The Bankability Foundation: The Underwriting Algorithm Nobody Talks About (2026)

1. Why Bankability Is an Algorithm (Not a Checklist)

Fifteen years ago, a small business owner walked into a local bank, sat across from a loan officer, showed tax returns and bank statements, and the officer used judgment — along with a credit score — to decide. That world is mostly gone. In 2026, even the warmest community bank uses an automated underwriting stack that runs your application through Middesk, Baselayer, DealHub360, Cobalt Intelligence, or Heron Data before a human ever sees the file.

The shift happened in three waves. The 2008 financial crisis forced banks to systematize risk scoring because regulators required defensible, auditable decisions. The 2010–2019 fintech wave (Kabbage, OnDeck, Bluevine) proved that automated underwriting could approve loans in minutes using bank-transaction data and alternative signals. By 2020, the KYB (Know Your Business) verification layer matured — Middesk, Cobalt, and Baselayer productized what used to be manual due diligence. By 2026, these platforms are baseline infrastructure. Your application is a vector. Every field on the form, every piece of metadata the lender can pull, contributes a score.

The Underwriting Stack You're Actually Being Scored Against

Here's what a modern business lender's data pipeline looks like when you hit "submit" on an application. This is not hypothetical — it's documented directly in these platforms' marketing materials to lenders.

The Composite Score: No Single Factor Kills You

Here's the part most advisors get wrong: bankability is not a pass/fail checklist. It's a composite score, very similar in design to a personal FICO. A 720 personal FICO doesn't come from any single thing — it's built from payment history, utilization, account age, mix, and inquiries, weighted and aggregated. Business bankability works the same way. No single foundation signal (except for a couple of hard-stops like "dissolved SOS status") automatically denies your application. But stacks of weak signals do.

Think about it from the underwriter's perspective. The algorithm sees an applicant with a Google Voice number, a Wix-subdomain website, an @gmail.com email, a brand-new iPostal1 address, no D-U-N-S number, and a 14-day-old business bank account. Each item alone is approvable — people get approved despite any one of these. But together? The applicant has painted a story. The story is "I filed an LLC last month, I'm applying for capital, nothing about this business has operational depth." That's a cluster of FTC Red Flags Rule signals, and it triggers either outright denial, manual review, or a lower approved limit with a mandatory personal guarantee.

The "Story" Metaphor: Why Lenders Think This Way

Lenders are not trying to catch you. They're trying to measure risk. The USA PATRIOT Act (Section 326) and FinCEN's Customer Identification Program rule at 31 CFR § 1020.220 require banks to establish customer identity — including for businesses, a "principal place of business, local office, or other physical location." Fraud prevention is not a nice-to-have; it's a legal mandate. And the business applicant who cannot demonstrate any operational depth is indistinguishable, from the automated system's perspective, from a synthetic identity or fraud shell.

So when we talk about "the foundation," we're really talking about "the signals that let the algorithm conclude you're a legitimate operating business, not a synthetic identity or a last-week shell." The more of those signals you have, the higher your story score. Bankability is like credit scoring for businesses — a composite score built from dozens of signals. You don't need a perfect score to get approved, but every point matters when you're stacking 5–7 cards for $200K+ in funding.

2. The Phone Number Problem — VOIP Is Silently Killing Applications

If the foundation has a single most-underestimated layer, it's the phone number. Business owners treat phone selection as a pure cost/convenience decision — Google Voice is free, Grasshopper is $29/month, a real carrier mobile line is $50+. What they don't realize: the number they pick becomes a foundational bankability input. Every lender runs a carrier lookup, and every carrier lookup returns a line type. If that line type is "nonFixedVoip" or even "fixedVoip" in some cases, you've handed the underwriter a data point.

How Lenders Detect VOIP — The Technical Layer

When a lender receives a business application, the phone number is — either in real time or during overnight batch processing — run through one or more carrier intelligence APIs. These return a standardized classification: mobile, landline, fixedVoip, nonFixedVoip, tollFree, or unknown. Detection is fast, cheap (typically under $0.01 per lookup), and accurate.

The major data sources lenders use:

• Twilio Lookup v2 API — The dominant carrier-intelligence service for U.S. fintechs. Returns line type plus the carrier name. Twilio's own developer tutorial walks through how to flag and alert on fixedVoip vs. nonFixedVoip classifications.
• Telnyx Number Lookup — Returns line_type: "voip" with spid_carrier_type: "3" for VoIP carriers.
• Bandwidth Dynamic Number Intelligence — Returns line type, voice carrier, messaging carrier.
• LERG (Local Exchange Routing Guide) — The monthly-updated master database of North American Numbering Plan resources. Identifies the carrier that controls each NPA-NXX (area code + prefix).
• LRN (Local Routing Number) — Critical for ported numbers. When a phone number has been ported between carriers, the LRN identifies the current routing carrier, not the original one, which is why NPA-NXX lookup alone fails for VOIP detection per Trestle.
• FCC 47 CFR § 9.3 — The regulatory definition of "Interconnected VoIP Service," which is what determines fixed vs. non-fixed classification.

