What defines the legitimacy of an IRB?
In the United States, this is governed by Title 45, Part 46.


Paragraph 101 states that this applies to all research funded by or "subject to regulation" by the US Government
The same paragraph also states that an Agency Head may determine that a foreign IRB system is equivalent and may be substituted


The key requirements for US IRBs are:


Subpart A, Paragraph 107: IRBs must have at least 5 members with varying backgrounds (as enumerated)
Subpart A, Paragraph 108: IRBs must have sufficient meeting space, staff, written procedures for its deliberations, decisions, and adverse incidents
Subpart A, Paragraph 115: IRBs must keep detailed records for three years (as described)
Subpart E: IRBs must be registered with HHS (Office for Human Research Protections and/or Federal Drug Agency).


Most of the other subsections detail the basic rules that IRBs must enforce (e.g., involving fetuses, prisoners).

From what I can tell (and I am no expert), the only barrier to people using Uncle Bill's Cigar Shop IRB is that if a subject is harmed by an IRB-approved protocol, Uncle Bill is going to get sued. Uncle Bill may also have legal problems with the Government if they fail to follow the federal regulations governing IRBs (i.e., if they approve something that is clearly not permitted under CFR).