Entity & identity

The rail doesn't know your customer, and no single "customer" record does either. An ACH payment identifies the payer by routing and account number, not by legal entity or invoice. Upstream, "customer" splits into the legal entity that owes, sold-to, ship-to, bill-to and payer; credit limits sit at the parent while orders arrive per ship-to.

KYB: three populations

An AR fintech runs full KYB (know your business) on the sellers it onboards: legal entity, beneficial owners at 25% or more, a control person, sanctions. Payers get lighter checks: bank-account validation, fraud signals, sanctions. A seller granting terms has no statutory KYB duty (domestic US companies have been exempt from beneficial-ownership reporting since March 2025) but strict-liability sanctions exposure, and may pull a consumer report on a guarantor, not on an officer who isn't personally liable.

Name-to-account checks are voluntary in the US: the Fed announced a Payee Name Verification service in December 2025 (launch unconfirmed), and under UCC 4A-207 a bank may rely on the account number when name and number disagree.

The mapping from bank account to payer to credit account to invoice is yours to build and keep, and it's the asset that makes cash application and credit control work.

Sources: FinCEN rule summary (March 2025), OCC, sanctions screening.

Ask an expert: how often does a payer pay from an account you've never seen, and at what level (parent or subsidiary) do you set and enforce credit limits?

AP keeps more nouns apart than it looks like from outside:

Is the supplier real?

In the US, the W-9 certifies the supplier's taxpayer identification number under penalties of perjury. The IRS's free TIN Matching service checks up to 25 name and number pairs instantly, or 100,000 in bulk within 24 hours; a missing or wrong number triggers 24% backup withholding (IRS, Oct 2026). Canada has no W-9: AP collects the Business Number and checks the GST/HST number in the CRA registry, keeping the result as evidence for tax credits.

Is the account theirs?

No Nacha rule requires a buyer to validate a supplier's account before sending an ACH credit. Nacha's December 2025 tips recommend it anyway, plus verifying change requests out of band with contact details already on file, and dual control. The Fed announced a Payee Name Verification service in December 2025 (launch date unconfirmed). Meanwhile UCC 4A-207 lets the receiving bank rely on the account number when name and number disagree.

A supplier's identity is issued by tax authorities and banks, not by you, and the bank account is the field a fraudster most wants to change.

Ask an expert: what share of vendor records at a mid-market buyer are inactive or duplicates, and how many bank-detail change requests arrive in a month?

Each card carries three identities, and each expense adds two more.

Reg Z counts organizations as cardholders, so on a corporate account the company is the cardholder. The employee becomes a debtor only under individual liability ("the cardholder will be solely liable", in Mastercard's definitions) or joint liability, and then needs a credit check. The employee's attributes still drive rules under every model: work state, province (which HST factor), Quebec (a second tax slip), owning 10% or more of the company (no lodging per diem for related parties), and a federally regulated Canadian employer (a 30-day reimbursement rule).

Visa's merchant data standards have the acquirer assign the code for the merchant's primary business, cut the name to 25 characters, and let marketplaces use one code (5262) for everything they sell. The network knows roughly who was paid; it never knows what was bought. US companies no longer report beneficial owners to FinCEN (since March 2025), but banks must still collect them, and sponsor banks push that work onto the program manager.

Sources: Reg Z interpretation, Visa Merchant Data Standards Manual (April 2026), Rev. Proc. 2019-48, FinCEN; Mastercard's definitions via a US bank's brochure (undated).

The bank issues the card, the company owes for it, the employee carries it, and the merchant is a 25-character string: model all four, because each answers a different question.

Ask an expert: for KYB refresh, employee sanctions screening and beneficial-owner changes, who is the customer of record: us, the bank, or both?

Three nouns get conflated constantly: the number (an E.164 address, the ITU format of country code plus national number, allocated to a carrier and reaching you through resale), the sender (whatever the recipient sees) and the business (the legal entity a gatekeeper has checked). Keep them apart in your data model.

Sources: TCR fees, TCR Auth+ 2.0, CNMC, TRAI, Google brand verification; the toll-free and sole proprietor details come from provider notices (secondary).

Two definitions to know cold. A 10DLC sole proprietor is a person or business without an EIN (an LLC with one isn't), verified by a one-time code to a US or Canadian mobile; providers report a limit of one campaign and one number. And Auth+, today required only of public companies, is reported by providers to extend to new brands of every type except sole proprietors from January 21, 2027.

The identity that matters is issued and checked by someone else, at a different level for every sender type. Model brand, campaign, sender and number as separate records, each with its own history.

Ask an expert: what share of brand and toll-free verification rejections trace to identity data (legal name, EIN, address, website) rather than the use case, and which field breaks most often?