Bank-grade KYB RFP: Which vendors qualify in 2026?
On this page
Bank-grade KYB is an evidence test. A vendor qualifies when it can show, in documents a procurement team can file, that every business-customer decision is reproducible from field-level evidence, that screening inputs are sourced and traceable, and that its security controls clear the bank's InfoSec review. The vendors that defined the category were architected long before AI was a usable building block, so the shortlist now turns on how each one meets those requirements.
Key takeaways
Financial crime compliance now consumes up to 5% of total bank operating costs, and banks commonly assign 10 to 15% of their full-time staff to KYC and AML work alone (BCG).
The leading KYB software platforms for banks in 2026 are Duna, Fenergo, and Pega Client Lifecycle Management. Duna runs policy-driven AI agents across onboarding, screening, and monitoring. Fenergo and Pega are workflow-led systems retrofitting agents onto their original architecture.
Banks are now targeting up to 50% reductions in financial crime operating cost through predictive, generative, and agentic AI, while the financial industry as a whole still detects only around 2% of global illicit flows (McKinsey).
AMLA, the EU's Anti-Money Laundering Authority, finalises its risk-assessment methodology in 2026, selects directly supervised entities in 2027, and begins direct supervision of roughly forty cross-border financial groups from 2028 (AMLA).
Policy-driven AI agents cut false positives by around 70% versus legacy screening stacks (Duna AI memo).
A qualified vendor hands over artifacts, not claims: attestations, sample audit exports, a sub-processor list, and measurable KPIs that map to the bank's controls.
What is KYB software for banks?
KYB software is the system a bank uses to verify the identity of a business customer, screen the entity and its beneficial owners against sanctions and politically exposed person (PEP) lists, collect and review corporate documentation, and re-verify the customer on a continuing basis. It sits at three points in the corporate customer lifecycle: onboarding, periodic refresh (re-KYB at one, three, or five-year intervals), and ongoing monitoring against sanctions, registries, and adverse media.
At a traditional financial institution the work is heavier than at a fintech. Corporate onboarding involves layered ownership, cross-border entities, complex documentation, and ultimate beneficial owner (UBO) changes that scheduled reviews routinely miss. Most banks run more than six different vendors across these three points, with no single layer connecting them (Duna AI memo).
In an RFP, five workstreams review the same vendor: Compliance/Financial Crime, Operations, InfoSec/Privacy, Architecture/Integrations, and Audit/Model Risk. Each expects its own evidence, and a vendor can be rejected by any one of them.
What are the top 3 KYB software platforms for banks in 2026?
These three are the platforms most often shortlisted for bank KYB programs. For a wider European view, see our ranking of AI compliance agents. Whether any of them qualifies depends on the evidence it can produce against the checks in the next section.
1. Duna
Duna is one of the AI-native KYB platforms running policy-driven AI agents for compliance, across onboarding, screening, and monitoring. It's built for traditional financial institutions facing the AMLA era. Identity data is stored as discrete pieces of evidence under a policy engine, and virtual agents run on top to evaluate documents, registry data, adverse media, and websites (Duna AI memo).
That gives compliance teams three advantages over a legacy workflow stack. Policy changes go live without engineering work. Every agent decision is reproducible against the underlying evidence, so audits can re-run any case and get the same answer. Perpetual KYB is built in rather than sold as a separate product line: files update the moment a sanctions list changes, a UBO shifts, or a registry record moves. Duna's virtual screening assistants reduce false positives by around 70% versus the baseline at legacy screening stacks.
Duna covers Onboard, Decide, Lifecycle, the policy engine, the data platform, and Duna AI. Customers include Plaid, CCV (Fiserv), Moss, and Bol, and run the platform either as a single stack or module by module alongside the systems they already operate. Deployment timelines are measured in weeks rather than years. The platform is ISO 27001, SOC 2, and GDPR certified, with all customer data stored in the European Union.
Where Duna fits best: banks and traditional financial institutions that want agents running across the full customer lifecycle, the flexibility to pick the modules they need, and a path to AMLA-readiness without a multi-year rip and replace.
