EIN Verification in KYB: How to Verify a Business's Tax Identity

An Employer Identification Number is the closest thing a U.S. business has to a Social Security number: the IRS-issued identity a company uses to file taxes, open accounts, and take on credit. For the teams responsible for verifying businesses, it is one of the first data points you collect and one of the most revealing. It is also one of the easiest to fabricate.

That tension sits at the center of Know Your Business (KYB). An EIN can anchor a detailed picture of a company, from its tax standing to its history to its financial footprint, but only once you have established that the number is valid, active, and genuinely tied to the entity claiming it. Establishing that is a discipline of its own, and one you are expected to document.

This guide covers what an EIN represents, how verification fits into KYB, the sources that make a check dependable, and where an EIN check stops being enough.

• EIN verification confirms that a business’s IRS-issued tax ID is valid, active, and genuinely tied to the entity presenting it. It is a core step in Know Your Business (KYB).
• No law mandates EIN verification by name, but the Bank Secrecy Act and FinCEN’s CDD Rule require verifying the businesses you onboard, and the EIN is central to establishing that identity.
• Public routes (SEC EDGAR, the IRS Tax Exempt Organization Search, business credit reports) cover only narrow segments. Most private businesses cannot be confirmed against a live source this way.
• Effective verification cross-references authoritative records, validates the format and prefix, and tracks EIN history across structural changes.
• An EIN alone confirms only that a tax registration exists. Resolving it to a complete business identity, covering status, ownership, watchlists, and fraud signals, is what turns a check into a decision.

An Employer Identification Number (EIN) is a unique nine-digit identifier issued by the Internal Revenue Service (IRS), formatted as XX-XXXXXXX. It is used for business identification, tax reporting, and employment. Nearly every U.S. business needs one to operate legally: to hire employees, open a business bank account, or apply for credit.

EIN vs. TIN vs. SSN. A Taxpayer Identification Number (TIN) is the umbrella term. An EIN is the TIN used by businesses; a Social Security Number (SSN) is the TIN used by individuals. Sole proprietors sometimes operate under an SSN instead of an EIN, a distinction that matters the moment you start verifying smaller entities.

EIN verification is the process of confirming that an EIN is valid, active, and belongs to the specific business presenting it. In KYB, it sits inside the broader background check that establishes whether a company is legitimate and safe to work with. It is one part of what is KYB (add link) as a whole.

The logic is straightforward. A valid, matching EIN is a signal the business is registered with U.S. tax authorities and is who it says it is. A missing EIN, an invalid format, or a mismatch against the record is a flag, not a verdict. Some legitimate businesses, such as new startups and sole proprietors, may not have an EIN yet, and structural changes can legitimately produce a new one. The flag tells you to look closer, not to decline.

No single law says “verify the EIN.” But several require you to verify the business, and EIN verification is how you meet that bar in practice.

In the U.S., the Bank Secrecy Act (BSA) and the Customer Due Diligence (CDD) Final Rule from the Financial Crimes Enforcement Network (FinCEN) require regulated entities to confirm the identity of the businesses they onboard as part of their anti-money laundering (AML) programs. Verifying the taxpayer identification number, an EIN for most U.S. businesses, is a core part of establishing that identity.

EIN verification typically comes up at five moments:

• Onboarding a new business customer or partner
• Opening a business account or extending a line of credit
• Lending decisions, before funds move
• Mergers and acquisitions, when confirming a counterparty is real
• Ongoing monitoring, to keep records current and audit-ready

Get it right and you have documentation that stands up to a regulator. Get it wrong and you have either onboarded a shell company or turned away a good one.

There is a manual way and an automated way. Start with what is publicly available, then understand why it only gets you part of the way.

Public and manual routes

• SEC EDGAR. Publicly traded companies file their EINs in documents like the 10-K. Searchable and free, but it covers only public entities.
• IRS Tax Exempt Organization Search. Confirms EINs for registered nonprofits and charities. Useful, but narrow.
• Business credit reports. Some include EIN or tax details; many do not. Check availability before you rely on them.
• Documents from the business itself. A CP575 (the IRS’s original EIN assignment notice) or a 147C letter (an EIN confirmation the IRS reissues on request) can corroborate a claim, but a document can be forged and does not confirm the record is still active.

The gap is clear once you list them out. For the vast majority of private U.S. businesses, the ones you are most likely onboarding, none of these routes offers a live, authoritative confirmation. They are partial, slow, and straightforward to spoof.

What separates effective EIN verification

A verification process worth trusting does three things the manual routes cannot do reliably.

It cross-references authoritative sources. EIN data pulled from a single third-party list can be stale or wrong. Confirming the number against primary-source records, the IRS and all 50 state Secretary of State registries, is what turns a claim into a fact.

It validates format and catches synthetic patterns. A real EIN follows the XX-XXXXXXX structure, and certain two-digit prefixes are never issued. Systems that check structure and prefix catch the crude fakes immediately, and flag the patterns common to synthetic identities, where a fabricated business is built around a plausible-looking number.

It tracks EIN history. Once assigned, an EIN stays linked to its entity. But businesses can acquire a new EIN when they restructure, such as a sole proprietorship becoming an LLC. Verification that sees the full history distinguishes a normal transition from a business that keeps changing its identity for reasons worth questioning.

A verified EIN is necessary, but it is not sufficient. It confirms one thing: a tax registration exists. It does not confirm the business is in good standing, operating legally, or controlled by the people who say they control it.

Consider what a clean EIN leaves unanswered. Is the entity active with its Secretary of State, or dissolved? Who are the beneficial owners, and are any of them on a sanctions list? Are there liens, litigation, or a bankruptcy on record? A valid EIN answers none of these.

Closing that gap means resolving the EIN to a complete, persistent business identity: one record that links entity status, officers and ultimate beneficial owners, watchlist screening, and fraud signals. This is where the source of your data starts to decide the quality of your decision. Legacy business data is often months out of date; a business dissolved last quarter can still look active in a file refreshed on a slow cycle. Verifying against real-time IRS and Secretary of State records means you are checking the government record itself, not a copy of it.

In one published example, the payments company Nuvei reported that match rates rose from roughly 60% under a previous provider to approximately 90%, and averaged 98% in many weeks, after adopting primary-source data from Baselayer. Higher match rates mean more legitimate businesses confirmed on the first pass and fewer sent to manual review.

For where this fits in the wider process, EIN verification is one detail inside business verification, which is itself the entity-level foundation of KYB. Turning verified identity into an onboarding decision is where a unified score, such as a KYB Rating, and continuous ongoing monitoring come in.

Confirming an EIN by hand is workable for a small number of applicants. As volume grows, each lookup requires a person to cross-reference the IRS, state registries, and supporting sources, which adds time before a decision is reached and friction a legitimate customer feels.

Automated verification consolidates the work. A single programmatic query can verify a business against primary-source government records, confirm the EIN, screen the entity and its officers against watchlists, and return the supporting signals together, so more decisions can be made without manual intervention and in less time.

Baselayer, for example, runs EIN verification against real-time IRS data and first-party feeds from all 50 Secretary of State registries, resolving each business to a persistent Business ID that supports ongoing monitoring after onboarding. The appropriate approach for any institution depends on its volume, risk tolerance, and regulatory obligations.