Fixed VOIP vs. Non-Fixed VOIP — The Distinction That Matters

Not all VOIP is equal. This distinction is poorly understood and matters enormously.

• Non-fixed VOIP: Numbers assigned without a registered physical address. Google Voice, Skype, MagicJack, most developer-platform numbers (Twilio test numbers). Per Bandwidth, these can be activated from anywhere and are the highest fraud risk in lender eyes.
• Fixed VOIP: VOIP service tied to a specific physical address (for 911 E911 routing). Business VOIP from Ooma, Nextiva business plans, Spectrum Business, Comcast Business. Better than non-fixed, but still VOIP in the classification returned to the lender.
• Mobile / Landline: Traditional cellular or POTS (Plain Old Telephone Service) copper. These return cleanly in carrier lookups and carry no VOIP flag at all.

The practical takeaway: if your carrier lookup result returns anything containing "VoIP" — fixed or not — you're giving the underwriter a flagged data point. Fixed VOIP is better than non-fixed VOIP, but it's not as clean as a mobile or landline result.

Lender-by-Lender VOIP Policy Breakdown

The VOIP Provider Reference Table

Every major consumer and business VOIP service, and how carrier lookups classify them:

One critical note about underlying carriers: Twilio, 8x8, RingCentral, Vonage, Grasshopper, and many others all source their numbers from Bandwidth.com. When a carrier lookup returns "Bandwidth.com" as the carrier name — and sophisticated underwriters know this — it's a VOIP tell regardless of which consumer brand layers on top. Google Voice specifically returns as "Google Voice Grandcentral SVR" via Bandwidth with line type nonFixedVoip.

The "Clean" Phone Options

The cleanest results from carrier lookups come from:

The hierarchy from best to worst, as underwriters see it: landline > mobile > fixed VOIP > non-fixed VOIP. The difference between a $0/month Google Voice number and a $50/month AT&T Business mobile line, in underwriting outcome terms, can be the difference between approved and denied — or the difference between a $35K limit and a $12K limit on the same card product.

How to Check Your Own Number

Before you apply for anything, run your current business number through a carrier lookup and see what a lender sees. Free tools:

• IPQualityScore Free Carrier Lookup — Returns line type and carrier instantly.
• Data247 Carrier247 — Returns M/L/V for mobile/landline/VOIP.
• Whitepages reverse lookup — Less definitive but shows carrier information.
• Twilio Lookup (API account required) — Authoritative; shows you the exact string an underwriter's system would receive.

If any of these return "voip," "nonFixedVoip," "Bandwidth.com," or "Google Voice Grandcentral SVR," that's exactly what the underwriter's carrier-lookup API returns. Fix before you apply.

Porting and Timelines

You can port a Google Voice or VOIP number out to a real mobile carrier, but the process has gotcha's. Per porting guides, typical timelines: mobile-to-mobile is 1–3 business days; landline-to-mobile is 5–10 business days; VOIP-to-mobile is typically 3–7 days. Google Voice specifically charges a $3 fee to port out and has its own documented nuances.

Our recommendation in most cases: don't port. Get a fresh number on a real carrier. Build directory listings under the new number. The old VOIP number was likely used in places you don't want the credit file associated with — keep a clean separation.

3. The Business Address Problem — CMRA, Virtual Offices & The Database Flag

The business address is the most complex bankability factor — and the one where most advisors give outright wrong advice. The single worst piece of advice floating around the business credit community is: "Just add a suite number to your virtual address and the bank won't know." In 2024–2026, that advice is dead. USPS launched the CMRA Customer Registration Database in January 2024, and every downstream address validator — Melissa Data, LexisNexis, SmartyStreets — now returns the CMRA flag as a structured data field. Cosmetic address changes do not defeat it.

The Address Type Hierarchy

Every physical address falls into a category. Here's how banks actually rank them, from best to worst:

How Lenders Detect Address Types

Address classification isn't a judgment call by a human underwriter. It's a database lookup. Four tools matter:

Why Cosmetic Changes Don't Defeat the CMRA Flag

The old trick: take an iPostal1 address at "123 Main St., Suite 200" and change it on your bank application to "123 Main St., #200" or "123 Main St., Unit 200." The theory was that the bank's address validator would treat it as a different address. This doesn't work.

USPS CMRA flagging is keyed to the building's delivery point, not the specific mailbox number. Once a building is registered as a CMRA in the Customer Registration Database, every suite number within that building returns the CMRA flag. Changing "Suite 200" to "#200" to "Unit 200" changes nothing in the underlying data — and in most cases, address validators normalize these variations to the same canonical form anyway.

Form 1583 — The Paper Trail That Creates CMRA Status

USPS Form 1583 is the "Application for Delivery of Mail Through Agent" — it's the federally-required authorization that allows a CMRA to handle your mail. Every legitimate virtual mailbox provider requires Form 1583 because the federal code mandates it. Per Stable's breakdown, Form 1583 creates the formal CMRA relationship — and that relationship is what gets cataloged in the USPS Customer Registration Database. Two forms of ID, notarization, and USPS filing. That is the paper trail the USPS CMRA database is built on.

