Purchasing · Supplier verification
Every supplier verified. Company, HMRC, bank account.
OmniPATH checks Companies House, HMRC VAT records, bank modulus and Confirmation of Payee in one automated pass, before any supplier can receive a purchase order or a payment. No spreadsheets. No phone calls. No guesswork.
The four-layer pass
Four government and banking-scheme checks. One automated pass.
Every UK supplier passes through Companies House, HMRC VAT, bank modulus and Confirmation of Payee in sequence, automatically, with a full audit trail, before the first PO or payment.
The four layers
The checks your auditors expect.
Each layer is a real-time call to a UK authority or banking scheme. Failures are stored as structured records, tagged as fraud-relevant and shown to your admin team straight away.
Layer 01
Companies House
Direct integration with the official Companies House API. Confirms the company exists, is active, the name matches (normalised) and the registered office postcode matches the supplier address. Flags a registered office in dispute.
Layer 02
HMRC VAT
A real-time lookup against HMRC’s VAT register. Validates the VAT number, then cross-references the registered name and postcode. Skipped automatically for suppliers without a VAT number, which is normal.
Layer 03
Bank modulus
The sort code and account number go through the UK modulus check, the same algorithm a bank runs at the start of a faster payment. Confirms the account number is valid for that sort code and returns the bank and branch.
Layer 04
Confirmation of Payee
The name check banks run before a faster payment. Confirms the account holder matches the bank’s records and detects switched, non-existent and opted-out accounts. The layer that stops fraud before money moves.
Companies House · layer 01
Five checks. One government API.
Every newly submitted supplier hits the same five checks against the official register. Failures land as structured records on the supplier, with code, message and field: auditable, exportable and defensible.
- Company number exists and is active in the register
- Status check: dissolved, liquidated and struck-off companies blocked
- Name match, with Ltd, Limited, case and spacing normalised first
- Postcode match: registered office against supplier address
- Address dispute flag on the registered office
Companies House lookup
Illustrative| Field | Result |
|---|---|
| Company number 03873787 | Found |
| Status active | Pass |
| Registered name FS Foodservice Ltd | Match |
| Registered office Buckingham · MK18 1HB | Match |
| In dispute false | Clean |
HMRC VAT · layer 02
VAT validated against HMRC’s live register.
OmniPATH calls HMRC’s VAT check API directly, with OAuth 2.0 and read-only VAT scope. Token refresh is managed automatically. It is the same lookup HMRC runs for VAT registration checks, embedded in your supplier flow.
- VAT number looked up against HMRC’s live register
- Registered name cross-referenced against the supplier name
- Registered postcode cross-referenced against the supplier address
- Skipped automatically for suppliers who are not VAT-registered
- Production and sandbox environments for testing
HMRC VAT lookup
Illustrative| Field | Result |
|---|---|
| VAT number GB 824 1962 47 | Valid |
| Registered name FS Foodservice Ltd | Match |
| Registered postcode MK18 1HB | Match |
| Scope read-only VAT | OAuth 2.0 |
Bank modulus · layer 03
The same maths your bank runs.
The modulus algorithm checks that a sort code and account number combination is valid before any payment instruction goes anywhere. The same check the banking system runs at the moment of payment, pulled forward to supplier set-up.
- Official UK modulus tables
- Sort code resolved to bank name, branch, address, town and postcode
- Always runs: sort code and account number are required
- Retries with exponential backoff on transient failures
- Catches typos before they reach the BACS file, saving the recall fee
Modulus check
Illustrative| Field | Result |
|---|---|
| Sort code 30-99-50 | Resolved |
| Account number 12345678 | Valid |
| Bank Lloyds Bank plc | Match |
| Branch Aylesbury · HP19 7QH |
Layer 04 · the fraud stopper
Confirmation of Payee. Every outcome, one verdict.
Confirmation of Payee is the same name check banks run before processing your faster payments. Every outcome is surfaced, with the action your team should take.
