How to Verify a Company Is Real: A KYB Checklist Using Open Sources

Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.

TL;DR

• If you need to know how to verify a company is legitimate, start here: a certificate of incorporation proves a company was registered. It does not prove the company is real in the sense that matters for KYB: that it exists, is run by the people named, and actually trades.
• Twelve open-source checks, from the company register to email records, phone number type and archived web pages, will tell you in about 30 minutes whether the story holds together.
• Most red flags are about consistency, not single facts. A new company is normal; a new company claiming ten years of trading is not.
• UserSearch's Corporate Intelligence and Domain Intelligence Search types, plus Phone and Email Intelligence, cover most of the checklist from one account.

Registered Is Not the Same as Real

To verify a company is legitimate, confirm that it exists on the official register, that the people named actually control it, and that it genuinely trades, then test each claim against open sources such as domain records, web archives, email and phone data. Forming a UK company takes minutes online. A registered office can be rented from a formation agent, a website can be built from a template in an afternoon, and a mobile number costs nothing. None of that is wrong. Thousands of genuine businesses start exactly this way every week. But it means the documents a new business customer sends you (certificate of incorporation, a utility bill, a bank statement) prove far less than they seem to.

Know Your Business (KYB) checks exist to close that gap. For a payments firm, a lender, a marketplace or a B2B platform, the question is simple: is this company what it says it is, and does it do what it says it does? This guide answers that question with open sources, one step at a time. It is deliberately narrow. It is about proving that a single company exists and trades, not the wider supplier risk process of tiering, sanctions screening and ongoing review, which needs its own playbook.

What Does KYB Verification Actually Have to Prove?

KYB is the business equivalent of customer due diligence on individuals. Under the UK Money Laundering Regulations, a regulated firm onboarding a company must verify its identity, understand its ownership and control, and understand the purpose and intended nature of the relationship. Unregulated platforms often run similar checks for commercial reasons.

For the "is it real" question, we break that into three claims you can test:

1. Existence. The entity is on the official register, is active, and the details match what you were given.
2. Control. The people you are dealing with are the people the register names, or are properly authorised by them.
3. Activity. The company trades in the way it claims: it has customers, a history and a footprint outside its own documents.

In the UK, the register itself is getting stronger. Since 18 November 2025, identity verification is a legal requirement for directors and people with significant control, with a 12-month transition for existing ones. That helps with control, but it says nothing about activity, and overseas registries have nothing like it.

Why Do Onboarding Teams Get Caught Out?

When the FCA fined Monzo £21m in July 2025, its enforcement director said the bank had onboarded customers on "limited, and in some cases, obviously implausible information", including people giving well-known London landmarks as their address. The case was about personal accounts, but the lesson transfers directly to KYB. Automated onboarding accepts whatever passes format validation. An address that exists on a map, a company number that exists on the register and an email that receives mail can all pass, while the combination makes no sense.

A second FCA case from the same month makes the point more sharply for businesses. In fining Barclays £42m, the FCA noted that for one business customer, a wealth manager, "one simple check" of the Financial Services Register would have shown the firm was not permitted to hold client money. Clients then paid £34m into the account. The information was public, free and one search away.

If your team onboards business customers for a regulated firm, our AML industry page shows how UserSearch fits beside your core KYB provider.

How Do You Verify a Company Is Legitimate? The Twelve-Step KYB Checklist

Run these in order. The early steps are quick and remove most bad applications; the later ones are where judgement comes in. Record each result, even when it is unremarkable, because "we checked and it was fine" is only useful if you can show it.

1. Confirm the registration on the official register

Search the company number, not the name, on Companies House (or the relevant national registry). Check that the exact registered name, number, status and registered office match the application. Watch for near-identical names: "Example Trading Ltd" and "Example Trading (UK) Ltd" can be unrelated companies, and borrowing an established company's name and number is a common trick.

At volume, use the Companies House API. It needs a free API key and is rate limited:

curl -s -u "$CH_KEY:" https://api.company-information.service.gov.uk/company/01234567 \
  | jq '{company_name, company_status, date_of_creation, type, sic_codes,
         registered_office_address, has_insolvency_history}'

sic_codes tells you what the company says it does. An applicant selling consumer electronics whose only SIC code is 99999 (dormant company) has some explaining to do.