The implication: you cannot "unsign" Form 1583 to undo CMRA status on an address. The address will remain CMRA-flagged for anyone using it.

Lender-by-Lender Address Policy Breakdown

Virtual Office Provider Analysis

Not all virtual office providers are equal. Some operate real commercial buildings with physical staff and walk-in capability; others are pure mail-forwarding operations. Here's how each major provider sorts:

A critical note on Alliance Virtual Offices: their marketing prominently positions the service as "bank-approved." In their own marketing, they claim alignment with SBA address requirements. That claim does not accurately reflect SBA site visit requirements. Some Alliance locations are genuinely non-CMRA real commercial buildings; others have been flagged. Always verify before using.

The Patrick Method — Call the Bank Before You Apply

Here's the single best piece of advice in this entire guide: call the bank and ask about the specific address before you apply. Not the generic "do you accept virtual addresses" question — the specific one: "My business address is [exact address]. Will this pass your address verification?" Banks want to answer. They'd rather tell you "no, that address won't work" over the phone than spend two months processing your application and then decline. And if they say yes, get it noted in your file.

The Three-Address Best Practice

The cleanest setup for a modern small business keeps three address identities distinct but consistent:

• Personal address — your home, used for your personal accounts and personal ID. Never used for business unless the business is home-based and fits the home address profile.
• Business physical address — either your home (for legitimate home-based businesses) or a real commercial lease/suite. This is the address on your bank account, loan applications, EIN letter, and SOS filing.
• Business mailing address — optional. A virtual mailbox can be used strictly for mail receipt (contracts, checks, correspondence) without being the address of record anywhere else. Amex explicitly supports this separation.

The mistake most business owners make is using a single virtual address for all three roles. That's the profile that triggers fraud flags. Segmenting is what a real operating business does.

Address Consistency Across Records — The 5-Point Match

Whatever address you use, it must match across your five core records: Secretary of State filing, IRS EIN letter, business bank account, 411 directory listing, and Google Business Profile. Automated underwriting pulls all five and cross-references. Inconsistencies — even small ones like "Ave" vs. "Avenue" or "Suite 200" vs. "#200" — can trigger a manual review flag. Normalize before you file.

When the Home Address Is the Right Answer

Home addresses are more accepted in 2026 than they were pre-2020. COVID normalized remote work, and banks updated their risk models accordingly. If you operate a home-based LLC — consulting, SaaS, e-commerce, creative services, coaching — using your home address on your bank account and credit applications is both common and clean. The condition: your business type must plausibly operate from a residence. Per Nav's interview with Funding Circle's Director of Underwriting: "A home address is OK as long as the address makes sense for your type of business."

The public-privacy tradeoff: if you use your home address as the SOS principal office address, it becomes publicly searchable in the SOS database. Many states offer a workaround — using a registered agent for service but keeping your home address as your internal records address. Others don't. If privacy is a real concern, the Regus/WeWork solution above is the cleanest.

4. The Digital Footprint — Website, Domain Age, SSL

Do lenders actually check your website? Yes. Unambiguously. DealHub360's loan origination platform explicitly verifies two things on every application: (1) whether the business website is live, and (2) whether the website name matches the business name on the application. Any mismatch is flagged for manual review. Baselayer's SMB risk rating cross-references the domain creation date against the business formation date as a core scoring input. This is not a judgment call by a human; it's structured data in an underwriting pipeline.

What Lenders Actually Verify

WHOIS and Domain Age — The 90-Day Threshold

WHOIS is the public record of every domain registration — when it was registered, who registered it (unless privacy protection is used), and where it's hosted. Every underwriting system that cares about domain age can pull WHOIS data in milliseconds. The generally documented rule-of-thumb: a domain registered within the last 30 days is a red flag. 30–90 days is borderline. 90+ days is in the safe zone.

Per Upsonic's legitimacy check reference: "Newly registered domains under 90 days old raise red flags." Nav's own guide to checking loan company legitimacy uses the same criteria — which is exactly what lenders apply to borrowers: "A brand-new domain — especially one registered in the past year — is often a red flag."

The cross-reference that matters: if your application claims three years in business and your WHOIS shows the domain was registered last month, that's a credibility mismatch. Automated systems catch this. Human underwriters catch this. The rule: register your domain the day you file your entity — ideally earlier. The domain should age alongside the business record.

SSL / HTTPS — Not Optional in 2026

A business website without SSL in 2026 is a flag. Browsers display "Not Secure" warnings on HTTP sites. The FTC's Red Flags Rule implies secure data handling as a baseline. Per UK Start Up Loans, "It's a legal requirement for any business website that requests and captures data from visitors to install an SSL certificate." SSL is free via Let's Encrypt and baked into Cloudflare, Shopify, Squarespace, Wix, and every mainstream hosting platform. There is no legitimate reason to run an HTTP site.

Per GoDaddy's 2026 SSL update, Google and the CA Browser Forum mandated shorter SSL validity periods beginning March 2026, reducing to 47-day cycles by 2029. Businesses must configure auto-renewal. An expired SSL certificate appears to underwriting systems exactly the same as "no SSL at all."

