How to verify a company from an AI agent

The four checks that carry the weight

Business verification, often called KYB, sounds like one question. In practice an agent needs four different answers, from four different authorities.

1. Does the company legally exist, and is it still active?

This comes from a national company register, and only from there. In France the state publishes the SIRENE and RNE data through a public API keyed on the SIREN number. In the United Kingdom, Companies House does the same with a company number. Registers disagree on field names, status codes and even what counts as an address, so anything downstream needs one normalized shape rather than five country-specific ones.

2. Is the VAT number valid right now?

Registration and VAT status are separate facts. A company can exist and still have an invalid or deregistered VAT number, which changes how you invoice it. The European Commission runs VIES for this, and it validates against the member state in real time.

The practical catch is availability: VIES depends on each national service, and individual member states go down or throttle regularly. A check that treats a temporary throttle as "invalid" will reject good customers. Treat unavailability as unknown and retryable, never as a negative answer.

3. Is the bank account plausible before money moves?

IBAN validation is pure computation: the country determines the expected length, and the ISO 7064 mod-97 checksum catches transposed or mistyped digits. It runs offline in microseconds and needs no third party, which also means the account number never has to leave your infrastructure.

Be honest about what it proves. A valid IBAN is correctly formed. It does not prove the account exists, and it does not prove it belongs to the company you verified in step one.

4. Is the counterparty sanctioned?

The US Treasury publishes the OFAC lists openly, and screening against them is table stakes before onboarding or paying anyone internationally. Two things make this harder than a string comparison: names arrive in different orders and transliterations, and the lists change continuously. A name that matched last quarter may not match today, because entries are added and removed.

That churn is also a trap for test suites. Hardcoding a designated name into a test means the test silently breaks when that entry is removed. Derive the expected match from the data you just downloaded instead.

What an agent needs that a human user does not

• One shape per answer. An agent cannot eyeball a layout. Same fields, same status vocabulary, whichever register answered.
• Errors that say what to do next."Not found" stops an agent. "No FR company found for that value; use a 9 digit SIREN" lets it recover on its own.
• Compact responses. Every extra field is tokens the caller pays for on each run.
• A cost signal. Agents run in loops. They need to read their remaining budget before starting an expensive batch.
• Honest confidence. A sanctions hit is a reason to review, not a verdict. Say so in the response, with the number of entries screened, so the agent can weigh it.

Doing it yourself, or not

Every source above is public and free, so building this yourself is entirely reasonable. The work that follows is the part people underestimate: normalizing four registers, handling VIES throttling, mirroring the sanctions lists so a download failure does not become an outage, and keeping all of it correct as sources change under you.

VerifyDesk is that maintenance, sold by the call. Six tools, official sources only, responses shaped for agents, and the reliability of each release published rather than claimed.