Match
FS Foodservice Ltd
The account holder name and account type both match the bank’s records exactly. A clean pass: payment can proceed.
Verified, proceed
Close match
Fresh Direct Ltd, registered as “Fresh Direct Limited”
A near match: the bank suggests the registered name is “Fresh Direct Limited”. Most likely benign, but worth confirming before you send funds.
Review the suggested name
No match
Joe’s Kitchen Supplies
The account holder name does not match the bank’s records. This is the classic fraud pattern: supplier identity stolen, bank details swapped. Do not pay. Check with the supplier on a known-good phone number.
Blocked, do not pay
Account does not exist
Metro Foods Ltd
The sort code passed the modulus check, but the account number doesn’t exist at that branch. Either a typo or a fabricated account: payment is blocked at verification, not at the BACS bounce two days later.
Blocked, check details
Account switched
Quick Catering Ltd
The account has moved to a new provider through the Current Account Switch Service, so the old account is no longer the supplier’s working account. Request new bank details before re-running verification.
Request new details
Type mismatch
Acme Trading
The name is close, but the account type differs: the bank has it as personal while the supplier is set up as business, or the other way round. Often a sole-trader set-up issue. Confirm before paying.
Check the account type
Illustrative examples of each outcome.
Bonus layers
Duplicate detection. Pre-flight validation.
Two checks that run before and around the four core layers: stop duplicate suppliers sneaking in, and stop verification starting when required fields are missing.
Within your organisation
Duplicate detection
Before verification runs, OmniPATH checks the supplier’s company number and email against every other supplier in your organisation, catching the same vendor entered twice with slightly different spellings.
- Match by company number
- Match by email
- Returns the existing supplier name, not just “duplicate detected”
- Runs on bulk import too, with a reason per skipped row
Pre-flight
Required-field check
If verification starts without the data it needs, you don’t burn an API call to find out: you get a clear “this field is missing” message before the four layers run.
- Company number for Companies House
- Company name and address for cross-reference
- Sort code and account number for bank checks
- VAT number optional: layer 02 skipped cleanly if absent
Procurement flow gating
Verification gates the whole lifecycle.
Verification status is a hard requirement on the actions that move money. POs and payments are blocked at platform level for unverified suppliers, with no path around it.
| Action | Requires a verified supplier? |
|---|---|
| Create supplier | No: anyone can create a draft |
| Submit for approval | No: verification is recommended first |
| Approve supplier | Recommended: unverified suppliers are flagged |
| Place an order or create a PO | Yes: blocked if not verified |
| Make a payment | Yes: blocked if not verified |
| Sync to Xero, QuickBooks or Sage | Yes: verified suppliers only |
Before and after
From “trust them on faith” to “verified at every layer”.
Most procurement platforms verify nothing. The good ones verify the company. OmniPATH verifies the company, the VAT registration, the bank account and the account holder name, automatically, before the first PO.
Default state for most procurement tools
Without OmniPATH verification
- Company checks done by hand on the Companies House website
- VAT checked by phone or email to HMRC
- Bank details trusted on faith, with no modulus or name check
- Duplicate suppliers slip through
- Payment fraud possible: the bank account doesn’t belong to the named supplier
- No audit trail of who checked what, when and with what result
Four layers, audit-trailed
With OmniPATH verification
- Companies House checked in real time: active status, name and postcode
- HMRC VAT validated automatically, with a name cross-reference
- Bank modulus check confirms the sort code and account number
- Confirmation of Payee confirms the account holder matches the supplier
- Duplicate detection on company number and email
- Every check, result and override logged and fraud-tagged
LEDGE and verification
Ask LEDGE about the state of your verification.
Every verification attempt, failure code and override is in the audit log. Ask in plain English and LEDGE cites the specific suppliers, codes and time stamps.
- Ask LEDGEHow many suppliers are still unverified?
- Ask LEDGEShow me all verification failures this month.
- Ask LEDGEWhich suppliers failed Confirmation of Payee checks?