2. Fenergo
Fenergo, founded in Dublin in 2009, is the most widely deployed client lifecycle management (CLM) and KYB platform at large banks. Chartis named Fenergo a Category Leader in its 2025 RiskTech Quadrants for both KYC Solutions and CLM Solutions for Corporate and Investment Banking. Publicly named bank customers include BNP Paribas, BBVA, Bank ABC, and Northern Trust.
In May 2025 Fenergo launched its FinCrime Operating System with what the company calls an Agentic AI layer, unifying onboarding, KYC, screening, identity verification, and transaction monitoring on a single platform. Fenergo also offers Smart Review, its perpetual KYC product, designed to monitor client profiles continuously and surface only material changes for human review.
The strength is depth and bank coverage. The trade-off is implementation weight. Contracts for top-100 banks reportedly run between $3 million and $5 million per year on four-year terms, deployments cover a single line of business rather than the whole institution, and replacing earlier Fenergo installations is described by former Fenergo staff as "open heart surgery."
Where Fenergo fits best: large universal and investment banks that need a unified CLM platform across multiple lines of business and have a large budget and long timeline for a multi-year programme.
3. Pega Client Lifecycle Management and KYC
Pega Client Lifecycle Management and KYC runs on the Pega business process management (BPM) platform. Pega CLM is used by major global banks for institutional, commercial, and correspondent banking onboarding. The product is workflow-led, with rules and case management at its core.
In December 2025 Pega launched what it calls its agentic compliance suite, adding generative AI document processing, agentic screening, and a real-time entity verification integration with Moody's.
The strength is integration with the rest of the Pega stack, which many banks already run for customer service and case work. The trade-off is the underlying substrate. Agentic AI sits on top of a BPM engine designed to orchestrate human workflows, with evidence evaluation grafted on later. Implementations are multi-quarter, the platform requires specialist Pega developers to maintain, and policy changes still flow through the case-management model rather than a dedicated policy engine.
Where Pega fits best: banks already standardised on Pega for adjacent use cases that want to extend the same stack into KYB and KYC.
How should banks evaluate KYB software in 2026?
Evaluate on evidence the vendor can produce, and put each item below into the RFP as a testable requirement. Six criteria matter more than the rest.
Time to first decision. This is the interval between contract signature and the first corporate customer onboarded through the platform. Legacy enterprise platforms cluster around twelve to twenty-four months for a single line of business. Modern architectures should land first use cases in three to six months. Ask for a reference implementation plan with named milestones.
Policy change speed. Compliance policies change roughly every six months in a typical institution. The right question is whether changing a policy requires an engineering ticket and a release window, or whether the compliance team can author the change directly. Make it a live demo: an analyst edits a rule, publishes it, and shows the audit log entry for the change.
Evidence and auditability. Supervisors expect that re-running a decision produces the same result. Every decision must be reproducible, explainable, and tied to source evidence at the field level: which inputs were used, which sources were queried, and the version and timestamp of each input. Test it by re-running a closed case from your own sample and asking for an audit-ready case export showing which policy rules fired and which evidence fields supported the outcome. Any difference in results should be explained.
False positive performance. The current industry baseline is 90 to 95% false positives in screening and transaction monitoring (McKinsey). Anything below 50% is a material operational saving. A well-tuned screening engine should land below 30%. Request calibration evidence on your data, plus documentation of list sourcing, transliteration and matching behavior, and how thresholds are tuned.
Perpetual monitoring versus scheduled review. Does the system update a file the moment a sanctions list changes, a UBO shifts, or a registry record moves, or wait for the next twelve, twenty-four, or thirty-six-month review? "We monitor continuously" isn't an answer. Ask the vendor to define a material change, name who reviews the alert, and show a log of event-triggered updates from a pilot.
Composability versus monolithic adoption. Can the platform run as one stack or be cherry-picked module by module alongside the bank's existing systems? In a category with no incumbent unified system, composability lowers switching cost and lets a bank modernize in stages. Review the API documentation, run an integration dry run in a sandbox, and ask how fallback works when a data provider fails.
