Every supplier verified. Company, HMRC, bank account.
OmniPATH checks Companies House, HMRC VAT records, bank modulus and Confirmation of Payee in one automated pass - before any supplier can receive a purchase order or a payment. No spreadsheets. No phone calls. No guesswork.
Four government and banking-scheme APIs. One automated check.
Every UK supplier passes through Companies House, HMRC VAT, bank modulus and Confirmation of Payee - sequentially, automatically, with full audit trail. Sub-five-second result.
The checks your auditors expect.
Each layer is a real-time API call to a UK authority - Companies House for company status, HMRC for VAT registration, bank validation and Confirmation of Payee. Failures are stored as structured JSON, audit-tagged as fraud-relevant and surface immediately to your admin team.
Companies House
Direct integration with the official Companies House REST API. Confirms the company exists, is currently active, the name matches (normalised) and the registered office postcode aligns with the supplier address.
- Company number exists in the register
- Company status is active - not dissolved, struck off, or liquidated
- Registered name matches (Ltd / Limited / case / whitespace normalised)
- Registered-office postcode matches supplier address
- Flags if registered office is in dispute
HMRC VAT
Real-time lookup against HMRC's VAT registration register. Validates the VRN, then cross-references the registered business name and postcode. Skipped automatically if the supplier doesn't have a VAT number - non-VAT-registered suppliers are normal.
- VRN exists and is currently valid at HMRC
- Registered business name matches supplier name (normalised)
- Registered postcode matches supplier address
- Production + sandbox environments supported
- Auto-refresh OAuth tokens - no manual maintenance
Bank Modulus
Sort code and account number passed through the UK Payments Association modulus check - the same algorithm a bank runs at the start of any faster-payments transaction. Confirms the account number is mathematically valid for that sort code and returns the bank and branch details.
- Modulus check against official UK banking validation tables
- Sort code resolved to bank, branch, address
- Returns: bank name, branch title, address, town, postcode
- Always runs - sort code and account number are required
- Exponential-backoff retry on transient failures
Confirmation of Payee
The same name-check banks run before processing faster payments. Confirms the account holder name matches the bank's records for that sort code and account number - and detects switched accounts, non-existent accounts and opted-out banks. This is the layer that stops fraud before money moves.
- Account holder name matches bank's records
- Account type matches (personal vs business)
- Detects switched accounts and non-existent accounts
- Suggests corrected name on close match
- Handles opted-out / not-enrolled banks gracefully
Five checks. One government API.
Every newly-submitted supplier hits the same five checks against the official Companies House register. Failures land as structured JSON on the supplier record - code, message, field - auditable, exportable, defensible.
- Company number exists and is active in the register
- Status check - dissolved, liquidated and struck-off companies blocked
- Name match - Ltd / Limited / case / whitespace normalised before comparison
- Postcode match - registered office postcode against supplier address
- Address dispute flag - surfaces Companies House disputes on the registered office
VAT validated against HMRC's live register.
OmniPATH calls HMRC's VAT Check API directly - OAuth 2.0 client credentials, read:vat scope only. Token lifecycle managed automatically. The same lookup HMRC themselves run for VAT registration verification, just embedded in your supplier flow.
- VRN lookup against HMRC's live VAT registration register
- Registered name cross-referenced against supplier name
- Registered postcode cross-referenced against supplier address
- Skipped automatically for non-VAT-registered suppliers - no false negatives
- Production and sandbox environments - full dev/test parity
The same maths your bank runs.
The modulus algorithm validates that a sort code and account number combination is mathematically valid before any payment instruction goes anywhere. Same check the banking system itself does at the moment of payment - pulled forward to the moment of supplier setup.
- Official modulus tables - the UK banking validation algorithm
- Sort code resolved to bank name, branch title, address, town, postcode
- Always runs - sort code and account number are mandatory verification fields
- Retry logic - exponential backoff with three attempts on transient failures
- Catches typos before they reach the BACS file - saves the recall fee
Confirmation of Payee. Eleven outcomes, one verdict.
The Confirmation of Payee scheme is the same name-check banks run before processing your faster-payment instructions. Every possible outcome surfaced - match, close match, no match, switched account, account doesn't exist - with the action your team should take.
FS Foodservice Ltd
Account holder name and account type both match the bank's records exactly. Clean pass - payment can proceed.
Fresh Direct Ltd → "Fresh Direct Limited"
Near match. The bank suggests the registered account name is "Fresh Direct Limited" rather than "Fresh Direct Ltd". Most likely benign - Ltd vs Limited - but worth confirming before you send funds.
Joe's Kitchen Supplies
The account holder name does not match the bank's records. This is the classic fraud pattern - supplier identity stolen, bank details swapped. Do not pay. Verify with the supplier directly via a known-good phone number.
Metro Foods Ltd
Sort code passed modulus check, but the account number doesn't exist at that branch. Either a typo or a fabricated account. Either way - payment is blocked at the verification step, not at the BACS bounce two days later.
Quick Catering Ltd
The account has been switched to a new provider via the Current Account Switch Service. Old account is no longer the supplier's working account. Request the new bank details from the supplier before re-running verification.
