KYC and onboarding
Counterparty identity with a receipt that survives seven years.
A regulatory register that will not validate, or an onboarding queue where analysts are re-doing the same identity search the system already ran.
One counterparty record in, one resolved registered entity out, with the register page cited, a calibrated confidence, and a receipt that reopens at a URL for as long as your retention policy keeps it. Where the evidence will not carry a decision, you get the shortlist and the field that would settle it rather than a pick.
Two pages carry what this one only points at: where assurance stands, and every figure with the population it was measured over.
trust and security →every figure, with its population →On this page
Financial crime and onboarding operations teams, third-party and vendor risk functions, DORA and operational resilience programmes, and the consultancies delivering them.
Buying breadth as the product: we hold a fraction of an incumbent’s records and are not building a global company graph. Entity Bind resolves companies and organisations only. It does not resolve people, vessels, bank-account ownership, sanctions exposure, emissions or geolocation, and its results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.
How it actually goes wrong
What causes it, what it costs when nobody notices, and the part of it a resolver can reach.
Know-your-business onboarding has an identity step that everybody treats as trivial and nobody can evidence. An analyst is given a name, sometimes a number, occasionally an address, and has to establish which registered legal entity that is before anything else in the file means anything. They do it by searching the register in a browser, reading four similar results, and picking one. The pick is right most of the time, it is recorded as a name in a field, and the reasoning behind it is not recorded at all.
That matters twice. It matters at the point of decision, because screening, ownership and risk assessment all run against whichever entity was picked, so an identity error propagates into every conclusion drawn afterwards while looking exactly like a correct file. And it matters years later, when a regulator asks for the evidence behind a customer due diligence decision and the file contains a name, a date and an analyst's initials.
Regulatory registers have made the same problem machine-readable and therefore visible. When a supervisor asks for a register of third-party providers with each one identified by a legal entity identifier, the gaps stop being a matter of opinion. The European Banking Authority ran a dry run over almost a thousand registers of information and only 6.5% passed every one of its 116 data quality checks — and most of what failed was identity: providers named inconsistently, identifiers missing, the same provider appearing as several.
If that reads like your week, create your Free workspace and upload a company CSV to see which rows match and which need review. Contact us separately if you want a guided first file.
Start freeDORA registers of information
EU financial entities must maintain and submit a register of information on their contractual arrangements with ICT third-party service providers, identifying each provider by its legal entity identifier. The European Banking Authority's dry run over almost a thousand registers found that only 6.5% passed every one of its 116 data quality checks.
Almost every one of those failures is an identity failure: a provider that appears under three names, an identifier that was never obtained, a subsidiary recorded where the contracting entity is the parent. Compiling that register is a company resolution exercise with a supervisory deadline attached, and the part that fails is the part this product does.
The register requirement is set out in DORA and its implementing standards; the 6.5% figure is the European Banking Authority's own published dry-run result.
What we do about it
Each of these runs today. Where one needs a column you might not have, or fails in a particular way, the sentence says so.
- 01
An identity decision that is evidence, not a field
Every resolution persists its features, thresholds, cited evidence with source URLs, the adjudicating model and prompt version where one ran, the pipeline version, and a re-run of the score from the stored features. That is the artefact a regulator asks for when they ask how you concluded this was the counterparty, and it is produced automatically rather than reconstructed later. - 02
A refusal instead of a pick
Where the register genuinely cannot separate two candidates, an analyst picking one is guessing with an audit trail behind it. So the cascade refuses instead: A match below 0.90 confidence is unrepresentable. The record comes back as an abstention with a ranked shortlist instead. The row lands in a review queue with a typed cause and the field that would decide it, and a human verdict is recorded against the credential that made it, with the reviewer identity taken from the credential rather than from the request body. - 03
Cross-register collisions closed rather than ignored
A charity number and a company number that share their digits are a classic false merge, and in Great Britain that case is closed by a shipped register table: a Charity Commission number no longer merges with the Companies House number carrying the same digits, and a Scottish charity number no longer merges with the Scottish company sharing them. Three of those collisions ship as labelled non-matches. That fix is Great Britain only, and other countries' registers are not enumerated. - 04
Ownership that states its basis
Ownership comes from the global LEI system's level two relationship records and the UK persons-with-significant-control register, one hop by default and up to ten on request, cycle-safe and bounded, failing closed on ambiguous or name-only owners. Control bands are published as bands: they are never multiplied and never converted to a midpoint, so an indirect percentage appears only when every hop carries an exact published figure. Otherwise the response says the arithmetic was refused and why. - 05
Retention shaped to the duty
The default retention window for decisions and records is seven years, chosen to clear the five-year duty under the money laundering regulations to retain the evidence behind a customer due diligence decision. Below roughly five years a KYB customer loses what they are legally required to produce. The windows are settings you can change in either direction.
Which of these is your export?
