Company identifiers explained
For the team that owns a company master and has to defend it.
A stewardship queue, a CRM after a migration or a merger, a supplier file before a payment run, counterparty onboarding that has to survive an audit. Read the argument here, take the takeaways at the foot into your next vendor conversation, and send us a file when you want the same measurement on your own rows.
Identifiers · 2,802 words · every figure carries the population it was measured over
13 min read, last revised . 6 questions answered at the foot.
all 19guides →how every figure here was measured →On this page
What makes an identifier decisive
Five properties separate an identifier you can bind a match on from a string that merely looks like one. Ask them in order, and most of the confusion in this area disappears.
- Who issues it, and does the issuer publish it. An identifier assigned by the body that also publishes the record is definitionally authoritative about that record. One assigned by a commercial vendor is authoritative about the vendor's own view.
- What it identifies. A legal entity, an establishment, a filer, a security, a tax registration and a bank branch are five different things, and identifiers exist for all five. Half the errors in company data are one of these being used as another.
- Its scope of uniqueness. Global, per country, per register, or per issuer. A number unique within one register is not unique within a country if the country runs several registers, and most do.
- Its lifecycle. Whether it can lapse, be reassigned, be retired, or survive a merger, and what the record says when it does. An identifier whose status can change is one where the status has to be read as well as the value.
- Whether it is checkable. A checksum you can verify offline, a register page you can open, or neither. A checksum catches transcription errors before they become wrong merges.
| Identifier | Scope | Supplied by |
|---|---|---|
| LEI | Global: roughly 3.4 million LEIs assigned across all registration statuses, about 2.0 million of them with registration status ISSUED and most of the rest LAPSED (GLEIF, golden copy of 2026-09-25) | GLEIF, which issues them |
| Company number, qualified by its register | Per register, not per country | The register of incorporation, with the authority code from the GLEIF register-of-registers list |
| CIK | United States SEC filers | SEC EDGAR |
| Ticker and exchange | Listed issuers | SEC EDGAR |
| VAT number | EU member states, and the UK | The home register (Czechia, Poland, Norway, Finland, Belgium, Denmark), checkable against the EU validation service |
| EUID | EU, where the member state issues one | Finland's PRH feed |
| National register numbers | Per jurisdiction | SIREN and SIRET in France, the organisation number in Norway, REGON and NIP in Poland, IČO in Czechia, the business ID in Finland |
| EIN | United States SEC filers | SEC EDGAR, at 100% fill on the sample measured |
| ISO 20275 legal form code | Global | GLEIF, and national registers that publish it |
| SWIFT / BIC | Financial institutions | GLEIF |
| D-U-N-S | Global, in principle | Your own file, or your incumbent |
| OpenCorporates identifier | Where GLEIF carries one | GLEIF's own CC0 payload |
| Microsoft tenant identifier | Organisations using Microsoft 365 | A planned source, not a live one |
"Supplied by" is where a value can be obtained rather than where a caller might have got theirs. Several of these are accepted on input and cannot be supplied: an identifier a system can match on is not the same thing as one it can issue you.
Company registration number: the workhorse, with a trap in it
The number a register of incorporation assigns when a company comes into existence. Per register, not per country: that distinction is the whole point.
A company number plus a country is not a unique key and never was: 1,071 registers serve 232 jurisdictions, 220 of those jurisdictions run more than one, German numbers are qualified by the court that holds them, and Poland runs three parallel number spaces. Treating the pair as unique produces false positives, which is why the qualifier is carried on the record.
So a registration number is only an identifier once you know which authority issued it, and the qualifier has to be carried on the record rather than inferred at query time. The practical consequences are immediate: a six-digit number with no register attached will collide with a charity reference, a VAT fragment or another country's company number, and the resulting merge will be high-confidence and wrong, which is the most expensive kind. In Great Britain that specific collision is closed by a shipped register table — a Charity Commission number no longer merges with the Companies House number carrying the same digits — and that fix is Great Britain only rather than a general property.
Shape matters too, and it is not string equality. A Companies House number is eight characters behind an optional letter prefix, so a stripped six-digit number and its zero-padded eight-character form are the same identifier and a naive comparison says they are not. Normalising to the register's own shape before comparing is the difference between a deterministic rule that fires and one that quietly does not.
LEI: the only global, free, issuer-published company identifier
Global: roughly 3.4 million LEIs assigned across all registration statuses, about 2.0 million of them with registration status ISSUED and most of the rest LAPSED (GLEIF, golden copy of 2026-09-25), issued by GLEIF, which issues them. Authoritative by definition: the body that publishes the record is the body that assigns the code.
It is twenty alphanumeric characters under ISO 17442, with the last two a check digit pair computed under the ISO 7064 MOD 97-10 scheme, so a mistyped LEI can be rejected offline before it is ever looked up. That property alone makes it the best identifier in this list to put in a data-entry form.
