How to Verify Legitimacy of a Business: KYB Guide [2026]

When you are about to work with a new business, whether as a vendor, partner, investor, or financial institution, it makes sense to want to know a bit more about who you are dealing with. Business verification is how you do that systematically.

At its core, business verification is the process of confirming that a company is legally registered, genuinely operating, and accurately represented. It typically involves checking registration records, reviewing key documents, understanding who owns and controls the business, and cross-referencing details across a few independent sources.

This guide covers the full picture. You will find a breakdown of the documents typically required before verification begins, a walkthrough of how to check registration, ownership, contact details, and online presence, and a look at the warning signs worth paying attention to. Whether you are handling verification manually or exploring ways to automate it, this should give you a clear and practical starting point.

What is business verification?

Business verification is the process of confirming that a company is legally registered, legitimately operating, and is who it claims to be. It involves cross-checking a business's credentials, such as its registration documents, ownership structure, tax identification, and contact details, against official records and trusted third-party sources.

Also known as Know Your Business (KYB), this process is used by financial institutions, vendors, investors, and compliance teams before entering into any formal relationship with a company.

Why is it important to verify a business?

Failing to verify a business before engaging with it exposes you to serious financial and reputational risk. Fraudulent companies can pose as legitimate vendors, partners, or clients to launder money or extract sensitive data, and by the time the deception is uncovered, the damage is often already done.

Regulatory bodies require businesses to perform due diligence on the entities they work with, meaning that skipping verification can also result in hefty compliance penalties. In short, business verification is not just a protective measure but a legal and operational necessity.

Here are some of the most common types of business fraud you need to watch out for.

Common types of business frauds

• Shell company fraud: Criminals set up companies with no real operations or assets, using them purely as a front to move illicit funds, evade taxes, or obscure the true ownership behind a transaction. These entities often appear legitimate on paper but have no verifiable business activity.
• Identity theft fraud: A fraudster impersonates a real, established business by cloning its name, registration details, or website to deceive partners, customers, or lenders into transferring money or sharing confidential information.
• Invoice and billing fraud: A fake or manipulated invoice is submitted to a business, tricking its accounts payable team into making payments to a fraudulent account. This can come from external bad actors or even insiders within the organization.
• Vendor fraud: Fraudsters pose as legitimate suppliers, collect advance payments for goods or services, and then disappear, leaving the victim with financial losses and operational disruption.
• Ponzi and investment schemes: Fraudulent businesses solicit investment by promising high returns, using funds from newer investors to pay earlier ones rather than generating any real profit, until the scheme eventually collapses.
• Loan fraud: A business fabricates financial records, inflates revenue figures, or misrepresents its structure to qualify for loans or credit it would not otherwise be eligible for.

How to verify the legitimacy of a business

Verifying a business's legitimacy starts with confirming it is properly registered and recognized by official sources. A few reliable places to start are state registration databases, the Better Business Bureau, and the E-Verify employer search. Here is how each one works.

1. Check business registration with the state

Every legitimate business operating in the United States is required to register with the state in which it conducts business. You can look up a company's registration status through your state's Secretary of State website, where you will typically find details like the business name, registration date, registered agent, and current standing.

If a business cannot be found in these records or shows as inactive or dissolved, that is worth investigating further.

2. Use the Better Business Bureau (BBB)

The Better Business Bureau maintains profiles on millions of businesses across North America. Searching a company on BBB.org can tell you how long it has been in operation, what customer complaints have been filed against it, how those complaints were resolved, and what rating the business holds.

While a BBB listing alone does not confirm full legitimacy, a pattern of unresolved complaints or a very low rating can be a telling sign.

3. E-Verify employer search

If you need to confirm whether a business is a registered employer, the E-Verify Employer Search tool, maintained by the U.S. Department of Homeland Security, allows you to check whether a company is enrolled in the E-Verify program.

This is particularly useful when vetting employers or validating that a business has the proper workforce compliance infrastructure in place.

Beyond registration checks, verifying a business thoroughly means looking at several other dimensions, including its ownership structure, financial standing, contact details, and online presence. Each of these is covered in the sections below.

Before KYB: Which documents are required to verify the business?

The exact requirements can vary depending on the nature of the relationship and the regulatory context, but at a minimum, you should expect to gather and review the following.

