How to Verify a Company’s Legitimacy in the Philippines (SEC, DTI, BIR Checks)

Updated for Philippine practice and procedure. This article is for general information and is not a substitute for legal advice.

I. Why verification matters

Verifying a counterparty avoids fraud exposure, void or unenforceable contracts, tax penalties for using invalid receipts, and reputational risk under anti–money laundering and data-privacy regimes. In the Philippines, legitimacy is demonstrated by (1) correct entity registration (SEC or DTI or CDA), (2) tax registration with the BIR, (3) local business permits from LGUs, and (4) any sectoral licenses (e.g., BSP, Insurance Commission, DICT, DOLE, FDA). Proper verification ties all four together.

II. Identify the correct registrar

Different organizations register with different government bodies. Start by classifying the entity you are checking:

Sole proprietorship → DTI (Business Name Registration)
Corporation or partnership (stock or non-stock; ordinary, OPC, or professional partnership) → SEC
Cooperative → CDA (Cooperative Development Authority)
Foreign company doing business (branch, representative office, regional HQ/ROHQ) → SEC license to do business
Foundations, NGOs → SEC (often with PCNC accreditation if seeking tax incentives)

Practical tip: If the business calls itself “Inc.,” “Corporation,” “Corp.,” “Company,” or “OPC,” look to SEC. If it’s clearly an individual’s trade name (e.g., “Juan’s Car Care”), look to DTI.

III. Verifying with the SEC (corporations/partnerships/foreign entities)

A. Core documents you should obtain

Ask the counterparty for legible copies (and, if risk is high, certified true copies) of:

Certificate of Incorporation / Registration (or SEC License for foreign branches/ROs)
Articles of Incorporation and By-laws (or Partnership Articles)
Latest General Information Sheet (GIS) (lists directors/trustees, officers, and beneficial owners)
Latest Audited Financial Statements (AFS) as filed with SEC
For One Person Corporations (OPC): Articles with name of the sole stockholder and nominee/alternate nominee

B. What to check in those documents

Exact legal name and SEC Registration Number
Company type: stock vs non-stock; OPC vs ordinary corporation
Principal office address (must match invoices/permits)
Corporate term (most are perpetual, but confirm)
Primary/secondary purpose (is your contemplated transaction within corporate powers?)
Directors/trustees and officers (cross-check signatories on contracts and board resolutions)
Beneficial ownership disclosures in the GIS (for AML and sanctions screening)
Status flags: revoked, suspended, dissolved, under rehabilitation/liquidation
For foreign entities: license scope (branch vs RO), assigned capital, resident agent

C. Red flags at SEC level

Entity name on documents does not match what appears on receipts, website, or bank accounts
No GIS for the current year (corporations must file annually)
AFS missing or unsigned by an independent auditor
Amendments (e.g., change of name, address, purpose) not reflected across other documents
For foreign ROs/branches, no SEC license despite “doing business” (risk: contracts unenforceable; PE tax exposure)

IV. Verifying with the DTI (sole proprietorships)

A. Core document

DTI Certificate of Business Name Registration (shows BN Number, proprietor’s legal name, business name, business address, territorial scope, and validity period—usually five years)

B. What to check

BN Number and validity (check expiry)
Owner’s full name and government ID (to confirm you are contracting with the right natural person)
Business address (should align with BIR COR and LGU permit)
Scope (barangay/city/regional/national)

C. Red flags at DTI level

Expired DTI certificate
Discrepancy between proprietor’s name on the DTI certificate and bank account/contract signatory
Use of corporate-sounding suffixes (“Inc.”/“Corp.”) on a sole proprietorship (misrepresentation risk)

V. Verifying with the BIR (tax legitimacy)

A. Core tax documents you should obtain

BIR Certificate of Registration (COR – Form 2303) Shows Taxpayer Identification Number (TIN), registered tax types (e.g., VAT/Non-VAT, withholding), RDO, and registered trade name.
Proof of Authority to Print (ATP) or Permit to Use (PTU) for Cash Register Machines/Point-of-Sale systems/e-invoicing solution.
Sample Official Receipt/Sales Invoice (preferably the same series you will receive), or a Billing Statement if a VAT-exempt activity—but confirm the correct document type for the transaction.
BIR Registration of Books (if relevant) and e-invoicing enrollment where applicable.

