Opening a corporate payment account looks like one decision. In practice, it is two. You are deciding whether the business is real and allowed to operate, and you are deciding whether the person applying is who they say they are and is allowed to act for that business. Teams that treat these as one check tend to miss problems that sit in the gap between them.
This guide walks through both checks, shows how to connect them, explains when to ask for more evidence, and covers what to keep on file so a later review goes smoothly.
Why one check is not enough
A verified business can still be used by the wrong person. A genuine person can still be applying on behalf of a shell company. Each of these cases passes a single check and fails the pair.
Common patterns that appear when only one side is checked:
- A real, registered company, opened by someone with no real link to it.
- A real applicant with solid ID, attached to a newly formed company with no trading history.
- A legitimate owner who adds extra users or cardholders later, and nobody checks them.
The fix is not more checks for their own sake. It is checking the right things on each side, then confirming the two sides actually belong together.
Step 1: Verify the business
Confirm it exists and is in good standing
Start with the registry. Match the legal name, registration number, registered address and incorporation date against the official company record. Check the status: active, dormant, struck off or in liquidation all mean different things for risk.
Understand what it does
Compare the stated business activity with what you can see: website, public listings, trading name and any licenses the sector requires. A mismatch is not proof of a problem, but it tells you where to ask a question.
Identify who owns and controls it
Find the beneficial owners and the people who control day-to-day decisions. Where ownership runs through other companies, follow it until you reach real people. If the structure is hard to explain, that is a signal to slow down and ask.
A company formed last week that asks for large payment limits is a different risk from a company with years of filings. Age is not a verdict, but it should affect how much additional proof you request.
Step 2: Verify the person
Confirm identity
Check a government ID and match the person to it, for example, with a selfie or liveness check. Make sure the document is genuine, and the details match the application form.
Confirm their role
Being a real person is not the same as being authorized. Ask how the applicant is connected to the business: director, owner, finance lead, or employee. Check that against the registry or a signed authorization from someone who can grant it.
Look at the surrounding signals
Email age, phone type, device, and location can all add context. Treat them as signals to weigh, not as proof. A new email address on its own means little. A new email address, a mismatched location and a brand new company together mean more.
Step 3: Connect the two
This is the step most teams skip. Once both sides check out separately, ask whether they fit together.
- Does the applicant appear in the company record as a director, owner, or authorized signatory, or is there documented authority?
- Is the applicant already linked to other recently opened accounts, businesses, or devices?
- Does the location make sense for both the person and the business?
- Is the requested use consistent with the business type, size, and age?
Seeing the same person, device, or contact details across several new applications is often where coordinated misuse shows up. A shared view of the signals across both checks makes that visible. For a deeper look at how identity checks fit into a layered fraud program, see this primer on KYC fraud detection.
When to ask for more evidence
Most applications should move through quickly. Save the extra steps for cases where something does not line up. Reasonable triggers include:
- A very new company asking for high limits.
- An applicant who is not listed in the company record and has no authorization document.
- Ownership that passes through several layers.
- Signals that conflict, such as ID details that do not match the application.
When you do ask, be specific. "Please send a document showing your authority to act for this company" gets a better answer than a general request for more information. Explain why you need it and what will happen next. Clear requests reduce drop-off for honest customers and make evasive answers easier to spot.
What evidence to keep
Good records protect you when a decision is questioned months later by an auditor, a partner bank or a regulator. For each account, keep:
- The registry extract and the date you checked it.
- The ID check result and which document type was used.
- Proof of the applicant's authority to act for the company.
- The ownership and control picture you reached, including any assumptions.
- The signals you weighed and the reason you approved, declined, or escalated.
- Any extra documents you requested and what came back.
The reason for the decision matters as much as the decision. A short note that says what you saw and why you acted on it makes later reviews far faster, and it helps new team members make consistent calls.
Keep checking after the account is open
Onboarding is the first control, not the last. Things change after approval: new users get added, limits go up, activity shifts, ownership changes. Build a few simple triggers for re-review:
- A new authorized user or cardholder is added.
- A request to raise limits significantly.
- A change to company ownership or registered details.
- Activity that no longer fits the profile you approved.
Treating onboarding as the start of an ongoing relationship, supported by risk decisioning that looks at both the business and the person over time, helps you catch problems that only show up after the account has been live for a while.
A simple checklist
- Confirm the business exists, is active and matches its stated activity.
- Identify the real owners and controllers.
- Verify the applicant's identity.
- Confirm the applicant is authorized to act for the business.
- Check whether the person and the business fit together.
- Ask for more evidence only where something does not line up.
- Record what you saw and why you decided.
- Set triggers to review the account as things change.
Conclusion
Corporate onboarding works best when it treats the business and the person as two connected questions. Verify each on its own, check that they belong together, ask for more only when the picture does not add up, and keep a clear record of your reasoning. That approach keeps onboarding fast for legitimate customers while making it harder for misuse to slip through the gap between the two checks.
Disclaimer: This article is a guest contribution. The opinions and views expressed are solely those of the author and do not necessarily reflect the views, policies, or position of
EnKash.