One export usually sits in three of these at once. Your rate is set by the columns still standing once the names have been stripped back to a comparable form.
A company number or an LEI supplied by the counterparty
Decides deterministically, with the identifier checked for register shape rather than string equality. An LEI is checked against its published checksum before it is trusted as an identifier at all.
Measured100% (317/317).
A legal name plus a registered address
The registered postcode is the discriminating part. A correspondence address is context rather than an identifying signal, and the pipeline treats it as such rather than scoring it as though it were a registered one.
Measured98.74% (313/317).
A legal name plus the country and nothing else
Resolves better than expected in registers with high name uniqueness and badly in registers without it, which is the single most important thing to know before you map a country column.
Measured98.42% (312/317) on the GB fixture. Forecast at low-to-mid nineties and measured higher, because a representative register is about 99% unique on company names. The collision-dense fixture this was first tested on had hidden that. France, by contrast, measures 67.96% name uniqueness against Great Britain's 99.53%.
A trading name from a marketing site or an application form
Trading names and previous names are register facts and are matched as such where the register publishes them. Where they are not published, a trading name is a name like any other and lands in the shortlist tier.
No published rateThis shape has not been measured on a published fixture, so the behaviour above carries no rate.
- Identifier — A company number or an LEI
- 100% 317/317
- Name and country — A company name and nothing else but the country
- 98.42% 312/317Forecast at low-to-mid nineties and measured higher, because a representative register is about 99% unique on company names. The collision-dense fixture this was first tested on had hidden that.
Zero wrong bindings were observed across the historical six-shape recording and the separate domain fixture. Observed correctness was 1.0000 on accepted outcomes; this does not guarantee an error-free new workload.
317 live GB companies sampled from the 2026-08-01 Companies House snapshot, with same-name siblings included. Identifier-rich arrivals seed the catalogue before the weaker input shapes are evaluated. Historical results on an internal UK fixture with a preloaded catalogue. The September 5 replay has no full-prompt-verified calls and cannot establish current calibration. No independent customer holdout or global coverage claim. The whole table, including the shapes this page does not use, with the safety results and an account of what none of it demonstrates.
Internal fixtures only. The historical 2026-08-29 per-tier recording covers 317 GB companies with identifier-rich arrivals seeding the catalogue first; the context tier includes country and registered-town prose. Its legacy replay has no full-prompt-verified calls and cannot certify current calibration. The September 5 CI reports cover 1,176 labelled pairs and 705 records over 250 companies using offline stubs. These are not independent customer holdouts or live production validation; the 99% minimum-input product target remains unmet. Scope is company and organisation identity only — not people, vessels, bank-account ownership, sanctions or emissions. Results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.
Not sure which of these your export is? Create your Free workspace and inspect your own CSV columns. For an assisted composition preview, contact us with the file: we tier each row by its strongest surviving signal before quoting a Sprint.
Start freeA provider register row that will not validate
One pass, in order, including the rows that do not resolve. The interesting rows are always the ones at the end.
A third-party provider named on an operational resilience register as a trading name, with a country, no identifier, and a services description in free text.
- 01The name and country retrieve a shortlist; the free text is mapped into context and reaches the adjudicator as caller-supplied evidence rather than as an identifying field.
- 02Two candidates in the shortlist share a name stem and cannot be separated on the evidence supplied.
- 03The record abstains at the probabilistic stage with `more_input_needed`, a five-candidate shortlist, and a clarification naming the one attribute that would decide it.
- 04An analyst supplies the provider's domain from the contract. The record resolves on the domain tier, and the crosswalk returns the LEI the register needs — or reports that the global LEI system holds none for this company, which is itself a finding.
A resolved provider with its identifiers, each separately cited, plus the systems that were asked and came back empty. The abstention cost nothing and the second attempt cost one resolution.
The valuable step is the third one. A tool that had returned one of those two same-stem candidates would have produced a register row that validates and is wrong, which is worse than a register row that fails validation, because nothing downstream would ever question it.
That example is ours. The one worth having is the same walk-through on eight rows of yours.
Start freePrefer to put it to a person? Talk to us instead →
What this will not do
Each of these is a decision we intend to keep. Read them before you scope the work.
- This is not sanctions or adverse media screening. There is no risk boolean anywhere in the data model and there must not be one: a screening hit is an assertion about a matcher, not a fact about a company, and writing one into a record as though it were a fact would manufacture a defamatory claim with a citation attached.
- This is not a credit reference agency and produces no score, no rating, no failure probability and no credit limit.
- Results may not be used for eligibility decisions about individuals, including employment, credit and tenancy. That is a term of use rather than a preference.
- We do not resolve people. Ultimate beneficial ownership stops at the point where the chain becomes a person: names published by the UK and French registers under open licences are stored, and every personal identifier that would let you disambiguate a person is discarded at ingestion.
