What is KYB and how does it work in Norway?
By Antony Richard Grov, founder of Apier
KYB, Know Your Business, is verification of a company rather than a person: establishing that a counterparty exists as a legal entity, is in normal operation, and is represented by people who actually hold the right to act for it. In Norway the check runs on public registers. Enhetsregisteret answers whether the company exists and is active, the registered distress flags answer whether it is bankrupt, under liquidation or deleted, the VAT register answers whether it is registered for MVA, and Foretaksregisteret carries the registered texts on who can sign. A proper check reduces those signals to one honest verdict, and honesty includes a third state: when a source cannot answer, the result is unknown, never a silent pass. That tri-state discipline is what separates a KYB check you can defend afterwards from a lookup that quietly guessed.
What does KYB actually mean?
Know Your Business is the discipline of verifying a company before you rely on it: before onboarding it as a customer, paying its first invoice, or signing a contract in its name. Banks and payment providers run it because anti-money-laundering rules oblige them to know their corporate customers. Marketplaces, procurement teams and SaaS platforms run it for a plainer reason: money sent to a company that no longer exists, or a contract signed by someone without authority, is a loss no terms-of-service clause recovers.
The output of a KYB check is evidence, not absolution. It tells you what the authoritative registers said about the company at the moment you asked, with sources attached. What you do with a warn verdict, and which counterparties you check at all, remain decisions your own process owns.
How is KYB different from KYC?
KYC verifies a natural person; KYB verifies a legal entity. In Norway the two run on entirely different rails. Person-level identity is normally established with an electronic ID such as BankID, a credentialed, consent-driven flow. Company-level verification needs no consent and no credential from the counterparty, because the facts are public by design: the Norwegian state publishes who exists, who is bankrupt and who may sign, precisely so that anyone can check.
The two also fail differently. A KYC failure is usually a person who cannot prove who they are. A KYB failure is often quieter: a company that looks fine on its website but was deleted from the register months ago. This page stays on the concept; when you are ready to wire the checks into code, the guide on automated company verification via API owns the endpoint-by-endpoint walkthrough and the evidence trail.
Which Norwegian data sources feed a KYB check?
Four, in practice, and they all join on the same 9-digit organisation number. Enhetsregisteret is the base record of existence, status and organisational form. The registered distress flags mark bankruptcy, liquidation and deletion. The VAT register, Merverdiavgiftsregisteret, records whether the company is registered for MVA, a separate flag from company registration itself. Foretaksregisteret carries the registered texts on signaturrett and prokura, which is where the question of who can bind the company is actually answered.
| Source | What it answers | When it cannot answer |
|---|---|---|
| Enhetsregisteret | Does the company exist, is it active, what form does it take? | An unknown org number is a fail, not a maybe: nothing exists to verify. |
| Distress flags | Is it bankrupt, under liquidation, or deleted from the register? | A flag that cannot be read surfaces as unknown, never as not bankrupt. |
| MVA register | Is the company registered for VAT? | Not registered is a valid answer; small companies fall under the threshold. |
| Foretaksregisteret | Who holds signaturrett and prokura? | Open data alone answers unknown here; the signing texts sit a tier deeper. |
What does a proper KYB check cover?
Six questions, each answerable from the registers. Does the company exist under the organisation number given? Is it active, in normal operation rather than dormant? Is it free of bankruptcy proceedings? Is it still on the register at all, rather than deleted? Is it registered for VAT, which matters both for invoicing and as a plausibility signal? And who is registered as entitled to sign for it, which decides whether the person across the table can actually commit the company to anything.
The first five reduce to a status verdict; the shipped guide on checking that a company is active and registered walks that reduction in detail. The sixth is its own check with its own failure modes, and skipping it is the most common gap in home-grown KYB: a company can be perfectly healthy while the person signing for it holds no registered authority at all.
Why is unknown not a pass?
Because absence of evidence is not evidence of absence. The open data tier does not expose the signing texts, so an open-tier answer about signaturrett is honestly unknown, and a system that renders that as an empty list has silently turned a gap in coverage into a clean bill of health. The same applies to any source that times out or cannot be read: the honest verdict is unknown, and the decision about what unknown means for this transaction belongs to you, not to a default.
This is why a defensible KYB check is tri-state at minimum: pass, fail, and unknown, with warn as the practical fourth for signals that deserve a human look. Systems that only model pass and fail must round unknown to one of them, and both roundings are wrong: rounding to fail blocks legitimate counterparties, rounding to pass is how a check stops meaning anything.
Make the first call
The sandbox call below returns the KYB verdict shape for a simulated company with no key at all, so you can see what a tri-state answer looks like before signing up for anything. The TypeScript sample runs the same verification against a real company with an API key, with source and freshness stated on the response itself.
# Zero-auth sandbox: the KYB verdict shape on a synthetic company.
curl -s https://www.apier.no/api/v1/sandbox/public/company/999999999/verify// One call: does this company exist, is it active, can it trade?
const res = await fetch(
"https://www.apier.no/api/v1/company/999999999/verify",
{ headers: { Authorization: `Bearer ${process.env.APIER_API_KEY}` } },
);
if (!res.ok) {
// Every non-2xx answers the same structured envelope.
const { error_code, explanation } = await res.json();
throw new Error(`${error_code}: ${explanation.summary}`);
}
const { data, _meta } = await res.json();
// verification_status is pass, warn, fail or unknown, and the signals
// behind it are listed one by one so a warn is explainable.
console.log(data.verification_status);
console.log(_meta.data_source, _meta.data_freshness);Frequently asked questions
- What does KYB stand for?
- Know Your Business. It is the company-level counterpart of KYC, Know Your Customer: instead of establishing who a natural person is, a KYB check establishes that a business exists as a legal entity, what form it takes, whether it is in normal operation, and who is registered as entitled to act for it. In Norway those facts live in public registers, which makes the check largely a matter of reading authoritative data rather than collecting documents.
- Is KYB legally required in Norway?
- For some businesses, yes. Entities covered by Norwegian anti-money-laundering rules, such as banks, payment institutions and certain professional services, must verify corporate customers as part of their compliance programmes. Many others run KYB without being obliged to, simply to avoid paying invoices to dead companies or signing contracts with people who lack authority. What your own obligations are is a question for your compliance function and legal advisers, not for this page.
- Is the data behind a Norwegian KYB check free?
- The core of it, yes. Company data from Enhetsregisteret is open and published under NLOD, the Norwegian licence for public data, and filed annual accounts are public documents. The engineering cost sits in normalising the fields, tracking freshness and detecting changes, which you can do yourself against the open registers or delegate to a normalised API layer that states source and freshness on every response.
- How often should a KYB check be refreshed?
- A verdict is a snapshot of the register at the moment it was read, so it ages. Re-checking every counterparty on a timer is expensive and still misses changes between runs. The more precise pattern is event-driven: subscribe to a change feed and re-evaluate when something moves, because a new bankruptcy flag or a role change invalidates a cached verdict immediately, not at the next scheduled sweep.
- Does a KYB check prevent fraud?
- No check can promise that. What KYB gives you is registered evidence at decision time: that the company exists, is active, is not flagged as bankrupt or deleted, and that the person about to sign is actually registered with that right. Acting on those facts filters out a real class of failure, including invoice fraud against deleted companies, but it is evidence for your own judgement, not a guarantee.