Business KYC Requirements

This page is the field-level reference for every attestation that may appear on a business compliance review — both review-level attestations and the per-associated-person attestations uploaded against each UBO / control person. For the end-to-end flow (creating a review, uploading documents, creating associated persons, submitting, polling status) see Compliance Reviews.

Each section below is one attestation. The header states whether the attestation is REQUIRED or CONDITIONALLY REQUIRED, the conditional sections lead with what triggers the requirement, and every section ends with a table describing each field — its JSON name, type, whether it is required or optional, and any input limits enforced by the API.

The supporting-document attestations (businessFormationDocuments, businessUboOwnershipDocuments, businessProofOfAddressDocuments, businessFlowOfFundsDocument, businessSourceOfFundsDocuments, associatedPersonProofOfAddress and associatedPersonProofOfSignatoryAuthority) also accept an optional additionalInformation string, which the tables below leave out: a note to the reviewer about that upload, such as where the requested detail sits in a document, or what the document is called locally. It holds up to 200 characters and cannot be blank. Don't put sensitive identifiers in it.

The requiredAttestations array on the review reflects the same rules described here. If the API response and this guide ever disagree, trust the API.

Tier overview

Business reviews use two tiers: US_STANDARD (USD-only payouts, reduced documentation) and FULL (full KYB with UBO ownership and proof-of-address documents). The tiers share an identical core; FULL adds two additional review-level document attestations and one additional per-associated-person attestation. On both tiers, EEA-registered businesses and associated persons who live in the EEA need extra per-person attestations.

---

Review-level attestations

businessIdentification — REQUIRED

Legal identity of the business.

businessTaxInfo — REQUIRED

Business tax identification number and type.

businessAddress — REQUIRED

Registered (legal) address, with an optional separate operating address.

businessContactInfo — REQUIRED

Business phone number and email.

businessDetails — REQUIRED

Website, legal structure, incorporation date, industry, free-text description, and intended use of Mural.

businessOperations — REQUIRED

Money-movement profile, geographic reach, and high-risk-activity flags.

businessFinancialInfo — REQUIRED

Primary income source, annual revenue band, and estimated monthly transaction volume.

businessFormationDocuments — REQUIRED

One or more uploaded formation document references (e.g. articles of incorporation). Upload each file via the Generate Upload URL endpoint first and reference the returned documentId here.

businessUboOwnershipDocuments — REQUIRED (FULL only)

Required for the FULL tier only. Omit on US_STANDARD.

One or more uploaded UBO ownership document references (e.g. shareholder registry, cap table).

businessProofOfAddressDocuments — REQUIRED (FULL only)

Required for the FULL tier only. Omit on US_STANDARD.

One or more uploaded business proof-of-address document references.

businessFlowOfFundsDocument — CONDITIONALLY REQUIRED

Required when businessOperations.transmittingCustomerFunds is true. Businesses that hold or transmit customer funds must attach a flow-of-funds document describing how money moves through the business. For all other businesses this attestation may be omitted.

A single uploaded flow-of-funds document reference.

businessAssociatedPersons — REQUIRED

Links the review to the organization's previously-created associated persons (UBOs and the control person). Each ID must reference an existing associated person for the organization, and the referenced persons must include exactly one CONTROL_PERSON and at least one BENEFICIAL_OWNER.

---

Associated-person attestations

Uploaded against each associated person via the Upload Associated Person Attestations endpoint. Every associated person referenced from businessAssociatedPersons must have the full required set uploaded before the review can be submitted.

Residential address, identity document, proof of address, and proof of signatory authority are checked automatically and return a pending validationStatus until the check finishes; poll the associated person for the result. The review cannot be submitted while any of them is pending, or failed with a BLOCKING failure. Re-upload to resolve a failure, or submit with acknowledgeWarnings: true to accept WARNING-only failures. Once no business or associated person attestation is pending, a failed check blocks submit with one 412 that lists every failure. When a business attestation also failed, the error is AttestationValidationsRejectedException and the associated person failures are in params.associatedPersonAttestations; otherwise it is AssociatedPersonAttestationValidationsRejectedException. Each associated person failure carries its associatedPersonId. When every failure is a WARNING, the 412 also lists submissionValidationFailures, the submission validation failures found on the same attempt. If there are any, the review moves to submissionValidationsFailed, and one submit with acknowledgeWarnings: true accepts the attestation and submission warnings together.

associatedPersonPersonalInfo — REQUIRED

associatedPersonContactInfo — REQUIRED

associatedPersonResidentialAddress — REQUIRED

P.O. boxes are not accepted. If this address is in the EEA, associatedPersonEeaInfo becomes required for this person.

associatedPersonTaxInfo — REQUIRED

associatedPersonIdentityDocument — REQUIRED

Government-issued identity document for the associated person. Same shape as the individual review — see Government ID object.

associatedPersonProofOfAddress — CONDITIONALLY REQUIRED

Required on the FULL tier. Omit on US_STANDARD.

One or more uploaded proof-of-address document references for this associated person.

associatedPersonEeaInfo — CONDITIONALLY REQUIRED

Required for an associated person when the business's registered address is in the EEA, or the person's residential address is in the EEA. The EEA is the EU member states plus Iceland, Liechtenstein, and Norway. It does not include the UK.

associatedPersonProofOfSignatoryAuthority — CONDITIONALLY REQUIRED

Required for each associated person of an EEA-registered business whose associatedPersonEeaInfo.isDirector is false.

---

Shared objects

Name object

Used wherever a name field appears (on associatedPersonPersonalInfo).

Address object

Used wherever a registeredAddress, operatingAddress, or address field appears.

Government ID object

The governmentId field on associatedPersonIdentityDocument accepts 28 document types. Every document type shares the same base shape; only the ID-number field and the document-reference field(s) differ by document type.

Common shape across every document type:

Single-sided variants (one documentId field): passport, internalPassport, travelDocument, citizenshipCertificate, panCard, nbiClearance.

Double-sided variants (front + back documentId fields): driverLicense, nationalId, stateId, passportCard, permanentResidenceCard, visa, residencePermit, voterId, healthInsuranceCard, workPermit, consularId, foreignId, myNumberCard, longTermPass, ofwId, postalId, sssId, umid, municipalId, tribalId, keypassId.

cnh (Brazil): cnhFrontDocumentId is required; cnhBackDocumentId is optional.

For the complete per-variant schema (exact field names, country examples, etc.) see the AssociatedPersonIdentityDocumentAttestation entry in the API reference.