- An incomplete ownership walk is an absence of coverage. We can say we found no parent; we cannot say there is no parent, and the response is built to express the difference.
- There is no SOC 2 and no ISO 27001, which for some regulated buyers is the end of the conversation.
We will not tell you how many dangerous merges we will find
We do not promise a count of dangerous merges prevented, and you should distrust anyone who does before they have seen your file. Zero is a normal, honest result: two rows carrying contradicting company numbers are refused outright and never reach the guard that would have counted them.
What this product does not have — no SOC 2, no external validation of the accuracy figures, no customer holdout — is published in full, with the retention, erasure and tenancy detail a security review asks for. Read the trust page →
Check these scope limits before integrating. Free signup lets you inspect your own company CSV; if a requirement falls outside the published scope, contact us and we will tell you whether it is supported.
Start freeThe method behind this, at length
3 articles that carry the working this page summarises.
- GuideKYB data requirementsWhat a know-your-business onboarding flow actually needs, field by field, and which step is identity resolution. Explicitly not a screening, scoring or eligibility tool.
- GuideThe DORA register of informationWhat the register demands, why only 6.5% of almost 1,000 dry-run registers passed all 116 data quality checks, and the provider identity problem that explains most of the failures.
- GuideWhat is an LEI?The Legal Entity Identifier explained: the twenty-character structure and its check digits, GLEIF and the LOUs, Level 1 and Level 2 data, annual renewal and lapse, and what a lapsed LEI means for matching.
The same pipeline, in other people's words
One product, described 6 other ways. If your team has a different vocabulary for the same file, start from the page that speaks it.
Audit company overlap before a CRM migration
Review duplicate companies across both exports while every source ID is still intact.
CRM and RevOps
Which accounts are one company, which merges to refuse, and a receipt for both.
Master data management
An independent admission policy beside the platform you already run.
Supplier master and accounts payable
Duplicate vendors, remittance conflicts and concentration you cannot see.
Reference data
Every identifier a company is known by, each separately cited — and the ones nobody holds.
AI agents
A counterparty check before the agent acts, and a receipt for what it acted on.
Start with your own company records.
Create your workspace, verify your email and run your first company file. The Free plan needs no card. Create API keys in your workspace when you need an integration.
300 credits. No card.
For a guided review of your file, explore the Merge Safety Sprint →
Questions about kyc and onboarding
Is this a KYC product?
It is the identity layer underneath one. Establishing which registered company a counterparty is, with cited evidence and a reopenable receipt, is one step of a customer due diligence process — and the step most often performed by an analyst in a browser and recorded as a name. Screening, risk assessment, source of funds, ongoing monitoring and the decision itself are not here and are not coming. What the layer gives the rest of your process is a counterparty that has actually been identified rather than typed.
Can you screen against sanctions lists?
No, and it is not on the roadmap: it is a deliberate boundary rather than a gap. There is no risk boolean anywhere in the data model and there must not be one: a screening hit is an assertion about a matcher rather than a fact about a company, and writing one into a record as though it were a fact would manufacture a defamatory claim with a citation attached. The nearest thing we would consider is corporate entity screening assurance over lists you already licence — checking that the entity your screening tool matched is the entity you meant — and even that is scoped to organisations rather than people. Complete person-name screening needs a different ontology, different data and a different evaluation, and none of our accuracy language would transfer to it.
What does an auditor actually see?
A decision id per identity conclusion, redeemable at a URL, carrying the feature vector, the top weighted contributions, the exact thresholds that decision was judged under, the cited evidence with register URLs, the model and prompt version where a model adjudicated, the pipeline version, and a re-run of the score from the stored features so the number can be checked rather than believed. Where a human settled it, the receipt carries the reviewer identity taken from their credential, their reason, and the surface they acted on.
How long do you keep the evidence?
Decisions, records and usage default to 2,555 days — seven years — and open review items to 365. Seven years is chosen to clear the money laundering regulations' five-year duty comfortably; below about five years you would lose what you are required to produce. Plan for one thing: nothing purges itself. Every retention window is a scheduled job an operator has to run, and a deployment that never schedules it keeps everything for ever.
Our register needs an LEI for every provider. Can you supply one?
Where one exists and the company can be resolved, yes, with the global LEI system's own record cited per identifier. Where none exists we say so explicitly rather than returning an empty field, and the response distinguishes a wired source that supplies the scheme and had no value for this company from a scheme no wired source supplies at all. For a register submission those are different findings and only the first one is about the provider.
Do you cover providers outside the measured registers?
Not with a measured quality claim, and a compliance register is the wrong place to accept an unmeasured one. Where a provider sits outside the registers we have fixtures for, the cascade can still retrieve and adjudicate, but the evidence behind the confidence is thinner: treat those rows as a review queue rather than as an answer. Ask for the register list before you scope the work; it is the boundary the measured claims sit inside.