EIN Verification in KYB: How to Verify a Business's Tax Identity

An Employer Identification Number is the closest thing a U.S. business has to a Social Security number: the IRS-issued identity a company uses to file taxes, open accounts, and take on credit. For the teams responsible for verifying businesses, it is one of the first data points you collect and one of the most revealing. It is also one of the easiest to fabricate.

That tension sits at the center of Know Your Business (KYB). An EIN can anchor a detailed picture of a company, from its tax standing to its history to its financial footprint, but only once you have established that the number is valid, active, and genuinely tied to the entity claiming it. Establishing that is a discipline of its own, and one you are expected to document.

This guide covers what an EIN represents, how verification fits into KYB, the sources that make a check dependable, and where an EIN check stops being enough.

• EIN verification confirms that a business’s IRS-issued tax ID is valid, active, and genuinely tied to the entity presenting it. It is a core step in Know Your Business (KYB).
• No law mandates EIN verification by name, the Bank Secrecy Act and FinCEN’s CDD Rule require verifying the businesses you onboard, and the EIN is central to establishing that identity.
• Public routes (SEC EDGAR, the IRS Tax Exempt Organization Search, business credit reports) cover only narrow segments. Most private businesses cannot be confirmed against a live source this way.
• Effective verification cross-references authoritative records, validates the format and prefix, and tracks EIN history across structural changes.
• An EIN alone confirms only that a tax registration exists. Resolving it to a complete business identity, covering status, ownership, watchlists, and fraud signals, is what turns a check into a decision.

An Employer Identification Number (EIN) is a unique nine-digit identifier issued by the Internal Revenue Service (IRS), formatted as XX-XXXXXXX. It is used for business identification, tax reporting, and employment. Nearly every U.S. business needs one to operate legally: to hire employees, open a business bank account, or apply for credit.

EIN vs. TIN vs. SSN. A Taxpayer Identification Number (TIN) is the umbrella term. An EIN is the TIN used by businesses; a Social Security Number (SSN) is the TIN used by individuals. Sole proprietors sometimes operate under an SSN instead of an EIN, a distinction that matters the moment you start verifying smaller entities.

EIN verification is the process of confirming that an EIN is valid, active, and belongs to the specific business presenting it. In KYB, it sits inside the broader background check that establishes whether a company is legitimate and safe to work with. It is one part of what is KYB (add link) as a whole.

The logic is straightforward. A valid, matching EIN is a signal the business is registered with U.S. tax authorities and is who it says it is. A missing EIN, an invalid format, or a mismatch against the record is a flag, not a verdict. Some legitimate businesses, such as new startups and sole proprietors, may not have an EIN yet, and structural changes can legitimately produce a new one. The flag tells you to look closer, not to decline.

There are no laws that say “verify the EIN.” There are however several that require you to verify the business, and EIN verification is how you meet that bar in practice.

In the U.S., the Bank Secrecy Act (BSA) and the Customer Due Diligence (CDD) Final Rule from the Financial Crimes Enforcement Network (FinCEN) require regulated entities to confirm the identity of the businesses they onboard as part of their anti-money laundering (AML) programs. Verifying the taxpayer identification number, an EIN for most U.S. businesses, is a core part of establishing that identity.

EIN verification typically comes up at five moments:

• Onboarding a new business customer or partner
• Opening a business account or extending a line of credit
• Lending decisions, before funds move
• Mergers and acquisitions, when confirming a counterparty is real
• Ongoing monitoring, to keep records current and audit-ready

Done well, it produces audit-ready documentation. Done poorly, it risks either onboarding an illegitimate business or declining a legitimate one.

You can perform verifications on an EIN manually or via automation. Both EIN verification methods consider what is publicly available, understanding the key differences in the two checks is important, and why those checks only get you part of the way.

Public and manual routes

• SEC EDGAR. Publicly traded companies file their EINs in documents like the 10-K. Searchable and free, but the data is only applicable to public entities.
• IRS Tax Exempt Organization Search. Confirms EINs for registered nonprofits and charities. These searches contain useful, narrow lanes of information.
• Business credit reports. Some reports include EIN or tax details; many do not. Check the availability of the reports before you rely on them.
• Documents from the business itself. A CP575 (the IRS’s original EIN assignment notice) or a 147C letter (an EIN confirmation the IRS reissues on request) can corroborate a claim. However a document can be forged and does not confirm the record is still active.

