Business verification software (also called KYB software) takes the business details on an application, queries independent sources such as state Secretary of State registries, sanctions lists, lien filings, business credit files and address data, decides which returned records describe the same business, and returns a structured result: what matched, what conflicted, what could not be found, and the evidence behind each finding.
This guide is about the software and the data, not the overall KYB process. If you want the process view (what KYB covers, where it sits in origination, a tiered approach to depth), start with our KYB guide for lenders, and for the line between business and individual checks see KYB vs KYC. Here we go one level down: the data sources automated KYB actually uses for SMB lending, how entity resolution and matching work, what a good result should return, how vendors orchestrate sources, where coverage breaks for small businesses, how monitoring works after funding, what the regulatory picture looks like in late 2026, and a set of questions to put in front of any vendor.
What does KYB verification software actually do?
KYB verification software automates three jobs: gathering records about a business from sources the applicant did not create, resolving those records to one entity, and comparing what the sources say against what the applicant stated. The output is a set of findings for a reviewer, not a decision.
Vendors are often strong at one job and weak at another. Gathering is about which sources the product reaches and how fresh they are. Resolving is deciding which of a dozen registry candidates, if any, is the applicant. Comparing checks each field the applicant supplied against the resolved sources and labels it a match, a mismatch, or not verifiable. Comparison quality is capped by resolution: a confident comparison against the wrong entity is worse than none.
In an underwriting workflow, KYB software sits at the verification stage, after documents are structured and financials are read, and before fraud and policy review. An unresolved identity or a registry-versus-bank-account conflict changes how carefully the fraud signals and policy checks should be read.
What data sources are typically used in automated KYB verification for SMB lending?
Automated KYB for SMB lending typically draws on state Secretary of State registries, EIN evidence, sanctions and watchlists, beneficial ownership information, UCC lien filings, business credit files, web and domain signals, address and phone intelligence, and bank account ownership checks. Each answers a different question, and none is complete on its own.
Secretary of State business registries
The state registry is the anchor for any registered entity. A registry record usually gives the exact legal name, entity type (LLC, corporation, limited partnership), state file number, formation or registration date, current status, and registered agent. What else it contains varies by state: some publish principal office addresses and the officers or managers named in annual reports, others publish very little beyond the agent. Status vocabulary varies too. Active, in good standing, forfeited, administratively dissolved, revoked and withdrawn mean different things in different states, and good software maps them to a small normalized set while keeping the state's own wording as evidence.
Two details catch teams out. First, a business formed in one state (often Delaware or Wyoming) and operating in another should appear twice: as a domestic entity in its formation state and as a foreign registration in the state where it operates. A lender in Texas looking only at the Texas registry may see a foreign LLC with a recent registration date and wrongly read the business as new. Second, a registry status is evidence of the status on the day it was pulled, so the retrieval timestamp belongs on the finding.
EIN and TIN evidence
Matching a business name to its Employer Identification Number is one of the most requested KYB checks and one of the most misunderstood. The IRS runs a TIN Matching program, but the IRS describes it as being only for payers and their authorized agents that submit information returns, used to validate name and TIN combinations before filing. It is not a general-purpose KYB lookup for lenders. Ask any vendor that advertises EIN verification exactly how it is done, and under what authority.
In practice, lenders often rely on documentary evidence: the IRS EIN assignment notice (CP 575) or an EIN verification letter (147C) supplied by the applicant, and the business name and EIN as they appear on tax returns in the file. Software helps by extracting the name and EIN from each document and checking that they agree with each other and with the registry.
Sanctions lists and watchlists
Sanctions screening checks the business, its owners and sometimes its address against government lists. For U.S. lenders the core source is OFAC. The OFAC Sanctions List Search covers the Specially Designated Nationals (SDN) list and OFAC's non-SDN lists, uses approximate string matching to find possible matches, and lets the user set a minimum name score. OFAC says it does not recommend any particular confidence rating, and that using the tool is not a substitute for appropriate due diligence.
