What know-your-business checks are, what Uzbek AML law asks about a legal entity's owners and authority, and how an organisation's Finmind account is reviewed.
In short
KYB checks that an organisation exists, is licensed, who controls it and whether the person acting for it is authorised.
Uzbek anti-money-laundering law requires obliged firms to identify the owners of a legal entity and refuse when they cannot.
Reviewers use the STIR, the regulator's licence registers, openinfo.uz disclosures and sanctions lists.
A platform that holds an organisation's data and contracts verifies too, to protect that data and stop impersonation.
Finmind combines advisory automatic pre-checks with a manual checklist, and some organisation types need two sysadmins to approve.
Start with a free Finmind account
It adds the market-wide order book and a practice simulator. Essentials, paid once, adds portfolio tracking from your broker's statements and orders through your own brokerage account. Premium adds valuation, the tax declaration and stop-loss orders.
What asset allocation is, how goals, time horizon and risk capacity shape your mix of cash, fixed income and shares, and what it means on the Uzbek market.
When an individual opens a brokerage account, the broker checks who they are. When an organisation signs up for a financial service, the provider has a harder question to answer: does this company exist, is it licensed for what it says it does, who controls it, and is the person in front of us allowed to act for it? That set of checks is called KYB, "know your business". This guide explains what KYB covers, what Uzbekistan's anti-money-laundering law says about legal entities, which public registers a reviewer can use, and how Finmind reviews an application for an organisation's Finmind account.
KYC and KYB: the difference
KYC (know your customer) verifies a person: identity documents, address, and sometimes the source of funds.
KYB (know your business) verifies an organisation and the people behind it. It has more layers:
the legal entity itself: its name, registration number, legal form, status and address;
its licence, where the activity is regulated;
the people who control it, its owners and management;
the authority of whoever acts for it, since an employee is not automatically entitled to bind the company;
screening of the entity and the key people against sanctions lists.
A KYB review therefore still includes KYC on individuals, but it asks who they are in relation to the company.
KYC and KYB
KYC
Verifies a person
Identity documents, address and sometimes the source of funds
KYB
Verifies an organisation and the people behind it
The legal entity, its licence, who controls it and who may act for it
Screens the entity and key people against sanctions lists
Still includes KYC on individuals, asking who they are in relation to the company
What Uzbek law says
The main law is No. 660-II of 26 August 2004 "On countering the legalisation of proceeds from criminal activity, the financing of terrorism and the financing of the proliferation of weapons of mass destruction", published on lex.uz. As read on 28 September 2026:
Who must apply it (Article 12). The law lists "organisations carrying out operations with money or other property". They include banks and other credit organisations, professional securities-market participants and the Central Securities Depository, exchange members, and insurers and insurance intermediaries, among others.
What customer due diligence includes (Article 7). Verifying the identity and authority of the customer and of the persons on whose behalf it acts, on the basis of documents; identifying the owner or the person who controls a legal-entity customer, by studying its ownership and management structure from its founding documents; and ongoing study of the business relationship and transactions to check they fit what is known about the customer.
Refusal (Article 12). If due diligence cannot be carried out, the organisation must refuse to carry out the operation or enter the relationship, end an existing one, and report a suspicious transaction to the designated state body.
Record keeping (Article 21). Identification data and due-diligence materials must be kept for the period set by law, and for at least five years after the operation or the end of the relationship.
Risk assessment (Article 7¹). The organisations covered must study and document their money-laundering risks at least once a year.
The institutions most likely to be Finmind's organisational users, such as banks, insurers, brokers and asset managers, are themselves obliged entities under this law. They know KYB from the other side of the table and usually expect a serious provider to do it too.
In Uzbekistan every legal entity has a nine-digit taxpayer identification number (STIR), assigned at state registration. A reviewer looks the STIR up in the state services and Tax Committee lookups and records the legal name, form, registration date, status (active or in liquidation) and registered address. A mismatch between the STIR and the name is a stop.
Is it licensed for what it does?
