The Ultimate Guide to Business Verification for KYB Compliance

In brief: 

• When an organization wants to onboard a business customer, they must verify the legitimacy of that business using official documented information.
• To properly verify a business, an organization needs to not only check the business’s information against official records to determine if the business physically exists and is being represented accurately. It also needs to identify the Ultimate Beneficial Owners (UBOs) of the business, determine if they are real people representing themselves truthfully, and evaluate the potential risk inherent in their circumstances.
• Some methods for verifying a business and its UBOs are to employ a dedicated company ID agency or software like Middesk; check federal or regional government registration databases; search other places where a company may have publicly-available official documentation; and/or contact the company directly.

‍

A key part of an organization’s risk management strategy needs to be knowing the other businesses it’s partnering with or taking on as clients. Does a business physically exist anywhere on Earth? Do its stated details match up with what governments and regulatory agencies have on file? Who owns the business? Are they a real person (or people), are they who they say they are, and how much risk do their circumstances present?

These are all questions an organization needs to answer when onboarding a business as a partner or customer, and occasionally during the relationship’s lifecycle to determine whether its risk profile has changed. This guide will go through the whys and hows of properly verifying that companies are legitimate before starting or continuing any sort of business relationship.

Let’s start off by explaining what it means to verify a business.

‍

Business verification is the process of an organization researching and validating information about another business, towards the end of onboarding or maintaining that business as a client or partner. Its purpose is to check if a business actually exists and is being represented truthfully.

Know Your Business (or KYB) and business verification typically refer to the same process.

‍

The overall goal of company verification is for an organization to assess the degree of risk involved in having another business as a partner or client. Typically, the most important risks concern whether the business—including its owners—is involved in financial criminal activity, or may become involved in the near future.

To that end, an organization needs to look at two general categories of information. One is regarding the business itself: whether it has a physical presence, where it’s located, what its stated business operations are, and whether it’s properly licensed. It’s also important to check that this information is consistent across official sources to ensure the business isn’t being misrepresented by its owners.

An organization also needs to get information on a business’s beneficial owners. These are the people who hold significant stock investment in the business, or otherwise have significant voting rights in the business’s high-level decision-making processes. They can be distinct from managers, who run a business’s daily operations but may not have any official stake in the business writ large.

Research into beneficial owners works much the same way as standard Know Your Customer (KYC) processes. That is, the goal is to determine whether they are actual people who are who they claim to be, and whether they are involved with activities or public administrative positions that pose risks related to (financial) crime. 

‍

Most organizations need to exercise at least some degree of due diligence when it comes to onboarding or maintaining a relationship with a business as a client or partner. But it’s a legal requirement for organizations that deal with finances, securities, and commodities to verify if a business is legitimate during the course of a relationship. This is due to their overall societal and economic importance, and the corresponding amount of damage that could be caused if they were to be abused.

As per FinCEN’s CDD Final Rule, types of organizations that are required by law to verify businesses they’re associated with include:

• Banks (including neobanks)
• Mutual funds
• Stock brokers or dealers
• Future commission merchants
• Commodities brokers
• Money services businesses
• Other financial institutions

‍

Remember that the process for how to verify if a business is real consists of two parts. The first is looking at information related to the business itself to see if it’s legitimate and describes the business in question. The second is finding out who owns the business, and whether they’re real persons truthfully representing themselves.

Some basic methods for how to verify if a business is legit include:

• Review their physical presence: Look up whether the business has a headquarters or operating branches somewhere in the world. A company that has no physical location may be a shell corporation; though these are sometimes legitimate, they often aren’t and are used to illegally hide or move money.
• Review their online/web presence: Most legitimate businesses will have at least a website, and many will also have accounts on social networking sites. They use these channels to advertise themselves, make announcements, answer questions, provide contact details, and so on. How active they are on social media can also be a measure of their legitimacy; fake companies tend to only post generic content sporadically, if at all.
• Check their Privacy Policy and Terms of Service: Even if a company has a website, it may not necessarily be legitimate if it doesn’t have a Privacy Policy or set of Terms of Service. Also be sure to check these terms to see how well written they are, both from a spelling and grammar point of view as well as a legal one (e.g. what customer data do they collect, and what do they use it for? What is the customer allowed or not allowed to do? What protections does the company give itself?).
• Contact them: Find ways of reaching out to the business through different channels and try them. Phone them, write them an email, send a letter through the mail, leave them a message on one of their social media accounts, or visit their headquarters or a branch in person. Make sure these are all valid and all lead to the same company.

Note, however, that these methods are rarely totally sufficient to verify a business—especially in the eyes of regulatory agencies. There are specific pieces of information that regulators will recommend (or require) organizations to find out about business partners and clients. These include official names, registration addresses, incorporation documents, industry-specific licensing, and tax ID numbers—all of which we’ll discuss next.

‍

How to verify a business properly for KYB compliance

So how do you verify a business is legitimate in terms of properly carrying out KYB? Here are six things about a business that should be searched for to confirm that they both exist and are valid:

1. Verify the legal name: A company may have an informal trade name or a “doing business as” (DBA) name, or both. So be sure to get its official name from an official source.
2. Verify the registered address: Ensure that the company is registered as operating from an address somewhere on Earth so that it isn’t a shell company. It would also be good to look up if the company has headquarters and operating branches in countries and territories, and assess risks associated with those jurisdictions.
3. Verify the Ultimate Beneficial Owner (UBO): Look up the person (or group of people) who has the highest level of ownership or control over the organization. Check their information both to ensure they’re a real person (or real people), and to assess what level of business risk they represent. See below for more information.
4. Verify the business registration or incorporation: This documentation proves that a business is properly registered with a government to operate in a certain jurisdiction (or jurisdictions).
5. Verify the licensing documentation: Some industries—including finance—require companies to have additional certification from regulatory boards. Make sure a company has the proper licensing from an accredited institution.
6. Verify the tax information: All legitimate businesses also need to be registered with a federal government in order to be identifiable for taxing purposes. Phony or corrupt businesses may avoid doing this to commit tax evasion. We’ll have more details later on about how to find this information.

