KYB Authorized Representative Identity Verification: Proving the Person and the Mandate

What Does KYB Authorized Representative Identity Verification Have to Prove?

It has to prove two separate facts and keep the evidence for each. The first is identity: the person in front of the camera matches a real, unexpired government ID and is physically present. The second is authority: that same person holds a current mandate to act for this legal entity, in this capacity, for this product. A business account opened by a real officer acting outside their mandate is as much a control failure as one opened by an impostor.

The two facts fail in different ways. Identity fails when someone presents a forged or GenAI-altered ID, a face swap, or a replayed video. Authority fails when someone presents a forged board resolution, a stale delegation, a compromised corporate email thread, or registry data that lags a recent change of directors. Workflows that collapse both into a single pass/fail field lose the ability to tell which one went wrong.

Treat the submitting representative as a role, not as the beneficial owner. Under FinCEN's CDD rule, a legal entity customer has one control-prong individual and up to four people who each own 25% or more, so the person filling in the form may be neither.

How Do Deepfakes and Forged Mandates Get Into Business Onboarding?

FinCEN's alert FIN-2024-Alert004, published 13 November 2024, says suspicious activity reports describing suspected deepfake media rose from 2023 into 2024, and that criminals used GenAI to alter or generate images on driver's licences and passports and then opened accounts to receive and launder proceeds of other frauds. Business accounts are attractive for this because they carry higher limits and are expected to move larger sums.

The alert lists red flags that apply directly to representative checks: a photo that looks altered or does not fit the stated date of birth, multiple identity documents that disagree, a customer who uses a third-party webcam plugin during a live verification, and a customer who asks to switch channels after repeated technical glitches. A webcam plugin lets the applicant feed pre-generated video into the session instead of a live camera, which is why liveness checks alone are not enough.

The authority side is older and lower-tech. The FBI's December 2024 public service announcement I-120324 describes criminals generating video for real-time calls with supposed company executives. A fraudster who can appear on video as a named director, and who also controls a lookalike email domain, can supply a convincing resolution and then confirm it on camera.

A Verification Sequence for Business Representatives

Order matters. Establish the entity first, then the person, then the link between them, and only then grant permissions scoped to the mandate you actually verified.

The step that catches most mandate fraud is the independent confirmation. Call or message the company using a number or address from the registry, an existing relationship record, or a public filing, and ask a known officer to confirm the representative and the scope of their authority. Never use contact details supplied in the same packet as the resolution, because the fraudster controls both.

• Verify the legal entity against the relevant company registry and keep the extract with its retrieval date.
• Identify beneficial owners and the control person under your jurisdiction's rules, and record how you reached the ownership figures.
• Verify the representative's identity with document checks plus a live selfie or video that is screened for deepfakes and injection.
• Collect the authority evidence (resolution, mandate, power of attorney) and confirm it through an independent contact route.
• Screen the entity, owners and representative for sanctions and adverse media.
• Grant roles, payment limits and user permissions that match the verified mandate, with an expiry or review date.

What Changes When the Representative Is Applying for a Business Loan?

Lending adds a third question on top of identity and authority: whether the financial evidence is real. A genuine employee may lack power to bind the company to debt, and a real director may submit altered bank statements or invoices. Each needs its own check, and a clean video call with the applicant does not repair a gap in any of them.

Before disbursement, confirm that the destination account belongs to the borrower, that guarantors were verified as individuals, and that the signatory on the facility agreement matches the person whose authority you confirmed. Small-business and MSME lending teams that onboard remotely face the same deepfake document and selfie risk as consumer lenders, with larger amounts at stake per approval.

Where Neural Defend NeuroVerify Fits in KYB

NeuroVerify handles the face part of representative identity. One API call checks the representative's selfie, video or audio and returns a unified risk score with signal-level evidence from six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Eligible image requests return in under 200 ms at p95 under defined test conditions, so the check fits inside a live onboarding flow.

The model behind it, ARCAS 1B, is described in a public arXiv paper that reports pooled accuracy of 99.99% on GenImage and 97.65% on OpenFake. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor. One VendorBench author also co-wrote the ARCAS paper; the corpus and results are public so any buyer can rerun them. VendorBench covers still images only, not video or injection.

NeuroVerify does not analyse ID documents and does not decide authority. If a submitted resolution or ID image needs forensic review, NeuroDetect can examine it in a case workspace with region-level heatmaps and a downloadable report. Integration takes two lines through the SDKs for Android, iOS, Flutter, Python, TypeScript, Go and Java, and deployment can be managed cloud, VPC, on-premises or air-gapped.

Keeping Representative Evidence Current After Onboarding

Authority expires even when identity does not. Directors resign, delegations lapse and ownership changes, so every mandate should carry a source, a scope, an effective date and a trigger that forces review. FinCEN's CDD FAQs make updating risk-based: new beneficial ownership information is needed when monitoring surfaces facts that call the existing record into question, not on a fixed calendar.

The federal register is a weaker backstop than it was. FinCEN's interim final rule of 26 March 2025 removed beneficial ownership reporting for US-formed companies, and the exemption was made permanent by a final rule effective 14 August 2026. Banks therefore rely on their own collection, state registries and the customer's certification for domestic entities. When a new signatory appears, run the full person-and-mandate sequence again and remove the previous representative's access once the change is confirmed.