Three ways to check a company before you pay it, and what an agent can actually use
If an agent (or a human) is about to pay a new counterparty, someone has to answer a basic question first: is this company real, who runs it, and is it on a sanctions list? There are three common ways to get that answer.
If an agent (or a human) is about to pay a new counterparty, someone has to answer a basic question first: is this company real, who runs it, and is it on a sanctions list? There are three common ways to get that answer. They differ a lot in cost, format, and whether software can consume them at all.
1. Manual registry lookups
Every jurisdiction has a company register: Companies House in the UK, state registries in the US, and so on. Many are free to search on the web.
What you get: incorporation facts, filing history, officer names. Straight from the source.
What it costs you: time and consistency. Every registry has its own search, its own format, and its own coverage quirks. Officer data is sometimes scanned documents. There is no sanctions screening in most registries, so you still need a separate pass over the OFAC SDN, the UK Sanctions List, or whichever lists apply. For a person doing one check, this is fine. For an agent doing fifty, it is fifty different parsers.
2. Credit bureaus and business information providers
Dun & Bradstreet, Creditsafe, and similar providers sell company reports with credit scores, financials, and risk indicators.
What you get: depth, especially financial data that registries do not publish.
What it costs you: money and access. These products are sold to humans through accounts, contracts, and sales calls. Pricing is usually per-report or subscription, often in the tens of dollars per report. Almost none of it is callable by an autonomous agent: there is no standard machine payment, and procurement alone assumes a human buyer.
3. Agent-callable screening APIs
A newer pattern: an HTTP API that returns a structured company report and charges per call through the x402 protocol. The agent sends a request, gets back HTTP 402 with exact payment requirements (for example a few dollars in USDC on Base), signs one EIP-3009 authorization with its wallet, and receives the report. No account, no API key, no procurement step.
What you get: registry profile, officers and owners where published, and - on the better ones - a sanctions screen with each finding cited to its source. The citations matter: downstream systems and humans can verify each line instead of trusting a bare score.
What to check before trusting one: read the coverage statement. A screen might cover the OFAC SDN and UK Sanctions List but not EU or UN lists. Country coverage can be partial (only SEC-reporting companies in the US, only federal corporations in Canada). And a sanctions screen is not a credit check: for financial depth, option 2 still exists for a reason.
Choosing
For a one-off check by a person, the registry is free and sufficient. For financial depth, a bureau earns its price. For an agent that needs a cited, structured answer in seconds to a few minutes without a human opening an account first, option 3 is the only one built for the caller.
Protocol documentation: https://docs.x402.org
This article was generated by an AI system.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.