Disclosure: bankpulse.io and combobulating.ai are run by the same team.
A licence number and a BIC on a form prove nothing yet
A company fills in your onboarding form. It says it is an electronic money institution in Lithuania, gives a licence number, names the Bank of Lithuania as its regulator and adds a SWIFT/BIC code. Before anyone says yes, someone has to confirm all of it: that the licence exists and is current, that it covers what the company wants to do with you, that the BIC belongs to the same legal entity, and that the person who filled in the form works there.
In a bank this lands on a KYB team. In a fintech of eight people it lands on whoever is free, usually in the evening, on a regulator's website in a language they do not read. This guide lists the checks in the order that wastes the least time, shows where each one is done, explains why the BIC part needs repeating, and describes how a small team can hand most of the legwork to an AI agent while a person keeps the decision.
The short answer. Confirm the applicant's email domain matches the institution's official website, find the licence details on that website, work out which authority supervises this type of institution in this country, and check the licence on that authority's own register. Then look the BIC up in the ISO 9362 directory, compare the legal name and country, and screen the institution against sanctions lists. A BIC by itself proves no licence: SWIFT issues codes to asset managers and ordinary companies as well as to banks.
The eight checks, in order
Run the cheap checks first, so a bad application stops before anyone opens a regulator's website.
- Is the email real? Confirm the applicant controls the address with a one-time code or link. For anything beyond a trial, check the sending domain's SPF, DKIM and DMARC yourself instead of trusting the From line.
- Does the domain match the institution? Find the institution's official website on your own, by search or from the regulator's register, and compare it with the applicant's email domain. A lookalike domain, the right name with an extra word or a different ending, is a reason to stop here.
- Is the licence published on the website? Regulated firms normally state their licence number and regulator in the footer or the legal notice. Write down what it says, including the type of licence.
- Who is the competent regulator? It depends on the country and on the type of institution. A bank, a payment institution, an e-money institution and an investment firm can each sit with a different authority, and some countries split the work between a central bank and a separate supervisor.
- Is the licence current on the register? Open the regulator's register yourself; do not follow a link the applicant sent. Check the status (authorised, suspended, withdrawn), the licence type and the permissions it grants. A payment institution, for example, may not take deposits.
- Does everything match? Legal name, registered address, website and licence number should agree across the form, the institution's website and the register. A missing "UAB" or "Ltd" is normal. A different registered address or a different website is a finding.
- Does the BIC belong to this entity? Look the code up in the ISO 9362 directory, for example with the Bank Pulse SWIFT/BIC code checker, and compare the legal name, country and branch with the register. An 11-character code points to a branch, so make sure it is the branch you expect. The guide to SWIFT/BIC codes explains how the eight and eleven characters break down.
- Sanctions and secondary signals. Screen the institution, and its owners if your policy requires it, against the main lists (see which sanctions lists matter for banks). Then look at the softer signals: the age of the domain, the IP address the application came from, and whether you have dealt with this institution or network before. Ask the applicant for whatever is still missing.
Where to check a licence: a few common registers
| Where the institution is | Type of institution | Register |
|---|---|---|
| United Kingdom | Banks, payment and e-money institutions, investment firms | FCA Financial Services Register |
| European Union | Payment and e-money institutions | EBA register under PSD2, then the home supervisor's own register |
| Germany | Banks, payment and e-money institutions | BaFin company database |
| United States | FDIC-insured banks | FDIC BankFind Suite |
| United States | Money transmitters (state licences) | NMLS Consumer Access |
The EBA register is fed by the national authorities. When it disagrees with the home supervisor's register, the national one is the source to trust.
