Online Verification of BIR-Registered Business Names in the Philippines
A practitioner-oriented legal guide (updated May 2025)
1. What “BIR registration” actually means
Under §236 of the National Internal Revenue Code (NIRC), every person or entity “subject to any internal revenue tax”—including sole proprietors, partnerships, corporations, cooperatives, estates and trusts—must register with the Bureau of Internal Revenue (BIR) and secure:
- Taxpayer Identification Number (TIN)
- BIR Form 2303 – Certificate of Registration (COR)
- Authority to Print (ATP) invoices/receipts or a Permit To Use (PTU) CAS/POS
- Books of accounts (manual, loose-leaf or computerized)
This is distinct from business-name registration with:
| Government office | Purpose | Governing law | Typical output |
|---|---|---|---|
| DTI (Department of Trade & Industry) | Register tradename of a sole proprietorship | Business Name Act (Act No. 3883, as amended) | Business Name Certificate |
| SEC (Securities & Exchange Commission) | Incorporate or organize partnerships | Revised Corporation Code (RA 11232) | SEC Certificate of Incorporation/Partnership |
| LGU (City/Municipality) | License the place of business | Local Government Code (RA 7160) | Mayor’s/Business Permit |
| BIR | Register for national tax purposes | NIRC §236; Revenue Regulations (RR) No. 7-2012, RR No. 12-2020, RR No. 6-2022 | BIR COR (Form 2303) |
Only the BIR Certificate of Registration proves that a business is authorized to issue official receipts/sales invoices and file tax returns. The question is how third parties—suppliers, customers, lenders, lawyers doing due-diligence—can confirm that a taxpayer is indeed BIR-registered without visiting a Revenue District Office (RDO).
2. Legal foundations for online verification
| Instrument | Key provisions relevant to verification |
|---|---|
| NIRC §236(I) | BIR shall “maintain a centralized database of all taxpayers” and “make basic registration information accessible to the public, subject to confidentiality rules.” |
| Data Privacy Act of 2012 (RA 10173) | Permits disclosure of non-sensitive personal data (e.g., registered name, business address, line of business, registration status) when required by law or for public interest. |
| RR No. 6-2022 (Implementing ORUS) | Launched the Online Registration & Update System (ORUS) and its quick-response (QR) code validation feature embedded in digitally-issued CORs. |
| Revenue Memorandum Circular (RMC) No. 122-2022 | First detailed procedures for online TIN and COR validation through ORUS. |
| RMC No. 30-2023 | Clarified third-party verification: any person may verify a taxpayer’s COR via the QR code or through the ORUS “Verify Taxpayer” menu. |
3. Current electronic channels for verification
| Channel | Who may use | What you see | How it works | Legal weight |
|---|---|---|---|---|
| QR Code on the digital COR (introduced 2022) | Anyone who scans | JSON preview or browser page showing: • Registered Name/Trade Name • TIN • RDO Code • Registration Date • Tax Types • Status (Active/Cancelled) | The QR points to an ORUS endpoint with an encrypted token valid for that specific COR. | Treated as an official extract from the BIR database (RMC 30-2023). |
| ORUS “Verify Taxpayer” portal (https://orus.bir.gov.ph) | Taxpayers with an ORUS account; from 2024, guest users limited to 10 look-ups/day | Same data set as the QR result | Input either (a) TIN + branch code, or (b) full registered name. | BIR system logs every query; data is “prima facie proof” under NIRC §235. |
| eFPS/eBIRForms cross-validation | Large taxpayers & eFPS filers | When encoding supplier/customer TINs, invalid or unregistered TINs prompt an error. | Front-end validation only; no descriptive info. | Merely a preliminary check; not proof of status. |
| Email request to the BIR Customer Assistance Division (contact_us@bir.gov.ph) | Law offices, banks, government agencies | Scanned Certificate of Tax Exemption or COR copy | Must attach letter request, government ID, and proof of legitimate purpose (RR 06-2020). | Manual process; turnaround 3–5 working days. |
4. Step-by-step: Verifying via ORUS (guest mode, 2025 workflow)
Access the portal – Open orus.bir.gov.ph ➜ Services ➜ Verify Taxpayer.
Accept the Privacy Notice – Confirms you will access basic taxpayer data only.
Enter search key:
- TIN – 9, 12 or 13 digits (last three are branch codes, e.g., 000).
- Registered Name – as it appears on DTI/SEC records (no punctuation).
CAPTCHA & Submit – Prevents automated scraping.
Review results – Fields returned:
- Registered Name & Trade Name (if any)
- TIN / Branch Code
- Line of Business
- RDO Code & Registration Date
- Tax Types & Forms (e.g., VAT, Income, Percentage, Withholding)
- Registration Status: Active, Inactive, Cancelled, Merged
Download optional PDF extract – Watermarked “For verification only; not a substitute for COR.”
