Certificate of good standing verification: a KYB guide

A genuine certificate can still support a fraudulent business application. Certificate of good standing verification means checking the document with its issuer, matching it to the right company’s current status and checking the file for edits. None of that proves the applicant controls the company.

Would you release funds just because a company exists? A lender or marketplace needs more than that before approving an applicant. You need to check the source and the PDF without letting proof of company standing stand in for the rest of the review.

A genuine certificate is not a clean bill of health

The dangerous word is “good”. It sounds reassuring, but what it covers depends on where the certificate was issued and what it says. Read what the authority certifies, not what your onboarding checklist implies.

For example, Companies House’s certificate guidance calls its former good standing statement a “summary statement”. It confirms continuous existence since incorporation and that no strike-off action is currently being taken. Companies House only issues it when filings are up to date and the company meets its director or secretary requirements. The guidance also says these certificates cannot include shareholder or people-with-significant-control information.

Keep three questions separate:

• Did the claimed authority issue this certificate with these details?
• Does the correct legal entity currently meet the status requirements your policy needs?
• Is the person applying entitled to act for that entity?

Answering the first question leaves the other two open. A certificate records the company’s position when issued, not its live status. The word “standing” alone does not prove who owns the business, whether it trades, whether it can pay its debts or who controls its payout account.

This matters in cross-border KYB (know your business). If your European onboarding team receives an overseas certificate, check who issued it and what it means locally before treating it like a domestic register extract. Similar-looking paperwork can answer different questions.

Ask for evidence that supports the decision you’re making. For a business loan, company status cannot replace financial assessment. For a marketplace seller, it cannot replace checks connecting the applicant and settlement account to the business.

A certificate of incorporation needs a separate check too. Proof that a company was formed does not, by itself, prove its current standing. If the applicant supplies the wrong document type, request the right evidence before calling it fraud.

“Certificate received” is a poor review note. Record the issuer, entity identifier, date and exact statement you relied on. The next reviewer should be able to tell what the certificate proved and what still needs checking.

Certificate of good standing verification starts at the registry

Start from the authority’s independently located website, not a link or QR code printed inside the uploaded certificate. Fraudsters can make a verification page look official too. A successful result on an applicant-controlled website proves nothing about the issuer.

Take Delaware. The Delaware Division of Corporations’ certificate validation guidance says you need the entity file number and the certificate’s authentication number. It also says certificates can be validated for a year from their issue date.

That year is a validation-service window. It does not give you permission to accept year-old evidence for every onboarding decision. Set your freshness rule around the transaction and the rules that apply. If your policy calls for a recent certificate, an older genuine one still fails that requirement.

Use the official result to check the details it actually returns:

• Match the entity identifier before relying on a similar company name.
• Compare the legal name and certificate details wherever the service exposes them.
• Investigate differences in dates or wording rather than treating a working reference number as blanket approval.
• Obtain separate current-status evidence if certificate validation does not provide it.

What exactly did the lookup confirm? Save that answer with the lookup time and source. Do not write “registry verified” when you merely found a company with a matching name.

The same Delaware guidance says its certificates are printed in black ink on standard white paper with the Secretary’s seal and signature. A certificate does not need to look elaborate to be authentic. Nor does a seal excuse you from validating it.

Where online validation is unavailable or inconclusive, use contact details obtained independently from the authority. An unavailable service leaves verification pending. It does not establish a fake certificate of good standing.

Fake certificates exploit names, dates and borrowed identities

Consider a hypothetical marketplace application. A seller uploads a certificate for an existing company whose name closely resembles the seller’s trading name. A reviewer finds that company in the register and approves the account.

The reviewer never matches the entity number or checks the applicant’s right to act. The company exists. The applicant’s connection to it is still unchecked.

The certificate may be completely genuine. The connection to the applicant is the unsupported part. File-level document forensics cannot resolve that relationship by itself.

A different hypothetical submission uses a genuine certificate as the base file but replaces the company name. The original reference number remains untouched. If the reviewer only checks whether that number works, the wrong company can pass the check.

