KYB site verification: prove a business operates at its address

KYB site verification in 30 seconds.

• The gap: registry and document checks prove a legal entity exists on paper. They say nothing about whether anyone actually works at the address.
• When it's expected: higher-risk merchant categories, high projected volume, lending decisions, and any onboarding file where the address signals don't add up.
• The three methods: an in-person agent visit, street-view and database checks, or remote guided capture by someone who is already at the premises.
• Who this is for: KYB, CDD and merchant-onboarding teams at banks, PSPs and credit bureaus who have to sign their name under "verified".

Every onboarding analyst has approved a file that looked perfect. The registry extract was clean, the documents consistent, the sanctions screen clear. And six months later the "warehouse" turns out to be a mail-forwarding shop between a nail salon and a vape store.

That gap has a name: site verification. It answers the one question the databases can't: does this business really operate at the address on its application? This guide covers what site verification adds on top of registry KYB, when regulators and acquirers expect it, how the three main methods compare on speed and evidence quality, and what kind of evidence actually survives an audit or a dispute.

If you run KYB or merchant onboarding at a bank, PSP or credit bureau, and the queue of files flagged "address needs review" keeps growing while nobody has budget to send inspectors, this is written for your desk. The short version is that you can see the premises without sending anyone. Book a 15-minute demo and we'll walk through a site-verification flow built for an onboarding team like yours.

What is business verification, and where site verification fits

Business verification, or KYB (Know Your Business), is the process of confirming that a company you're about to onboard is real, legally registered, and safe to deal with. It sits inside the wider customer due diligence obligations that follow from KYC and AML rules.

A standard KYB file covers four things:

• Registry checks: the entity exists, the registration number matches, the filing history is plausible.
• Ownership: who the directors and ultimate beneficial owners (UBOs) are, verified against documents.
• Screening: sanctions, watchlists, PEPs and adverse media on the entity and the people behind it.
• Documents: certificates of incorporation, proof of address, bank details, checked for consistency and tampering.

All four are desk checks. They establish that a legal entity exists and who stands behind it. Site verification adds the fifth check the desk can't do: evidence that the business physically operates where it says it does. Premises, signage, stock, equipment, people. The operating reality behind the paperwork.

Regulators know the paper layer is weak on its own. The UK's Economic Crime and Corporate Transparency Act forced every company to maintain an "appropriate registered office address" from 4 March 2024, and banned plain PO boxes as registered offices, precisely because the register had filled up with addresses nobody could be reached at (Michelmores on the ECCTA reforms).

Why registry data can't tell you the business operates

A registered address and an operating address are different claims. The registered office is where official mail goes. It can legitimately be an accountant's office or a formation agent. The trading address is where the work supposedly happens, and no registry verifies it.

That's the opening fraudsters use. The red flags onboarding teams see daily cluster around exactly this seam (Gridlines lists the common ones): a residential or virtual-office address behind a company claiming warehouse operations, dozens of unrelated entities registered at one unit, a freshly incorporated business projecting outsized volume, or an offshore registration paired with claimed local operations.

None of those flags is decisive on its own. Plenty of honest startups share a registered address with thirty other companies. The question a reviewer actually needs answered is narrower and more concrete: is there a real business at the trading address today, doing roughly what the application says?

The cost of not asking is no longer theoretical. In September 2026 the FTC announced a proposed $12 million settlement with a payment processor it accused of handling payments for merchants that were shell companies or engaged in fraud, arguing the processor knew or should have known (Greenberg Traurig's summary). "The database said they existed" is not a defence anyone wants to test.

When KYB calls for site verification

No rulebook says "visit every customer". KYB is risk-based: under the FATF recommendations and, in the EU, the EBA's risk-factor guidelines (EBA/GL/2021/02), the strength of your verification should match the risk of the relationship. Site verification is an enhanced measure. You reach for it when the file earns it.

In practice, that means:

• Higher-risk merchant categories: the MCCs your risk policy already treats with suspicion (high-chargeback goods, CBD, gambling-adjacent, ticket resale, nutraceuticals).
• High projected volume from a young entity: a six-month-old company forecasting serious monthly processing deserves a look at its actual premises.
• Lending and finance decisions: before credit is extended against a business that supposedly has stock, equipment or a workshop.
• Mismatch clusters: virtual-office address plus vague activity description plus offshore ownership. One flag is noise. Three together change the workflow.
• EDD escalations and periodic review: when enhanced due diligence is triggered, or when a merchant's pattern shifts and you want to re-confirm the operation still exists.