• Certificate of incorporation or formation
• Business license
• Employer Identification Number (EIN)
• Articles of association or operating agreement
• Proof of business address
• Ownership and shareholding records
• Financial statements
• Bank account details

Finding Ultimate Beneficial Owner (UBO): How to verify who owns the business?

Knowing who is legally registered as a business is only part of the picture. What matters just as much is understanding who actually controls it. This is where UBO identification comes in. An ultimate beneficial owner is any individual who directly or indirectly owns or controls a significant share of a business, typically defined as 25% or more of ownership or voting rights, though thresholds can vary by jurisdiction and regulatory framework.

Identifying UBOs matters because fraudulent entities often use complex ownership structures, including layered holding companies or nominee arrangements, to obscure who is truly pulling the strings.

Regulators across the globe, including FATF, FinCEN in the U.S., and the EU's Anti-Money Laundering Directives, require businesses to identify and verify UBOs as part of standard due diligence.

Ultimate Beneficial Owner (UBO) verification steps

1. Start with official filings: Many jurisdictions now maintain public or semi-public beneficial ownership registries. In the U.S., the Corporate Transparency Act requires most companies to report their beneficial owners to FinCEN. In the UK, Companies House maintains a People with Significant Control (PSC) register. These are your first port of call.
2. Review shareholder and ownership documents: Ask the business to provide its shareholder register, cap table, or equivalent documentation. Cross-check this against the incorporation documents and articles of association collected during the document verification stage.
3. Trace layered ownership structures: If the business is owned by another company rather than an individual, you need to go up the chain until you identify the natural persons at the top. This may involve reviewing filings across multiple jurisdictions if the structure spans borders.
4. Screen UBOs against watchlists: Once identified, each beneficial owner should be screened against sanctions lists, politically exposed persons (PEP) databases, and adverse media sources. Ownership by a sanctioned individual or a high-risk PEP changes the risk profile of the entire business relationship.

Use third-party data providers: Corporate intelligence platforms aggregate ownership data from multiple sources and can help surface hidden connections or inconsistencies that manual review might miss. Signzy's UBO Verification API does exactly this, pulling from multiple registries and intelligence sources to map ownership structures and flag high-risk relationships automatically, without the manual legwork of querying platforms one by one.

How to verify the contact information of the business?

Contact information is one of the easier things to fabricate, which is exactly why it deserves careful attention. Here is how to verify each type systematically.

• Phone number: Cross-reference the number against the company's official website and third-party directories like Google Maps or LinkedIn. A basic reverse lookup can also confirm whether the number is actually tied to the business name it claims to represent.
• Email address: Check that the domain in the email address matches the company's official website. A legitimate business will rarely use a generic Gmail or Yahoo address for formal correspondence.
• Physical address: Cross-check the address against state registration records and directories. Then use Google Street View to confirm the location is a real commercial space and not a residential building, virtual office, or empty lot.

The goal here is consistency. A legitimate business will generally have contact details that align across multiple independent sources, and any mismatch is worth investigating before you go further.

How to assess the company’s online presence?

• Review the company website: Check whether the website looks professionally maintained and contains detailed information about the company's services, team, and history.
• Search for reviews and mentions: Look the business up on Google, Trustpilot, Glassdoor, and industry-specific forums. A pattern of negative reviews, no reviews at all, or reviews that appear fabricated can all be informative. Also search the company name alongside terms like "fraud," "scam," or "complaint" to surface any red flags that might not appear in standard listings.
• Verify LinkedIn presence: Check whether the company has a LinkedIn page and whether employees actually list it as their employer. A business with no employee presence on LinkedIn, or one where the listed employees have sparse or suspicious profiles, may not be what it claims.
• Run a WHOIS domain check: A WHOIS lookup lets you see when a business's domain was registered, who registered it, and where. You can run a WHOIS check through tools like whois.domaintools.com or ICANN's lookup tool at lookup.icann.org.

Business verification best practices

In its October 2019 document, Best Practices on Beneficial Ownership for Legal Persons, the Financial Action Task Force (FATF) recommends what it calls a multi-pronged approach to verifying beneficial ownership. Rather than relying on a single mechanism, such as a company registry alone, the FATF found that jurisdictions combining several sources of information were significantly more effective at preventing the misuse of legal persons for financial crime.

The core idea is that different information sources supplement and check each other, making it harder for inaccuracies or deliberate misrepresentations to go undetected.

Drawing from that framework and general best practice, here is what a thorough business verification process should include.

