCert", "country": "DE", "file": "" }, { "type": "IncorporationArticles", "country": "DE", "file": "" }, { "type": "ShareholderRegistry", "country": "DE", "file": "" }, { "type": "DirectorsRegistry", "country": "DE", "file": "" } ] } } } ] ``` Each corporate owner carries its own `company_data.documents` and `beneficiaries`. The same document groups and beneficiary requirements apply at every level of the structure. The natural persons who ultimately own 25%+ through the chain must appear as UBOs. ### Business API Field Reference The request envelope has four top-level fields beyond `type`: | Field | Type | Required | Description | | --------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------- | | `company_data` | object | Yes | Company identity, beneficiaries, and documents (`company_info`, `beneficiaries`, `documents`) | | `phone` | string | Yes | Company phone number (international format) | | `ip_address` | string | Yes | IP address of the device used to submit the identification | | `questionnaire` | object | Yes | KYB compliance questionnaire. Set `type` to `Generic` (all company types except sole proprietorships) or `SoleProp` | These fields live under `company_data.company_info`. | Field | Type | Description | | --------------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `company_name` | string | Legal name of the company | | `alternative_names` | string\[] | Optional list of trading or alternative names | | `registration_number` | string | Number assigned at legal registration | | `country` | string | ISO 3166-1 alpha-2 country code of registration | | `incorporation_date` | string | Date of incorporation (YYYY-MM-DD) | | `legal_address` | string | Address used during legal registration | | `postal_address` | string | Postal address of the company | | `address` | object | Structured address (`street_1`, `street_2`, `city`, `state`, `zip_code`, `country`) | | `email` | string | Company email address | | `tax_identification_number` | string | Tax ID of the company | | `website` | string | Company website URL | | `company_type` | enum | `LimitedLiabilityCompany`, `PubliclyListedCompany`, `SoleProprietorship`, `Partnership`, `Corporation`, `Trust`, `PrivateFoundation`, `Charity`, `NonprofitCorporation`, `NonprofitOrganization`, `PublicAgenciesOrAuthorities`, `StockCorporationOutOfStock`, `GeneralCorporation` | The `company_data.beneficiaries` array contains one or more `CompanyBeneficiary` objects representing UBOs, directors, representatives, or corporate shareholders. Each business level holds up to 5 beneficiaries and at most one business beneficiary, and businesses nest at most two levels below the root company. The `Director` role is only valid on person beneficiaries, and each nested business beneficiary must include at least one person with the `Director` role. Requests outside these bounds are rejected with `400`. #### `CompanyBeneficiary` | Field | Type | Required | Description | | ------------------ | ------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `roles` | enum\[] | Yes | One or more of: `UltimateBeneficialOwner`, `Director`, `Representative`, `Shareholder` | | `share_percentage` | decimal | Conditional | Ownership percentage, 0-100. Combined `UltimateBeneficialOwner` shares must not exceed 100 per company, at the root and at every nested level. Required when roles include `UltimateBeneficialOwner`. | | `beneficiary_info` | object | Yes | Person or Business info. | | `attesting_party` | boolean | No | Marks this beneficiary as certifying the beneficial-ownership information (31 CFR 1010.230). At most one per submission: a root-level person beneficiary with the `Director` role. Used by US companies without an `IncorporationArticles` document: see [Company Documents](#company-documents). | | `attested_at` | string | Conditional | RFC 3339 timestamp of when the beneficiary certified the information. Must be in the past. Required when `attesting_party` is `true`. | The `beneficiary_info` field is a discriminated union. Set `"type": "Person"` for an individual or `"type": "Business"` for a corporate owner, which carries a nested `company_data`. #### `PersonBeneficiaryInfo` Used when the beneficial owner is a natural person. | Field | Type | Required | Description | | ------------------------------- | ------ | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `type` | string | Yes | Must be `"Person"` | | `first_name` | string | Yes | First name | | `last_name` | string | Yes | Last name | | `middle_name` | string | No | Middle name | | `date_of_birth` | string | Yes | Date of birth in `YYYY-MM-DD` format | | `tax_identification_number` | string | Conditional | SSN for US persons, otherwise a national TIN. Required for `Director` and `UltimateBeneficialOwner` person beneficiaries