A virtual card provider may ask who you are, what your business does, where funds come from, and how you plan to use the account. That can feel like a delay when you only want to pay for an online service. In practice, these checks are part of the infrastructure behind a payment account.
Understanding what the questions mean makes it easier to provide accurate information, protect your documents, and avoid unnecessary back-and-forth.
KYC identifies people, KYB helps a provider understand businesses, and AML controls assess whether account activity fits the available information and applicable risk requirements.
KYC, KYB, and AML: the difference
KYC means “Know Your Customer.” It usually applies to an individual and may involve a legal name, date of birth, identity document, address, and sometimes a liveness or selfie check. A freelancer may complete KYC even when the card will be used for work-related spending.
KYB means “Know Your Business.” It concerns a legal entity or business activity. A provider may ask for registration details, a website, directors, beneficial owners, the business model, and the reason the company needs the service. A company account can require both KYB for the business and KYC for the people who own or control it.
AML refers to anti-money-laundering controls. It is broader than collecting an identity document. It can include screening, transaction monitoring, risk assessment, and questions about whether payment activity makes sense for the account profile.
In simple terms: KYC asks who the person is; KYB asks what the business is; AML asks whether the account activity is consistent with the information provided.
Why a virtual card account may receive more questions
A virtual card is more than a card number displayed on a screen. It sits within a funding account, card programme, payment network, issuing arrangement, and merchant payment flow. Providers need to understand who is using that infrastructure in order to manage fraud, sanctions, chargeback, and financial-crime risks.
The review also depends on the intended use. A few personal subscriptions look different from an agency paying advertising accounts, a company funding cloud services, or a platform seeking to issue cards to many users. Different use cases are not automatically a problem; they simply require different operational and compliance information.
Verification is not a promise that every future transaction will be approved. Merchant acceptance rules, card configuration, country restrictions, available balance, authentication, and transaction-level risk signals can still affect an individual payment.
What providers usually need to understand
Identity and account control
The provider needs to know who is opening or controlling the account. Typical information can include a government-issued identity document, date of birth, residential address, phone number, or verification video.
Use your legal name where the form asks for it. Avoid switching between a nickname, company alias, and different spelling. If a professional or trading name differs from your legal name, explain the relationship through the appropriate field or support channel.
Business activity and ownership
For KYB, explain what the company actually does, who it serves, and why it needs a virtual card solution. A short, specific description is more useful than “online business.” For example: “We provide design services to European startups and pay for software used to deliver client projects.”
Providers may also need to identify directors, authorised representatives, and ultimate beneficial owners. Keep the answers consistent across the application, company records, website, and later support conversations. If there is a holding company, trading brand, or recent ownership change, explain it clearly.
Source of funds and expected activity
“Where did the money come from?” can refer to employment income, business revenue, a company bank account, investments, or another lawful source. For crypto-funded accounts, a provider may also need to understand how the assets were acquired and how the account will be used.
The provider may ask which merchants you expect to pay, the currencies you expect to use, the number of cards you need, and estimated monthly spending. Give an honest range if the exact amount is not known. For example: “Initially around €2,000–€4,000 per month for software and advertising, with a possible increase after testing.”
Geography and counterparties
Country can matter at several levels: where you live, where the company is registered, where customers are located, where merchants are based, and where the card will be used. Be precise about those differences rather than treating them as the same question.
Providers may also ask about high-risk industries or restricted activities. Describe the real activity plainly. A clear “not applicable” answer is better than an answer designed to make a use case sound simpler than it is.
What documents may be requested?
There is no universal document list for every virtual card account. Requirements vary by customer type, jurisdiction, product, risk level, and any changes to the account profile. The categories below are common examples, not a promise of what a provider will accept.
| Area | Possible evidence | Check before uploading |
| Identity | Passport, national ID, residence permit, selfie or liveness check | Legal name, expiry date, image quality, and official upload channel |
| Address | Utility bill, bank statement, government letter, or accepted proof | Current address, issue date, and permitted redactions |
| Business | Registry extract, incorporation certificate, licence, or tax registration | Legal name, registration number, country, and consistency with the account |
| Ownership | Shareholder register, ownership chart, director details, or authorisation letter | Who owns, controls, and may operate the account |
| Activity | Website, invoices, contracts, product description, or payment-flow explanation | Whether it reflects the real business and intended use |
| Funds | Bank statement, payslip, transaction history, or source-of-funds explanation | Whether it explains the source without exposing unnecessary credentials |
Never share a wallet seed phrase, private key, one-time password, password, or full card credentials as “proof of funds.” Those details can give someone direct control over assets or payments and are not a normal substitute for compliance evidence.