So screening produces possible matches that someone must clear with reasons (different date of birth, different country). A KYB tool should show the list, entry, score and driving fields, record who cleared it and why, and re-screen when lists change. OFAC sanctions apply to U.S. persons generally, not only banks, which is why screening is close to universal in business lending.
Beneficial ownership information
Ownership is where expectations and available data diverge most in 2026. For domestic U.S. companies there is no federal beneficial ownership database a lender can query, because FinCEN removed the reporting requirement for U.S. companies (details in the regulatory section below). Ownership therefore comes from the applicant's own certification, from state filings where a state publishes members, managers or officers, from documents such as an operating agreement or tax schedules showing ownership percentages, and from KYC on the individuals named. Software can compare those sources; it cannot invent a registry that does not exist.
UCC filings
UCC-1 financing statements are public notices that a secured party claims an interest in a debtor's assets. They are filed with the state, usually the Secretary of State, against the debtor's legal name. For alternative lenders they do two jobs. They corroborate identity (the debtor name and address on the filing should match the registry), and they reveal other funders and secured lenders, which matters for stacking review. A UCC search is only as good as the name it is run against, which is one more reason entity resolution has to come first.
Business credit bureau files
Commercial credit bureaus aggregate firmographics, trade payment history, public records and derogatory items. For the businesses many MCA and SMB funders serve, the file is often thin or absent, and a not-found result from a bureau is common and usually uninformative on its own. Treat bureau firmographics as corroboration, and treat disagreement between the bureau's years in business and the registry's formation date as a question, not a verdict.
Web presence and domain signals
Web checks look for an operating footprint: a live website, a business listing, a domain whose registration date predates the claimed operating history, an email domain that matches the website. They are weak evidence in both directions: real trades often have no website, and a fabricated business can build one in an afternoon. The useful signal is usually inconsistency, such as a domain registered three weeks ago for a business claiming eight years of operation, which is the pattern described in our piece on shell companies and synthetic business identities.
Address and phone intelligence
Address intelligence classifies the stated address: commercial or residential, a commercial mail receiving agency (a private mailbox), a virtual office, a registered agent's address shared by thousands of entities, or a vacant lot. Phone intelligence returns line type (mobile, landline, VoIP), carrier and sometimes how long the number has been associated with the business. Neither is disqualifying alone; a home-based contractor has a residential address and a mobile number. The combination matters: a registered agent address as the operating address, a VoIP number with no history and a two-week-old domain say together what none says alone.
Bank account ownership verification
For funders that remit and collect by ACH, confirming that the operating account belongs to the business is close to the most important check in the file. Evidence can come from the account holder name on bank statements, from a bank data connection that returns the account owner's name, or from a voided check. A mismatch between the account holder and the legal entity often has an innocent explanation (a trade name, a parent company account), but it needs one written into the file before funds move.
How do entity resolution and matching work in KYB software?
Entity resolution is how KYB software decides that a registry record, a UCC filing, a bureau file and an applicant's form all describe the same business. It works by normalizing names and addresses, narrowing candidates with hard filters, scoring each field with fuzzy comparison, and returning a confidence level with the reasons behind it.
Name normalization
Business names are written inconsistently everywhere. The applicant types Cedar and Stone LLC, the registry holds CEDAR & STONE, L.L.C., the bank statement header says CEDAR STONE LLC and the UCC filing says Cedar & Stone Limited Liability Co. Normalization makes these comparable before any fuzzy matching runs: fold case, strip punctuation, standardize the ampersand, remove or separately capture legal suffixes, drop a leading article, collapse whitespace. The legal suffix should be captured rather than thrown away, because a mismatch in entity type (an Inc. where the applicant claims an LLC) is a finding in its own right.
const SUFFIXES = [
[/\b(l\.?\s?l\.?\s?c\.?|limited liability co(mpany)?)$/, "llc"],
[/\b(inc\.?|incorporated)$/, "inc"],
[/\b(corp\.?|corporation)$/, "corp"],
];
export function normalizeBusinessName(raw) {
let name = raw.toLowerCase().trim();
let suffix = null;
for (const [pattern, label] of SUFFIXES) {
if (pattern.test(name)) {
suffix = label;
name = name.replace(pattern, "");
break;
}
}
name = name
.replace(/&/g, " and ")
.replace(/[.,'"()-]/g, " ")
.replace(/^the\s+/, "")
.replace(/\s+/g, " ")
.trim();
return { name, suffix };
}
// normalizeBusinessName("CEDAR & STONE, L.L.C.")