The acquiring world has formalised the expectation even where public scheme rules stay general. Mastercard's public service-provider material requires payment facilitators to verify that each submerchant is a "bona fide business" before signing it (Mastercard, Service Provider Categories and PCI). And acquirer contracts routinely reserve the right to inspect: Clearhaus's standard acquiring terms, for example, entitle the acquirer to physically inspect the merchant's premises and warehouses without notice (Clearhaus terms, PDF). The right exists because the need does.

Merchant onboarding site inspections: what acquirers expect

When an acquirer or processor does commission a site inspection, there's a fairly settled picture of what it covers. FraudPractice's overview of on-site merchant inspections splits it into two tiers.

The exterior inspection, or drive-by. An agent photographs the building, the signage and the unit number. It confirms the address physically exists and the business name is on the door. That's all it confirms. A drive-by can't tell a functioning operation from a rented sign.

The interior inspection. The agent goes inside and documents what an application can't fake from a distance: inventory levels, equipment, square footage, number of staff on site, business hours, licences on the wall, and whether what's being sold matches what the application said. Handwritten signs, empty shelves or a vacant unit go straight into the report as risk indicators.

Underwriters then read the inspection against the application. A merchant that claimed 15 employees and a stocked warehouse, inspected as two desks and a laptop, has answered the question before anyone asks it.

The friction is logistics. Inspections are typically outsourced to field-agent networks, and most vendors complete one within 3 to 5 days of the request, per FraudPractice. Multiply that by cost, by geography (a rural merchant, another country, another continent), and by your monthly application volume, and you get the real policy at most acquirers: in-person inspection for the few files that scare someone, and nothing at all for the rest.

The files that get hurt are the middle tier: not scary enough to justify an agent, not clean enough to approve on registry data alone. That tier is where most of the shell-merchant losses actually live, because it's the tier nobody looks at.

Three ways to verify a site, compared

There are three working methods, and they're not interchangeable. I've sat with onboarding teams walking through their flagged-address queue, and the pattern repeats: the in-person tier is reserved for a handful of files a month, the desktop tier quietly decides everything else, and everyone in the room knows the street-view image is older than the merchant's company.

The third method is the one most KYB stacks are missing. Remote guided capture means the person who is already at the premises (the merchant's owner or manager, your own field rep, a local partner) films the site on their phone, guided step by step. This is what Venta Capture, a product of VentaVid, is built for: you send a secure, personal capture link, and the submitter walks through the exact steps your compliance team defined: the outside with signage and the unit number, the shop floor or warehouse, the stock, and a short walkthrough video with spoken answers to your questions.

No app, no account, works in the mobile browser in 15 languages. And because the capture is guided rather than a loose "send us some photos" request, the right footage arrives the first time: your expertise is built into the flow, so the submitter can't skip the angles that matter.

The operational difference from a video call matters just as much as the difference from a site visit. Nobody schedules anything. You send the link now, the merchant captures when they're standing at the premises, your analyst reviews when the file comes up in the queue. Send the link. Let them capture. Review when you're ready. At onboarding volume, that's the difference between a verification step that scales and one that needs a calendar.

Running a flagged-address queue that keeps growing? Start for free and send your first site-verification link today.

What evidence holds up: timestamped, located, sealed

Here's the objection every compliance officer raises, and should: if the merchant films their own premises, why trust the footage? Photos emailed by an applicant can be old, borrowed from a listing, or edited. The fix is not asking anyone to trust the applicant: it's making the footage carry its own provenance, the same discipline we've written about for verifying any customer-submitted photo.

