How to Verify a Wholesale Customer Is a Real Business (Before You Approve Them)

A wholesale application lands in your queue. The company name sounds plausible, the email looks corporate enough, and there's a tax ID in the right field. You approve it, because what else would you do — call them?

Most guides about B2B approval on Shopify stop exactly there. They'll tell you how to build the form, how to tag the customer, how to gate the pricing. The actual question — is this a real business? — gets answered with "review the application manually," as if reading a form a second time makes the information in it more true.

TL;DR: You verify a wholesale customer by checking their claims against official registries, not by re-reading their form. EU VAT numbers verify against VIES, UK VAT against HMRC, Australian ABNs against the ABR, Danish CVR numbers against the business register — all in real time, all returning the registered business name so you can cross-check it. What can't be registry-checked (US EINs, documents) gets format validation plus human review. Automated verification is real; automated approval judgment is where you should stay in the loop.

A common claim in this space is that business verification can't be automated — that approval is inherently a manual review. That's true of the decision and false of the evidence. The evidence is sitting in government registries with public APIs.

What "Verified" Actually Means

A wholesale application makes three claims worth testing:

1. The business exists — it's registered somewhere, under the name given.
2. The tax ID is real and belongs to them — not just formatted correctly, but currently registered, and registered to the entity applying.
3. The person applying plausibly represents that business — the email, domain, and details hang together.

Each claim has a different verification path, and the paths vary wildly by country.

Check Claims Against Registries, Not Against the Form

The core move is simple: take what the applicant typed, look it up at the source, and compare.

Applicant claims	Where to check it	What comes back
EU VAT number	VIES (free, real time)	Valid/invalid + registered name and address
UK VAT number (GB…)	HMRC Check-a-VAT-Number API	Valid/invalid + registered name and address
Northern Ireland VAT (XI…)	VIES	Valid/invalid + name
Australian ABN	ABR ABN Lookup (free)	Status + entity name + GST registration
Danish CVR number	CVR register (free)	Status + registered name
UK company (no VAT)	Companies House	Company status, officers, filing history
US EIN	No free public API	Format check + documents + human review

The registered-name return is the underrated half. A number can be perfectly valid and still not belong to the applicant — someone can paste a competitor's public VAT number into your form. When the registry says the number belongs to "XYZ Trading GmbH" and the form says "ABC Wholesale," the number checked out and the application still fails verification. That cross-check is the whole game.

The Three Outcomes (Not Two)

Verification isn't pass/fail. Design for three outcomes:

Confirmed. The ID is valid, current, and the registered name matches the application. These are your auto-approval candidates — a VAT-validated EU business applying with matching details is about as verified as a stranger gets.

Contradicted. Invalid number, lapsed registration, or a name mismatch. Not always fraud — trading names differ from legal names, and businesses do let registrations lapse — but never something to approve without a look.

Unverifiable. The registry is down, or no registry exists for that country. This is the case that separates careful systems from careless ones: unverifiable is not a failure and not a pass. It's "flag for manual review," with the reason recorded.

What About Documents?

For US buyers, the document usually is the evidence — a resale certificate rather than a registry entry. The same cross-check logic applies: does the business name on the certificate match the application, does the state match, is it in date? Reading the document is easy; the mismatches are what matter. That's a big enough topic that it has its own post.

What to Automate, What to Keep

Automate the lookups, the format checks, the name comparison, and the flagging. These are mechanical, they're where humans are slowest and least reliable, and doing them in real time — while the applicant is still on the form — has a bonus effect: invalid IDs bounce before they ever reach your queue, so the applications you review are already pre-filtered.

Keep the judgment. Auto-approval is safe for the confirmed bucket if you choose to enable it (a merchant selling into the EU can reasonably auto-approve VIES-validated businesses). Everything contradicted or unverifiable deserves a human — and that human should see the evidence laid out, not a raw PDF and a hope.

Red Flags Worth Encoding

A few patterns show up repeatedly in junk applications: free-mail addresses paired with big-company names, tax IDs that are valid but registered in a different country than the shipping address, applications where every field is technically filled but the registry name matches nothing, and repeat submissions with small variations after a rejection. None of these is a verdict on its own. All of them are worth surfacing automatically so the reviewer doesn't have to notice them by luck.

Frequently Asked Questions

Can B2B customer verification be automated on Shopify? The evidence-gathering can: registry lookups (VIES, HMRC, ABR, CVR), format validation, and name cross-checks all run in real time during registration. The approval decision itself should stay reviewable — automation prepares the case, the merchant rules on it.

Which countries support real-time business verification? The EU (VIES), the UK (HMRC), Australia (ABR), Denmark (CVR), and the UK's Companies House for company data, among others. The US notably does not offer a free public EIN check — US verification leans on documents plus review.

Is a valid tax ID enough to approve a wholesale account? Valid and matching is the standard: the registry's returned business name should correspond to the applicant. A valid number with a mismatched name is a flag, not a pass.

What should happen when a registry is unavailable? Neither approve nor reject on it. Route the application to manual review with the reason recorded — silent failures in verification systems are how invalid accounts get approved.

---

B2B Onboard runs these checks during registration: EU VAT via VIES, UK VAT via HMRC, Australian ABN via the ABR, and Danish CVR — cross-checking registered names against the application and flagging what doesn't line up. Confirmed businesses can auto-approve; everything else queues for your review with the evidence attached. See how it works.