Best practice: Save a PDF of the verification result and keep it with the supplier/customer file, together with their DTI/SEC papers, for 3 years after the last transaction (NIRC §235 retention rule).
5. Evidentiary value and limitations
- Prima facie evidence – A positive ORUS result creates a presumption that the taxpayer is duly registered as of the timestamp shown.
- Not conclusive for compliance – It does not confirm that returns have been filed or taxes paid. For that, demand a BIR Certificate of Tax Filing & Payment (available to the taxpayer only) or obtain a waiver/authorization under Data Privacy Act.
- Name variations – ORUS shows the exact registered name. If a trade name or brand is used in commerce, match it to the “Trade Name” field.
- Sole proprietors – The individual’s legal name always precedes the trade name in ORUS (e.g., “JUAN DELA CRUZ / JDC PHARMA”).
- Confidential fields withheld – Address, contact numbers, and authorized representative details are not publicly exposed; they are disclosed only to the taxpayer inside their ORUS account.
6. Penalties for non-registration or misrepresentation
| Violation | Statutory basis | Administrative consequences | Criminal penalties |
|---|---|---|---|
| Failure to register / to update registration | NIRC §236 & §275 | BIR may impose compromise penalty ₱ 1,000–₱ 25,000 per year; closure under “Oplan Kandado” for VAT-registered entities. | Fine ₱ 5,000–₱ 20,000 and/or imprisonment 6 months–2 years. |
| Printing/issuing receipts without COR or with wrong TIN | NIRC §264 | Surcharge & compromise; denial of input VAT to buyers. | Fine ₱ 1,000–₱ 50,000 and/or imprisonment 2–4 years. |
| Falsifying or altering COR | Revised Penal Code Art. 171; NIRC §257 | Immediate revocation of COR; blacklisting | Reclusion temporal & fine < ₱ 10,000. |
7. Data-privacy compliance for verifiers
- Identify your lawful basis – Legitimate interests (due-diligence), contract necessity, or compliance with legal obligation (e.g., withholding tax rules).
- Collect only what is necessary – The ORUS extract is sufficient; do not keep the taxpayer’s internal financial data unless needed.
- Inform data subjects – In procurement documents or loan disclosures, state that tax registration will be validated with the BIR.
- Secure storage – Keep digital copies encrypted; destroy after statutory retention.
8. Common practitioner questions
| Question | Answer |
|---|---|
| Is an e-mailed PDF copy of Form 2303 valid? | Yes, if it bears the BIR “e-signature” or ORUS QR code; but verify the QR or ORUS record to rule out tampering. |
| Can I bulk-verify 1,000 suppliers? | The guest portal is limited; apply for BIR API access (pilot since 2025 under RMC 18-2025) or ask each supplier for their QR-embedded COR. |
| Does ORUS cover branches? | Yes. Each branch (TIN suffix other than 000) has its own COR and a separate QR. |
| What if the result says “Inactive”? | The taxpayer’s COR has been cancelled (e.g., business closure). Withhold further transactions; require proof of re-registration. |
| Can foreign entities be verified? | Only if they obtained a Philippine TIN (e.g., branch offices, non-resident lessors). Otherwise, BIR will not return a record. |
9. Forthcoming reforms (as disclosed by BIR through press releases and draft regulations up to Q1 2025)
- Full ORUS public API – To allow banks and e-commerce platforms real-time TIN validation (target Q4 2025).
- Integration with Business One-Stop Shop (BOSS) – LGUs will notify BIR of new business-permit issuances, triggering automatic TIN generation (pilot in Quezon City).
- Blockchain-anchored COR hashes – A sandbox with DICT to ensure immutability and offline verification through hash lookup.
- Single “Philippine Business ID” – Proposal in Congress (House Bill No. 2475) to unify DTI/SEC/BIR/LGU registration numbers.
10. Practical compliance checklist for lawyers & accountants
- ☐ Always request a QR-embedded COR from counterparties.
- ☐ Scan/ORUS-verify the QR before contract signing or first payment.
- ☐ Schedule annual re-verification of long-term suppliers (best aligned with financial-statement audits).
- ☐ Flag “Inactive/Cancelled” results and obtain explanation within 5 calendar days.
- ☐ Retain ORUS extracts for 3 years after the end of the taxable year when the transaction occurred.
Conclusion
Online verification of BIR registration has moved from manual RDO visits to a near-instant, public-facing system anchored on ORUS and QR-coded Certificates of Registration. While it does not replace tax-compliance monitoring, it radically lowers the risk of dealing with unregistered or rogue entities and strengthens evidence in both civil and criminal tax cases. Practitioners should embed ORUS checks in their onboarding and procurement workflows, stay updated on the forthcoming API roll-out, and keep an eye on legislative proposals for a unified business identifier.