How to Verify Legitimate Businesses and Merchants

Modern businesses rely on a web of trust that includes partners, suppliers, customers and various third parties. Running checks to verify the entities you do business with is both a smart risk-mitigation strategy and a regulatory compliance requirement for many industries.

Criminals have developed numerous schemes that use fake companies to perpetrate fraud and expand the scope of potential targets. After all, companies can deal with hundreds or even thousands of customers so that fraudulent companies can cast a wide net for their questionable activities. Some of these schemes include:

• Phishing
  Sending out fake emails to try and collect information to enable theft
• Deceptive websites
  Luring customers in with copycat sites to phish information
• Fraudulent merchant accounts
  Setting up fake business accounts to collect payment card information to sell or to run up charges
• Tax fraud
  Creating fake employees and receiving refunds on their behalf
• Identity theft
  Setting up fake jobs to collect personally identifiable information to create fake credit profiles

Unfortunately, it can be very easy to create a fake company; it usually involves simply entering registration information at a government agency and paying a fee.

There’s a growing demand to validate company information. For financial institutions, there are compliance considerations to help prevent money laundering and other financial crime. For other industries, data privacy, security and fraud prevention are the driving factors for checking the legitimacy of a business.

Steps to verify a business

As more business transactions are conducted online, on-site visits are often impractical. With the ease of creating fake company records and profiles, the risk of fraud has also risen. The risk isn’t just financial, but also reputational — nobody wants their business to be connected to a criminal, or worse, an organization linked to terrorism.

For regulated entities, such as financial institutions, company information is required for opening accounts. Depending on the jurisdiction and perceived level of risk, this information includes:

• Location of the business
• Occupation or nature of the business
• Purpose of the business transactions
• Expected patterns of activity in terms of transaction types, dollar volumes and frequency
• Expected origins of payments and payment methods
• Articles of incorporation, partnership agreements and business certificates

More jurisdictions require beneficial ownership information, such as in the EU under 5AMLD and in the U.S. under the Corporate Transparency Act. For situations that call for Enhanced Due Diligence, additional information requirements are necessary, such as beneficial ownership information.

Depending on the jurisdiction, there are different requirements on how to collect company information. One method is to have company data available and accessible through an online central register, which is the approach taken by regulators in the EU. A central register helps ensure the information is accurate and up to date, enabling law enforcement to gather necessary information and support cross-border investigations quickly.

If registry information is accurate, up to date and robust, this approach can provide one source of truth that delivers effective transparency. However, in many cases, these registries don’t have the requisite procedures and authority to meet objectives.

In its October 2019 document, Best Practices on Beneficial Ownership for Legal Persons, The Financial Action Task Force (FATF) suggests using a holistic approach, or, in their terminology, a multi-prong approach. A holistic approach enables collection from different channels to provide more detailed and up-to-date information and makes it possible to cross-check information for accuracy. According to the FATF, “the variety and availability of sources increases transparency and access to information, and helps mitigate accuracy problems with particular sources.”

Acquiring business and beneficial ownership information

For example, in the U.S., financial institutions can use information supplied by the customer as long as they have “no knowledge of facts that would reasonably call into question the reliability of the information.” While under the Corporate Transparency Act, it’d be a criminal offense to provide false information, it’s questionable if that can deter criminals from doing so.

Other jurisdictions often only perform limited vetting on listings provided and have little or no investigative powers to check false filings. Without proper listings, these procedures are open to misrepresentation and outright fraud.

Confirming this information assumes that registers exist and are accessible. As each jurisdiction has its own rules and systems regarding business registration, there are considerable variations in the type, quality and format of information. Data is fragmented and inconsistent. Legal corporate structures with multiple layers of ownership increase the number of entities to be verified. Data is often kept in different databases, making it difficult to link data across repositories.

So, how does an organization verify a business entity before doing business with them? What can a business do to check a company’s legitimacy? Fortunately, some companies perform business verification checks on company information.

Previously, verifying a business entity was a low-tech and cumbersome process for both the financial institution and the business entity. Business entities were required to submit official documentation to the financial institution, which was accepted as the business’s record of authority. For business entities that require additional due diligence, financial institutions would then carry out further analyses, such as:

• Ordering official company documents from the official registry to verify accountholder-submitted information
• Identifying the Ultimate Beneficial Owner(s)
• Performing a KYC check on each Ultimate Beneficial Owner

How to check if a company is legitimate

Trulioo Business Verification automates the entire process from information input through to register checks. As the information is in a computer-ready format, further analysis is also automated:

• Checking names of businesses against Anti-Money Laundering (AML) watchlists
• Parsing and analyzing ownership information to determine beneficial ownership structure
• Running the beneficial owners themselves through identity verification and AML watchlist checks

Using an automated approach to verifying businesses also enables adding other data to create more in-depth profiles. These other data layers add to the identification, risk evaluation and vetting process, delivering a more thorough analysis and better protecting the business from risk and fraud.

Legitimate businesses need to have proper due diligence procedures that are still open to doing business online to foster growth and opportunities. With appropriate checks, companies can build the necessary trust online to safely take on new customers, suppliers and third parties and expand globally.