// -> { name: "cedar and stone", suffix: "llc" }DBAs and trade names
Many small businesses operate under a name that is not their legal name. Assumed name or DBA filings are made at the state level in some states and at the county level in others, and some sole proprietors never file one at all. KYB software that only compares the applicant's operating name to the registry will produce false mismatches on legitimate businesses every day. Better tools carry a list of known names for the entity (legal name, registered DBAs, names seen on bank statements and invoices) and record which name each source matched, so the reviewer can see that Cedar Stone Supply on the bank account is a recorded trade name rather than a different business.
Fuzzy matching and blocking
After normalization, the software narrows candidates with hard filters (often called blocking): same state of formation or registration, compatible entity type, perhaps the same ZIP code region. Then it scores the remaining candidates field by field. Names are usually compared with string-similarity measures such as edit distance or token-based similarity, which tolerate typos and reordered words. Addresses are compared after standardization (suite numbers, street suffixes, directional abbreviations). Officer or member names are compared against the people the applicant listed. Dates are compared with tolerance, since a registration date and a claimed start date can legitimately differ.
The failure modes are predictable. Common names (ABC Construction, Elite Auto, Prime Logistics) produce many plausible candidates and false matches. Shared registered agent addresses make unrelated entities look co-located. A business that re-formed after a dissolution can have two registry records with nearly identical names and different file numbers. Good software surfaces these situations as ambiguous instead of quietly picking the top score.
Confidence and match reasons
A resolution result should come with a confidence level and the reasons behind it, not just a single number. Name matched on normalized legal name; address matched on street but not suite; one of two members appears as manager in the annual report; formation date within the claimed range. A bare 0.84 invites either blind trust or a full manual redo.
What should a KYB verification result return?
A useful KYB result returns the resolved entity, a field-by-field comparison with match, mismatch or not-verifiable status, the source and retrieval time for every finding, open flags for a reviewer, and the raw source records or links needed to re-check them. Anything less pushes reconstruction work back onto the underwriter.
Concretely, a result worth integrating has these parts:
- Resolved entity: legal name, entity type, state and file number, formation date, normalized status and the state's own status text, registered agent, and any foreign registrations.
- Field comparisons: each applicant-supplied field with its status (match, partial, mismatch, not verifiable) and the source that decided it.
- Provenance: source name, the identifier of the record, the query that was run, and when it was retrieved. Without a timestamp you cannot tell a stale finding from a fresh one.
- Screening results: lists checked, list version or date, possible matches with scores and the fields that drove them, and their disposition.
- Flags: plain-language items for a reviewer, each tied to the comparison that raised it.
- Coverage notes: which sources were not reached, timed out or do not cover this entity type, so a missing result is not mistaken for a clean one.
{
"applicant": { "legalName": "Cedar & Stone LLC", "state": "TX", "entityType": "LLC" },
"resolvedEntity": {
"legalName": "CEDAR & STONE, L.L.C.",
"fileNumber": "illustrative-0000000",
"status": { "normalized": "active", "sourceText": "In existence" },
"formedOn": "2019-04-02",
"confidence": "high",
"reasons": ["normalized name exact", "member listed as manager", "formation date in claimed range"]
},
"fields": [
{ "field": "legalName", "result": "match", "source": "state_registry", "retrievedAt": "2026-10-30T14:02:11Z" },
{ "field": "address", "result": "partial", "detail": "street matches, address type residential", "source": "address_intel" },
{ "field": "owners", "result": "not_verifiable", "detail": "registry lists one manager; applicant lists two members" },
{ "field": "bankAccountHolder", "result": "mismatch", "detail": "account name: Cedar Stone Supply" }
],
"screening": { "lists": ["OFAC SDN", "OFAC non-SDN"], "possibleMatches": 0 },
"flags": ["Bank account holder differs from legal name; confirm DBA before funding"],
"coverage": { "businessCredit": "not_found", "uccSearch": "complete, 2 filings" }
}Notice what the result does not contain: an approve or decline. KYB software should report what it found and how sure it is. Whether a residential address or an unconfirmed DBA is acceptable for a given product is a policy question for the lender, which is why it belongs in a policy engine or a reviewer's judgment and not inside the verification vendor's black box.
