Modern SMB lending requires a verification stack that addresses fraud, identity, and credit risk in a single coherent workflow.

Most lenders start the waterfall with fraud and digital intelligence checks: products like Sentilink, or Socure handle synthetic identity detection, device signals, and consumer KYC on the applicant side. Baselayer handles the rest: it covers the business entity itself, handling business verification, lien and litigation screening, and credit assessment signals that consumer fraud tools do not reach.

After Baselayer, the workflow continues into financial underwriting:personal credit reports on the owner or guarantor, cash flow analysis, and bank account verification. Together, these layers form a complete picture of the business and the person behind it.

Key challenges for lenders:

Credit risk assessment: Evaluating ability and willingness to repay
Legal exposure: Identifying existing liens, litigation, and bankruptcy risk
Fraud prevention: Detecting synthetic businesses and serial defaulters
Regulatory compliance: Meeting CDD requirements and AML obligations
Portfolio management: Monitoring borrowers for signs of financial distress

This guide provides a standard verification workflow optimized for business lending underwriting teams, from initial application through ongoing portfolio monitoring.

A Note on Sole Proprietors

Before implementing this workflow, determine whether your policy approves sole proprietors. Sole proprietors - individuals operating without a registered legal entity - are common applicants in small business lending but require a fundamentally different verification approach, since Secretary of State registration data does not exist for them.

If your product accepts sole proprietors, review the Sole Proprietor Verification. Our recommendation is to set up a separate waterfall and decisioning criteria specifically for these entities. The workflow below applies to registered businesses (LLCs, corporations, and partnerships).

Verification Workflow Overview

A standard business lending verification flow includes six steps:

Fraud & Identity Screening: pre-Baselayer fraud signals on the applicant (Partner/s)
Industry & Web Presence Screening: industry risk and website legitimacy check (Baselayer)
Business Verification: entity match, TIN validation, SoS registration, velocity, and consortium (Baselayer)
Credit Assessment: lien and litigation screening to assess financial health (Baselayer)
Personal Credit Report: credit history and FICO score on the owner or guarantor (Partner/s)
Financial Analysis: cash flow underwriting and bank account verification (Partner/s)

Add-on: Portfolio Monitoring - ongoing monitoring of funded borrowers (Baselayer)

Step 1: Fraud & Identity Screening

Purpose: Screen the applicant for fraud signals before committing to a full business verification.

Context

Fraud and identity screening typically runs on the individual applicant - the business owner, authorized signer or guarantor - before any business-level verification begins. This step catches synthetic identities, stolen credentials, and known fraud patterns early, before incurring the cost of a full business search.

Common checks at this stage include identity document verification, device fingerprinting, behavioral signals, and shared fraud databases.

Baselayer works with hundreds of partners and can recommend ideal providers for every product and use case.

Step 2: Industry & Web Presence Screening

Purpose: Confirm the business operates in an eligible industry and that its web presence is consistent with a legitimate operating business.

Configuration Questions

Which NAICS codes or industry groups does your credit policy exclude?
Are there specific high-risk keywords that trigger a decline regardless of NAICS classification?
Will you review the applicant's website to check for domain consistency?

Baselayer Recommendation

Decline if a prohibited keyword is detected in the industry classification
Decline if a prohibited NAICS code is returned with confidence ≥ 0.70; manual review if confidence is lower
Flag for review if the submitted domain does not match the domain found by Baselayer, and the discovered domain is email-deliverable (a real, operational domain exists for this business, so submitting a different one is suspicious)
Flag for review if the submitted domain was registered less than 90 days ago

Tip: If you do not collect the applicant's website, pass us the domain extracted from their email address as the website input. This enables all domain-level checks to run on the most available signal.

Baselayer Products Used

Web Presence Request: industry prediction, website analysis, domain signals

Verification Logic

// Extract web presence signals
industry               = response.industry_prediction
website_analysis       = response.website_analysis        // discovered domain analysis
input_website_analysis = response.input_website_analysis  // submitted domain analysis

// Check prohibited industry keywords
IF industry.keywords CONTAINS ANY prohibited_keyword:
    flag = "RED"
    reason = "Prohibited industry keyword detected"

// Check prohibited NAICS codes with confidence threshold
IF industry.code IN prohibited_naics_list:
    IF industry.accuracy >= 0.75:
        flag = "RED"
        reason = "Prohibited industry"
    ELSE:
        flag = "YELLOW"
        reason = "Potential prohibited industry - needs review"

// Check if submitted domain was recently registered (under 90 days)
IF input_website_analysis.domain_created_at > today - 90 days:
    flag = "YELLOW"
    reason = "Submitted domain registered less than 90 days ago"

// Check for suspicious domain mismatch:
// applicant submitted a domain that differs from what Baselayer found,
// but the discovered domain is real and can receive email
IF business_website_match == FALSE:
    IF input_website_analysis.url != NULL:
        IF website_analysis.email_deliverable == TRUE:
            flag = "YELLOW"
            reason = "Submitted domain does not match discovered domain - business has a real, operational web presence"

Note: Prohibited NAICS code and keyword lists are defined by your credit policy. Contact your Baselayer representative for access to industry reference lists used by other lenders.