Acme Trading
Name is close, but the account type doesn't match - bank has it as personal, supplier set up as business (or vice versa). Often a sole-trader configuration issue. Confirm with the supplier before paying.
Duplicate detection. Pre-flight validation.
Two checks that run before - and around - the four core layers. Stop duplicate suppliers from sneaking in and stop verification from kicking off when required fields are obviously missing.
Duplicate detection
Before verification runs, OmniPATH checks the supplier's company number and email against every other supplier in your organisation. Catches the same vendor entered twice with slightly different spellings - the silent data-quality killer.
- Match by company number - within your organisation only
- Match by email - within your organisation only
- Returns the existing supplier name, not just "duplicate detected"
- Runs on bulk import too - duplicates skipped with a per-row reason
Required-field check
If verification kicks off without the data it needs, you don't burn an API call to find out - you get a clear "this field is missing" error. The supplier is told exactly what's needed before the four layers run.
- Company number required for Companies House lookup
- Company name and address required for cross-reference
- Sort code and account number required for bank checks
- VAT number - optional; layer 02 skipped cleanly if absent
Verification gates the whole lifecycle.
Verification status is a hard requirement on the actions that move money. POs and payments are blocked at the platform level for unverified suppliers - there is no path around it.
From "trust them on faith" to "verified at every layer".
Most procurement platforms verify nothing. The good ones verify the company. OmniPATH verifies the company, the VAT registration, the bank account validity and the account holder's name - automatically, before the first PO.
- Company checks done manually - someone logs into the Companies House website
- VAT checked by phone or email to the HMRC helpline
- Bank details trusted on faith - no modulus or CoP check
- Duplicate suppliers slip through - same company entered twice
- Payment fraud possible - bank account doesn't belong to the named supplier
- No audit trail - who checked what, when and what the result was
- Companies House checked in real-time via API - active status, name, postcode
- HMRC VAT validated automatically - VRN lookup with name cross-reference
- Bank modulus check confirms sort code and account number are valid
- Confirmation of Payee confirms the account holder matches the supplier name
- Duplicate detection catches same company number or email within the org
- Full audit trail - every check, every result, every override logged and fraud-tagged
Ask LEDGE about the state of your verification.
Every verification attempt, every failure code, every override is in the audit log. LEDGE has the whole picture. Ask in plain English - it'll cite the specific suppliers, codes and timestamps.
The bits your IT and audit teams ask about.
Standard government auth, OAuth where applicable, licensed scheme participation for the bank checks, full audit logs and zero personal data sent to third parties.
Government auth
Companies House: Basic Auth API key. HMRC: OAuth 2.0, read:vat scope only.
Bank Verification
Licensed bank verification API. Confirmation of Payee enabled.
Retry & failover
Exponential backoff, 3 retries on transient failures. tenacity on bank checks.
Sandbox mode
Full dev/test support without real network calls or real keys. Deterministic fixtures.
Audit trail
Every attempt logged. Failures fraud-tagged. Full failure detail kept on supplier and audit log.
Notifications
Admin alerted on every verification failure - inline UI flag plus the channel of their choice.
Admin override
skip_checks requires Admin role. Logged as an audit event with reason and operator.
Minimal data out
Only company number, VRN, sort code, account number and account holder name leave the platform.
The practical details.
Does verification work for non-UK suppliers?
unverified state. International register integrations (Irish CRO, French SIRENE, etc.) aren't currently on the platform.How does this compare to Open Banking verification?
Does verification re-run automatically over time?
account_switched CoP outcome when payment time comes around (since CoP runs at payment time too in many setups), but supplier-side scheduled re-verification is not a feature today.What happens when a verification check fails?
verification_failed_at is timestamped. An admin notification fires immediately with the failure reasons. An audit event is created with the fraud=true flag set, so the failure shows up in fraud-tagged audit views and in LEDGE's fraud queries. The supplier remains in unverified state - POs and payments are blocked - until the issue is resolved or an Admin uses the skip_checks override (also audit-logged).Can I override a verification failure?
skip_checks flag forces the supplier into approved state without all four layers passing. Use cases: overseas suppliers (no Companies House record), sole traders without VAT registration, charities, edge cases. Every override is logged as an audit event with the operator and reason. LEDGE can pull the list of all skip-checks suppliers - useful periodic-review check for compliance teams.Does Confirmation of Payee work with all UK banks?
not_supported - we treat this as a pass (no failure) since there's no name-check available, but it's flagged in the audit trail so your finance team knows verification was less strict for that supplier. The other three layers run normally.What data leaves the platform during verification?
company_no (Companies House), vrn (HMRC), sort_code + account_no (bank modulus) and account_holder_name + account_type (CoP). Email, phone, contact names, addresses-other-than-the-postcode and any other personal data stays inside OmniPATH. The verification services themselves are subject to government and government retention policies - they do not share their request logs with us beyond the response data.Are sanctions, PEP or credit-risk checks included?
See verification in action.
Add a test supplier on the demo and watch OmniPATH check Companies House, HMRC, the bank modulus and CoP in under five seconds. Bring a real supplier from your existing list if you want - we'll redact the bank details on screen.