An examiner or auditor opening a business customer's file can ask four things about the provider's part: which facts it confirmed, from which source, on which date, and who accepted the result. The answers start at the registry lookup, the first of five stages in the KYB and UBO verification guide, which a service automates.
What is a business verification service?
It is an outside provider of a firm's business customer checks: register lookups, ownership searches and screening, through an online platform, an API or both. Buyers also say company, corporate or corporation verification service, business validation service or KYB solution.
It runs part of KYB verification, the step that confirms a business customer, inside know your business, the wider program. Picture a payments firm (illustrative): one API call per merchant returns the register record, officers, owners and screening hits. An analyst decides.
How do business verification services work?
A service returns six kinds of result, each only as good as its source:
Table 1. What a business verification service returns, and what it cannot prove (as of October 2026)
| What it returns | Source it should name | What it cannot prove on its own | What stays with the firm |
|---|---|---|---|
| Company record: name, number, legal form, status, incorporation date, address, officers | The register of incorporation, direct or licensed, with the retrieval date | That the filing is true; later filings | Whether the record is recent and matches the application |
| Ownership: shareholders, parents, the natural persons reached | Shareholder, PSC or ownership registers; the customer's declaration | Control without shares; registers the provider cannot read | Who the beneficial owners are |
| Document checks: certificate, articles, extracts the customer sends | The register entry, matched by number | Ownership, unless the document lists owners | Whether the document counts as evidence |
| Screening of the company and every person found | The lists screened and their refresh times | A company blocked through owners that no list names | Whether a match is true, and who signs it off |
| Licenses held for the activity | The regulator's public register | That the business stays within its permission | Whether the activity fits the license |
| Change alerts: status, officers, owners, lists | Each register and list, on its own schedule | Changes not yet published | The review the alert opens, under ongoing monitoring |
Rows 1 and 2 follow FATF's list for a company, from proof of existence to the natural persons who own or control it (FATF Recommendations, INR.10 para 5(a), (b), June 2026).
Row 4 is where a name check falls short. A free sanctions check of a company name shows whether that name is listed, while OFAC treats a company as blocked, listed or not, once blocked persons together own 50 percent or more of it (guidance of 13 August 2014).
How fresh is the data a business verification service returns?
Each result is true as of its retrieval date; registers publish on their own schedules. Since 9 June 2024, Regulation (EU) 2023/138 has listed basic company data (name, status, registered office, number) among the datasets EU registers publish free through APIs, with no officers or owners (Annex point 5). Timing depends on the registers. A domestic company with one ownership layer returns as fast as its register answers, while a group with a foreign parent waits on each register in its chain.
Why do firms use a business verification service, and what stays with them?
Reach: one provider queries many registers and lists, the important benefit for AML and KYB compliance teams. No rule requires one, and using business verification services moves neither the duty to verify nor the risks of operating without verification off the firm. Four things stay with the firm:
- Liability for a provider's checks, under every rulebook in Table 2.
- The risk profile, recorded in the KYC risk rating.
- The decision to take the customer on.
- The records an examiner or auditor asks for.
Table 2. Using a provider: what each rulebook says and who stays liable (as of October 2026)
| Rulebook | Outsourcing | Reliance | Who stays liable | Records |
|---|---|---|---|---|
| FATF (Recommendations, R17, INR.17, R11) | Outside R17; the provider works under the firm's procedures and control | On a regulated, supervised or monitored firm, usually with its own customer relationship | The firm ("ultimate responsibility" on reliance) | At least five years |
| EU today (Directive (EU) 2015/849) | Outside the reliance rules where, by contract, the provider is "regarded as part of the obliged entity" (Art 29) | On other obliged entities (Arts 25 to 28) | The firm on reliance (Art 25); a contracted provider counts as part of the firm (Art 29) | Five years after the relationship ends (Art 40) |
| EU from 10 July 2027 (Regulation (EU) 2024/1624) | Supervisor told before the provider starts; written agreement; risk profile and onboarding decision not outsourced, save some investment funds (Art 18(3), (7)) | On other obliged entities; copies upon request within five working days (Arts 48, 49) | The firm, "fully liable" (Art 18(2)) | Five years (Art 77(3)) |
| UK (MLR 2017 reg 39, reg 40) | Allowed if the arrangement keeps the firm liable for any failure (39(7), (8)) | Listed persons only; copies on request (39(2), (3)) | The firm, which "remains liable" (39(1)) | Five years (40(3)) |
| US (31 CFR 1020.220, 68 FR 25090) | An agent may do the work; the bank "ultimately is responsible" for it | On a regulated financial institution, by contract and annual certification ((a)(6)) | The bank; exception below | Identity data five years after the account closes, other records five years after made ((a)(3)(ii)) |
The US exception is reliance. A bank relying on another regulated financial institution under (a)(6) "will not be held responsible for the failure" of that institution, if it can show the reliance was reasonable and holds the contract and certifications (68 FR 25090, at 25104). For a vendor, 2023 interagency guidance says using third parties does "not diminish or remove" a bank's responsibilities (88 FR 37920).