A submission that will survive an auditor, a dispute or a regulator's file review needs to carry more than pixels:

• Recorded in the session. Material filmed through the capture link is confirmed by the server as originating in that session, and carries a visible stamp with date and time. A gallery upload never gets that stamp; it's labelled separately and checked for metadata consistency, signs of editing, and whether the image already exists online.
• Server receipt timestamps. Every file is fingerprinted with SHA-256 on arrival and the case records exactly when the system received it.
• Location, handled honestly. Location can be off, requested, or required per workflow. When a submitter declines to share it, the case says so plainly and records it as neutral. A declined location is never counted as a strike against anyone.
• A sealed case with an audit trail. The submission becomes a case with a signed digital seal and a downloadable manifest that can be verified outside the platform, plus a timeline of everything that happened: link created, each time it was opened, submission received, who reviewed it, every note.
• Signals for a human to weigh. Every submission carries more than 25 control points: automatic signals, recorded session events and one signed seal. Each signal comes with its own caveat in the interface, because several recording attempts or a shared family device are normal life, not proof of anything.

That last point deserves repeating because it's where vendors oversell. Venta Capture does not detect fraud. It performs checks, records what it observed, and raises a flag when something deserves a closer look. Your analyst looks, weighs it against the rest of the file, and decides. For a compliance team, that restraint is the feature: a tool that issued verdicts would be making your regulatory judgment for you, on logic you can't defend in an audit.

What lands in your inbox is a structured evidence package, not a folder of attachments: the footage, the answers to your questions, transcripts of spoken explanations, timestamps, integrity information and the full session history, tied to your own case reference and ready to push to the systems that hold the onboarding file.

Honest limits: what a capture proves, and what it doesn't

Any vendor that promises certainty here is lying to you, so let's be precise about what remote site verification establishes.

What it shows: that these premises, this signage, this stock and this activity were filmed, in a guided sequence, and received by your system on a verifiable date. For the "does this business really operate here" question, that is usually exactly the evidence the file was missing.

And here is what it does not establish:

• The receipt timestamp proves receipt, not the event. It tells you when the system received the submission. It is not an independent proof of when the premises looked that way, beyond the session's own recording checks.
• A real recording can still show a staged scene. Harder to manipulate does not mean impossible to deceive. A borrowed warehouse filmed live is still a borrowed warehouse; that's why the capture is one input next to registry data, documents and screening, and why remote visual inspection works best as a tier in a risk-based policy, not a replacement for it.
• It clears nothing else in the file. A clean site capture says nothing about sanctions, UBOs or licensing. Those checks run on their own tracks.
• The judgment stays with your team. Capture delivers the evidence and the signals. Whether the file passes KYB is, and should remain, your compliance decision.

Remote-first, not remote-only. For the handful of files with real credit exposure or serious suspicion, send the agent. For the long middle of the queue, a guided capture answers the question the drive-by was pretending to answer, in hours instead of days.

Frequently asked questions

What is KYB site verification?

It's the step in business verification that confirms a company physically operates at its stated address, rather than merely being registered there. It supplements registry, ownership and sanctions checks with visual evidence of the premises and activity.

Is a site visit required for KYB?

There's no universal mandate. KYB is risk-based under FATF and EBA frameworks, so site verification is an enhanced measure for higher-risk files: risky merchant categories, large exposures, lending, or clusters of address red flags.

How long does a merchant site inspection take?

Outsourced in-person inspections typically complete within 3 to 5 days of the request, per FraudPractice. A remote guided capture is same-day: the link goes out in minutes and the merchant films whenever they're at the premises.

Can I verify a business address without visiting?

Registry and street-view checks confirm an address exists, but not that the business operates there. Remote guided capture closes that gap: someone at the premises films it step by step, and the submission arrives timestamped, sealed and reviewable.

What if the submitter declines to share their location?

The case records the decline plainly and treats it as neutral. It is never counted as evidence against the submitter; your reviewer simply weighs the file on everything else it contains.

Does remote site verification replace sanctions, UBO or licensing checks?

No. A capture shows premises and activity on a date. Sanctions screening, beneficial-ownership verification and licence checks remain separate parts of the KYB file, and the overall decision stays with your compliance team.

Talk to us

If your onboarding queue has a pile of files stuck at "address needs review", the fastest way to judge this is to run one real file through it. Build a site-verification workflow, send the link to a test merchant, and look at the case that comes back: the footage, the answers, the timeline, the seal.

What it takes to start.

• A free plan, no credit card, and you can be live in 10 minutes.
• Nothing for the merchant to install: the capture link opens in their phone's browser.
• Your steps, your questions, your branding on the flow.

Stuck on the setup? Book a free setup call and someone on the VentaVid team builds your first capture workflow with you, live.

Start for free or book a demo and bring your trickiest flagged-address file.