2. Check the officers and their other appointments

Open the officers list and click through each director. Look at appointment dates and at their other directorships. A director who was appointed last month, holds 40 other appointments and whose companies are regularly dissolved within two years is a pattern worth noting. So is a director whose correspondence address is the same formation agent as every other company they run.

curl -s -u "$CH_KEY:" https://api.company-information.service.gov.uk/company/01234567/officers \
  | jq '.items[] | {name, appointed_on, resigned_on, occupation, country_of_residence,
                   appointments: .links.officer.appointments}'

The appointments link can be requested in turn to list every company that officer has been appointed to.

3. Read the filing history, not just the status

"Active" only means the company has not been dissolved. The filing history shows what it has actually said about itself. Look for dormant or micro-entity accounts that contradict claimed turnover, a first notice of compulsory strike-off (a sign of overdue filings), repeated changes of registered office, and recent changes of name or ownership just before the application. Strike-off and insolvency notices are also published in The Gazette.

4. Work out what kind of address the registered office is

Since March 2024, a UK registered office must be an "appropriate address" where documents will come to the attention of someone acting for the company, and PO boxes are no longer allowed. Formation agent and virtual office addresses remain lawful and common. The question is whether the address type fits the story. A company claiming a warehouse and 30 staff, registered at a serviced address shared with 2,000 other companies, should also give you a trading address, and that trading address should show a building that could plausibly house the business. Public wireless records can also help confirm where a business operates, as our wireless OSINT guide to verifying premises explains. Search the address in quotes to see how many companies share it:

"12 Example Street" "EX1 2MP" -site:examplecompany.example.com

5. Check regulated status where it applies

If the company says it is authorised, look it up. The FCA Financial Services Register shows whether a firm is authorised, what it may do, and whether it is a "clone" of another firm's details. Similar registers exist for solicitors, accountants, estate agents under AML supervision, and many overseas regulators. This is the check from the Barclays case, and it takes two minutes.

6. Look up the domain's registration date

Compare when the website's domain was registered with when the company says it started trading. Use RDAP, or the python-whois library if you want it in a script (pip install python-whois; no API key needed, but registries rate limit repeated queries):

import whois
w = whois.whois("example.com")
print(w.domain_name, w.creation_date, w.registrar)

creation_date sometimes comes back as a list when the registry returns more than one value; take the earliest. The library, maintained in the python-whois repository, parses raw WHOIS text, so results vary by registry, and for .uk domains you may get the registration date but little else.

7. Check how long the website has existed

A domain can be old while the website is new, or the reverse. The Wayback Machine shows what the site looked like and when. For the first capture only:

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com&limit=1&fl=timestamp,original,statuscode"

Open the earliest few captures in a browser. If the domain once belonged to a different business (a dental practice, say, before it became your applicant's electronics shop), that is a dropped domain bought for its age. It happens legitimately, but it means the domain age tells you nothing about this company.

8. Test the email domain setup

A trading business that sends invoices from its own domain almost always has mail exchanger (MX) records and usually SPF and DMARC. Check all three:

dig +short MX example.com
dig +short TXT example.com | grep -i "v=spf1"
dig +short TXT _dmarc.example.com

MX records show where mail is handled (Microsoft 365, Google Workspace, a hosting provider). An SPF record, defined in RFC 7208, lists the servers allowed to send for the domain; a record reading v=spf1 -all means the domain sends no mail at all. DMARC, explained at dmarc.org, tells receivers what to do with mail that fails checks. None of these is proof. But an applicant who emails you from a free webmail address while its own domain has no MX record is telling you its website is a shop window with nothing behind it.

9. Identify the phone number type

UK numbers carry meaning. 01 and 02 are geographic landlines, 03 is non-geographic at geographic rates, 07 is mostly mobile, and 070 is "personal numbering", a redirect service that is not a mobile despite looking like one. Google's open-source phonenumbers library classifies numbers offline (pip install phonenumbers):

import phonenumbers
from phonenumbers import PhoneNumberType, carrier
types = {v: k for k, v in vars(PhoneNumberType).items() if k.isupper()}
n = phonenumbers.parse("+44 7700 900123", None)
print(phonenumbers.is_valid_number(n), types[phonenumbers.number_type(n)], carrier.name_for_number(n, "en"))

A 070 number returns PERSONAL_NUMBER and a London landline returns FIXED_LINE. The Ofcom drama range used in our example returns UNKNOWN and is not valid, which is correct. The carrier name reflects the original range holder, so a number ported to another network will show the old one.