Note: TIN details are not publicly searchable for privacy—verification is document-based and through the receipts you receive.

B. What to check on the COR and receipts

Exact legal name and trade name (must match SEC/DTI)
TIN format and consistency across documents and OR/SI
Address (aligns with SEC/DTI and LGU)
Tax types and VAT status (e.g., VAT-registered vs Non-VAT/8%/exempt); if they charge VAT, they must be VAT-registered
OR/SI specifics:
- Presence of BIR Permit/ATP details, serial numbers, and phrase “VAT” where applicable
- Date within validity period, correct series, and breakdown of VAT vs non-VAT
- QR code or machine details if system-issued
Withholding obligations: their COR indicates if they are a withholding agent; your own obligations may apply when you pay them.

C. Red flags at BIR level

Charging VAT without VAT registration on the COR
OR/SI without ATP/PTU details, generic or pre-printed forms, missing TIN or address
Name/TIN mismatch between COR and invoices
Refusal to issue registered receipts (“Ask for Receipt” rule)

VI. Verifying LGU permits (local legitimacy)

Every business must secure:

Barangay Clearance (location)
Mayor’s/Business Permit (city/municipality; renewed annually)
Occupancy / Fire Safety / Sanitary permits as applicable

What to check:

Permit validity (current calendar year), business name, owner/corporate name, exact business address, and nature of business.
The place of business on LGU permits should match the address on the BIR COR and the SEC/DTI records.

Red flags: Outdated permits, different addresses, or permits for a different line of business.

VII. Sector-specific licenses (when applicable)

Depending on the industry, request proof of license/authority from:

BSP – banks, e-money issuers, remittance/transfer companies, virtual asset service providers
Insurance Commission – insurers, HMOs, insurance brokers/agents
DICT/NTC – telecoms, value-added services
DOLE/POEA/DMW – recruitment, contracting, manpower
DENR/DOE/DOH/FDA/DA/DTI-FTEB/DPWH/SEC-FinSec – regulated sectors (environmental permits, energy, health, food/drug/cosmetics, retail, construction, financing/lending/microfinance)
PEZA/BOI – if claiming incentives (check registration status and scope of registered activities)

Red flags: Holding out as regulated (e.g., “lending company”) but lacking the required specific SEC license or BSP registration.

VIII. Step-by-step verification workflow (practical checklist)

Baseline identity
- Get the exact legal name, TIN, business address, contact person, and entity type.
Registrar check
- SEC (corp/partnership/foreign): Certificate, GIS, AFS, status.
- DTI (sole prop): Business Name certificate + validity.
- CDA (cooperative): Certificate + latest General Assembly/Board info.
Tax check (BIR)
- COR (Form 2303), VAT status, tax types; ATP/PTU; sample OR/SI or e-invoice proof.
LGU permits
- Current Mayor’s/Business Permit and Barangay Clearance for the address where business is actually conducted.
Authority and capacity to contract
- Board or partner resolutions authorizing the transaction/signatory; Secretary’s Certificate (for corporations) or SPA (for sole props).
Beneficial ownership & AML/KYC
- Review GIS (beneficial owners), obtain valid IDs of principals, and run sanctions/PEP/adverse media checks appropriate to your risk policy.
Financial capacity (as needed)
- Latest AFS and bank/credit references; for large exposures, consider site visits and reference calls.
Sectoral/technical compliance
- Industry-specific licenses; product approvals (e.g., FDA CPR/CPN), environmental permits, data-privacy registration/DPO appointment where applicable.
Contract housekeeping
- Make sure the entity name, address, and TIN in your contract and on invoices match their official registrations. Attach copies of key documents as annexes.