It is also the only one in common use that is simultaneously global in scope, free to consume, published by the body that assigns it, and carries a machine-readable ownership layer. Its weakness is adoption: an LEI exists because somebody needed one, usually for a reporting obligation, so coverage skews to financial counterparties and larger companies and thins out sharply below that. It has a full article of its own on this site, because renewal status is the part that catches people.
CIK and ticker: a filer and a listing, not a company
The central index key is united states sec filers, assigned by SEC EDGAR. It identifies a filer — the entity that files with the Securities and Exchange Commission — which is usually but not always the operating company you mean, and which persists across name changes, so it is a genuinely stable key within its scope.
A ticker is listed issuers, and it is the identifier most often misused. EDGAR gives the exchange as free text, so a ticker is only unambiguous once the exchange is normalised to a market identifier code — which is itself a planned source, not a live one.
A ticker is also not a company. It is a listing of a class of security on a venue, so one company can carry several across share classes and exchanges, tickers are reassigned after delisting, and the same three letters mean different companies in different markets. Using a bare ticker as a company key produces exactly the failure you would expect and produces it silently, because the string always resolves to something.
SIREN and SIRET: the legal person and the establishment
Both come from the national registers named in the table above, and the pair is worth understanding precisely because the distinction generalises. SIREN identifies the legal person: nine digits, one per registered French business. SIRET identifies an establishment of that legal person: the same nine digits followed by a five-digit establishment number. A company with forty sites has one SIREN and forty SIRETs.
Mapping a SIRET into a company field is therefore a category error that behaves almost correctly, which is the worst kind. The first nine characters are the company, so a naive match on the full fourteen fails to join two records for the same company at different sites, while a match on the first nine succeeds — and a system that does not know the structure will report the first case as a coverage problem rather than as its own bug.
France is also the register where this matters most, because names discriminate least. A third of French companies share their exact name — 1,003 live companies sit on one name. A French file needs a town or postcode column, and with one it measured 2,998 of 3,000 on the postcode tier. A French file therefore wants a SIREN, and where it does not have one it wants a postcode; a French file carrying names alone is the shape most likely to come back as shortlists rather than matches, and that is the register rather than the matcher.
VAT number: a tax registration, which is not the same as an entity
EU member states, and the UK, issued by The home register (Czechia, Poland, Norway, Finland, Belgium, Denmark), checkable against the EU validation service.
A VAT number identifies a registration for value added tax, and the mapping to legal entities is not one to one in either direction. A VAT group registers several legal entities under one number. A company trading below the threshold has no number at all. A company deregisters and its number stops being valid while the company continues to exist. And a non-resident company can hold a registration in a member state where it has no legal presence.
It is still worth carrying, for two reasons that are not matching. It is checkable against the EU validation service, which turns an invoice field into something with a yes or no answer; and where a home register publishes it, it is a genuine cross-reference between the tax and company registers. What it is not is a tier: there is no lawful bulk name-to-VAT source in the UK, so there is nothing to measure a resolution rate against and no rate is published for it.
DUNS: the identifier your stack speaks and nobody publishes
Global, in principle, and in this deployment it comes from your own file, or your incumbent. Accepted on input, matched on, and carried through. We cannot supply one: it is a proprietary identifier, and four sweeps of the open web found 35 records anywhere that publish one. If a D-U-N-S is the key your stack speaks, it has to come from the party that issues it.
That is the commonest disappointment in a reference data evaluation. A D-U-N-S number is a commercial identifier assigned by a single data provider, and open supply of the mapping is effectively absent. So a D-U-N-S you already hold will decide a match here, and no amount of register work will produce one you do not.
It also identifies at a different granularity from a registration number. A D-U-N-S is assigned to a business location, so a company with multiple sites has multiple numbers and a group structure is expressed as a hierarchy of them. Treating one as equivalent to a company number is a granularity error of the same family as the SIRET one, and it produces the same silent failure to join.
EUID: the pan-European key that mostly does not exist yet
EU, where the member state issues one, from Finland's PRH feed. The only pan-European registry-issued key that exists. Supply is thin because most member states do not publish it yet.
The EUID is assigned under the Business Registers Interconnection System and is structured as a country code, the register's own identifier and the company's number within it, which is exactly the qualified shape a registration number ought to have had all along. Conceptually it is the right answer to the register-scoping problem described above.
Practically, supply is the constraint rather than design. Most member states do not publish it, and in this deployment there is one live source that does. Read a EUID wherever you are given one — it carries its own register qualifier, so it cannot collide the way a bare number does — and do not yet plan a European matching strategy around it.
ISIN, CUSIP and SEDOL: securities identifiers, not company identifiers
These belong in a different column of your data model. An ISIN identifies a security — a specific instrument — and a company can be the issuer of many, across share classes, bonds and depositary receipts. There is no reliable one-to-one relationship in either direction, and an issuer-to-ISIN mapping is a one-to-many join rather than a crosswalk.