10. Look for a trading footprint beyond the company's own pages

Real businesses leave evidence that other people create: job adverts, supplier and customer mentions, trade association listings, planning applications for their premises, local press, conference attendance, product listings on marketplaces, certificates issued for their subdomains. Search for mentions that exclude the company's own site:

"Example Electronics Ltd" -site:exampleelectronics.example.com
"Example Electronics" (supplier OR distributor OR "case study" OR vacancy)

The absence of any third-party mention for a company claiming £2m turnover is more telling than any single bad result.

11. Read the reviews for pattern, not score

Look at when reviews were posted, how many reviewers have only ever reviewed this company, and whether the language repeats. A burst of five-star reviews in the week before the application is a pattern. Since 6 April 2025, commissioning or posting fake reviews has been explicitly banned under the DMCC Act, and review platforms have become more active in labelling suspicious activity, so check the platform's own warnings too.

12. Match the bank account and the paperwork

Finally, confirm that the bank account name matches the registered company name (in the UK, Confirmation of Payee does this at payment set-up) and that invoices, contracts and the website all carry the same company number and registered address, as UK law requires on business websites and documents.

Red Flags and What Each One Usually Means

Two KYB Checks From Start to Finish

A merchant application that falls apart

Context. A payments firm receives a merchant application from Example Electronics Ltd, claiming £2m annual card turnover from online sales of refurbished laptops, trading "since 2016".

Actions. Companies House shows incorporation five months ago, a formation agent registered office and a sole director appointed at incorporation who holds eleven other directorships, eight dissolved. The domain was registered three months ago. The earliest archive capture is from last month and shows a template site with stock photos. The domain has an MX record but no SPF or DMARC, and the contact number returns PERSONAL_NUMBER. Twenty-three five-star reviews appeared in a single week. A search excluding the company's own site returns nothing.

Outcome. Any one of these on its own would be a question. Together they contradict every claim in the application: history, scale and activity. The analyst records each finding, requests trading evidence (bank statements, supplier invoices, platform sales reports), and the application lapses when none arrives.

An old company that looks thin but is genuine

Context. A B2B lender reviews Example Engineering Ltd, a precision parts maker applying for asset finance. Its website is two pages long and has no reviews anywhere. The automated score flags "low digital presence".

Actions. Companies House shows incorporation in 1998, the same two directors since 2003, and full accounts filed on time for over twenty years. The archive has captures back to 2004, showing the same business and address. MX records point to Microsoft 365 with SPF and DMARC set. The phone number is a geographic landline for the town on the registered office. A trade association directory lists the company, and a local planning portal shows an extension to its workshop approved in 2019.

Outcome. Approved. The "low digital presence" flag was a false alarm: many long-established industrial firms barely market online. The file records why the automated flag was overridden, with the evidence, which is the kind of record a regulator would expect to see when a person overrides a system score.

Running KYB Checks Through UserSearch

Every step above can be done by hand, and every analyst should know how. The cost is time and fragmentation: an API key for the register, a terminal for DNS, a script for phone types, a browser for the archive, and screenshots scattered across a desktop.

UserSearch 2.0 gathers most of the checklist behind one account with access to 100+ third-party data sources:

• Corporate Intelligence covers company records and officers, the core of steps 1 to 3.
• Domain Intelligence covers domain ownership, registration history and favicon matching, which helps with steps 6 and 7 and can show when one template site sits behind several applicant domains.
• Phone Intelligence and Email Intelligence help with steps 8 and 9, and IP Intelligence shows where a website is hosted.
• OneScan runs one input, such as a domain, across several selected sources and merges the results with source attribution. The Credit cost is shown before you run it.
• Cases in Forensic Mode store the search history and bookmarks, and SargeBot can draft a PDF report from findings you have checked.

Our domain OSINT and WHOIS guide covers the domain steps in more depth, and the phone intelligence knowledge base explains what number data can and cannot tell you. As always, results are leads to corroborate; source coverage and freshness vary.