What a review may look like
Compliance is often a sequence rather than a single yes-or-no event.
- Identity review. The provider confirms who controls the account and whether the submitted information is valid. For a company, this can include the entity and the authority of the person applying.
- Intended-use review. The provider may ask what you plan to pay for, how the account will be funded, and what volume or card controls you need. This helps assess whether the account profile and product configuration are appropriate.
- Ongoing monitoring. After activation, a provider may ask more questions if there is a material change in volume, country, business category, ownership, or payment pattern. An honest explanation, supported by relevant evidence where needed, is easier to review than a sudden unexplained change.
How to answer clearly
Strong compliance answers are specific, truthful, and proportionate. Explain what is known, what is estimated, and what is still being tested.
Too vague:
“We do everything online and need unlimited cards for global payments.”
This does not explain the business, users, merchants, expected volume, or reason for the card count.
Clearer:
“We are a two-person design studio registered in Portugal. We use software subscriptions, stock-media services, and occasional advertising tools for client projects. We expect about €1,500–€3,000 per month at the start and need a small number of reusable cards to separate project costs.”
Use ranges instead of false precision. Early-stage businesses may not know the final merchant list, exact number of cards, or precise monthly amount. It is fine to say that the first stage is a controlled test and that future volume depends on business growth. What matters is that the account description remains consistent across the application, supporting documents, and later conversations.
Common reasons a review is delayed
A delayed review does not necessarily mean a rejection. Common reasons include:
- Blurry, expired, or incomplete documents
- A name or address that does not match the application
- Missing ownership or authorised-user information
- A website that does not clearly explain the business
- Expected payment activity that is much larger than the original description
- Multiple documents with different names but no explanation of the relationship
When clarification is requested, answer the exact question through the official secure channel. Sending many unrelated files, complete card details, or a full account history can make a review harder rather than easier.
Keep documents and communication secure
Before uploading sensitive information, confirm that you are using the provider’s official domain, in-app verification flow, or authenticated support channel. Be cautious if someone in a chat asks for an identity document, live selfie, wallet password, or complete card credentials outside the normal process.
Where redaction is allowed, hide unrelated account numbers, transaction lines, or personal details that are not needed for the stated purpose. Do not redact the information the provider specifically needs to verify. Keep a simple note of what was sent and when, but never store passwords or one-time codes with the documents.
If details change - such as your address, legal name, company ownership, website, expected volume, or main use case - use the provider’s update process. Opening several replacement accounts to avoid an outdated profile can create more questions, not fewer.
Personal account, freelancer, or company account?
Choose the account type that reflects the real user and purpose. A freelancer may operate as an individual while serving business clients. A registered company should not be presented as a personal account simply because the application seems shorter. Likewise, an individual should not invent a company structure that does not exist.
The distinction can affect ownership records, support, tax reporting, and the way activity is reviewed. If you are paying a client expense, clarify the relationship and keep relevant authorisation or invoice records. Do not mix other people’s funds into an account without understanding the provider’s rules.
Where Buvei fits
Buvei is a virtual card platform, not a way to skip verification. A responsible user should provide accurate personal or business information when requested, describe the legitimate payment scenario clearly, and ask about suitable card options only after the account profile is understood.
Available cards, limits, supported merchants, and verification requirements can depend on account status and configuration. The most useful support request explains who is paying, the relevant personal or business activity, the expected payment range, and the specific payment need. Avoid requesting guaranteed approval or a card that works everywhere: merchant acceptance and transaction decisions also depend on the merchant’s own rules.
Practical examples
Freelancer buying tools for client work
An independent designer pays for design and project-management software and expects €500–€1,000 per month. The relevant profile is an individual identity, self-employed activity, named tools, and a realistic range. There is no need to describe the business as a large agency.
Small agency separating client campaigns
An agency has two directors and needs separate cards for client advertising. It should explain the legal entity, authorised account user, client-project relationship, expected currency, and why separate cards support operational control. Separate cards should never be described as a way to avoid platform rules.
New software company with limited history
A new company has incorporation documents and a live product website but only a few invoices. It can say that it is newly launched, explain the planned revenue model, and provide the evidence available. A short operating history is not the same as a hidden business; the information simply needs to be consistent.
Final takeaway
KYC and KYB reviews are easier when you understand what each question is trying to establish. KYC confirms the person, KYB explains the business, and AML controls assess whether the account activity fits the profile and applicable risk requirements.
Prepare accurate documents, give realistic ranges, explain name or ownership differences, and use secure official channels. A completed review can support access to a payment account, but it does not guarantee that every later transaction will be accepted. Clear, honest, and consistent information helps legitimate users move through the process more smoothly.
