Guides · Due diligence
How to verify if a company is legitimate
Whether you are onboarding a new supplier, a counterparty or a corporate customer, the same seven steps separate a real, trustworthy business from a shell, a fraud or a sanctioned entity. Use this as a starting checklist for your KYB and due-diligence process.
1. Confirm the company exists in an official registry
Start at the corporate registry of the jurisdiction the company claims to be incorporated in - Companies House (UK), the SEC and Secretary of State portals (US), the Handelsregister (Germany), ACRA (Singapore), and so on. Verify the legal name, registration number, incorporation date and registered office. A business that cannot be found in its home registry is the single biggest red flag.
2. Check that the company is active, not dissolved
Registry records show status: active, dormant, in liquidation, struck-off or dissolved. Many fraudulent invoices come from companies that look real on a website but are formally dead in the registry. Also check whether the company has filed its most recent annual return or accounts - long-overdue filings are a warning sign.
3. Identify the directors and ultimate beneficial owners (UBOs)
A legitimate business is owned and run by real, identifiable people. Pull the current officer list and the persons-with-significant-control / UBO register. Cross-check the names against sanctions and politically-exposed-person (PEP) lists. If ownership runs through opaque shell companies in secrecy jurisdictions with no disclosed UBO, treat that as high risk.
4. Match the trading details to the registered entity
The bank account, VAT/tax ID, website domain and invoicing address should all tie back to the registered company. Compare the bank account name to the legal name on the registry record. Look up the VAT number in the local tax-authority validator (e.g. VIES for the EU). Domain WHOIS, when public, should be consistent with the company.
5. Screen against sanctions, watchlists and adverse media
Run the legal entity, directors and UBOs against global sanctions lists (OFAC, EU, UK HMT, UN), law-enforcement lists, and adverse-media sources. A clean registry record is not enough - a company can be properly incorporated and still be subject to sanctions, fraud allegations or enforcement actions.
6. Sanity-check the operating footprint
Real businesses leave evidence: a working website with a real address, employees on LinkedIn, customer reviews, press coverage, accounts that show genuine activity. Anomalies - a brand-new domain, stock-photo team page, no phone number, accounts showing zero turnover for a company claiming millions in trade - are signals to dig deeper.
7. Document everything and re-verify periodically
Keep a dated record of every source you checked, what it showed, and who signed off. Companies, owners and risk status change - rerun the same checks at least annually for ongoing relationships, and immediately if anything material changes (new directors, change of control, new jurisdiction, unusual transaction patterns).
Do all seven steps automatically with veraf.ai
veraf.ai pulls registry data, surfaces directors and UBOs, screens everyone against global sanctions, PEP and adverse-media lists, and stores the evidence pack for your auditors - in one KYB check.