Context

Industry screening runs before business verification to catch ineligible businesses early and cheaply. A match on a prohibited NAICS code or keyword is typically a terminal check - there is no value in proceeding to verification for a business in a category your program does not serve.

Domain signals are strong fraud indicators in lending. A submitted website that does not match the discovered website suggests the applicant may have fabricated their online presence. A domain registered under 90 days before application is a common pattern in synthetic business fraud, where fraudsters quickly set up websites to pass basic screening.

Step 3: Business Verification

Purpose: Confirm the business exists, is registered and in good standing, matches the submitted information, and shows no fraud or velocity signals.

Configuration Questions

What is your minimum time-in-business requirement? (Most common is 12+ months)
Will you always collect and submit EIN for TIN validation? (strongly recommended)
Do you need to verify the owner's SSN of the officers or guarantors?
Are there entity types your program does not support (e.g., non-profits, trusts)?
How should DE/NJ registrations be handled?
Are you a Baselayer Fraud Consortium member? Do you want to use the Identity Network data?

Baselayer Recommendation

Business must be found, no match is an automatic decline
tin_matched must be TRUE - TIN mismatch is an automatic decline
Name and address: business_name_match = SIMILAR + business_address_match = EXACT, OR business_name_match = EXACT + business_address_match ≠ NO_MATCH
At least one active SoS registration required
months_in_business must be 12+ months (calculated from incorporation_date)
DE/NJ handling: approve if any other active registration exists
Identity Network: flag for manual review if more than 2 application activities in the last 30 days
Fraud Consortium: decline if the business appears in the Baselayer Exclusion List

Baselayer Products Used

Business Search: entity match, TIN validation, SoS registration data, watchlist screening, Identity Network
Application History (GET /businesses/{id}/applications): velocity check
Exclusions (GET /businesses/{id}/exclusions): fraud consortium screening

Verification Logic

// Extract core match signals from /searches response
business_id   = response.business.id
name_match    = response.business_name_match
address_match = response.business_address_match
tin_matched   = response.tin_matched
registrations = response.business.registrations

// Business must be found
IF business_id == NULL:
    flag = "RED"
    reason = "No business match found"
    // Stop — do not proceed to remaining checks

// TIN must validate with IRS
IF tin_matched != TRUE:
    flag = "RED"
    reason = "TIN does not match IRS records"

// Name and address match combination
IF name_match == "SIMILAR" AND address_match == "EXACT":
    flag = "PASS"
ELSE IF name_match == "EXACT" AND address_match != "NO_MATCH":
    flag = "PASS"
ELSE:
    flag = "RED"
    reason = "Insufficient name and address match"

// Active SoS registration required
active_registrations = [r for r in registrations where r.status == "active"]
IF COUNT(active_registrations) == 0:
    flag = "RED"
    reason = "No active Secretary of State registration"

// Time-in-business: domestic registration must be 12+ months old
IF months_in_business < 12 months:
    flag = "YELLOW"
    reason = "Business registered less than 12 months ago"

// DE/NJ domestic registration handling
IF domestic_reg.state IN ["DE", "NJ"]:
    other_active = [r for r in active_registrations where r.state NOT IN ["DE", "NJ"]]:
        flag = "YELLOW"
        reason = "DE/NJ incorporation under 12 months with no other active registration"

// Business structure filter
IF response.business.entity_type IN excluded_entity_types:
    flag = "RED"
    reason = "Business structure not eligible"

// Application velocity
applications        = GET /businesses/{business_id}/applications
recent_applications = [a for a in applications where a.created_at >= today - 30 days]
IF COUNT(recent_applications) > 2:
    flag = "YELLOW"
    reason = "More than 2 applications in the last 30 days"

// Fraud consortium and exclusions
exclusions = GET /businesses/{business_id}/exclusions
IF COUNT(exclusions) > 0:
    flag = "RED"
    reason = "Business in Baselayer Exclusion List"

Note: The Fraud Consortium and Identity Network are available to Baselayer member entities who contribute to the shared database. Contact your Baselayer representative to join and unlock these checks.