They also carry licence constraints that shape what any product can do with them. CUSIP and SEDOL terms prohibit maintaining a master file of the numbers, which makes them pass-through material: a system may show you one it retrieved and may not warehouse it. Here the write path enforces that rather than a contract clause — saving an entity that carries a pass-through fact raises before any write happens, and the step that decides which value wins when records merge, survivorship, drops those facts before a golden record, the single merged view of a company, is assembled. ISIN is specified and blocked pending legal advice, and the field says so rather than quietly returning nothing.
If your matching problem is really an instrument problem, the identifier layer you need is a securities master, and this resolves companies rather than instruments. The overlap — resolving the issuer behind an instrument to a registered legal entity — is a company resolution problem, and that part is in scope.
Which of these actually decide a match
Only two are decisive on their own: an agreeing LEI, and an agreeing registration number qualified by its register. Both are checked for register shape rather than for string equality, and both decide with no model call and no egress. On the live-adjudicated fixture of 2026-08-29, the identifier input shape resolved 100% (317/317).
Everything else is evidence rather than a decision. A domain is a strong digital signal — name and website measured 100% (197/197) at zero model spend, measured separately, at zero model spend, on 197 individually verified company-to-domain pairs. Those companies are large and well known, so this is the tier's behaviour on famous names rather than a register-wide sample. A postcode qualifies a name into a decidable shape: 98.74% (313/317). A country alone measured 98.42% (312/317) on that same GB fixture and would measure far worse on a register with lower name uniqueness, which is why the register has to travel with the figure.
The direction that matters most is the negative one. Conflicting strong identifiers are as informative as agreeing ones, and more useful: two records carrying different well-formed LEIs are not the same legal entity, and no amount of name and address similarity should be allowed to outvote that. A matcher that lets positive evidence overwhelm a strong-identifier conflict has a bug rather than an opinion, and it is the bug that produces the merges nobody can explain afterwards.
So the practical advice for a data model is short. Store every identifier with its scheme and its issuing authority, never as a bare number. Store the negative — that a scheme was checked and returned nothing — separately from silence, because "the LEI system holds none for this company" and "we never asked" are different findings and only one of them is about the company.
What to take away
- Ask five questions of any identifier: who issues it, what it identifies, its scope of uniqueness, its lifecycle, and whether it is checkable.
- A registration number plus a country is not a unique key. 1,071 registers serve 232 jurisdictions, 220 of those jurisdictions run more than one, German numbers are qualified by the court that holds them, and Poland runs three parallel number spaces. Treating the pair as unique produces false positives, which is why the qualifier is carried on the record.
- SIRET, D-U-N-S and ticker all identify something finer than a company — an establishment, a location, a listing — and using them as company keys fails silently rather than loudly.
- A VAT number is a tax registration. VAT groups, thresholds and deregistration all break the one-to-one mapping to legal entities in both directions.
- ISIN, CUSIP and SEDOL identify securities, not companies, and CUSIP and SEDOL terms prohibit warehousing the numbers at all.
- Only an agreeing LEI or a register-qualified company number is decisive on its own: 100% (317/317) on the 317-company fixture of 2026-08-29.
- Conflicting strong identifiers must outweigh any amount of positive similarity, and a checked-and-empty scheme must be stored differently from a scheme nobody asked about.
Those takeaways hold for anybody's data. The number for yours comes out of your own rows — a few hundred of them, with the matches you already have beside them.
Start freePrefer to put it to a person? Talk to us instead →
Where this article is applied
6 pages name this method as the working behind what they claim.
Is this your file?
The article is for anyone. The measurement behind it is worth commissioning for one kind of team.
Teams with a company master they have to defend — an MDM or stewardship queue, a CRM after a migration or a merger, a supplier file before a payment run, or counterparty onboarding that has to survive an audit.
Buying breadth as the product: we hold a fraction of an incumbent’s records and are not building a global company graph. Entity Bind resolves companies and organisations only. It does not resolve people, vessels, bank-account ownership, sanctions exposure, emissions or geolocation, and its results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.
Sources
The papers, regulators and registers this article quotes, each with the caveat that travels with it.
- GLEIF, “The Legal Entity Identifier (LEI)”
The operator of the system, describing the twenty-character code and the four ISO 17442 principles it adheres to. It is GLEIF's account of the standard rather than the standard's own text.
- CC0 1.0 Universal
The dedication GLEIF publishes the LEI records under. Nothing is conditional on attribution, which is why that material can be stored and resold.
- GLEIF Registration Authorities List
The register of registers. The 1,071 registers across 232 jurisdictions quoted on this site were read from GLEIF's registration-authorities API when the list was loaded, and the API still reported 1,071 on 2026-09-25; the list is versioned, so those counts move with it.