What a Legitimate Business Website Looks Like

From an underwriter's perspective, a legitimate site has:

• Home page — clearly describes what the business does
• About page — company history, ownership, mission
• Contact page — phone, email, physical address (must match the application)
• Services or Products page — what you actually sell
• Custom domain — yourbusiness.com, not yourbusiness.wix.com or yourbusiness.wordpress.com

Website Builders — Are They Acceptable?

Yes. The platform — Wix, Squarespace, WordPress (self-hosted), GoDaddy Website Builder, Webflow, Shopify — does not matter to lenders. What matters: (1) you own the custom domain, (2) SSL is active, (3) content is professional and matches the stated business. Squarespace itself offers business loans via Squarespace Capital through a partnership with Stripe — which alone demonstrates that a Squarespace-hosted site does not disqualify a business from lending.

Social Media vs. Website

A social media profile — Facebook, Instagram, LinkedIn — does not substitute for a dedicated business website in traditional lending. A LinkedIn page alone won't satisfy DealHub360's website check. However, fintech lenders (Sun Finance via SEON, OnDeck, Kabbage/AmEx) supplement website checks with broader online presence signals. A strong social presence — LinkedIn Company Page, active Facebook page, Instagram with business content — can partially compensate for a minimal website at fintechs. Not at banks.

5. Business Email — @gmail.com Is Losing You Points

This one is cheap to fix and expensive to ignore. Every major authoritative source confirms: using a generic @gmail.com, @yahoo.com, @hotmail.com, or @aol.com email address on a business credit card or loan application is a scored negative signal. Ramp's own business credit card application guide states directly: "Applying with a Gmail or Yahoo address instead of a business domain can raise red flags. If you don't have a company email, it's worth setting one up before you apply."

Neo Mail's loan application guide puts it even more bluntly: "Lenders will use this official email address to verify your business's identity. This is important to prevent fraud or misinterpretation in the loan application process."

The Cheapest Foundation Upgrade Available

$6 per user, per month. That's the price of Google Workspace Business Starter. Point your domain's MX records at Google, create hello@yourbiz.com or your-name@yourbiz.com, and you've just upgraded your bankability. There is no reason — other than pure inertia — for any business applying for credit to use a free Gmail address.

One common trap: forwarding yourbiz@gmail.com to a custom-domain alias doesn't count. The email you send from — the "From" field the lender receives — must be the custom domain. Set up Google Workspace or a comparable service and actually send from @yourbiz.com.

Email Consistency

The email domain should match your website domain exactly. If your website is acmeconsulting.com, your email should be @acmeconsulting.com — not @acmeconsulting.net, not @acme-consulting.com, not @acmellc.com. Automated systems compare these fields and flag mismatches. It's a small thing. It's also a zero-cost thing to get right.

6. Directory Listings — The 411 Strategy

Directory listings are the foundation layer business owners most often dismiss — "nobody uses 411 anymore." That dismissal is correct about consumer behavior and dead wrong about underwriting behavior. Synchrony Bank, which underwrites business credit lines for Lowe's, Conoco Phillips, JCPenney, and many other retailer-branded cards, is documented as checking 411 directory assistance as part of their approval process for starter vendor tradelines. A business that can't be found via 411 appears transient. A business that can adds one more consistency signal.

411 Listings — Free and Fast

The national 411 directory assistance database is populated from multiple aggregators. A business with a traditional landline from a local phone company is added automatically. Businesses using VoIP or mobile must add themselves. The easiest free path is ListYourself.net, which offers individual listings at no cost. Regional or national distribution tiers cost $25–$100/month for broader coverage.

Verification is typically automated: a call to your listed number delivers a code, you enter it on the portal, and the listing goes live within 5–14 days across the national directory system.

Google Business Profile — The Single Most Important Listing

If you do one directory-layer thing, make it Google Business Profile (formerly Google My Business). Verified GBP is now effectively required for most service businesses. Why it matters to underwriting:

• It's the primary third-party-verified address anchor for your business
• Google verifies the address via postcard, phone call, video, or email
• DealHub360 and other AI underwriting systems automatically cross-reference GBP name, address, phone, and category against the application
• A verified GBP appearing in Google Maps is a direct, cheap signal of operational reality

The Complete Directory Stack

NAP Consistency — The Non-Negotiable

NAP = Name, Address, Phone. Across every directory listing, these three fields must match exactly. Heron Data's verification service reviews 10–15 online sources per business, with specific flagging for inconsistent NAP. Your legal business name (matching EIN), your physical business address (matching SOS filing), and your business phone number (matching bank records) should appear identically on every directory. "ABC Consulting LLC" is not "ABC Consulting, LLC" is not "ABC Consulting L.L.C." Different strings. Normalize before publishing.

LinkedIn Company Page

Per Entrepreneur magazine, mortgage lenders have begun checking LinkedIn as part of borrower verification. Kevin Leibowitz, President/CEO of Grayton Mortgage, stated: "It can give a clearer picture as to the job history, description, length of employment, locale, etc." For business lending, LinkedIn Company Pages are cross-referenced for business size, founding year, industry, and employee count. The LinkedIn Verified Company Pages program adds another third-party credibility layer.