Context

Business verification is the core of the Baselayer workflow. It confirms the entity is real, matches IRS records, has an active legal registration, and does not appear in fraud databases.

TIN validation is a hard requirement for lending. An EIN that does not match the business name with the IRS is a strong fraud signal: it may indicate a fabricated entity, a recycled EIN, or a name discrepancy that will create problems at underwriting. TIN validation is included in the standard business search when an EIN is submitted.

Application velocity is particularly relevant in lending because sophisticated fraud rings often test multiple lenders with the same business identity in a short window. More than two applications in 30 days is a signal worth surfacing for manual review, even if the individual application looks clean.

Step 4: Credit Assessment

Purpose: Evaluate the business's lien and litigation profile to identify financial distress, existing creditor obligations, and legal exposure.

Credit assessment criteria will vary widely depending on the product and customer base of the lender.

Configuration Questions

What is the maximum number of active UCC liens ahead your program accepts? (Most common is 1, and being in second-priority position)
What is your lookback period for tax liens? (Baselayer recommends 5 years)
What is your lookback period for bankruptcies? (Baselayer recommends 5 years)
Are there specific litigation case types you always flag (e.g., evictions, class actions, regulatory actions)?
Do you want to run lien and litigation searches on the business only, or also on officers and guarantors?

Baselayer Recommendation

Maximum 1 active UCC lien: being third or further in repayment priority significantly reduces recovery likelihood in default
Any tax lien filed in the last 5 years → manual review required
Any bankruptcy filed in the last 5 years → manual review required
Any high-risk litigation case with exact name match → manual review required
Start with the business only; extend to officers and guarantors when ready - see Lien Search for Individuals and Docket Search for Individuals

Baselayer Products Used

Lien Search: UCC filings, tax liens, judgment liens
Docket Search: litigation and bankruptcy proceedings

Verification Logic

// --- LIEN ASSESSMENT ---

lien_response    = POST /lien_searches with business_id
active_ucc_count = 0

FOR EACH filing IN lien_response.filings:

    // Tax liens: flag any filed in the last 5 years, regardless of current status
    IF filing.filing_type.startswith("tax."):
        IF filing.filing_date >= today - 5 years:
            flag = "YELLOW"
            reason = "Tax lien filed in last 5 years - manual review required"

    // For UCC liens, only count currently effective filings
    IF filing.status != "active":
        CONTINUE
    IF filing.lapse_date != NULL AND filing.lapse_date < today:
        CONTINUE

    // Count active UCC filings
    IF filing.filing_type.startswith("consensual."):
        active_ucc_count += 1

// Flag if more than 1 active UCC
IF active_ucc_count > 1:
    flag = "YELLOW"
    reason = "More than 1 active UCC lien - review repayment priority"

// --- LITIGATION & BANKRUPTCY ASSESSMENT ---

docket_response = POST /docket_searches with business_id

FOR EACH docket IN docket_response.dockets:

    IF docket.match_level != "EXACT":
        CONTINUE

    // Bankruptcy: flag any filed in the last 5 years
    IF docket.is_bankruptcy == TRUE:
        IF docket.date_filed >= today - 5 years:
            flag = "YELLOW"
            reason = "Bankruptcy filed in last 5 years - manual review required"

    // High-risk litigation
    IF docket.risk_level == "high":
        flag = "YELLOW"
        reason = "High-risk litigation case - manual review required"

Note: Thresholds above (1 active UCC, 5-year lookbacks) reflect Baselayer's standard starting point for small business lending. Adjust to match your credit policy and risk appetite.

Note: This logic runs on the business only. To extend coverage to officers or guarantors, see Lien Search for Individuals and Litigation & Bankruptcy Search for Individuals.

Context

Context is critical at this stage. A single UCC lien from a bank is normal for a small business with a term loan. Three active UCCs from different lenders, combined with a tax lien filed last year, is a materially different picture.

The 1-active-UCC recommendation reflects repayment priority. If a borrower defaults, secured creditors are paid in order of filing. Being third or fourth in line significantly reduces recovery likelihood. Lenders should understand their collateral position before extending credit.

Tax liens and bankruptcies are the strongest distress signals in this dataset. An IRS lien means the business has failed to pay federal taxes, a significant indicator of cash flow problems. A bankruptcy in the last five years means the business has already restructured or liquidated debt under court supervision. Both warrant at minimum a manual review regardless of the apparent strength of the rest of the application.