How do waterfall and orchestration across KYB sources work?
Orchestration decides which sources to query, in what order, and when to stop. A waterfall queries a primary source first and falls back to secondary sources only when the primary returns nothing or low confidence, which controls cost and latency without giving up coverage.
A typical waterfall for a registered SMB looks like this: resolve the entity against the state registry in the claimed state; if nothing is found, search the likely formation states and commercial aggregators that combine registry data across states; once resolved, run the dependent checks (UCC search on the exact legal name, sanctions screening on the entity and the named owners, address and phone classification); then pull optional sources such as a business credit file only if the product's policy calls for them. Dependent checks matter. Running a UCC search on the applicant's typed name before resolution will miss filings made against the true legal name, or return filings against a similarly named stranger.
Questions to ask about orchestration:
- Is the order configurable per product?
- What triggers a fallback? Not found, low confidence, a timeout and a stale record should be distinct triggers, and the result should say which fired.
- Are results cached, and for how long? A day during one review is reasonable; a three-month-old status at renewal is not.
- What happens when a source is down? The result should mark the source as unavailable rather than silently omitting it.
Where do automated KYB checks have coverage gaps?
Automated KYB is weakest exactly where alternative lenders lend most: sole proprietors with no state filing, newly formed entities that have not reached aggregated databases, businesses in states with slow or limited online records, and owners whose details appear in no public source. A not-found result in these cases usually means the data is missing, not that the business is fake.
- Sole proprietors. A sole proprietorship generally needs no state formation filing, so there is no registry record to find. Verification shifts to the owner's identity (KYC), local licenses, a DBA filing if one exists, tax documents and the bank account holder name.
- New formations. A business formed last month may be on the state's own site but not yet in commercial aggregators, and will have no bureau file or UCC history. Query the primary registry directly before concluding anything.
- State refresh lags and access limits. States differ in how quickly filings appear online, in what fields they publish, and in whether bulk or automated access is available. A vendor's coverage claim for all 50 states can hide large differences in freshness and depth between them.
- Ownership. As covered below, there is no federal ownership registry for domestic companies, and many states publish no member or owner data at all.
The practical rule: a KYB result must distinguish not found from conflicting. Not found is a coverage statement that should trigger a document request (articles of organization, an EIN letter, a DBA certificate). Conflicting is an evidence statement that should trigger a reviewer's attention. Collapsing both into a single fail flag penalizes legitimate young businesses and teaches reviewers to ignore the flag, which is the worst outcome for the cases that really are conflicts.
What are the benefits of KYB checks in loan applications?
KYB checks in loan applications confirm that the business exists and is in good standing, that the person applying is connected to it, that funds will go to an account the business owns, and that sanctions screening was done. They also make the rest of underwriting more reliable, because financial analysis is only meaningful for a business whose identity is settled.
The benefits are concrete when you trace them through a file:
- Earlier stops on invalid files. A forfeited or dissolved entity, or a bank account owned by someone else, is better found before an analyst spends an hour on cash flow.
- Better fraud context. Identity conflicts are among the strongest inputs to fraud review, and they change how deposit patterns and document anomalies should be read.
- Cleaner stacking and position review. A UCC search on the resolved legal name surfaces other secured parties, which feeds directly into how a funder reads existing obligations.