A LinkedIn Company Page claiming founding year 2024 doesn't match an application claiming five years in business with a 2020 SOS filing. That inconsistency will be investigated. Keep LinkedIn current.

Propagation Timelines

Directory listings don't appear in underwriting data instantly. General propagation timelines:

• Google Business Profile — verification can take 5–14 days (postcard method); instant with phone/video verification
• 411 / ListYourself — 5–14 days for national propagation
• Yelp — instant claim; listing appearance same day
• Bing Places — 2–5 days for verification
• BBB — 1–2 days for listing; accreditation longer
• Data aggregator propagation (DataAxle, Localeze, Factual) — 30–60 days to reach all downstream consumers

The rule: set up your directories a minimum of 30 days before applying. Sixty is better. This gives the data ecosystem time to catch up and ensures that when the underwriter's system cross-references, everything matches.

7. Secretary of State Compliance

The Secretary of State (SOS) record is the foundational document of your business identity. It's where your legal business name, entity type, formation date, registered agent, and principal office live. Every KYB platform — Middesk, Cobalt Intelligence, Heron Data — pulls SOS data at the start of every verification. Cobalt Intelligence verifies SOS status across all 50 states in approximately one second per lookup.

Active vs. Inactive — The Hard Stop

This is the only foundation factor that is a genuine, categorical hard stop. A business that is dissolved, revoked, or suspended in its state of registration cannot legally enter into loan agreements in most jurisdictions. Every lender checks SOS status before funding. An "inactive" status auto-declines every legitimate bank product.

Common reasons businesses lose good standing, per Starfield & Smith attorneys:

• Failure to file annual reports (required in most states)
• Failure to maintain a registered agent in the state
• Failure to pay state fees or franchise taxes
• Administrative dissolution due to inactivity

Certificate of Good Standing

A Certificate of Good Standing (also called Certificate of Existence) is issued by the SOS and confirms: the business is registered, not in default of corporate rules, not suspended, and current on taxes and fees. For SBA loans, it's explicitly mandatory — per Starfield & Smith, "A 7(a) lender that proceeds without a valid Certificate of Good Standing violates the Loan Authorization's express requirements, potentially jeopardizing the loan guaranty." A historical example: during the PPP rollout, dormant businesses generated "Hold Code 506" errors that traced back to SOS status mismatches.

Registered Agent — Separate From Business Address

On your SOS filing, the registered agent's address and the principal office address should be different. Using a registered agent service (Northwest Registered Agent, LegalZoom, Incfile) for both creates a "shell company" flag in automated underwriting. Banks recognize registered-agent-only addresses — they're cataloged as such in LexisNexis and Middesk databases. The registered agent address is for legal service of process; your business needs its own physical address for bankability.

DBA Filings and Name Consistency

If you operate under a "doing business as" (DBA) name different from your legal entity name, the DBA must be properly filed with your state or county. Banks require both: your legal entity name and any registered DBA. An unfiled DBA that appears on your website, business cards, or Google Business Profile but not on your SOS record creates a naming inconsistency the algorithm catches.

8. IRS EIN Verification

The EIN (Employer Identification Number) is your business's federal tax identifier. It's issued by the IRS after you file Form SS-4, and it's what banks, lenders, credit bureaus, and vendors require to verify your business exists as a federal tax entity. Two documents matter: the original CP 575 letter (issued on EIN creation) and the 147C letter (replacement verification).

CP 575 — The Original, Usually Lost

The CP 575 is the IRS's one-time original EIN confirmation. It's sent to the address used on Form SS-4 within approximately four to five weeks of EIN issuance. It shows the 9-digit EIN, the business name exactly as recorded with the IRS, and the mailing address. Banks prefer it, along with the Articles of Organization, as the cleanest EIN verification document.

The problem: most business owners lose it. CP 575 is not reissued by the IRS. Once you lose it, your only replacement path is the 147C.

147C — The Replacement

The IRS Letter 147C is the official replacement EIN verification. It carries identical legal weight to the CP 575. Banks accept either. To request one:

1. Call the IRS Business & Specialty Tax Line: 1-800-829-4933
2. Follow the phone tree: Option 1 (English) → Option 1 (EIN) → Option 3 (already have EIN, can't remember it)
3. Request delivery by fax (immediate) or mail (4–6 weeks)
4. Only the business owner, authorized officer, or Power of Attorney can request

Per Stripe's documentation, the 147C is specifically what Stripe requests when their TIN/name matching service fails to verify an applicant. If your EIN name doesn't match exactly what's on file at the IRS, your Stripe or payment processor application gets held.

Name Control Matching — The 4-Letter Code

The IRS uses a four-letter "name control" code derived from the legal business name on file. When your bank or a payment processor (Stripe, PayPal, Square) runs an IRS name-match check, they're verifying your submitted name against this name control. Per the IRS name control guidance, the rules are strict: capitalization, special characters, ampersands, and word order all matter.