Regulated activities are checked in the regulator's own register. The National Agency of Perspective Projects (NAPP) regulates the capital market and insurance and publishes a register of professional securities-market participants on napp.uz. Banks are licensed by the Central Bank, whose list of banks is public. Licences are revoked from time to time, so the check is made at the time of review, not assumed from a website.
Who controls it?
Article 7's requirement to identify the owner or controlling person of a legal entity is what practitioners call beneficial ownership. For a listed joint-stock company, significant shareholders and management are also disclosed on openinfo.uz, as described in how to read openinfo disclosures. For a state body, the founding legal act on lex.uz takes the place of an ownership chart.
Is the person authorised?
A director named in the register can usually sign. Anyone else needs a power of attorney or a board decision. The contact person is confirmed through the organisation itself, for example by calling back a number published on its own website, never a number typed into the application.
Screening
The entity and its signatory are checked against sanctions lists such as the UN Security Council consolidated list.
The KYB checks
1Step 1: Does the entity exist?The STIR is looked up and the legal name, form, status and address are recorded; a mismatch between STIR and name is a stop.
2Step 2: Is it licensed?The licence is checked in the regulator's own register at the time of review.
3Step 3: Who controls it?The owner or controlling person is identified from the ownership and management structure.
4Step 4: Is the person authorised?A director named in the register, or a power of attorney or board decision; the contact is confirmed through the organisation itself.
5Step 5: Screening.The entity and its signatory are checked against sanctions lists.
Why a platform that is not a bank verifies too
An analytics platform does not move a client's money, but an organisation's Finmind account still carries weight:
other people's data. The workspace holds the organisation's portfolios, members and audit log. Verifying who controls it protects that data from someone who merely claims the company's name;
contracts. Features for organisations are provided under an agreement, and only an authorised signatory can make one;
impersonation. A fake "pension fund" or "bank" in a product built for institutions would damage everyone who relies on it;
fit. Checking what the organisation wants to use, before approval, avoids promising something the product does not do.
How Finmind reviews an organisation
The process is described on the /institutions page and runs today as follows.
Application. A public form at /institutions/apply asks for the entity and its STIR, the licence and its regulator, the applicant and the signatory, what the organisation wants to use, and three consents. A confirmation link goes to the work email, and nothing enters review until it is opened.
Automated pre-checks, advisory only. The system checks the STIR format and whether another application or organisation uses the same STIR, compares the email domain with the website, flags free email domains, and for a bank matches the name against the Central Bank registry the platform already holds. It calls no state system and decides nothing.
Manual review. A Finmind sysadmin works through a checklist: the entity exists and its STIR matches its name; the registered address matches; the licence is valid for the stated activity; the applicant works there; the signatory is authorised; screening; the domain; and whether the intended use is something the product does today. Each item is recorded with its evidence. A pension fund, a bank or an insurer needs the approval of two different sysadmins.
Approval and invitation. On approval, the person the signatory named receives the owner's invitation and an evaluation period begins.
Contract and activation. Seats, features and term are agreed in a contract off the platform. A sysadmin activates the organisation once it is recorded.
Applications are never deleted automatically, including rejected ones. Personal security still matters inside the organisation: members protect their own Finmind account with two-factor sign-in.
Frequently asked questions
KYC verifies an individual, usually from identity documents. KYB verifies an organisation: that it exists and is registered, that it holds any required licence, who owns and controls it, and that the person acting for it is authorised to do so.
Law No. 660-II of 26 August 2004 on countering the legalisation of criminal proceeds. Article 7 requires obliged organisations to identify the owner or controlling person of a legal-entity customer by studying its ownership and management structure from its founding documents.
Use the regulator's own register: NAPP publishes a register of professional securities-market participants on napp.uz, and the Central Bank publishes the list of licensed banks on cbu.uz. Check at the time you need it, because licences can be revoked.
No. Automated pre-checks only highlight issues for the reviewer. A Finmind sysadmin checks the entity, licence, applicant, signatory and screening by hand with evidence recorded, and a pension fund, bank or insurer needs two different sysadmins to approve.
This article is for education only and is not investment advice. Investing in securities involves risk, including the loss of money you invest.
Key terms in this post
Depository
The organisation that records who owns which securities. In Uzbekistan it is the Central Securities Depository.