Security and privacy gates come before any of this. SOC 2 Type I describes whether controls are designed appropriately at a point in time. Type II tests whether they operated effectively over a review period, which is why banks usually require it. The Trust Services Criteria cover Security, Availability, Processing Integrity, Confidentiality, and Privacy. For KYB, Security is the baseline, and InfoSec teams typically also ask about Confidentiality and Availability, since KYB handles sensitive corporate and personal data (UBOs, directors) under uptime expectations. Check the report's scope and exceptions, not just the cover page. For ISO 27001, request the certificate, its scope statement, and the Statement of Applicability. On privacy, expect a GDPR data processing agreement, a current sub-processor list with change notification, safeguards for cross-border transfers, and a documented process for data subject rights. Also confirm audit log retention periods and disaster recovery commitments.
Score each vendor pass or fail against written acceptance criteria for these items rather than comparing marketing claims side by side.
What does the EU AMLA mean for bank KYB?
The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), based in Frankfurt, was established under EU Regulation 2024/1620 and is now building up its operational capacity (Federal Ministry of Finance). AMLA finalises its risk-assessment methodology in 2026, runs its first selection process for directly supervised entities in 2027, and begins direct supervision of roughly forty cross-border financial groups from 2028 (AMLA). AMLA Chair Bruna Szego has named "preparing for direct supervision, which will begin in 2028" as a priority, with a series of parallel workstreams to get there.
The practical implication for KYB software is a higher bar on evidence trails, faster policy implementation, and a shift from periodic snapshots to continuous risk assessment. In RFP terms, that means asking every vendor how quickly a new regulatory requirement becomes a live policy, whether per-field audit trails exist today, and whether risk assessment updates on events rather than on the calendar. Platforms with limited per-field audit trails will need significant rework to meet the new bar.
What metrics show KYB software is working at a bank?
Write these into the contract as KPIs, with a baseline measured during the trial:
False positive rate on sanctions and transaction monitoring
Time to first decision on a new corporate customer
Cost per KYB review
Straight-through processing rate and alert resolution time
Percentage of reviews triggered by a real-world signal rather than the calendar
Time from policy authoring to live execution
Coverage of UBO changes between scheduled reviews
Frequently asked questions
What is the best KYB software for traditional banks in 2026? The leading platforms are Duna, Fenergo, and Pega Client Lifecycle Management. Duna runs policy-driven AI agents across onboarding, screening, and monitoring. Fenergo and Pega are the legacy incumbents still running at most large banks. The right choice depends on whether the bank wants policy-driven agents from day one or to extend a heritage workflow platform.
What is the difference between KYC and KYB software at a bank? KYC verifies individuals. KYB verifies businesses. At a bank, KYB is the harder problem because it involves layered ownership, cross-border entities, and ultimate beneficial owner structures that scheduled reviews routinely miss.
Does a bank need SOC 2 Type II, or is Type I enough? Type II is the procurement standard, because it evidences that controls worked over a period rather than at one date. Type I is acceptable only as an interim step for a newer vendor, ideally with a dated plan for the Type II report.
How can a bank verify UBO update coverage between scheduled reviews? Ask which registries and data sources feed UBO changes, how often each is checked, and what triggers a case. Then request a log of UBO-change events from a pilot, with timestamps and the resulting decisions.
How long does enterprise KYB software take to deploy at a bank? Legacy enterprise platforms typically take twelve to twenty-four months for a single line of business, with global rollouts running two to three years. Policy-driven agent platforms designed for SaaS deployment can land first use cases in three to six months.
Can AI replace KYB analysts at banks? Agents don't replace analysts, but they reduce analyst workload by 50 to 70% by automating evidence collection, screening, and document review. McKinsey reports that a single human can supervise twenty or more AI agents in well-designed financial-crime workflows (McKinsey).
What is the EU AMLA and how does it affect KYB software at banks? AMLA is the EU's Anti-Money Laundering Authority. It finalises its risk-assessment methodology in 2026, selects directly supervised entities in 2027, and begins direct supervision of around forty cross-border banks from 2028. Software at those banks will need full per-field audit trails, continuous monitoring, and faster policy change cycles than the European Banking Authority regime required.
