Verify a vendor's legal entity at onboarding with LEI, VAT and SEC data

Names are not identities

Vendor onboarding, KYC and CRM de-duplication all start with the same step: turn whatever the counterparty typed into one legal entity. A name matches many companies, a trading name differs from the registered one, and the address on a website is rarely the registered address.

The Company Identity Resolver looks the entity up in official registries (GLEIF for LEIs, the SEC company ticker table, EU VIES for VAT numbers) and returns the legal name, jurisdiction, registry ID, addresses and parent entities. When a name is ambiguous it returns status: ambiguous with ranked candidates instead of guessing. It does not scrape the company's website.

Resolve by the strongest identifier you have

Send any of name, domain, lei, vat, cik or ticker, with an optional country to narrow a name search. An identifier is exact; a name is a search. Ask the vendor for an LEI, VAT number or CIK where you can, and use the name only as a fallback.

curl -sS -X POST "https://$RAPIDAPI_HOST/v1/company-identity" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: $RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: $RAPIDAPI_HOST" \
  -d '{"name": "Microsoft Corporation", "country": "US"}' > entity.json

jq '.data | {status, best: (.best | {lei, legal_name, entity_status, jurisdiction, registry, sec})}' entity.json

What comes back

For the request above the status was resolved and best held the LEI INR2EJN1ERAN0W5ZP974, legal name MICROSOFT CORPORATION, entity status ACTIVE, jurisdiction US-WA, the registry record, and the SEC CIK 0000789019 with ticker MSFT. Five ranked candidates were returned alongside it.

Note the two addresses. The registered (legal_address) address was a registered-agent office in Tumwater, Washington, while the headquarters_address was One Microsoft Way, Redmond. Contracts and sanctions screening use the legal entity and its registered address; shipping and site visits use the headquarters. The sources used are listed with a SHA-256 of each registry response, so you can keep the evidence with the onboarding record.

Decide in code, escalate in the gaps

Accept automatically only when status is resolved and the entity status and registration status are active. Anything else goes to a person with the candidates attached. Check notes and limits too: the response states what it did not verify (for example, a parent relationship it could not read), and a missing LEI means the entity has not registered one, not that it does not exist.

import os, requests

def resolve(**ident):
    r = requests.post(
        f"https://{os.environ['RAPIDAPI_HOST']}/v1/company-identity",
        headers={"X-RapidAPI-Key": os.environ["RAPIDAPI_KEY"], "X-RapidAPI-Host": os.environ["RAPIDAPI_HOST"]},
        json=ident, timeout=30,
    )
    r.raise_for_status()
    return r.json()["data"]

entity = resolve(name="Microsoft Corporation", country="US")
best = entity.get("best")
if entity["status"] == "resolved" and best and best["entity_status"] == "ACTIVE":
    print("verified:", best["legal_name"], best["lei"])
else:
    print("needs review:", [c.get("legal_name") for c in entity.get("candidates", [])])