Note: For advanced lien interpretation including collateral scope, amendment history, and senior lender identification, see Lien Search: Best Practices. For litigation interpretation, see Litigation & Bankruptcy Search: Best Practices.

Step 5: Personal Credit Report

Purpose: Assess the personal credit history and financial standing of the business owner or guarantor.

Configuration Questions

Will you pull a personal credit report on all applicants, or only on those providing a personal guarantee?
Which credit bureaus do you use (Experian, Equifax, TransUnion)?
What is your minimum FICO score threshold?
Do you use a soft pull for pre-qualification and a hard pull at funding?

Context

Personal credit remains a strong predictor of repayment behavior in small business lending, particularly for businesses with limited credit history. For businesses under 3 years old, or where the owner's personal assets back the loan, the guarantor's credit profile is often as important as the business's.

A personal credit report surfaces derogatory marks, existing personal debt obligations, and credit utilization patterns that do not appear in business records. Combined with the business-level signals from Steps 2–4, it provides a complete view of the financial risk associated with both the entity and the individual behind it.

Baselayer works with hundreds of partners and can recommend ideal providers for every product and use case.

Step 6: Financial Analysis

Purpose: Verify the business's financial health and cash flow capacity to service the loan.

Configuration Questions

Will you require bank account verification, or rely on stated financials?
Which bank data providers do you use (Plaid, Finicity, MX, or similar)?
What minimum monthly revenue or cash flow do you require?
Do you use cash flow underwriting as the primary credit signal, or as a secondary check?
Will you require tax returns or bank statements for larger ticket sizes?

Context

Financial analysis is typically the final gate before a credit decision. For small business lending, cash flow underwriting - analyzing actual bank transaction data rather than stated financials - has become the standard approach, particularly for short-duration or revenue-based products. Bank account verification via Plaid, Finicity, or similar providers gives lenders direct access to transaction history, average daily balances, and revenue consistency.

For larger ticket sizes or longer loan durations, tax returns and financial statements remain important alongside bank data. The combination of verified bank cash flow and tax-reported income provides a more complete picture of the business's financial health than either source alone.

Baselayer works with hundreds of partners and can recommend ideal providers for every product and use case.

Add-On: Portfolio Monitoring

Purpose: Continuously monitor funded borrowers for changes that signal increased risk.

When to Use

After funding, add each borrower to portfolio monitoring to track:

New liens or tax liens filed
New litigation or bankruptcy proceedings
SoS registration status changes (delinquent, dissolved, revoked)
Officer changes
New activity in the Baselayer Identity Network or Fraud Consortium

Baselayer Products Used

Portfolio Monitoring: POST /portfolio/items

Verification Logic

// Add business to portfolio monitoring after funding
IF application.status == "FUNDED":
    portfolio_item = POST /portfolio/items {
        "business_search_id": business_search_id
    }

Recommended Configuration

Monitoring frequency: monthly for standard portfolios; weekly for higher-risk borrowers
Monitor for: lien changes, bankruptcy events, SoS standing, identity network activity

Context

One-time KYB at origination captures the business profile at a single point in time. Portfolio monitoring extends that coverage across the life of the loan, surfacing early warning signs before they become defaults. New tax liens, SoS standing changes, and bankruptcy filings are among the strongest predictors of repayment problems - and they often appear weeks or months before a payment is missed.

For comprehensive guidance on monitoring configuration, see Portfolio Monitoring: Basics.

Implementation Checklist

Setup

Step 2: Industry & Web Presence Screening

Configure POST /web_presence_requests
Load prohibited NAICS codes and keyword lists
Enable submitted website vs. found website comparison

Step 3: Business Verification

Configure POST /searches with TIN submission
Implement name/address match logic
Implement TIN validation check
Implement SoS registration age and status checks
Implement DE/NJ registration handling
Implement application velocity check via GET /businesses/{id}/applications
Implement exclusions check via GET /businesses/{id}/exclusions

Step 4: Credit Assessment

Configure POST /lien_searches
Implement lien effectiveness check (status + lapse date)
Implement tax lien classification and lookback logic
Implement active UCC count threshold
Configure POST /docket_searches
Implement bankruptcy lookback logic
Implement high-risk litigation flagging

Steps 5–6: Personal Credit & Financial Analysis

Integrate credit bureau provider and configure FICO threshold
Integrate bank data provider (Plaid, Finicity, or similar)
Define minimum cash flow or revenue thresholds

Portfolio Monitoring (Add-On)

Configure POST /portfolio/items on funding event
Define monitoring frequency and alert thresholds

For questions about implementation or to customize this workflow for your product, contact your Baselayer account representative.