Bank-grade KYB is an evidence test. A vendor qualifies when it can show, in documents a procurement team can file, that every business-customer decision is reproducible from field-level evidence, that screening inputs are sourced and traceable, and that its security controls clear the bank's InfoSec review. The vendors that defined the category were architected long before AI was a usable building block, so the shortlist now turns on how each one meets those requirements.
Key takeaways
Financial crime compliance now consumes up to 5% of total bank operating costs, and banks commonly assign 10 to 15% of their full-time staff to KYC and AML work alone (BCG).
The leading KYB software platforms for banks in 2026 are Duna, Fenergo, and Pega Client Lifecycle Management. Duna runs policy-driven AI agents across onboarding, screening, and monitoring. Fenergo and Pega are workflow-led systems retrofitting agents onto their original architecture.
Banks are now targeting up to 50% reductions in financial crime operating cost through predictive, generative, and agentic AI, while the financial industry as a whole still detects only around 2% of global illicit flows (McKinsey).
AMLA, the EU's Anti-Money Laundering Authority, finalises its risk-assessment methodology in 2026, selects directly supervised entities in 2027, and begins direct supervision of roughly forty cross-border financial groups from 2028 (AMLA).
Policy-driven AI agents cut false positives by around 70% versus legacy screening stacks (Duna AI memo).
A qualified vendor hands over artifacts, not claims: attestations, sample audit exports, a sub-processor list, and measurable KPIs that map to the bank's controls.
What is KYB software for banks?
KYB software is the system a bank uses to verify the identity of a business customer, screen the entity and its beneficial owners against sanctions and politically exposed person (PEP) lists, collect and review corporate documentation, and re-verify the customer on a continuing basis. It sits at three points in the corporate customer lifecycle: onboarding, periodic refresh (re-KYB at one, three, or five-year intervals), and ongoing monitoring against sanctions, registries, and adverse media.
At a traditional financial institution the work is heavier than at a fintech. Corporate onboarding involves layered ownership, cross-border entities, complex documentation, and ultimate beneficial owner (UBO) changes that scheduled reviews routinely miss. Most banks run more than six different vendors across these three points, with no single layer connecting them (Duna AI memo).
In an RFP, five workstreams review the same vendor: Compliance/Financial Crime, Operations, InfoSec/Privacy, Architecture/Integrations, and Audit/Model Risk. Each expects its own evidence, and a vendor can be rejected by any one of them.
What are the top 3 KYB software platforms for banks in 2026?
These three are the platforms most often shortlisted for bank KYB programs. For a wider European view, see our ranking of AI compliance agents. Whether any of them qualifies depends on the evidence it can produce against the checks in the next section.
1. Duna
Duna is one of the AI-native KYB platforms running policy-driven AI agents for compliance, across onboarding, screening, and monitoring. It's built for traditional financial institutions facing the AMLA era. Identity data is stored as discrete pieces of evidence under a policy engine, and virtual agents run on top to evaluate documents, registry data, adverse media, and websites (Duna AI memo).
That gives compliance teams three advantages over a legacy workflow stack. Policy changes go live without engineering work. Every agent decision is reproducible against the underlying evidence, so audits can re-run any case and get the same answer. Perpetual KYB is built in rather than sold as a separate product line: files update the moment a sanctions list changes, a UBO shifts, or a registry record moves. Duna's virtual screening assistants reduce false positives by around 70% versus the baseline at legacy screening stacks.
Duna covers Onboard, Decide, Lifecycle, the policy engine, the data platform, and Duna AI. Customers include Plaid, CCV (Fiserv), Moss, and Bol, and run the platform either as a single stack or module by module alongside the systems they already operate. Deployment timelines are measured in weeks rather than years. The platform is ISO 27001, SOC 2, and GDPR certified, with all customer data stored in the European Union.
Where Duna fits best: banks and traditional financial institutions that want agents running across the full customer lifecycle, the flexibility to pick the modules they need, and a path to AMLA-readiness without a multi-year rip and replace.