The gap is clear once you list them out. For the vast majority of private U.S. businesses, the ones you are most likely onboarding, none of these routes offers a live, authoritative confirmation. They are partial, slow, and easy to fall out of date.

What separates effective EIN verification

A verification process worth trusting does three things the manual routes cannot do reliably.

It cross-references authoritative sources. EIN data pulled from a single third-party list can be stale or wrong. Confirming the number against primary-source records, the IRS and all 50 state Secretary of State registries, is what turns a claim into a fact.

It validates format and catches synthetic patterns. A real EIN follows the XX-XXXXXXX structure, and certain two-digit prefixes are never issued. Systems that check structure and prefix catch the crude fakes immediately, and flag the patterns common to synthetic identities, where a fabricated business is built around a plausible-looking number.

It tracks EIN history. Once assigned, an EIN stays linked to its entity. Businesses can acquire a new EIN when they restructure, such as a sole proprietorship becoming an LLC. Verification that sees the full history distinguishes a normal transition from a business that keeps changing its identity for reasons worth questioning.

Verifying an EIN is necessary, but it is not always sufficient on its own. It confirms one thing: a tax registration exists. It does not confirm the business is in good standing, operating legally, or controlled by the people who say they control it.

What an EIN can’t tell you

Closing that gap means resolving the EIN to a complete, persistent business identity, one record that links every signal back to the entity. Each of those signals comes from a different authoritative source:

• Is the entity active or dissolved? Its current registration status across the Secretary of State records for all 50 states.
• Does it carry encumbrances? UCC filings and tax liens tied to the entity.
• Who controls it, and are they clear? Officers and beneficial owners screened against OFAC, PEP, and other government watchlists.
• Is it in legal or financial distress? Lawsuits and bankruptcies from state and county courts.
• Is its footprint real? Website status, domain metadata, and other web signals.
• Has it shown fraud patterns? Behavioral risk signals from Baselayer’s Identity Network and fraud intelligence shared across 2,200+ financial institutions.

A valid EIN answers none of these on its own.

Why the freshness of the data matters

Collecting those details is only half the task. A detail is only as current as the source behind it, and there are two ways it goes stale.

The first is treating point-in-time data as if it were current, such as the information a business filed when it first incorporated or registered with the Secretary of State. Registration data describes the company on the day it filed, not the company today; standing, address, officers, and ownership all change afterward.

The second is relying on a legacy business-data provider’s copy of the records. Aggregators like Dun & Bradstreet, Experian, and LexisNexis often draw on the same Secretary of State and IRS records Baselayer does. The difference is how they pull them: they resell copies refreshed on a periodic cycle rather than in real time, so their datasets can trail the live record. A business that dissolved last quarter can still read as active in the provider’s copy until its next refresh, which means the status and EIN you confirm against it reflect the record as of its last sync, not today.

Either way, you are checking a snapshot. Verifying against real-time IRS and Secretary of State records means checking the government record itself, not a copy of it.

For where this fits in the wider process, EIN verification is one detail inside business verification, the entity-level step that confirms a company is real, registered, and correctly identified against authoritative records. Business verification is the foundation the rest of KYB builds on. Turning that verified identity into an onboarding decision is where two further pieces come in: a KYB Rating, a unified score with reason codes that shows how confident you can be in a business’s legitimacy, and ongoing monitoring, which re-checks the business after onboarding so a change in status, ownership, or risk does not go unnoticed. For the process end to end, see what is KYB.

Confirming an EIN by hand is workable for a small number of applicants. As volume grows, each lookup requires a person to cross-reference the IRS, state registries, and supporting sources, which adds time before a decision is reached and friction a legitimate customer feels.

Automated verification consolidates the work. A single programmatic query can verify a business against primary-source government records, confirm the EIN, screen the entity and its officers against watchlists, and return the supporting signals together, so more decisions can be made without manual intervention and in less time.

Baselayer, for example, runs EIN verification against real-time IRS data and first-party feeds from all 50 Secretary of State registries, resolving each business to a persistent Business ID that supports ongoing monitoring after onboarding. The appropriate approach for any institution depends on its volume, risk tolerance, and regulatory obligations.

Baselayer verifies U.S. businesses against primary-source government data, including real-time EIN verification. Learn more about business verification.