when the root company is registered outside the US, and always for sole proprietors. See [Required Information by Party Type](#required-information-by-party-type). | | `email_address` | string | Yes | Email address | | `phone_number` | string | Yes | Phone number in international format (e.g. `+4915112345678`) | | `tax_jurisdiction_country_code` | string | Yes | ISO 3166-1 alpha-2 country code of tax jurisdiction | | `birth_place` | object | Yes | Place of birth (see `BirthPlace` below) | | `address` | object | Yes | Residential address (see `Address` below) | | `identity` | object | Yes | Identity document and biometric data (see `BeneficiaryIdentity` below) | | `proof_of_address` | string | Conditional | Base64-encoded proof of address document, 10 MB max. Requirement depends on the root company's country and the beneficiary's roles: see [Required Information by Party Type](#required-information-by-party-type). A missing required proof of address holds the identification at `Pending` with a resume URL. | #### `BeneficiaryIdentity` The `identity` object on a person beneficiary. | Field | Type | Required | Description | | ------------------------- | ------ | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `identity_country_code` | string | Yes | ISO 3166-1 alpha-2 country code of the identity document | | `identity_document_type` | enum | Yes | `Passport`, `NationalId`, or `DriverLicense`. `ResidencePermit` is rejected. Beneficiaries of US companies (except sole proprietorships) need `Passport` or `DriverLicense`: see [Identity Verification](#identity-verification-/-liveness-check). | | `identity_document_front` | string | Yes | Base64-encoded image of the document front, 10 MB max | | `identity_document_back` | string | Conditional | Base64-encoded image of the document back, 10 MB max. Required for `NationalId` and `DriverLicense`. `Passport` needs the front only. | | `identity_number` | string | No | Number printed on the identity document | | `selfie` | string | Conditional | Base64-encoded selfie, 10 MB max. Required unless the beneficiary's only role is `UltimateBeneficialOwner`. UBO-only beneficiaries omit it. | | `selfie_collected_at` | string | Conditional | ISO 8601 timestamp of when the selfie was captured. Provide it together with `selfie`. | | `nationality` | string | Yes | ISO 3166-1 alpha-2 country code of nationality | #### `BusinessBeneficiaryInfo` Used when a beneficial owner is a legal entity (corporate shareholder). It carries a full `company_data` with the same shape as the top level, so the same information is collected at every level of the corporate structure. | Field | Type | Required | Description | | -------------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `type` | string | Yes | Must be `"Business"` | | `company_data` | object | Yes | `company_info`, `beneficiaries`, and `documents` for this entity. Same schema as the top-level `company_data`. Nesting continues through further business beneficiaries. | Each corporate owner carries its own `company_data.documents` and `beneficiaries`. The same document groups and beneficiary requirements apply at every level of the structure. The natural persons who ultimately own 25%+ through the chain must appear as UBOs. #### `BirthPlace` | Field | Type | Required | Description | | --------- | ------ | -------- | ------------------------------- | | `place` | string | Yes | City or town of birth | | `state` | string | Yes | State or region of birth | | `country` | string | Yes | ISO 3166-1 alpha-2 country code | #### `Address` | Field | Type | Required | Description | | ---------- | ------ | -------- | ------------------------------- | | `street_1` | string | Yes | Street address | | `street_2` | string | No | Additional street address | | `city` | string | Yes | City | | `state` | string | Yes | State, province, or region | | `zip_code` | string | Yes | Postal / ZIP code | | `country` | string | Yes | ISO 3166-1 alpha-2 country code | The `company_data.documents` array contains up to 4 `CompanyDocParams` objects. Each document is uploaded as a base64-encoded file. Documents are optional at submission: an incomplete set for the company's region holds the identification at `Pending` with a resume URL. See [Company Documents](#company-documents) for the groups required per region. #### `CompanyDocParams` | Field | Type | Required | Description | | --------- | ------ | -------- | ------------------------------------------------------------------ | | `type` | enum | Yes | Document type (see table below) | | `country` | string | Yes | ISO 3166-1 alpha-2 country code of the issuing country | | `file` | string | Yes | Base64-encoded document content **without** the `data:` URI prefix | #### Upload requirements * Maximum file size: **10 MB** per