Bulk vendor verification: checking a whole supplier list against sanctions and registries

Updated 2026-11-08

Most vendor checks are done one name at a time, when someone asks. The problem shows up when you inherit a list of 200 suppliers, or when a payment run has 40 new payees. This guide explains how to check a whole list, what each result means, and where the manual method stops being practical.

1. Clean the list first

Each row needs at least:

• the legal name as it appears on the registry (not the trade name on the storefront);
• the country of registration;
• a registration number when you have one (Companies House number, Canadian business number, LEI);
• a website or domain, to confirm what the company does.

Remove duplicates and merge rows that point to the same entity. A company with two spellings counted twice doubles your review work and can hide a match.

2. Screen against the sanctions lists

Check each name against the lists that apply to your business:

• US: the OFAC SDN list, through the Consolidated Screening List (CSL) search at https://sanctionssearch.ofac.treas.gov/
• UK: the UK Sanctions List, published at https://www.gov.uk/government/publications/the-uk-sanctions-list
• EU: the EU consolidated financial sanctions list
• Canada: the consolidated sanctions list maintained by Global Affairs Canada

Record for each row: the list checked, the date, the hit or no hit, and the exact name matched. Fuzzy matches (spelling variants, same address, same director) need a human decision, not an automatic rejection.

3. Confirm the company exists

A sanctions miss does not prove the company is real. For UK companies, search the register at https://find-and-update.company-information.service.gov.uk/. For Quebec contractors, check the RBQ licence (see our guide on the RBQ and RENA).

4. Turn results into a decision

Use four outcomes, the same ones Tolca's verify-business returns:

• ok: no hit, company found in its registry.
• review: a possible match or a registry record that does not match the name, address or status.
• blocking: an exact match on an applicable list. Stop the payment and escalate.
• not_found: no registry record. This is not proof of fraud; ask the vendor for documents.

Write the rule down before you start, so the same name gets the same answer every time.

5. The batch way

Doing steps 2 to 4 by hand for 200 rows takes an afternoon, and the work is easy to get wrong at row 150. Tolca's verify-business does the same checks in one call per company, against the lists above plus the UK Companies House, Canadian federal companies, GLEIF (LEI) and the Quebec, Washington and Oregon contractor licences. It returns ok, review, blocking or not_found with the sources it checked.

• Apify Store: https://apify.com/tolca/business-verification (pay per company, usable in batch)
• Agents: POST https://tolca.tonbot.ca/v1/verify-business (x402, USDC on Base)
• MCP: https://tolca.tonbot.ca/mcp/public

It checks companies only, not individual people. A person who is a director still needs a manual check against the lists.

Keep a record

Keep the date of each check and the list version you used. Sanctions lists change, so a clean result from six months ago is not a current result. Re-screen the list before any large payment run.