‍

How to verify business ownership or a Ultimate Beneficial Owner (UBO)

Ultimate Beneficial Owners are typically defined as natural persons who own at least 25% of stock investment in a company, and/or at least 25% of voting shares in the company’s high-level decision-making processes. Despite that definition being rather straightforward, determining who owns a business isn’t always clear-cut.

Businesses can have unusual corporate structures that use various and sometimes ambiguous titles for officials. When a business has such a confusing chain of command, it can be difficult—–at least on the surface—to separate who actually owns the business from who is merely elected to run its daily operations. It’s also possible that this is intentional to hide the true degree of risk a company’s owner(s) present, or even cover for them while they conduct illicit dealings behind the scenes.

Legitimate businesses will often have their UBO(s) listed in government registers. So searching for a company on an online government database, or submitting a public information request to a government, is usually a reliable (if sometimes costly and time-consuming) way to verify business ownership. This information may also be found in other public databases, or through contacting the company directly. But dedicated corporate information platforms usually offer the best balance of accuracy and convenience.

‍

How to verify a business tax ID number

In the US, the main business tax ID number is the Employer Identification Number, or EIN. There are a few ways to find this number; the most direct one is to contact the company’s finance department and ask for the number. It’s also possible to find the number on company documents if the company is registered in the SEC’s EDGAR database.

Another way to verify a business EIN number involves searching online for public copies of government registration forms filed by the company, which may include the EIN. The company’s credit report will definitely list the EIN, so contacting a major credit bureau is another option. Again, though, specialized company ID verification services will often have this information or know how to get it easily, saving significant time and energy in acquiring this information and also providing a more trustworthy verification process.

‍

There are several types of resources out there for how to verify a business is legitimate. Here are four methods of getting official information on a business in order to tell if it’s real or not.

‍

1. Business identity platform: Middesk

How a business identity platform helps: Delivers information to accelerate onboarding, approve more business applications, and stay ahead of the competition—all while reducing fraud and staying compliant.

An all-in-one business identity solution specializes in collecting and organizing information needed for verifying a business. Middesk’s Business Verification solution checks information sources such as company websites, government registries, postal services, international organization lists, and more. 

This lets it get not just basic verification information on businesses—legal names, addresses, corporate documentation, tax status, UBOs, etc. It also provides additional risk-related information like what industry the company’s in, if there’s any outstanding litigation against it, or if it’s been sanctioned by a country or organization.

‍

2. Government register: State Secretary of State portals

How a government register helps: Contains most official identification information for legitimate businesses registered in a jurisdiction

Legitimate businesses will have most or all of their compliance-related information registered with a local or federal government. In the case of the US, each state’s Secretary of State office has a database that should contain official filings for each company licensed to operate in that state.

If not found online, this information can be searched for through submitting a public information request to a state government. This sometimes costs money, and often takes significantly more time than using a dedicated solution. Middesk is the only provider with partnerships for direct Secretary of State (SOS) data for all states, meaning Middesk clients get the most up-to-date and trustworthy SOS data available.

‍

3. Alternative public records

How alternative public records help: A free, if indirect and time-consuming, method of getting official information on a business

If a main federal or regional government (like a state Secretary of State portal) doesn’t have certain information on a company, then other institutions and government agencies might. For example, an organization like the Department of Motor Vehicles might have information on a company if it has vehicles registered in its name. Or, if the business is in an industry that requires additional licensing, then contacting the appropriate licensing bureau can be a way to get information on the business.

These options are mainly meant as ways to fill in information gaps about companies, rather than as primary sources of information. It can take quite a while to look through them all, and there’s no guarantee of finding any information that’s useful and isn’t already known. 

‍

4. Contacting the company

How contacting the company helps: Getting company information directly from the source, though they may be unwilling or unable to provide it

If all else fails, going straight to the company itself is a way to validate a business. Visiting a company branch or headquarters in person is probably the best bet, though an email, regular letter, phone call, or message on a website or social media account might also be helpful. The ideal goal is to get copies of official documents that can be used to verify a business’s identity.

Note that it may take a while to find a person in the company who can provide the information or documentation necessary to verify the business as being legitimate. Even then, they may not divulge it without a proper request, or may not have authorization to give it out either on a company level or for legal reasons. And verbally-delivered information usually won’t suffice in terms of complying with business verification regulations; copies of official documents are typically required.

‍

Properly verify business partners and clients to stay out of regulatory and reputational trouble

Since the Panama Papers scandal in 2016, validating partner and customer credentials has become as important for B2B relationships as it is for B2C relationships. Many jurisdictions now legally require organizations to conduct adequate background checks on businesses they want to start or continue relationships with.

Failure to do so can result in stiff regulatory penalties. Not to mention if an associated business (or one of its owners) is caught doing something immoral or illegal, an organization can collaterally suffer significant reputational damage.

Avoid these dangers by knowing how to verify if a business is real, and having the right tools to do it properly. Contact our team here at Middesk to see how we can help.