- Enforceability. Contracts signed with the correct legal entity, by someone connected to it, are easier to enforce than contracts signed with a trade name.
- A defensible record. Investors, bank partners and auditors increasingly ask how a business was verified. A stored result with sources and timestamps answers that question without anyone reconstructing it from memory.
- Faster reviews for clean files. When verification comes back consistent with clear evidence, the reviewer can confirm it quickly and spend time where the file actually needs it.
How should KYB business risk assessments handle ongoing monitoring?
Ongoing monitoring re-checks a funded business on a schedule or on events, such as a change in state status, a new UCC filing, a sanctions list update or a renewal request, and routes changes to a person to review. The point is to notice that the business you verified at funding is no longer the business on file.
For short-duration products such as merchant cash advances, renewal is the obvious checkpoint: compare the renewal file against the original KYB record rather than verifying from scratch, because drift in owners, address, bank account or status is what matters.
Event-driven monitoring is more useful than calendar-driven re-pulls when the sources support it. The events worth watching for most SMB funders are:
- Status changes at the state registry, such as forfeiture for a missed franchise tax or annual report, or a voluntary dissolution.
- New UCC filings against the business's legal name, which can indicate new secured debt or another funder taking a position.
- Sanctions list updates, which require re-screening existing customers and owners, not only new applicants.
- Changes in the operating bank account used for remittances, which deserve the same ownership check as at onboarding.
- Ownership or officer changes visible in annual reports where the state publishes them.
Each monitoring alert should land as a flag in a reviewer's queue with the before and after values and their sources. A status change from active to forfeited might be an administrative lapse cured in a week or the first sign of a business winding down. That judgment belongs to a person who can look at the remittance history and call the merchant. For more on keeping people in that loop, see human-in-the-loop AI underwriting.
What regulations shape KYB for alternative lenders in 2026?
Federal KYB rules center on FinCEN's Customer Due Diligence rule, which applies to specific covered financial institutions, and OFAC sanctions obligations, which apply to all U.S. persons. Beneficial ownership reporting under the Corporate Transparency Act no longer applies to domestic U.S. companies. Which obligations reach a given non-bank lender depends on its structure, partners and states, so confirm with counsel.
FinCEN's Customer Due Diligence rule
FinCEN's Customer Due Diligence rule applies to covered financial institutions: U.S. banks, brokers or dealers in securities, mutual funds, futures commission merchants and introducing brokers in commodities. They must identify and verify each individual who owns 25 percent or more of a legal entity customer and an individual with significant responsibility to control it, alongside customer identification, understanding the customer relationship, and ongoing monitoring.
That requirement has since been narrowed in one respect. On February 13, 2026, FinCEN issued exceptive relief order FIN-2026-R001, which lets covered institutions stop re-identifying and re-verifying beneficial owners at every new account opening. Instead they may do it when a legal entity customer first opens an account, any time they learn facts that reasonably call previously obtained ownership information into question, and as needed under their risk-based ongoing due diligence. The order states that other AML/CFT requirements under the Bank Secrecy Act continue to apply.
Many MCA funders and non-bank SMB lenders are not on that list, but bank partners, warehouse lenders and investors often expect a comparable ownership process, and the 25 percent and control-person test is a common policy default. Whether it applies to you is a legal question, not a software setting.
The Corporate Transparency Act and beneficial ownership reporting
According to FinCEN's beneficial ownership information page, FinCEN announced an interim final rule on March 21, 2025, published March 26, 2025, that redefined a reporting company to mean only entities formed under the law of a foreign country and registered to do business in a U.S. state or tribal jurisdiction. That removed the requirement for U.S. companies and U.S. persons to report beneficial ownership information. On August 11, 2026, FinCEN issued a final rule making those exemptions permanent, and FinCEN states the final rule became effective on August 14, 2026. Foreign entities registered to do business in the U.S. still report, but do not have to report U.S. persons as beneficial owners.