Advanced KYB Techniques for Harder Cases

Linking applicant websites through shared infrastructure

When several applications arrive from different companies in a short period, compare their websites. Shared favicons, the same analytics or tag manager ID in the page source, the same hosting IP or the same contact number across supposedly unrelated firms suggests one operator. Domain Intelligence's favicon data and IP Intelligence make this quicker than viewing source page by page.

Checking the directors' earlier companies

A company can be brand new while the people behind it have long, legitimate histories. Use the officer appointment list to find their earlier companies, and check whether those traded and filed properly. A clean history at previous firms is strong evidence of genuine intent.

Overseas entities with thin registries

Where the registry shows only a name and number, lean harder on activity evidence: customs and trade data where available, trade fair exhibitor lists, local-language press, and archived versions of the site. Search in the local language and script.

Preserving what the applicant showed you

Websites change after a decision, particularly after a decline. Capture the key pages at the time of review with our free Forensic Capture extension, which records SHA-256 fingerprints and two independent timestamps.

Keeping KYB Research Proportionate and Lawful

Company records are about companies, but directors, owners and sole traders are people, and UK GDPR applies to what you collect about them. Record your lawful basis (a legal obligation for regulated firms, legitimate interests for most others), keep the research to their business roles, and set a retention period. Tell applicants in your terms or privacy notice that you check public sources.

Use only information that is openly available or supplied by the applicant, and respect each platform's terms. Be open about who you are if you contact the applicant's staff or customers, or visit a trading address. A red flag is a reason to ask a question, not a conclusion: give applicants the chance to explain, and record their answer. The Companies House PSC guidance is a useful reference for what ownership information a UK company must publish and what it need not.

Frequently Asked Questions About Verifying a Company Is Legitimate

How do you verify a company is legitimate?

To verify a company is legitimate, test three claims. Existence: the company is active on the official register and its details match. Control: the people you deal with are the people the register names, or are authorised by them. Activity: the company trades as it claims, with customers, a history and a footprint beyond its own documents.

Does a certificate of incorporation prove a company is real?

No. A certificate of incorporation proves a company was registered, not that it is real in the sense that matters for KYB. Forming a UK company takes minutes, a registered office can be rented from a formation agent and a website can be built in an afternoon, so the certificate needs to be tested against other open sources.

How long does a KYB check take?

Twelve open-source KYB checks, from the company register and filing history to email records, phone number type and archived web pages, take about 30 minutes for a single company. The early steps are quick and remove most weak applications; the later steps, such as reading the trading footprint and review patterns, are where analyst judgement comes in.

What are the red flags that a company may not be genuine?

Most KYB red flags are about consistency, not single facts. A new company is normal; a new company claiming ten years of trading is not. Warning patterns include a domain newer than the claimed history, dormant accounts alongside claimed turnover, no mail records on the company's own domain, a 070 personal number presented as a mobile, and directors with many short-lived companies.

How can you check if a UK company is registered and legitimate?

Search the company number, not the name, on Companies House or the relevant national registry, and check that the exact name, number, status and registered office match the application. Near-identical names can belong to unrelated companies. At volume, the Companies House API returns the same data, but it needs a free API key and is rate limited.

What is the difference between KYB and KYC?

KYB, or Know Your Business, is the business equivalent of customer due diligence on individuals, often called KYC. Under the UK Money Laundering Regulations, a regulated firm onboarding a company must verify its identity, understand its ownership and control, and understand the purpose and intended nature of the relationship. Unregulated platforms often run similar checks for commercial reasons.

Proving a Company Is Real in Half an Hour

Verifying a business is not about one perfect source. It is about twelve ordinary checks that either line up or do not. When the register, the domain, the archive, the mail records, the phone number and the outside world all tell the same story, you can approve with confidence. When they contradict each other, you know exactly which question to ask.

UserSearch puts Corporate, Domain, Phone, Email and IP Intelligence behind one account with 100+ sources, merges results with OneScan, and keeps the record in a Case your colleagues and auditors can follow. Explore the platform on our UserSearch 2.0 page.

Stop guessing. Start researching with UserSearch. Run your next business verification at UserSearch.