- Ask LEDGEList suppliers verified with a skip-checks override.
- Ask LEDGEAre there any duplicate company numbers across our supplier base?
- Ask LEDGEWhich suppliers had their bank account switched in the last 30 days?
Security and controls
The bits your IT and audit teams ask about.
Standard government authentication, OAuth where it applies, a licensed bank verification service, full audit logs and minimal data sent out.
Government authentication
Companies House: API key. HMRC: OAuth 2.0 with read-only VAT scope.
Bank verification
A licensed bank verification API with Confirmation of Payee enabled.
Retry and failover
Exponential backoff with three retries on transient failures.
Sandbox mode
Full development and test support without real network calls or real keys.
Audit trail
Every attempt logged, failures fraud-tagged and full detail kept on the supplier record.
Notifications
Admins alerted on every verification failure, inline and on the channel of their choice.
Admin override
Skip-checks requires the Admin role and is logged with the reason and operator.
Minimal data out
Only company number, VAT number, sort code, account number and account holder name leave the platform.
Questions
The practical details.
Does verification work for non-UK suppliers?
Not today: all four layers are UK-specific. Companies House is the UK register, HMRC VAT covers UK VAT registrations only, the modulus check uses UK sort code tables and Confirmation of Payee checks UK account holder names. Overseas suppliers can still be created and managed in OmniPATH; verification just doesn’t run and the supplier stays unverified. International registers aren’t on the platform yet.
How does this compare to Open Banking verification?
It’s not Open Banking. It’s the Confirmation of Payee scheme, the same name check banks use during faster-payment processing. Open Banking is a different protocol for account information and payment initiation by consent. Confirmation of Payee is built for “is this account name who I think it is?” and needs no supplier-side consent flow, which makes it the right fit for procurement.
Does verification re-run automatically over time?
Verification is point-in-time, not continuous. It runs when a supplier is created or submitted, and again on demand when you click Verify. There is no scheduled re-verification today: companies can be dissolved, VAT registrations cancelled and bank accounts switched after the check.
What happens when a verification check fails?
The full failure detail is stored on the supplier: code, message and the field that caused it, with a time stamp. An admin notification fires straight away and an audit event is created with a fraud flag, so the failure shows in fraud-tagged audit views and in LEDGE’s fraud queries. The supplier stays unverified, with POs and payments blocked, until the issue is fixed or an Admin uses the skip-checks override.
Can I override a verification failure?
Yes, with the Admin role only. Skip-checks moves the supplier to approved without all four layers passing. Use it for overseas suppliers, sole traders without VAT registration, charities and other edge cases. Every override is logged with the operator and reason, and LEDGE can list every skip-checks supplier for periodic review.
Does Confirmation of Payee work with all UK banks?
Most major UK banks take part in the scheme, including Lloyds, Barclays, HSBC, NatWest, Santander and Nationwide. Some smaller institutions and building societies haven’t enrolled. When a supplier’s bank isn’t a participant, the layer returns not supported: we treat that as a pass, but it’s flagged in the audit trail so finance knows the check was less strict. The other three layers run normally.
What data leaves the platform during verification?
Only the fields the checks need: company number (Companies House), VAT number (HMRC), sort code and account number (modulus) and account holder name and type (Confirmation of Payee). Email, phone, contact names, addresses beyond the postcode and other personal data stay inside OmniPATH.
Are sanctions, PEP or credit-risk checks included?
No, and we don’t claim them. The four layers cover company existence, VAT validity, bank account validity and account holder match. Sanctions screening and credit-risk scoring are separate kinds of due diligence and aren’t part of the platform today. Some customers run those externally and import the result; we’re happy to discuss native integrations if there’s demand.
See verification in action. Bring a supplier. We'll verify it live.
Add a test supplier in the demo and watch OmniPATH check Companies House, HMRC, the bank modulus and Confirmation of Payee. Bring a real supplier from your list if you like: we'll redact the bank details on screen.
No minimum term · UK-based support