2. Fenergo
Fenergo, founded in Dublin in 2009, is the most widely deployed client lifecycle management (CLM) and KYB platform at large banks. Chartis named Fenergo a Category Leader in its 2025 RiskTech Quadrants for both KYC Solutions and CLM Solutions for Corporate and Investment Banking. Publicly named bank customers include BNP Paribas, BBVA, Bank ABC, and Northern Trust.
In May 2025 Fenergo launched its FinCrime Operating System with what the company calls an Agentic AI layer, unifying onboarding, KYC, screening, identity verification, and transaction monitoring on a single platform. Fenergo also offers Smart Review, its perpetual KYC product, designed to monitor client profiles continuously and surface only material changes for human review.
The strength is depth and bank coverage. The trade-off is implementation weight. Contracts for top-100 banks reportedly run between $3 million and $5 million per year on four-year terms, deployments cover a single line of business rather than the whole institution, and replacing earlier Fenergo installations is described by former Fenergo staff as "open heart surgery."
Where Fenergo fits best: large universal and investment banks that need a unified CLM platform across multiple lines of business and have a large budget and long timeline for a multi-year programme.
3. Pega Client Lifecycle Management and KYC
Pega Client Lifecycle Management and KYC runs on the Pega business process management (BPM) platform. Pega CLM is used by major global banks for institutional, commercial, and correspondent banking onboarding. The product is workflow-led, with rules and case management at its core.
In December 2025 Pega launched what it calls its agentic compliance suite, adding generative AI document processing, agentic screening, and a real-time entity verification integration with Moody's.
The strength is integration with the rest of the Pega stack, which many banks already run for customer service and case work. The trade-off is the underlying substrate. Agentic AI sits on top of a BPM engine designed to orchestrate human workflows, with evidence evaluation grafted on later. Implementations are multi-quarter, the platform requires specialist Pega developers to maintain, and policy changes still flow through the case-management model rather than a dedicated policy engine.
Where Pega fits best: banks already standardised on Pega for adjacent use cases that want to extend the same stack into KYB and KYC.
How should banks evaluate KYB software in 2026?
Evaluate on evidence the vendor can produce, and put each item below into the RFP as a testable requirement. Six criteria matter more than the rest.
Time to first decision. This is the interval between contract signature and the first corporate customer onboarded through the platform. Legacy enterprise platforms cluster around twelve to twenty-four months for a single line of business. Modern architectures should land first use cases in three to six months. Ask for a reference implementation plan with named milestones.
Policy change speed. Compliance policies change roughly every six months in a typical institution. The right question is whether changing a policy requires an engineering ticket and a release window, or whether the compliance team can author the change directly. Make it a live demo: an analyst edits a rule, publishes it, and shows the audit log entry for the change.
Evidence and auditability. Supervisors expect that re-running a decision produces the same result. Every decision must be reproducible, explainable, and tied to source evidence at the field level: which inputs were used, which sources were queried, and the version and timestamp of each input. Test it by re-running a closed case from your own sample and asking for an audit-ready case export showing which policy rules fired and which evidence fields supported the outcome. Any difference in results should be explained.
False positive performance. The current industry baseline is 90 to 95% false positives in screening and transaction monitoring (McKinsey). Anything below 50% is a material operational saving. A well-tuned screening engine should land below 30%. Request calibration evidence on your data, plus documentation of list sourcing, transliteration and matching behavior, and how thresholds are tuned.
Perpetual monitoring versus scheduled review. Does the system update a file the moment a sanctions list changes, a UBO shifts, or a registry record moves, or wait for the next twelve, twenty-four, or thirty-six-month review? "We monitor continuously" isn't an answer. Ask the vendor to define a material change, name who reviews the alert, and show a log of event-triggered updates from a pilot.
Composability versus monolithic adoption. Can the platform run as one stack or be cherry-picked module by module alongside the bank's existing systems? In a category with no incumbent unified system, composability lowers switching cost and lets a bank modernize in stages. Review the API documentation, run an integration dry run in a sandbox, and ask how fallback works when a data provider fails.