For KYB software, the consequence is simple: for a domestic SMB there is no federal ownership filing to check against, so ownership verification depends on the applicant's certification, state records where they exist, documents in the file and KYC on the named individuals. This area has changed several times since 2024 through rulemaking and litigation, and it may change again through legislation, litigation or further FinCEN action. Check FinCEN's page for the current position rather than relying on any article, including this one.
How to choose business verification software: an evaluation checklist and RFP questions
Choose KYB software by testing it on your own historical files, not on a demo dataset, and by scoring how it handles resolution, evidence, coverage gaps and conflicts. The top business verification tools for lenders are the ones that are honest about not-found results and show their work.
Pull 50 to 100 past applications with known outcomes (clean files, sole proprietors, recent and out-of-state formations, confirmed identity fraud), run them through each candidate, and compare results with what your team actually found.
Data and coverage questions
- Which sources do you query directly, and which through aggregators? For state registries, which states do you reach directly, and how fresh is each state's data?
- How do you handle foreign registrations, so an LLC formed in one state and operating in another resolves to one entity with both records?
- How exactly do you verify an EIN, and under what authority? If the answer involves IRS TIN Matching, how is the program's eligibility requirement met?
- Which sanctions lists do you screen, how quickly after a list update, and do you re-screen existing customers automatically?
- What do you return for sole proprietors and businesses formed in the last 90 days?
Matching and output questions
- Show the field-level reasons behind a resolution, not just the confidence score. Can thresholds be set per product?
- How are DBAs and trade names captured, and does the result say which name matched each source?
- Do you distinguish not found, source unavailable and conflicting in the output?
- Does every finding carry the source record identifier and retrieval timestamp? Can we store the raw source response?
- What happens on ambiguous candidates: do you choose one, or return the set for a reviewer?
Workflow, security and commercial questions
- Can a reviewer re-run a single source, add a note, and override a finding with a reason that is logged?
- Is there event-driven monitoring for status changes and new UCC filings, and how are alerts delivered?
- How is applicant data protected in transit and at rest, who can access it, and how long is it retained? Ask for documentation, and compare it with what you expect of any underwriting vendor; see our security page for the questions we answer ourselves.
- How is pricing structured (per check, per bundle, per monitored entity), and what does a fallback in the waterfall cost?
- Does any part of the product make or recommend approve or decline decisions? If so, can that be switched off so findings stay findings?
How should KYB results sit in the underwriting file?
KYB results belong in the underwriting file as evidence, field by field: what the applicant stated, what each source found and when, and what the reviewer decided about any difference. Stored that way, the verification can be checked, re-run or defended later without anyone reconstructing it.
This structure does three things a pasted screenshot or a vendor PDF does not. It makes every conflict visible next to its resolution, so a second reviewer can see at a glance that the residential address was noticed and explained. It preserves the source and time of each finding, so a renewal can compare like with like. And it records the reviewer's reasoning, which is what an auditor, investor or bank partner will ask for. Our guides to evidence-backed underwriting reports and underwriting audit trails go deeper on the report and the log.
Two rules help. Link each finding to the document it was compared against, as source-linked extraction does for financial figures. And never let an override erase the original finding: the mismatch and the reviewer's explanation both stay in the file.
From here, this article is about Cevrynt
How Cevrynt approaches business verification
Cevrynt is AI-assisted underwriting infrastructure for MCA funders and alternative lenders, and Business Verification is one stage of its workflow: Intake, Documents, Financials, Verification, Fraud, Policy, Report, then the human decision. Verification findings are organized field by field against what the applicant submitted, with conflicts and not-found results shown separately and kept next to the documents they relate to, so they flow into Fraud Signals and policy review rather than living in a separate tool.
Cevrynt is not a lender and does not replace a lender's own KYB or compliance program. Identity conflicts and other findings are flags for a person to review, never automatic declines, and the lender keeps final approval authority. Reviewer notes and overrides are kept in the file's audit history alongside the original findings.
If you are evaluating business verification software and want to see how verification sits inside an evidence-linked underwriting file, book a walkthrough or talk to our team.