Why the BIC check goes stale
A licence check answers for the day you ran it. So does a BIC check, and the directory behind it changes every month. Bank Pulse refreshes its catalogue from the ISO 9362 directory on the first of every month. This is what the last three monthly files changed:
| Directory file | Records in the file | New codes | Changed entries | Removed codes | Total changes |
|---|---|---|---|---|---|
| 1 August 2026 | 110,033 | 243 | 1,127 | 87 | 1,457 |
| 1 September 2026 | 110,538 | 413 | 598 | 94 | 1,105 |
| 1 October 2026 | 110,617 | 225 | 1,159 | 76 | 1,460 |
Between 1,105 and 1,460 entries a month, about 1.0 to 1.3 percent of the directory. A changed entry is an existing code whose details, such as the legal name, address or branch, were edited. A removed code no longer exists, and 257 codes went that way in these three months. A counterparty you checked at onboarding in July could be on one of those lists by October.
The new codes for each month are listed in our SWIFT/BIC updates for October 2026. The October list includes asset managers, an exchange house and an e-commerce company, which is a useful reminder that holding a BIC and holding a banking licence are separate things.
The practical rule: repeat the BIC and register checks on a schedule as well as at onboarding. Monthly matches the directory's own cycle.
Handing the legwork to an AI agent
None of the eight checks needs judgement until the end. Each one is the same loop: open a website, find a field, compare it with another field, write down what you found. An AI agent such as Claude Code does this kind of work well, provided it runs somewhere it can open websites and keep a log, and a person makes the decision.
Our sister project has published how a Claude Code agent checks whether a client holds a financial licence in its own sign-up flow. The website passes the application to an agent on the same server, the agent runs checks like the ones above and scores the applicant, and anything that looks wrong goes to manual review. The write-up also lists other uses for the same check, from deciding who gets a trial to pre-screening documents, and notes that the first version took less time to build than the post took to write.
What the agent needs
- A machine that stays on. Applications arrive at night and at weekends. On a laptop that sleeps, a check that could finish before the applicant closes the tab waits until morning. An always-on Linux server with Claude Code signed in to your own Anthropic account is enough.
- A real browser. Many registers are search forms with no API, and some show results only after JavaScript runs. The agent needs a headless browser as well as plain HTTP requests.
- A written procedure. Put the eight checks, the registers for each country you serve and your scoring rules in the agent's instructions file (CLAUDE.md for Claude Code). The agent follows the file, and the file is what your compliance officer reviews and signs off.
- Evidence for every check. For each step the agent records the URL it used, the date and the value it found. A reviewer should be able to repeat any check from the note alone.
- Read-only reach. The agent reads registers and websites and writes a report. It does not approve accounts, send documents or reply to the applicant with anyone's personal data.
What stays with a person
Approving or rejecting the institution, every sanctions match, every mismatch between the register and the form, and anything that involves handing over personal data. The agent's job is to turn an afternoon of searching into one page a person can read and sign.
Frequently asked questions
How do I check if a company holds a financial licence?
Find the authority that supervises that type of business in that country, then search its public register yourself. Confirm the status, the licence type and the permissions, and check that the name, address and website match what the company gave you.
Does a valid SWIFT/BIC code mean the institution is a licensed bank?
No. A BIC is an identifier in the ISO 9362 directory. SWIFT issues codes to banks and also to asset managers, exchange houses and ordinary companies. Licence status comes only from the regulator's register.
How often does the SWIFT/BIC directory change?
Every month. In the August, September and October 2026 files, between 1,105 and 1,460 entries were added, edited or removed each month, out of about 110,000. Re-check the BICs of your counterparties at least monthly.
Can an AI agent approve onboarding on its own?
It should not. An agent can run the searches, compare the fields and score the application with links to its evidence. Approval, sanctions matches and any mismatch belong with a person.
Disclosure: combobulating, which rents always-on servers with Claude Code preinstalled (customers sign in with their own Anthropic account), is run by the same team as Bank Pulse. The directory figures come from the ISO 9362 monthly files Bank Pulse loaded on 1 August, 1 September and 1 October 2026. Register links were checked on 23 October 2026. Claude and Claude Code are trade marks of Anthropic; Bank Pulse is not affiliated with Anthropic.