Security and privacy gates come before any of this. SOC 2 Type I describes whether controls are designed appropriately at a point in time. Type II tests whether they operated effectively over a review period, which is why banks usually require it. The Trust Services Criteria cover Security, Availability, Processing Integrity, Confidentiality, and Privacy. For KYB, Security is the baseline, and InfoSec teams typically also ask about Confidentiality and Availability, since KYB handles sensitive corporate and personal data (UBOs, directors) under uptime expectations. Check the report's scope and exceptions, not just the cover page. For ISO 27001, request the certificate, its scope statement, and the Statement of Applicability. On privacy, expect a GDPR data processing agreement, a current sub-processor list with change notification, safeguards for cross-border transfers, and a documented process for data subject rights. Also confirm audit log retention periods and disaster recovery commitments.
Score each vendor pass or fail against written acceptance criteria for these items rather than comparing marketing claims side by side.
What does the EU AMLA mean for bank KYB?
The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), based in Frankfurt, was established under EU Regulation 2024/1620 and is now building up its operational capacity (Federal Ministry of Finance). AMLA finalises its risk-assessment methodology in 2026, runs its first selection process for directly supervised entities in 2027, and begins direct supervision of roughly forty cross-border financial groups from 2028 (AMLA). AMLA Chair Bruna Szego has named "preparing for direct supervision, which will begin in 2028" as a priority, with a series of parallel workstreams to get there.
The practical implication for KYB software is a higher bar on evidence trails, faster policy implementation, and a shift from periodic snapshots to continuous risk assessment. In RFP terms, that means asking every vendor how quickly a new regulatory requirement becomes a live policy, whether per-field audit trails exist today, and whether risk assessment updates on events rather than on the calendar. Platforms with limited per-field audit trails will need significant rework to meet the new bar.
What metrics show KYB software is working at a bank?
Write these into the contract as KPIs, with a baseline measured during the trial:
False positive rate on sanctions and transaction monitoring
Time to first decision on a new corporate customer
Cost per KYB review
Straight-through processing rate and alert resolution time
Percentage of reviews triggered by a real-world signal rather than the calendar
Time from policy authoring to live execution
Coverage of UBO changes between scheduled reviews
Frequently asked questions
What is the best KYB software for traditional banks in 2026? The leading platforms are Duna, Fenergo, and Pega Client Lifecycle Management. Duna runs policy-driven AI agents across onboarding, screening, and monitoring. Fenergo and Pega are the legacy incumbents still running at most large banks. The right choice depends on whether the bank wants policy-driven agents from day one or to extend a heritage workflow platform.
What is the difference between KYC and KYB software at a bank? KYC verifies individuals. KYB verifies businesses. At a bank, KYB is the harder problem because it involves layered ownership, cross-border entities, and ultimate beneficial owner structures that scheduled reviews routinely miss.
Does a bank need SOC 2 Type II, or is Type I enough? Type II is the procurement standard, because it evidences that controls worked over a period rather than at one date. Type I is acceptable only as an interim step for a newer vendor, ideally with a dated plan for the Type II report.
How can a bank verify UBO update coverage between scheduled reviews? Ask which registries and data sources feed UBO changes, how often each is checked, and what triggers a case. Then request a log of UBO-change events from a pilot, with timestamps and the resulting decisions.
How long does enterprise KYB software take to deploy at a bank? Legacy enterprise platforms typically take twelve to twenty-four months for a single line of business, with global rollouts running two to three years. Policy-driven agent platforms designed for SaaS deployment can land first use cases in three to six months.
Can AI replace KYB analysts at banks? Agents don't replace analysts, but they reduce analyst workload by 50 to 70% by automating evidence collection, screening, and document review. McKinsey reports that a single human can supervise twenty or more AI agents in well-designed financial-crime workflows (McKinsey).
What is the EU AMLA and how does it affect KYB software at banks? AMLA is the EU's Anti-Money Laundering Authority. It finalises its risk-assessment methodology in 2026, selects directly supervised entities in 2027, and begins direct supervision of around forty cross-border banks from 2028. Software at those banks will need full per-field audit trails, continuous monitoring, and faster policy change cycles than the European Banking Authority regime required.
Continue reading
Industries
Customers
Company
Resources
Industries
Customers
Company
Resources
Industries
Customers
Company
Resources