document (after base64 decoding) * Maximum 4 documents per company. The limit applies separately to the root company and to each nested business beneficiary. More than 4 is rejected with `400`. * Encoding: standard base64 (no `data:application/pdf;base64,` prefix) * Supported formats: PDF, JPEG, PNG #### Document types | Value | Description | | ----------------------------- | ------------------------------------------------------------------- | | `PowerOfAttorney` | Power of attorney | | `TransparencyRegistryExtract` | Recent excerpt from a transparency company registry | | `DirectorsRegistry` | Directors registry | | `GoodStandingCert` | Certificate of good standing | | `IncorporationArticles` | Memorandum, articles of incorporation, association, or registration | | `IncorporationCert` | Certificate of incorporation or registration | | `IncumbencyCert` | Certificate of incumbency | | `InformationStatement` | Statement of information | | `PartnershipAgreement` | Partnership agreement | | `ProofOfAddress` | Proof of address (e.g. utility bill, rent contract) | | `ProofOfNatureOfBusiness` | Proof of nature of business | | `RegulatoryLicense` | Regulatory or operating license | | `SelfDeclarationForm` | Self-declaration form | | `ShareholderRegistry` | Shareholder registry | | `StateRegistry` | Recent excerpt from a state company registry | | `TradeLicense` | Commercial or trading license | | `TrustAgreement` | Trust agreement | | `Other` | Other document not covered by the types above | The `BusinessQuestionnaire` object is a required compliance questionnaire structured into three sections. Each section collects specific regulatory information about the business. Set `type` to `Generic` for all company types except sole proprietorships, or `SoleProp` for sole proprietorships. ```json theme={null} { "questionnaire": { "type": "Generic", "business_details": { ... }, "planned_activities": { ... }, "source_of_funds": { ... } } } ``` #### `business_details` Industry classification and operational information about the company. | Field | Type | Required | Description | | ------------------------------- | --------- | -------- | ------------------------------------------------------------------------- | | `industry_type` | enum | Yes | Industry sector classification (see values below) | | `business_model_description` | string | Yes | Description of the business model and target clients | | `main_business_countries` | string\[] | Yes | ISO 3166-1 alpha-2 country codes where the company primarily operates | | `has_licenses_or_registrations` | boolean | Yes | Whether the company currently holds any licenses or registrations | | `requires_aml_program` | boolean | Yes | Whether the company is required to maintain an AML/CFT compliance program | | `estimated_annual_revenue` | enum | Yes | Estimated annual revenue bracket in EUR | **`industry_type` values:** `Agriculture`, `Automotive`, `BankingAndFinancialServices`, `ConstructionAndRealEstate`, `CryptocurrencyAndBlockchain`, `CryptocurrencyMining`, `DecentralisedFinance`, `NftPlatforms`, `CryptoPaymentProcessors`, `CryptoWalletProviders`, `CryptoExchanges`, `CryptoCustodyServices`, `EcommerceAndOnlineMarketplaces`, `EducationAndTraining`, `EnergyAndUtilities`, `EntertainmentAndMedia`, `GamingAndEsports`, `HealthcareAndPharmaceuticals`, `HospitalityAndTourism`, `InformationTechnologyAndSoftware`, `Insurance`, `LegalAndProfessionalServices`, `LogisticsAndTransportation`, `ManufacturingAndIndustrial`, `MetaversePlatforms`, `MiningAndNaturalResources`, `NonProfitAndCharitable`, `RetailAndWholesaleTrade`, `Telecommunications`, `VentureCapitalAndPrivateEquity`, `CasinosAndGambling`, `MoneyServiceBusinesses`, `SocialMediaAndNetworking`, `CrowdfundingPlatforms`, `RegTech`, `Other` **`estimated_annual_revenue` values:** | Value | Range | | --------------- | ---------------------------- | | `Under100K` | 0 - 99,999 EUR | | `From100KTo1M` | 100,000 - 999,999 EUR | | `From1MTo10M` | 1,000,000 - 9,999,999 EUR | | `From10MTo50M` | 10,000,000 - 49,999,999 EUR | | `From50MTo250M` | 50,000,000 - 249,999,999 EUR | | `Over250M` | 250,000,000+ EUR | #### `planned_activities` Information about the company's intended account use and expected transaction patterns. | Field | Type | Required | Description | | -------------------------------------------- | ------- | ----------- | ---------------------------------------------------------------------------------------------------------------------- | | `purpose_and_intended_use` | enum | Yes | Primary purpose of the business account | | `estimated_monthly_volume` | enum | Yes | Expected monthly transaction volume in EUR | | `estimated_monthly_transactions` | enum | Yes | Expected number of transactions per month | | `sends_funds_on_customer_behalf` | boolean | Yes | Whether the company sends funds on behalf of customers or third parties | | `sends_funds_on_customer_behalf_description` | string | Conditional | Required if `sends_funds_on_customer_behalf` is `true`. Describe how funds are sent. | | `flow_of_funds_diagram` | string | Conditional | Base64-encoded flow of funds diagram, 10 MB max. Required if `sends_funds_on_customer_behalf` is `true`. | | `source_of_funds_document` | string | Conditional | Base64-encoded source of funds supporting document, 10 MB max. Required if `sends_funds_on_customer_behalf` is `true`. | **`purpose_and_intended_use` values:** `ReceivingBusinessIncome`, `BusinessPurchasesAndExpenses`, `EmployeeAndContractorPayouts`, `EcommerceSales`, `TreasuryManagement`, `PaymentIntermediary`, `Investments`, `TaxPlanning`, `AssetProtection`, `Other` **`estimated_monthly_volume` values:** | Value | Range | | -------------------------------------- | --------------------- | | `TenToTwentyFiveThousand` | 10,000 - 25,000 EUR | | `TwentyFiveToFiftyThousand` | 25,000 - 50,000 EUR | | `FiftyToOneHundredThousand` | 50,000 - 100,000 EUR | | `OneHundredToTwoHundredFiftyThousand` | 100,000 - 250,000 EUR | | `TwoHundredFiftyToFiveHundredThousand` | 250,000 - 500,000 EUR | | `MoreThanFiveHundredThousand` | 500,000+ EUR | **`estimated_monthly_transactions` values:** | Value | Range | | -------------------- | ------------- | | `LessThanTen` | Fewer than 10 | | `TenToTwentyFive` | 10 - 25 | | `TwentyFiveToFifty` | 25 - 50 | | `FiftyToOneHundred` | 50 - 100 | | `MoreThanOneHundred` | More than 100 | #### `source_of_funds` Information about where the company's funds originate. | Field | Type | Required | Description | | --------------------------------- | ------ | -------- | --------------------------------------------------------------------------------- | | `source_of_funds` | enum | Yes | Primary source of the company's funds | | `source_of_funds_description` | string | Yes | Detailed description of the source of funds | | `customer_funds_handling_details` | string | Yes | How customer funds are handled, including the business model and transaction flow | **`source_of_funds` values:** `BusinessRevenue`, `ShareholderFunds`, `VcPrivateEquity`, `AssetSale`, `IcoProceeds`, `CryptoActivityProceeds`, `LoanProceeds`, `Other` *** ## Standard KYB Requirements ### Company Information * Country * Company name * Registration number * Company registration address * Company operations address * Type of entity * Date of registration * Website * Company email * Tax ID ### Company Documents Company documents fall into four groups. Which groups you need depends on where the root company is registered and its type. The same required set applies at every business level: the root company and each nested business beneficiary, even when a nested entity is registered in a different country. | Company profile | Required document groups | | ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | Registered outside the US, all types except sole proprietorships | One document from each group: Company Details, Legal Presence, Ownership Structure, Control and Management Structure | | Registered in the US, all types except sole proprietorships | One document from each group: Company Details, Legal Presence. With a CDD attestation, Company Details only (see the note below). | | Sole proprietorship, any country | Incorporation certificate (`IncorporationCert`) | A submission missing a required group is created as `Pending` with a resume URL. It is not rejected. See [Incomplete Submissions](#incomplete-submissions). US companies (except sole proprietorships) can satisfy the Legal Presence group without an `IncorporationArticles` document. Designate one root person beneficiary holding the `Director` role as the attesting party: set `attesting_party: true` and `attested_at` on them, after presenting the collected beneficial-ownership information to them for confirmation. Iron generates a CDD certification (31 CFR 1010.230) from the submitted data and files it in place of the incorporation articles. This path requires a `share_percentage` on every UBO, at least one UBO at 25% or more, an SSN for each listed US person (a tax or identity document number otherwise), and at most two levels of beneficiaries. A submission that cannot produce the certification is rejected with `400`. Accepted document types: * Incorporation certificate (`IncorporationCert`) * Excerpt from a state company registry (`StateRegistry`) * Certificate of good standing (`GoodStandingCert`) Accepted document types: * Articles and memorandum of association (`IncorporationArticles`) Accepted document types: * Shareholder registry (`ShareholderRegistry`) * Statement of information (`InformationStatement`) * Trust agreement (`TrustAgreement`) * Certificate of incumbency (`IncumbencyCert`) The document must list all shareholders with their ownership percentages (totaling 100%), be dated within the last 12 months, and signed by a director unless publicly available. **KYC checks:** Each UBO with 25%+ ownership and all company directors must complete KYC (Proof of ID + Proof of Address) and be individually approved before onboarding. If there is no UBO who owns 25%+, all UBOs with 10%+ ownership must be verified. **KYB checks:** Apply to all legal entities in the ownership chain. For each additional entity, the same information is required unless ownership can be verified through open sources. Accepted document types (any that contains information about appointed directors): * Director registry (`DirectorsRegistry`) * Trust agreement (`TrustAgreement`) * Statement of information (`InformationStatement`) * Certificate of incumbency (`IncumbencyCert`) ### Business Questionnaire | Section | Question | Answers | | -------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Business information | Industry type | Agriculture, Automotive, Banking and Financial Services, Construction and Real Estate, Cryptocurrency and Blockchain, Cryptocurrency Mining, DeFi, NFT Platforms, Crypto Payment Processors, Crypto Wallet Providers, Crypto Exchanges, Crypto Custody Services, E-commerce and Online Marketplaces, Education and Training, Energy and Utilities, Entertainment and Media, Gaming and Esports, Healthcare and Pharmaceuticals, Hospitality and Tourism, Information Technology and Software Development, Insurance, Legal and Professional Services, Logistics and Transportation, Manufacturing and Industrial, Metaverse Platforms, Mining and Natural Resources, Non-Profit and Charitable Organizations, Retail and Wholesale Trade, Telecommunications, Venture Capital and Private Equity, Casinos and Gambling, Money Service Businesses, Social Media and Networking Platforms, Crowdfunding Platforms, RegTech, Other | | Business information | Business description | Free text | | Business information | Main countries of operation | Dropdown country selection | | Business information | Licensed or registered | Yes / No | | Business information | Licenses or registrations required in jurisdiction | Yes / No | | Business information | Estimated annual revenue | Up to 99,999 EUR, 100,000-999,999 EUR, 1,000,000-9,999,999 EUR, 10,000,000-49,999,999 EUR, 50,000,000-249,999,999 EUR, More than 250,000,000 EUR | | Source of funds | Source of funds | Business revenue, Shareholder funds, VC or private equity, Sale of assets, ICO proceeds, Crypto related income, Loan proceeds, Other | | Source of funds | Customer funds details | Free text | | Planned activities | Purpose and intended use | Receiving income, Expenses, Payouts, E-commerce sales, Treasury management, Payment intermediary, Investments, Tax planning, Asset protection, Other | | Planned activities | Estimated monthly volume | 10,000-25,000 EUR, 25,000-50,000 EUR, 50,000-100,000 EUR, 100,000-250,000 EUR, 250,000-500,000 EUR, More than 500,000 EUR | | Planned activities | Monthly transaction count | Less than 10, 10-25, 25-50, 50-100, More than 100 | | Planned activities | Send funds on behalf of customers | Yes / No | Upload Source of Funds document is only required for Euro 3rd party payout. ### Associated Parties | Party Type | Description | | ------------------------------- | ----------------------------------------------------------------------------------------------- | | UBO (Ultimate Beneficial Owner) | Always a natural person. Direct or indirect ownership above 25% (or 10% in high-risk cases). | | Director | Individual(s) formally appointed as director(s). | | Representative | Authorized individual acting on behalf of the company. | | Shareholder | Direct ownership above 25%. A legal entity, or a natural person whose only role is shareholder. | Example: Business Customer → owned by Company A → John Smith owns Company A → Company A is Shareholder, John Smith is UBO. ### Required Information by Party Type * First name * Last name * Middle name * Date of birth * Email * Contact number * Nationality * Percentage of ownership * Tax ID: SSN for US persons, otherwise a national TIN. Required when the root company is registered outside the US, and always for a sole proprietor. Optional for beneficiaries of US companies. * Address details * Proof of Address, not older than 90 days, when required (see the note below) * First name * Last name * Middle name * Date of birth * Email * Contact number * Nationality * Tax ID: required for a `Director` when the root company is registered outside the US and is not a sole proprietorship. Not required for a `Representative`. * Address details * Proof of Address, not older than 90 days, when required (see the note below) * Country * Company name * Registration number * Certificate of incorporation * Shareholder Registry or Register of Members or Excerpt from state companies registry (if it contains ownership data) Proof of address for person beneficiaries depends on the root company's registration country. Non-US companies: every person beneficiary provides one. US companies: only person beneficiaries whose only role is `Shareholder`. US sole proprietorships: none. A missing required proof of address holds the identification at `Pending` with a resume URL. ### Identity Verification / Liveness Check For business customers, there are typically 2-3 types of people to identify, depending on whether an authorized representative is appointed: | Party | Requirements | | ------------------------- | ---------------------------------------------------------------------------------------- | | Director(s) | ID collection + liveness check | | UBO(s) | ID collection (liveness check may be required in high-risk cases, or if also a director) | | Authorized Representative | ID collection + liveness check + power of attorney signed by the company's director | Accepted identity documents are `Passport`, `NationalId`, and `DriverLicense`. `ResidencePermit` is rejected. Beneficiaries of US companies (except sole proprietorships) need a `Passport` or `DriverLicense`: another accepted type is not rejected, the identification is held at `Pending` with a resume URL to collect the right document. ### Sole Proprietor Onboarding Sole proprietors use the same onboarding paths as any other business. Pass `company_type: "SoleProprietorship"` to the Hosted Link flow or the Programmatic Business API. The Hosted Link flow automatically adapts its UI to a streamlined collection. The Programmatic API uses the same wire schema as any business: by convention, the proprietor is submitted as a single beneficiary with the `UltimateBeneficialOwner` role at 100% share. For sole proprietors, set `questionnaire.type` to `"SoleProp"`. This is a simplified variant of the business questionnaire with fewer required fields. Sole proprietorships need one company document: the incorporation certificate (`IncorporationCert`). US sole proprietors do not provide a beneficiary proof of address. Non-US sole proprietors can omit it at submission and supply it through the resume URL. The hosted sole-proprietor flow walks the customer through four verification steps: * Country * Company name * Incorporated on * Registration number * Website * Custom field: Doing Business As Sole Proprietor Information (sets `questionnaire.type` to `"SoleProp"`). * Certificate of incorporation or registration The proprietor as a single UBO: * First name * Last name * Date of birth * Email * Phone * TIN ```json theme={null} { "type": "Business", "phone": "+12175550100", "ip_address": "203.0.113.42", "company_data": { "company_info": { "company_name": "Jane's Consulting", "alternative_names": null, "registration_number": "DBA-12345678", "country": "US", "incorporation_date": "2020-01-15", "legal_address": "123 Main St, Springfield, IL 62701", "postal_address": "123 Main St, Springfield, IL 62701", "address": { "street_1": "123 Main St", "street_2": null, "city": "Springfield", "state": "IL", "zip_code": "62701", "country": "US" }, "email": "jane@janesconsulting.com", "tax_identification_number": "12-3456789", "website": "https://janesconsulting.com", "company_type": "SoleProprietorship" }, "beneficiaries": [ { "roles": ["UltimateBeneficialOwner"], "share_percentage": 100, "beneficiary_info": { "type": "Person", "first_name": "Jane", "middle_name": null, "last_name": "Doe", "date_of_birth": "1985-06-15", "tax_identification_number": "123-45-6789", "address": { "street_1": "123 Main St", "street_2": null, "city": "Springfield", "state": "IL", "zip_code": "62701", "country": "US" }, "email_address": "jane@janesconsulting.com", "phone_number": "+12175550100", "tax_jurisdiction_country_code": "US", "birth_place": { "place": "Chicago", "state": "IL", "country": "US" }, "identity": { "identity_country_code": "US", "identity_number": null, "identity_document_type": "Passport", "identity_document_front": "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAFklEQVR42mP4z8BAEmIY1TCqYfhqAACQ+f8B8u7oVwAAAABJRU5ErkJggg==", "identity_document_back": null, "nationality": "US" } } } ], "documents": [ { "type": "IncorporationCert", "country": "US", "file": "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAFklEQVR42mP4f+A0SYhhVMOohuGrAQDBXYofzKX3pgAAAABJRU5ErkJggg==" } ] }, "questionnaire": { "type": "SoleProp", "planned_activities": { "purpose_and_intended_use": "ReceivingBusinessIncome", "estimated_monthly_volume": "TenToTwentyFiveThousand", "estimated_monthly_transactions": "LessThanTen" }, "source_of_funds": { "source_of_funds": "BusinessRevenue" }, "business_details": { "industry_type": "LegalAndProfessionalServices", "business_model_description": "Independent