Common naming issues that bounce applications:

• Registered with IRS as "ACME LLC JOHN SMITH SOLE MBR" but applicant writes "Acme LLC" on application
• DBA name used instead of legal entity name
• Ampersand (&) vs. spelled-out "and"
• Punctuation variations (commas, periods)
• Spelling differences between SOS filing and EIN filing

How Lenders Verify EIN

The IRS does not provide a public EIN lookup. Lenders verify via: (1) IRS Form 4506-C for tax transcript requests (submitted directly to IRS by the lender), (2) IRS Form 8821 for tax information authorization, or (3) third-party KYB platforms like Middesk that maintain direct IRS connections. Per LendingTree's Chase Business Loans review, Chase specifically requires "Tax transcripts, including 4506-C or 8821" as part of loan documentation.

9. D-U-N-S Number and D&B Profile

The D-U-N-S Number (Data Universal Numbering System) is a unique 9-digit business identifier issued by Dun & Bradstreet. It's the primary key to your D&B business credit file. Without a D-U-N-S, D&B cannot calculate a PAYDEX score on your business, and the vast majority of institutional lenders and government contracting programs require one.

Getting a Free D-U-N-S

A D-U-N-S is free. Apply at dnb.com/duns-number.html. Standard processing: up to 30 business days. Expedited processing: paid, faster. The free application is all most business owners need.

The Complete D&B Profile

Once you have a D-U-N-S, complete your D&B profile fully. Every field matters for bankability. Underwriting systems scrape D&B data for: legal business name, DBA, address and phone, number of employees, annual revenue (self-reported), year founded, SIC/NAICS codes, and the suite of D&B scores.

D&B Scores That Matter

To generate a PAYDEX, D&B requires a minimum of 2 tradelines with at least 3 payment experiences. This is the baseline data volume needed before any scoring is possible. See our complete guide to Net-30 vendor accounts for how to build the tradelines that generate PAYDEX.

Trade References

D&B is the only major business credit bureau that allows manual trade reference submission. This is done through D&B's paid CreditBuilder program. What counts as a trade reference: vendors/suppliers you pay on net terms. What doesn't count: banks, credit card companies, landlords, foreign companies, companies with anonymity requests, companies legally related to yours, or companies without their own D&B file. Per Nav's trade reference guide, minimum three trade experiences from at least two separate creditors are required before a PAYDEX score is calculated.

The $1.5M Loan Case Study

A real-world example illustrates why D&B matters even when you don't think it does. Per Visbanking, a $1.5M commercial loan application with strong submitted financials was fundamentally changed when the D&B pull revealed: a PAYDEX of 75 (payments averaging 15 days past terms) and a parent company with recent high-value judgments that the applicant had not disclosed. The deal's risk profile was completely rewritten by the D&B data.

Why D&B Matters Even for Business Credit Cards

Amex specifically pulls D&B data on business card applications. Chase, BofA, US Bank, and virtually every BLOC/SBA lender references D&B for larger approvals. A business owner who says "I don't need a D-U-N-S for my Chase Ink application" is not wrong on the surface — Chase Ink can approve without one — but limits itself to the floor of the approval range. For the ceiling, a complete D&B profile with a clean PAYDEX is foundational.

10. Business Bank Account Age & History

Per Nav's survey of small business owners: 70% of business owners WITHOUT a business bank account were rejected for financing. The bank account isn't sufficient for approval — it's necessary. Applying for business credit without one is applying at the floor.

Minimum Age Requirements by Loan Type

Chase's Existing Relationship Preference

Chase specifically prefers existing relationships for most business loan products. An active Chase business checking or savings account improves approval odds and relaxes other requirements. The Credit People's Chase loan requirements guide states: "Strengthen your relationship with Chase. Maintain a healthy balance in your Chase business checking account and use Chase credit products responsibly." For products under $500K, Chase generally expects 24 months in business (same majority ownership). Exceptions exist for strong financials or large loan requests.

What Lenders Actually Review

When you submit bank statements (typically 3–6 months), underwriters look at:

• Average daily balance — consistent positive balance, no extended near-zero or negative periods
• Deposit activity — regular monthly deposits matching stated revenue
• Deposit count — 3–5+ deposits per month showing active operations
• DSCR (Debt Service Coverage Ratio) — annual net operating income ÷ total annual debt payments; below 1.25x raises flags
• Sudden pattern changes — accounts opened one month before application with sudden large deposits look synthetic

Many alternative lenders want to see a minimum annual revenue of $50,000–$100,000 consistently deposited in the business account. Fintechs like Kabbage/AmEx connect directly to the business bank account via Plaid or similar APIs for real-time transaction analysis, bypassing paper statements entirely.

Why Opening the Account BEFORE You Apply Matters

Even if your business bank account sits empty for 30 days before your first credit application, the account existing is a positive signal. A brand-new account opened the day after EIN issuance with no transaction history and no established relationship is a different signal from an account 30–60 days old with at least a few deposits. The sequence we recommend: open the business bank account immediately after EIN issuance. Run 3–5 real transactions through it — even small ones. Wait 30–60 days minimum. Then apply.

