How to verify a UK company before paying it: Companies House and the UK Sanctions List

Updated 2026-11-02

Before you pay a new supplier, sign a contract or send money to a company registered in the United Kingdom, two checks take a few minutes and use official sources: does the company exist in the register, and is it or its officers listed under a sanctions regime? This guide explains both, first by hand (free), then how to automate them for an AI agent or a bulk list.

What you need to check

1. Identity: the exact legal name, the company number, the registered office and the status (active, dissolved, in liquidation...).
2. Sanctions: whether the entity appears on the UK Sanctions List, which is the list maintained by the UK government under the Sanctions and Anti-Money Laundering Act 2018.
3. Context: the other lists that matter for your deal (US, EU, Canada), since a UK company can be owned or controlled by an entity listed elsewhere.

Companies House does not tell you whether a company is sanctioned. The UK Sanctions List does not give you the full company record. You need both.

Method 1: by hand (free)

Step 1: find the company in the register.

• Go to the Companies House search at gov.uk and search by name or by company number.
• Open the company profile. Check the company number, the status, the registered office address and the incorporation date.
• If the status is not "active", or the name you were given does not match the register, stop and ask for the company number in writing.
• Look at the filing history and the officers list. A company that was just incorporated or that changes its officers often is a reason to look closer, not proof of anything.

Step 2: check the UK Sanctions List.

• The UK Sanctions List is published by the Foreign, Commonwealth & Development Office on gov.uk. Its page shows the date of the last update. At the time of writing, the page was last updated on 30 October 2026, and it lists updates by regime (Russia, Iran, Sudan, cyber and others).
• Search the list for the company name and for the names of its directors and owners that you know. Watch for spelling variants, former names and trading names.
• A match is not automatically a block: it needs a human reading the entry, the regime and the identifiers (number, date of birth, address). Keep a record of what you checked and when.

Step 3: record the result. Save the company number, the status, the date of the check and the list version. This is what a compliance reviewer or an auditor will ask for.

Method 2: the API route

Companies House publishes a REST API with OpenAPI specifications for its public operations. It is useful when you need the same check on many companies, or when a software process must decide before a payment. Read the official documentation at developer.company-information.service.gov.uk before you build on it, including the authentication and rate limits.

Doing both checks in code means handling three things that a manual check hides: company names that are close but not identical, companies that have been struck off, and sanctions updates that arrive during the week. A screening call that returns a clear verdict (ok, review, blocking or not found) is easier to log than a folder of screenshots.

The same check through Tolca: verify-business

Tolca's verify-business endpoint runs the checks above and returns one verdict per company:

• Sources: the UK Sanctions List, Companies House (UK), the US consolidated list (CSL, including OFAC SDN), the EU consolidated list, the Canadian list (LMES) and GLEIF (LEI), along with federal Canadian companies and Quebec, Washington and Oregon contractor licences.
• Verdicts: ok, review (a possible match to read by a human), blocking (a match that should stop the payment) and not_found.
• Scope: companies only. It does not return data about individuals.
• Price: 0.05 USD per company.
• Where: Apify Store at https://apify.com/tolca/business-verification (card, batch use), or the x402 API at POST https://tolca.tonbot.ca/v1/verify-business (USDC on Base, for agents). The OpenAPI description is at https://tolca.tonbot.ca/openapi.json. An MCP endpoint is available at https://tolca.tonbot.ca/mcp/public.

A review or blocking verdict is a signal to investigate, not a legal conclusion. Read the matched entry and decide with your compliance process.

Checklist for an agent that pays vendors

• Require a company number and legal name before any payment.
• Call the screening step before the payment, not after.
• Treat review as a hold, and blocking as a refusal to pay pending human review.
• Log the verdict, the timestamp and the source list version.
• Re-check periodically: sanctions lists change often (the UK Sanctions List had several updates in late October 2026 alone).

Limits

• This guide is general information, not legal advice. Sanctions obligations depend on your jurisdiction and your activity.
• No list is complete: a name can be spelled differently in the source than on your invoice.
• Use official sources for final decisions, and keep a human in the loop for any match.