consulting services for small businesses", "main_business_countries": ["US"], "estimated_annual_revenue": "Under100K" } } } ``` ```json theme={null} { "type": "Business", "phone": "+442071234567", "ip_address": "203.0.113.42", "company_data": { "company_info": { "company_name": "Jane's Consulting Ltd", "alternative_names": null, "registration_number": "SC123456", "country": "GB", "incorporation_date": "2020-01-15", "legal_address": "10 Downing Street, London, SW1A 2AA", "postal_address": "10 Downing Street, London, SW1A 2AA", "address": { "street_1": "10 Downing Street", "street_2": null, "city": "London", "state": "London", "zip_code": "SW1A 2AA", "country": "GB" }, "email": "jane@janesconsulting.co.uk", "tax_identification_number": "GB123456789", "website": "https://janesconsulting.co.uk", "company_type": "SoleProprietorship" }, "beneficiaries": [ { "roles": ["UltimateBeneficialOwner"], "share_percentage": 100, "beneficiary_info": { "type": "Person", "first_name": "Jane", "middle_name": null, "last_name": "Doe", "date_of_birth": "1985-06-15", "tax_identification_number": "GB987654321", "address": { "street_1": "10 Downing Street", "street_2": null, "city": "London", "state": null, "zip_code": "SW1A 2AA", "country": "GB" }, "email_address": "jane@janesconsulting.co.uk", "phone_number": "+442071234567", "tax_jurisdiction_country_code": "GB", "birth_place": { "place": "Manchester", "state": "England", "country": "GB" }, "identity": { "identity_country_code": "GB", "identity_number": null, "identity_document_type": "Passport", "identity_document_front": "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAFklEQVR42mP4z8BAEmIY1TCqYfhqAACQ+f8B8u7oVwAAAABJRU5ErkJggg==", "identity_document_back": null, "nationality": "GB" }, "proof_of_address": "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAFUlEQVR42mNgYPhPIhrVMKph2GoAAJLb/wHQPqPSAAAAAElFTkSuQmCC" } } ], "documents": [ { "type": "IncorporationCert", "country": "GB", "file": "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAFklEQVR42mP4f+A0SYhhVMOohuGrAQDBXYofzKX3pgAAAABJRU5ErkJggg==" } ] }, "questionnaire": { "type": "SoleProp", "planned_activities": { "purpose_and_intended_use": "ReceivingBusinessIncome", "estimated_monthly_volume": "TenToTwentyFiveThousand", "estimated_monthly_transactions": "LessThanTen" }, "source_of_funds": { "source_of_funds": "BusinessRevenue" }, "business_details": { "industry_type": "LegalAndProfessionalServices", "business_model_description": "Independent consulting services for small businesses", "main_business_countries": ["GB"], "estimated_annual_revenue": "Under100K" } } } ``` ## Enhanced KYB Due Diligence Business customer risk is defined through a customer risk rating process, calculating the risk score based on different factors: geography, industry, use of product, expected activities, legal form, etc. | Requirement | Details | | ---------------- | -------------------------------------------------------------------------------- | | KYB Information | Standard KYB | | UBO Information | Individuals holding 10%+ ownership | | Source of Wealth | Financial document outlining the corporate entity's ability to continue business | ## Appendix ### Prohibited Industries The following business activities are prohibited from using Iron's services to ensure alignment with regulatory expectations and Iron's risk appetite. * Adult entertainment and dating services (dating apps, matchmaking sites, coaching/advice providers) * Sexual services (anything which implies sex as a service) * Marijuana/Cannabis/CBD industry (including cannabis paraphernalia) * Production or trade in tobacco (cigarettes, cigars, e-cigarettes, vapes, vape liquids) - vape hardware not included * Production or trade in weapons and munitions, including explosives and nuclear weapons * Arms/Defense/Military * Private military/Security contractors * Car dealers * Antique brokers * Jewellery or watch dealers * Precious metal and/or gem dealers * Pre-paid cards * Religious organizations * Multi-Level Marketing (MLM) structures * Financial pyramid or Ponzi schemes, matrix programs, and other similar schemes * Unlicensed Forex/Binary Options * Drugs, as well as chemicals used to manufacture synthetic drugs * Commercial activity which infringes on copyrighted material * Alternative medicines (e.g. homeopathy) * Financial services (loan lenders, payday loans companies, debt/credit consolidation companies, debt collection agencies) ### Business Ownership and Constitutional Documents To comply with Iron's KYB requirements, all businesses must provide clear, official documentation that reliably verifies their