11. Business Credit Profile

Every major business bureau scores your file differently, and every lender pulls from a different set of bureaus. The foundation isn't "have a business credit score" — it's "have a scoreable file at each of the major bureaus." Most business owners don't realize they have three separate business credit files (D&B, Experian Business, Equifax Business) plus a combined SBA score (FICO SBSS). Thin files in any of these cap your approvals.

The Four Scores That Matter

A few nuances worth calling out:

• The average Experian business credit score is 62 — meaning the typical small business falls in the "medium risk" band. Getting into the 76+ "low risk" band is genuinely differentiating.
• Equifax Business Delinquency Score starts low for brand-new businesses (zero history) and drifts lower automatically after 12 months of dormancy. Fresh tradeline activity pulls the score up.
• FICO SBSS combines personal credit + business credit + business history + cash flow into a single score used by the SBA for 7(a) pre-screening. It's weighted heavily toward the personal credit profile of the guarantor.

Tradeline Minimums to Generate Scores

Tier 2 vendor approval (net-30 vendor accounts at real suppliers, not just starter vendors) typically requires 3–5 accounts with clean payment history. Our Net-30 vendor account guide covers the full sequencing in depth.

Thick File vs. Thin File

A "thin file" business has 0–2 tradelines reporting. A "thick file" has 5–10+ tradelines across multiple bureaus with consistent on-time payments. The difference in lender treatment is dramatic. Thin files get the floor of every approval range; thick files get the ceiling. Per LexisNexis Small Business Attributes, alternative data can help lenders reach up to 60% more thin-file businesses — but for the business owner, the goal is to get off thin-file status as quickly as possible.

Timeline — 60 to 90 Days Minimum

From first tradeline report to a meaningful file: 60–90 days minimum. Most starter vendors report on a 30-day cycle. Two reporting cycles gets you a PAYDEX. Three gets you stability in the score. The business owner applying for bank products 30 days after their first tradeline report is apply in an unscored state — the bureau has data, but not enough to produce a stable score.

12. NAICS Code Strategy

NAICS (North American Industry Classification System) codes tell lenders what industry you're in. The code you pick during entity formation or EIN application gets referenced everywhere: your tax return, your SOS filing (in some states), your D&B profile, your Experian Business profile, your loan applications. Per SmallBusinessLoans.com and Fair Figure's high-risk industry analysis, lenders, banks, insurance companies, and business credit reporting agencies use NAICS to categorize industry risk. The wrong code can trigger an automatic denial or a much higher rate.

The High-Risk NAICS Codes That Trigger Auto-Decline

High-Risk — Stricter Underwriting, Higher Rates

• 441110 / 441120 — New/Used Car Dealers
• 722511 / 722513 — Full-Service / Limited-Service Restaurants
• 561510 — Travel Agencies
• 458310 — Jewelry Retailers
• 236118 — Residential Remodelers
• 484110 — General Freight Trucking
• 812930 — Parking Lots and Garages

Low-Risk — Favorable Underwriting

Sources: Fair Figure, Small Business Lending Source, SmallBusinessLoans.com.

NAICS Consistency Across Filings

Your NAICS code should be consistent across IRS tax filings, Secretary of State records (where applicable), D&B profile, Experian Business profile, and loan applications. A mismatch — "management consulting" on your IRS return, "jewelry retail" on your D&B profile — creates a flag that underwriters must investigate. If D&B has an incorrect high-risk code, it directly lowers your approval odds. Correcting it requires logging into your D&B profile and requesting an update; Experian via Nav or direct; IRS on your next tax return.

Can You Change NAICS Later?

Yes, but it requires updating at each cached location. The larger strategic question is whether your NAICS accurately represents the lowest-risk version of your actual activity. A business that could legitimately classify under either "Management Consulting" (541611 — low risk) or "Consumer Lending" (522291 — auto-decline territory) should choose Management Consulting if the actual activity supports it. Choose truthfully, but choose at the lowest-risk accurate classification.

13. The Consistency Algorithm — How It All Adds Up

Every section above is a single data point. This section is the glue: how those data points are cross-referenced and scored as a pattern. In modern underwriting, no single foundation element exists in isolation. Every submitted field is compared against every pullable record. Inconsistencies are the actual trigger for manual review, denials, and capped limits.

The Core Consistency Equation

When a modern underwriting system evaluates your file, it's solving this:

When these strings don't match — even for reasons that seem trivial — the algorithm flags it. Per Heron Data, their system reads "naming differences with 98% accuracy" — meaning minor punctuation (LLC vs. L.L.C.) is normalized, but substantive mismatches produce a fraud flag.

FTC Red Flags Rule — The Regulatory Source

The FTC Red Flags Rule (16 CFR Part 681) requires financial institutions and creditors to implement written Identity Theft Prevention Programs. The rule explicitly lists the following as "red flags of identity theft":

• "A notice of address discrepancy provided by a credit reporting company"
• "Inconsistencies in the information a customer has submitted to you"
• "An address, phone number, or other personal information already used on an account you know to be fraudulent"
• "A bogus address, an address for a mail drop or prison, a phone number that's invalid"

In other words, the very things we've discussed — CMRA addresses, VOIP numbers, name mismatches — are formally enumerated in federal regulation as fraud signals. Lenders aren't being paranoid; they're implementing required controls.