Is using a business verification service outsourcing or reliance?
Outsourcing, as a rule. Reliance accepts checks a regulated firm ran on its own customer under its own procedures, and Recommendation 17 "does not apply to outsourcing or agency relationships" (INR.17 para 1). Picture a bank (illustrative) taking on a client verified by the client's own bank: reliance. Sending registration numbers to a provider is outsourcing.
What changed in 2026 for firms that use a provider?
- 30 June. The UK bar on reliance in reg 39(4) now names a "FATF call for action country" (S.I. 2026/621).
- 14 August. FinCEN's final rule took effect, making permanent the exemption of US companies from beneficial ownership reporting.
- 30 September. AMLA published its final report on the EU standards for customer due diligence (AMLR Article 28(1)); next comes submission to the European Commission for adoption.
- No sooner than the end of 2026. Companies House expects to finish identity verification of more than 7 million existing directors and PSCs; until then some listed officers may be unverified.
How do you choose a business verification service?
Seven key features to look for, each a test to run before you sign:
- A source on every field. Verifying means using "a reliable source which is independent" of the customer (MLR 2017 reg 28(18)).
- A retrieval date on every record. A record proves facts only as of that date.
- Country coverage, with closed registers named. EU ownership registers open to obliged entities "within the framework of customer due diligence" (Directive 2015/849 Art 30(5)(b)), and the Court of Justice ruled general public access invalid on 22 November 2022, so an empty owner field can mean no access.
- Ownership traced to natural persons, gaps marked (INR.10 para 5(b)).
- Every party screened, owners included, with list refresh times stated.
- Records, copies and liability in the contract. UK outsourcing arrangements must keep the firm liable (reg 39(7)); from 10 July 2027 an EU firm needs a written agreement (AMLR Art 18(4)).
- Results that support the firm's decision. From that date an EU firm may not outsource the risk profile or the onboarding decision (Art 18(3)(c), (d)), some investment funds aside (18(7)).
Before signing, run the service on business customers whose files the firm already knows, including one company dissolved in the last year and one group with a foreign parent: a service that shows the dissolved company as active, or stops at the foreign parent without saying so, will do the same with applicants nobody knows yet.
For tests 1 and 2, complead, formerly Sanction Scanner, confirms each company against official registers and vetted sources, and "every record carries its retrieval date and the publication cadence of its source."
Where does a business verification service stop?
Three illustrative files:
An EU holding company comes back with no owner. The provider cannot read that register, the firm as an obliged entity can, so the file says "not available from the provider" and the analyst checks the register. From 10 July 2027 a provider doing that work counts as part of the firm, central registers included (AMLR Art 18(2)). Where no natural person stands behind a company at all, the rules fall back on the senior managing official.
A company shows active on a May record. The register now names a liquidator, and the retrieval date gives it away.
A director matches a sanctioned name: the provider raises it, and the firm decides whether it is true.
Which businesses need verification services?
Every firm under due diligence rules needs business verification for business customers, in house or through a service: financial institutions (FATF Recommendation 10), virtual asset service providers (R15), and lawyers, accountants and other DNFBPs (R22). A small business registered as a company is verified like any other company. INR.10 para 5 covers every legal person customer.
Firms also verify suppliers under know your supplier checks, and vendors and deal targets under vendor due diligence.
Partners too: Unity screens the partners of its app economy business against sanctions, PEP and watchlists before it works with them.
With a provider that passes the seven tests, the examiner's four questions have answers in the file: each fact, its source, its retrieval date, and who in the firm accepted the result.
Related terms
- KYB verification. The step of know your business that confirms a business customer exists, who runs it and who owns it.
- Ultimate beneficial owner. The individual, never a company, who in the end owns or controls a business.
- Know your supplier. Checks on a supplier's identity, owners and sanctions exposure.
- KYC verification. The checks that confirm an individual customer's identity.
- Ongoing monitoring. Keeping a customer's file and activity under review while the relationship lasts.
- Know your business (KYB). The program a firm runs for business customers, from application to exit.
How this entry was checked. Two people stand behind this entry: Sinan Tekin, Regional Sales Manager at complead, wrote it, and Fatih Coşkun, Founder and CEO, checks each rule, date and quotation in it against the source. Last reviewed: 28 October 2026. The firms and files in the examples are illustrative. Sources opened on 28 October 2026: MLR 2017 regulations 28, 39 and 40 with S.I. 2026/621, the FATF Recommendations (June 2026), Regulation (EU) 2024/1624 and Directive (EU) 2015/849, 31 CFR 1020.220 with 68 FR 25090, 88 FR 37920, Regulation (EU) 2023/138, OFAC's guidance of 13 August 2014, the Court of Justice release of 22 November 2022, and the FinCEN, AMLA and Companies House pages.
