KYB API for AI agents: verify a vendor before paying it

Updated 2026-11-07

An AI agent that pays a vendor on its own needs the same check a finance team would do before the first payment: is this company real, is it registered where it claims to be, and is it on a sanctions list? This guide explains the manual method first, then the faster way to do it in one call.

What a KYB check answers

KYB means "know your business". For a payment to a new vendor, four questions matter:

1. Does the company exist in an official registry (in the country where it says it operates)?
2. Is it on a sanctions list (US, UK, EU, Canada, and UN measures applied by those jurisdictions)?
3. Does it hold the licence its trade requires, if the trade is licensed?
4. Does it have a legal identifier such as a Legal Entity Identifier (LEI) registered with GLEIF?

A sanctions hit is not the only risk, but it is the one you cannot afford to miss, so it comes first.

The manual method (free)

Use the official sources directly:

• US: the OFAC Sanctions List Search tool, and the Consolidated Screening List (CSL) for the other US lists. Search the company name and its known variants.
• UK: the UK Sanctions List published on GOV.UK, and Companies House for the company register.
• EU: the EU consolidated financial sanctions list, searchable through the EU sanctions map.
• Canada: the Consolidated Canadian Autonomous Sanctions List and the federal corporations registry (Corporations Canada).
• Global identifier: the GLEIF search for an LEI.

Write down the date, the list you searched, the exact name you searched, and the result. A "no match" result is only valid for the name and date you used, so repeat it before a large payment.

The limits of the manual method: name matching is fuzzy (spelling, transliteration, subsidiaries), each list has its own search syntax, and a list of 50 vendors takes a long time to check by hand.

The fast method: one call per company

Tolca's verify-business service runs these checks in one call and returns a verdict: ok, review, blocking or not_found. It covers the US CSL (including OFAC SDN), the UK Sanctions List, the EU consolidated list, the Canadian LMES list, Companies House (UK), federal companies in Canada, GLEIF (LEI), and contractor licences in Quebec, Washington and Oregon. It does not return data about individuals.

• Price: 0.05 USD per company, paid per call.
• For agents: POST https://tolca.tonbot.ca/v1/verify-business, paid with x402 in USDC on Base.
• Through MCP: https://tolca.tonbot.ca/mcp/public.
• For a person who wants to pay by card: the listing on the Apify Store, apify.com/tolca/business-verification, which also works in batches.

A simple decision rule for an agent

• ok: continue, and store the check date and the verdict with the payment record.
• review: do not pay automatically. Escalate to a human with the matching records.
• blocking: stop. Do not pay, and keep the record.
• not_found: the company is not in the sources covered. Ask for a registration number or an LEI before paying.

A not_found is not a clean result. It means the check could not confirm the company, which is a different thing.

What this does not replace

A KYB check verifies the company against lists and registries. It does not check the quality of the work, the delivery, the bank account ownership, or the beneficial owners of the company. For a large contract, keep your own due diligence process and use this check as the first filter.

Related guides: How to screen a company against US sanctions lists (OFAC SDN and the CSL) and How to verify a UK company before paying it.