Ramp's Direct Language on Inconsistency

Ramp's own application guide spells it out: "Inconsistent business information. Make sure your business name, address, and EIN match exactly across your application, bank accounts, and official records. Even small discrepancies can trigger manual review."

Middesk's Entity Graph

Middesk — the KYB verification leader — maps corporate structures through an "entity graph" that links the business, its principals, related entities, and all associated liens, judgments, bankruptcies, and UCCs. If your name appears on an entity graph with undisclosed connections to other businesses, that surfaces in underwriting. The FinCEN Customer Due Diligence rule requires banks to collect beneficial ownership for anyone with 25%+ ownership; SBA requires documentation for 20%+ ownership.

Baselayer's Cross-Reference Checks

Baselayer's SMB risk rating explicitly cross-references business registration date vs. domain creation date, analyzes operational activity patterns, and detects synthetic behavior. When your domain was created last week and your SOS filing claims five years in business, Baselayer flags it. When your business bank account was opened after a sudden pattern of large deposits, Baselayer flags that too.

The 5-Point and 7-Point Match Models

Different lenders use different match-count thresholds, but the general framework:

Real Denial Triggers From Research

Documented denial patterns from the research:

• US Bank denial citing "unable to verify identification information" tied specifically to a Google Voice number
• Chase account lockouts resolved only via 3+ in-person branch visits when VOIP was on file
• BofA account rejections after 2 months of processing due to CMRA address
• Multiple Amex "please call to verify" holds triggered by VOIP numbers
• SBA 7(a) site visits failing virtual-office addresses
• PPP "Hold Code 506" errors traced to SOS status mismatches

14. The Full Bankability Audit Checklist

Here is the complete audit checklist we run before any Stacking Capital client applies for their first card. Every item has a pass/fail criterion and an estimated point value. The point values are directional — they represent the approximate weight we've observed in thousands of client applications — not a formal score published by any lender.

Total possible: 30+ points from the optional foundation layers, plus required items that are pass/fail. Most clients arrive at us with 5–15 of the required items missed and 10–20 of the optional points unclaimed. Our typical pre-filing audit recovers the missing required items and 60–80% of the optional points within 30–60 days.

15. Stacking Capital's Pre-Application Audit Process

Stacking Capital does not let clients apply until the foundation is solid. Our typical engagement starts with 30–60 days of foundation work before a single hard pull goes out. This is the operational difference between our process and the "apply to these five cards in this order" playbook floating around the internet.

What the Pre-Application Audit Covers

Without giving away the specific sequence and thresholds we've built from our client data, here's the general framework:

1. Entity verification — Pull SOS record, verify good standing, confirm registered agent, check annual report status, confirm name matches EIN records via 147C if needed.
2. Phone number classification — Run the client's current business number through carrier intelligence. If VOIP, set up a dedicated business mobile line before any application.
3. Address validation — Run the current business address through USPS CMRA database and address validation. If CMRA-flagged, migrate to a clean address (residential home, real executive suite, or leased commercial) before applying.
4. Digital footprint audit — WHOIS check on domain age, SSL verification, content review, contact info alignment with application data. If any gap exists, fix before applying.
5. Directory propagation — Google Business Profile verification, 411 listing, Bing Places, Yelp, BBB, LinkedIn Company Page. Allow 30+ days for propagation.
6. D&B profile setup — Free D-U-N-S application, full profile completion, NAICS verification, trade reference path.
7. Credit profile assessment — Pull personal credit, pull business credit (D&B, Experian Business via Nav), identify gaps in tradelines, calculate FICO SBSS directionally.
8. Consistency normalization — Verify that name, address, phone, email match identically across all 7+ records.
9. Bureau assignment strategy — Know which bureau each bank pulls (Chase = Experian, BofA = TransUnion, Amex = Experian, US Bank = TransUnion, Wells Fargo = Experian) and sequence applications to optimize inquiries.
10. Application timing — Don't apply during unusual credit activity. Wait for inquiry windows to close. Stack in the right order.

Why This Works

A client who applies with a weak foundation gets approved somewhere around 30–50% of the time at the floor of the approval range. A client who applies after a thorough foundation audit gets approved 70–90% of the time at the middle-to-ceiling of the range. Across 5–7 business card applications, that's the difference between $50K total approved limits and $200K+ total approved limits.

The foundation work isn't glamorous. Nobody writes viral posts about "I updated my Google Business Profile and got approved for a Chase Ink Plus with a $35K limit." But that's what actually happens. Our clients don't see the foundation work on their own — they see the approvals.

16. Red Flags to Avoid — Scams, Gurus, and "Skip the Foundation" Hacks

The foundation work is tedious. The industry has responded to that tedium with shortcuts — most of which are either outright fraud or setups that guarantee long-term problems. Here's what to avoid and why.

Frequently Asked Questions

Related Guides