- Companies House register search
The register the United Kingdom figures were measured on. A name-uniqueness share is a property of the register, not of any resolver.
- Open Government Licence v3.0
The instrument Companies House publishes under. It is what makes those facts storable and resellable rather than return-only.
- SEC EDGAR company search
A register of filers rather than of incorporation, so a company absent from it is not a company that does not exist. United States federal works are public domain.
- Annuaire des Entreprises
The keyless government search route to the SIRENE universe. What it cannot fix is that a third of French companies share their exact name.
- Licence Ouverte 2.0 (Etalab)
The licence SIRENE data is reused under. It permits free reuse, including commercial reuse, with attribution.
- VIES on-the-Web, European Commission
The EU's VAT validation service. It confirms a number you already hold and cannot be searched by name, and several member states return no name or address.
- European e-Justice Portal, “Business registers – search for a company in the EU”
The portal through which the EU's interconnected business registers are searched; it states that the registers of all EU countries have been interconnected since June 2017. It has no API and no bulk product, so identifiers reach anybody through national feeds.
Internal fixtures only. The historical 2026-08-29 per-tier recording covers 317 GB companies with identifier-rich arrivals seeding the catalogue first; the context tier includes country and registered-town prose. Its legacy replay has no full-prompt-verified calls and cannot certify current calibration. The September 5 CI reports cover 1,176 labelled pairs and 705 records over 250 companies using offline stubs. These are not independent customer holdouts or live production validation; the 99% minimum-input product target remains unmet. Scope is company and organisation identity only — not people, vessels, bank-account ownership, sanctions or emissions. Results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.
Figures read off the product repository on 2026-09-05. The per-tier rates come from the live-adjudicated 317-company recording of 2026-08-29; the gate figures come from the stub-adjudicated continuous-integration run and are a floor rather than a ceiling. The two are never averaged. Entity Bind holds no SOC 2, no ISO 27001 and no other certification, and claims none. Every figure, with the population it was measured over and the method behind both recordings, is set out on the accuracy page. The retention, erasure, tenancy and sub-processor detail a security review asks for is under Trust and security, with where assurance stands: no external validation of the accuracy figures and no customer holdout.
The same measurement, on your own rows.
Create your workspace, verify your email and run your first company file. The Free plan needs no card. Create API keys in your workspace when you need an integration.
300 credits. No card.
For a guided review of your file, explore the Merge Safety Sprint →
The questions this article answers
Is a company registration number unique?
Within its own register, yes. Within a country, usually not, and that is the assumption that produces wrong merges. A company number plus a country is not a unique key and never was: 1,071 registers serve 232 jurisdictions, 220 of those jurisdictions run more than one, German numbers are qualified by the court that holds them, and Poland runs three parallel number spaces. Treating the pair as unique produces false positives, which is why the qualifier is carried on the record. The fix is to carry the issuing authority alongside the number rather than to infer it from a country column.
What is the difference between SIREN and SIRET?
SIREN identifies a French legal person — nine digits, one per registered business. SIRET identifies one establishment of that legal person: the same nine digits plus a five-digit establishment code, so a company with forty sites has one SIREN and forty SIRETs. Matching on the full fourteen characters fails to join two records for the same company at different sites; matching on the leading nine succeeds.
Can I use a VAT number to identify a company?
Only weakly, and never as a primary key. A VAT group registers several legal entities under one number, a company below the threshold has none, a deregistered company keeps existing after its number stops being valid, and a non-resident company can hold a registration where it has no legal presence. It is worth carrying and worth validating against the EU service; it is not a tier we measure, because there is no lawful bulk name-to-VAT source to measure against.
Can you give us a D-U-N-S number?
No. Accepted on input, matched on, and carried through. We cannot supply one: it is a proprietary identifier, and four sweeps of the open web found 35 records anywhere that publish one. If a D-U-N-S is the key your stack speaks, it has to come from the party that issues it. What you can do here is send the one you already hold: it is treated as a strong identifier and decides the match with no model call and no egress.
Is an ISIN a company identifier?
No. An ISIN identifies a security, and one company can issue many across share classes, bonds and depositary receipts, so issuer-to-ISIN is a one-to-many join rather than a crosswalk. Related to that, CUSIP and SEDOL terms prohibit maintaining a master file of the numbers, which makes them pass-through material a persistence layer must refuse to store; ISIN is specified here and blocked pending legal advice.
Which identifier should we ask customers for on a form?
An LEI if the customer is likely to have one, because it has an offline check digit under ISO 7064 MOD 97-10 and can be rejected at the point of entry before a wrong value ever enters your data. Otherwise the registration number together with the register or country that issued it — as two fields, not one string. Both resolve on the identifier tier, which measured 100% (317/317) and costs one credit with no model call.