✔️ Cross-check across multiple sources: Never rely on information from a single database or document. Compare what a business declares against state registries, tax records, financial institution data, and third-party platforms. Discrepancies between sources are often where red flags surface first.

✔️ Verify at onboarding and on an ongoing basis: Verification is not a one-time event. Ownership structures change, licences lapse, and financial standing shifts. Building in periodic re-verification, particularly for high-value or high-risk relationships, significantly reduces exposure.

✔️ Apply a risk-based approach: Not every business relationship carries the same level of risk. Apply lighter-touch checks to straightforward, low-risk engagements and enhanced due diligence to those involving complex structures, foreign ownership, or higher-risk sectors. The FATF specifically recommends calibrating verification intensity to the ML/TF risk profile of the entity in question.

✔️ Identify and verify the ultimate beneficial owner (UBO): Verifying a company name and registration number is not enough if the actual individuals behind the business remain obscure. Tracing ownership down to the natural person who ultimately controls or benefits from the entity is a critical step, particularly where layered or complex corporate structures are involved.

✔️ Maintain records systematically: Documentation collected during verification should be stored in an organised, retrievable format. The FATF recommends retaining records for a minimum of five years, and many regulatory frameworks mandate this as well.

✔️ Use technology to support, not replace, human judgment: Automated cross-checks, digital identity verification tools, and AI-assisted screening can significantly speed up the process and flag anomalies that manual review might miss. However, technology works best as a layer of support, with human review applied where alerts are triggered or risk is elevated.

✔️ Leverage KYB automation platforms where appropriate: For organisations that onboard businesses at scale, automated KYB platforms can standardise the process, reduce manual effort, and ensure checks are applied consistently across every relationship.

"With Signzy, we built one workflow and updated logic every time we expanded into a new region instead of rewriting everything. This saved weeks of engineering effort and avoided a second integration." — Co-Founder & CTO, Fintech (200+ employees)

How do you spot a fake business? Red flags explored

❌ No verifiable registration: The business cannot be found in any state or national registry, or its registration status shows as inactive, dissolved, or pending.

❌ Mismatched contact details: The phone number, address, and email provided do not align across the company website, registration records, and third-party directories.

❌ Suspicious physical address: The listed address turns out to be a residential property, a virtual office, or an empty lot with no evidence of actual business operations.

❌ Recently registered domain: A WHOIS lookup reveals the company's website domain was registered very recently, despite the business claiming years of operation.

❌ No traceable ownership: There is no clear information about who owns or controls the business, or the ownership structure is deliberately layered and difficult to follow.

❌ Unverifiable or fabricated documents: Documents provided during onboarding contain inconsistencies, look altered, or cannot be authenticated against official sources.

❌ No digital footprint: The business has no credible online presence, no employee profiles on LinkedIn, no reviews, and no mentions anywhere outside its own website.

❌ Requests for unusual payment methods: Pressure to pay via wire transfer, cryptocurrency, or other untraceable methods is a common tactic used by fraudulent entities.

❌ Pressure to move fast: Legitimate businesses rarely rush you through due diligence. Urgency tactics are often designed to prevent you from asking the right questions.

❌ Inconsistent financial records: Financial statements that appear fabricated, show implausible revenue figures, or do not match the apparent size and activity of the business.

❌ Negative or absent reviews with no explanation: Either a suspicious absence of any reviews for a supposedly established business, or a pattern of unresolved complaints pointing to the same issues.

Automating business verification: How can Signzy’s KYB suite help?

Manual business verification is time-consuming, inconsistent, and difficult to scale. Signzy's KYB suite brings the entire process under one roof, so you can onboard businesses faster without cutting corners on compliance.

"Signzy helped us go live in 6 days. The team has been incredibly responsive throughout. They've earned every bit of our business." — CTO, Fintech Startup (20-50 employees)

With Signzy’s KYB suite, you can:

• Verify business registration and legal status in real time across multiple jurisdictions.
• Authenticate KYB documents instantly using AI-powered checks that detect tampering and forgery.
• Trace ownership structures automatically down to the ultimate beneficial owner, however complex the hierarchy.
• Screen against global sanctions lists, PEP databases, and adverse media sources in a single pass.
• Monitor businesses continuously after onboarding and get alerted the moment anything changes.
• Store every verification step in a clean, audit-ready trail that holds up to regulatory scrutiny.

Ready to see it in action? Book a demo with Signzy and find out how businesses like yours are cutting verification time while staying fully compliant.