complete ownership structure, ultimate beneficial owners (UBOs), controlling individuals, and confirms the existence and ongoing operations of the legal entity. If the entity does not have individual beneficial shareholders, we will need to confirm the individuals who significantly control the entity instead, such as its directors and officers. **Supported entity types:** * Sole Proprietorships * Partnerships * LLCs & Corporations * Trusts * Nonprofits * DAOs * Cooperatives ### Required Documentation per Entity Type * Official sole proprietorship license or registration document clearly naming the sole proprietor and confirming active operation * Recent tax filings or official government-issued documents linking the proprietor to business operations * Partnership agreements officially certified or notarized, detailing partners and ownership shares * Officially issued partnership registration certificates clearly listing partners and their shares * Articles of Incorporation or Articles of Organization issued by the official business registry, clearly listing shareholders/members * Official shareholder/membership register or certified extracts from commercial registries clearly indicating owners and ownership percentages * Share certificates officially verified or notarized * Recent audited financial statements (for publicly traded or regulated entities), confirming the company's operations and ownership * Official trust deed or certificate clearly identifying trustees, settlors, protectors (if applicable), and beneficiaries * Notarized trustee affidavit clearly verifying trustee identity, roles, and authorities * Official formation documents (e.g., Articles of Incorporation) clearly listing controlling individuals (e.g., directors or board members) * Government-issued or officially filed annual reports or governance documents confirming ongoing operations and key individuals * Official governance documents or independently audited membership agreements clearly outlining membership, control mechanisms, and operational status * Official formation documents clearly identifying cooperative members * Independently certified membership ledgers or agreements clearly indicating members and voting rights ### Document Verification Standards All provided documents must be issued by an official governmental authority and, where applicable, certified by a notary public, lawyer, auditor, or similar independent professional, with Apostille certification where applicable. * Must be officially issued by governmental authorities * Must be verifiable online through an official registry or database (if not possible, must be independently certified) * Apostille certification or equivalent legalization required where applicable * Self-generated or internally-produced documents are NOT acceptable * Must clearly display the full legal name and registration code of the business entity * If ownership structure involves more than two layers, a clear organizational chart with ownership percentages is required * Must be recent (issued within the past three months) * Documents not in English must include certified translations Documents must clearly confirm: * The legal existence of the entity * Its current operational status * Clear identification of ultimate beneficial owners, controlling individuals, and precise ownership percentages * Self-generated, internal, unsigned, or informal documents * Simple printouts, screenshots, or unofficial emails * Internally prepared capitalization tables (unless provided by reputable equity management services) ### Requirements for Regulated Entities Entities that operate under regulatory supervision must provide additional documentation to confirm their licensing status and compliance with AML/CFT regulations. #### Regulatory Licenses and Authorizations A valid license or authorization issued by the relevant financial regulator or supervisory authority permitting the entity to conduct its business activities. If the license or authorization is not publicly accessible online, it must be certified by the issuing authority or a notary public. #### AML/CFT Policy and Procedures A copy of the entity's internal AML/CFT policy, outlining its approach to: * Customer due diligence (CDD) and enhanced due diligence (EDD) * Transaction monitoring processes * Suspicious activity reporting procedures * Sanctions screening and PEP checks - The policy must be approved by senior management and aligned with the applicable jurisdiction's AML laws and regulations - Licenses and authorizations must be verifiable online (if not, must be certified by the issuing authority, a notary public, or a licensed legal/audit professional) - The submitted AML/CFT policy must be an officially approved internal document (not a draft or template)