These are hypothetical examples, not reported VerifyPDF customer incidents. They show why you need to distinguish between different problems:

• With altered content, a name, identifier or date differs from what the issuer confirms.
• Stale evidence can be authentic but too old for your requirements. That is an evidence gap, not necessarily deception.
• In entity impersonation, a genuine document belongs to the right company, but the applicant’s authority remains unverified.
• A fabricated source points reviewers from a fake document toward a lookalike validation site.

The wider problem overlaps with vendor onboarding fraud involving company records and banking documents. A consistent packet can still be false if the applicant controls every document in it.

Cross-reference the application, certificate and banking evidence, but record which facts came from independent sources. Three uploaded PDFs repeating the same legal name are not three independent confirmations.

If you work for a lender or marketplace, ask whether the evidence connects the same legal entity to the proposed relationship. A perfect-looking certificate for somebody else’s company is still the wrong evidence.

PDF forensics adds file checks, with limits

A registry search checks the company record. It does not inspect the certificate file you received. Document forensics checks that file for signs of edits, including changes to a copy of a genuine certificate.

Relevant findings can include:

• Different fonts or text objects around the legal name or issue date.
• Metadata that does not fit the claimed file history.
• Saved revisions or object changes affecting a key field, where available.
• A flattened image that leaves no original text objects to inspect.

We treat these as leads to investigate. A font difference can come from the issuer’s template, an editor name can reflect harmless file handling and a scan may be the format the applicant received. Flagging an anomaly is not establishing fraud.

Our competitor Inscribe’s KYB document-verification guidance describes examining metadata, fonts and revision-history anomalies in business documents. That is a description of its approach, not independent evidence of a detection rate. It also does not mean every edit leaves traces you can recover.

At VerifyPDF, we analyze PDF structure for signs of manipulation. You can evaluate our document fraud detection checks alongside your registry workflow, using original issuer downloads and known altered samples. Our file analysis does not replace registry authentication or checks on the applicant’s authority. Keep those steps separate.

When a finding concerns the company name, compare that exact field with issuer evidence. When conversion removed useful structure, request the original download if the issuer provides it.

Our explanation of what PDF anomalies cannot prove covers the limits in more detail. A clean forensic result does not prove a file is genuine, just as an unusual producer field does not prove deception. Combine file findings with facts obtained from a separate, trusted source.

Turn conflicting KYB evidence into a review decision

A single “verified” checkbox hides too much. Your reviewer needs separate outcomes for certificate authenticity, current entity status and applicant authority. Otherwise a successful company-name search can quietly clear every other concern.

Use this sequence to check a company’s certificate of good standing without losing those distinctions:

1. Preserve the upload.

   Retain the original bytes, calculate a file hash and record when the application received it. Keep converted working copies separate and document who handled each copy.

2. Identify the entity and issuer.

   Record the legal name, registration number, jurisdiction and certificate type. Resolve similar names through identifiers rather than visual resemblance.

3. Check certificate authenticity and current status separately.

   Use the authority’s validation route where available, then obtain the current record needed for your decision. GOV.UK’s company-information guidance lists available details including registered address, incorporation date, officers, previous names and insolvency information. Those records add context, but do not by themselves authenticate the uploaded certificate.

4. Review the file and the applicant’s authority.

   Investigate material forensic findings and complete your separate representative, ownership and banking checks. Do not infer authority solely because the applicant knows public company details.

5. Record the decision and unresolved gaps.

   State what each check established, what remains unknown and who approved the next action. Preserve source results, correspondence and any replacement files under your retention policy.

Give each gap its own outcome rather than one fraud label:

Tell the applicant exactly what you need: “Please provide the original issuer download for entity number X.” A vague “upload a better certificate” invites another copy of the same problem.

Good standing is a finding, not an approval

Before you approve, check who issued the certificate, which company it covers and whether its status meets your needs. Examine the file for edits and check the applicant’s right to act. Don’t let a pass on one check clear the rest.

To assess the file itself, start a VerifyPDF business trial and test whether the findings help your team resolve certificate discrepancies alongside registry checks. The certificate says something about the company. You still have to establish who you’re dealing with.