IX. Advanced checks and nuances

Name confusion: A DTI business name is not a separate juridical entity. Contracts with a sole proprietorship bind the proprietor personally. Use the proprietor’s legal name “doing business as (dba)” the business name.
Group structures: Philippine subsidiaries are separate juridical entities. Do not assume a parent’s liability absent a guarantee or comfort letter.
Ongoing compliance:
- SEC: Annual GIS and AFS filings (deadlines vary by fiscal year-end and entity type)
- BIR: Monthly/quarterly/annual tax filings; invoice/receipt issuance rules; books maintenance; e-invoicing where covered
- LGU: Annual permit renewal (usually January)
Dissolution/closure: Seek proof of SEC dissolution or BIR closure if a counterparty claims to have ceased operations; otherwise legacy liabilities may linger.
Foreign counterparties shipping into PH: If they regularly solicit sales or maintain a dependent agent in PH, they may be “doing business” and need an SEC license; otherwise, consider requiring a local distributor or trading with their licensed PH subsidiary/branch.
Data Privacy: If the business processes personal data as a core activity and meets thresholds, confirm DPO appointment and, where required, registration with the National Privacy Commission; request the privacy notice and security policies for due diligence.
Public procurement claims: If they claim government dealings, ask for PhilGEPS registration and sample NOAs/POs; verify against permits and tax status.

X. Common red flags (quick scan)

“Corporation” but only shows DTI paperwork (mismatch of entity type)
Expired DTI certificate or no SEC GIS/AFS for the current year
VAT charged on invoices though COR shows Non-VAT
ORs/SIs lacking BIR ATP/PTU details or TIN
Different addresses across SEC/DTI, BIR, and LGU permits without documentary amendments
Refusal to provide copies of basic documents or evasive behavior regarding signatory authority
Use of generic receipts, online payment links issued by unrelated entities, or bank accounts under a different name

XI. Sample document request list (you can copy-paste)

SEC Certificate of Incorporation/License (or DTI BN Certificate/CDA Certificate)
Latest SEC GIS and latest AFS (file-stamped)
BIR Certificate of Registration (Form 2303) and ATP/PTU; sample OR/SI
Current Mayor’s/Business Permit and Barangay Clearance
Board/Secretary’s Certificate authorizing the transaction and signatories (or SPA for sole prop)
Valid government ID of authorized signatory; specimen signature
Industry-specific licenses/permits (if applicable)
Privacy compliance confirmation (DPO details; if registered, proof)
Company profile, references, and bank details exactly matching registered name

XII. Practical contracting tips

Exact names everywhere. In contracts, match the name as it appears on SEC/DTI/CDA and BIR.
TIN in vendor onboarding. Capture TIN and RDO for correct withholding and alphalist reporting.
Attach exhibits. Include copies of COR, permits, and resolutions as annexes; add compliance warranties and termination for misrepresentation.
Payment controls. Pay only to bank accounts titled in the same legal name; avoid third-party accounts unless justified and documented.
Renewal ticklers. Track expiries (DTI BN, LGU permit, licenses); require updated copies annually.

XIII. FAQs

Q: Are SEC/DTI documents enough without BIR? No. Registration with the registrar shows juridical legitimacy, but only BIR registration legitimizes tax compliance and receipt issuance.

Q: Can I publicly check a company’s TIN? No. TIN data is confidential. Verification is done through the BIR COR and the validity of the receipts/invoices they issue to you.

Q: We received e-receipts—are they valid? They must originate from a BIR-registered system (PTU or e-invoicing enrollment) and contain the required details (name, TIN, address, serial/series, VAT tags).

Q: The company is “Non-VAT” but charges 12% VAT. Do not accept such invoices. Request corrected billing or updated COR evidencing VAT registration.

XIV. One-page summary checklist

Identify entity type (SEC / DTI / CDA)
Obtain registrar docs (SEC Cert + GIS + AFS or DTI BN; CDA for co-ops)
Obtain BIR COR + ATP/PTU + sample OR/SI
Obtain LGU permits (Mayor’s/Business Permit + Barangay)
Confirm address and name consistency across all docs
Confirm VAT/withholding status matches invoices
Verify authority (resolutions/SPA; signatory IDs)
Check sector licenses if regulated
Review beneficial owners (GIS), run AML/PEP/adverse media checks
File updated copies in your vendor master; set renewal reminders

Disclaimer

This article summarizes common Philippine practice for verifying business legitimacy. Implementation details can vary by location and agency updates. For high-value or regulated transactions, seek advice from Philippine counsel or a licensed tax practitioner.