The Collection Ceiling

Every business register in North America is an administrative by-product. It holds what a government needed for its own purpose - incorporation, taxation, licensing - and nothing beyond it. No aggregation layer, no vendor consolidation and no model improvement can return information that was never collected. We call that hard boundary the Collection Ceiling.

Above the ceiling sits everything a payments company or bank actually needs to make a risk decision on a small business: who really owns it, where it really trades from, what it actually sells, how much it expects to process, who it buys from, whether the person signing has authority to sign. In the United States, none of this is publicly available, and none of it exists as a general-purpose business-data source an institution can query. It exists in one place only - the memory and the filing cabinet of the business owner. We call that residual the attestation layer.

The attestation layer is not an edge case. On our field-level assessment, roughly 57% of the data points required to onboard and underwrite a North American SMB merchant are attestation-only. They are not independently retrievable at scale without the applicant's cooperation, which in practice means a human asking another human. Because they can only be asked for, they are also the fields most likely to arrive incomplete, which is why compliance and operations teams spend their days sending follow-up requests rather than reviewing risk.

The industry has spent a decade optimising the layer below the ceiling, because that is the layer vendors can sell into and benchmark. Coverage percentages, match rates, straight-through-processing rates and API latency all describe the retrievable half of the problem. There is no published benchmark anywhere for the number of information requests per onboarding, the elapsed days they add, or the applications they kill. The most expensive part of merchant onboarding is the part nobody measures, because no vendor owns it.

What this paper establishes

• The ceiling is a policy artefact, not a technical limit. The same field - beneficial ownership - is filed and publicly searchable for a federally incorporated Canadian company and structurally unavailable for a Delaware LLC. Nothing about the data makes it hard. A legislature decided.
• The United States has just lowered its own ceiling, permanently. The Corporate Transparency Act was the one serious attempt to close the largest gap in the stack. On 11 August 2026, following eighteen months of an interim exemption, Treasury issued a final rule removing the reporting requirement for all entities formed in the United States and for US persons who are beneficial owners. The single state that legislated its own register covers only foreign-formed LLCs, and holds the data in a non-public database. The manual ownership request loop is likely to remain central in the largest SMB market on earth unless policy or market infrastructure changes, and no operating model should be built on the assumption that it is temporary.
• The cost is roughly ten billion dollars a year. Our model puts the annual North American cost of the attestation layer at US$10.4bn, with a defensible range of $3.5bn to $31.7bn. Institutional labour is the smallest component. Abandoned applications are the largest.
• Perpetual KYB is structurally impossible on this base. Attestation-layer data has no refresh mechanism. A merchant's stated business model is accurate on the day it is typed and decays from that moment, with no event anywhere in the world that will tell the institution it has changed.
• Autonomous agents compress the handling cost of a request. They do not remove the request. An agent cannot retrieve a fact that does not exist in any system. It can only ask the owner faster and chase more politely.

There is a comfortable assumption running through the business identity market: that coverage is a function of effort. Connect to more sources, normalise more formats, resolve more entities, train better models, and the gaps close. It is an assumption that suits everyone who sells into the category, because it implies that every gap is a roadmap item.

It is also wrong, and the reason is unglamorous. A company register is not a description of a business. It is the residue of a transaction between a business and a state. Delaware asks for the information Delaware needs to constitute a legal person and serve process on it. The IRS asks for the information the IRS needs to assign a tax identifier. A state licensing board asks for the information it needs to grant a licence. None of these bodies is in the business of describing a company to a third party, and none of them collects a field simply because someone downstream might one day find it useful.

This produces a structural boundary that no amount of downstream engineering can cross. If a fact was never collected by anyone, it is not in the pool. It cannot be aggregated, because there is nothing to aggregate. It cannot be inferred reliably, because inference on a firm with four employees and no web presence is guesswork with a confidence score attached. It cannot be modelled into existence. The only remaining route to that fact is the person who holds it.

Two ceilings, not one

The boundary is actually two boundaries stacked, and conflating them causes bad procurement decisions.

The collection ceiling is set by what was gathered at all. If no filing anywhere captures the percentage of an LLC held by each member, that number exists in no system.

The distribution ceiling sits below it, and is set by what is released to whom. A fact can be collected and still be unavailable: held in a non-public register accessible only to law enforcement, released only in paper form, priced beyond reach, published without a machine-readable interface, or updated on an annual cycle that makes it stale for operational use. New York's beneficial ownership regime is the cleanest example in North America: the state legislated a register, and then specified that the data sits in a database available only to government agencies. Collected, and still invisible to the bank.

For an operator the two ceilings feel identical - the field is missing either way. For a policymaker they are entirely different problems with entirely different remedies, and a paper that blurs them produces recommendations that cannot be acted on. We keep them separate throughout.

Why the ceiling is invisible from inside a vendor

Every metric the business verification market reports is a ratio with the retrievable universe as its denominator. Coverage is measured as jurisdictions connected, not as fields required. Match rate is measured against records that exist, not against the decision the institution has to make. Straight-through-processing rate counts cases that cleared automatically, which by construction excludes every case that was routed to a human precisely because the data was not there.

The result is a market that reports excellent and improving numbers about a shrinking share of the actual problem. A provider can move from 82% to 94% coverage of state filing records and change the compliance team's working day almost not at all, because the working day is not spent retrieving filing records. It is spent chasing the thirty-one fields that were never in a filing record to begin with.

The test that separates the two layers

A field is below the ceiling if a stranger with the right credentials and enough money could obtain it without the company's cooperation. A field is above the ceiling if the only path to it runs through the company itself. That test is deliberately indifferent to how important the field is, how sensitive it is, or how obvious the answer seems. It asks one thing: does an independent record exist?

Apply it honestly and the results are uncomfortable. A merchant's legal name passes. Its operating address usually fails, because what the register holds is a registered office or a registered agent's address, which is frequently neither where the business trades nor where its goods are held. Its ownership fails almost everywhere in the United States. Its business model fails in almost every case: licensing, tax and sectoral regimes capture fragments of business purpose or activity, but no register captures what a company actually sells in a form that is structured, current and comparable across jurisdictions.

Company formation in the United States is a state function. Fifty states and the District of Columbia each operate their own register, with their own fields, formats, fee schedules, update cadences and access methods. Canada adds ten provincial and three territorial registries, plus a federal register under the Canada Business Corporations Act. Throughout this paper, the sixty-four filing jurisdictions are the fifty US states, the District of Columbia, the ten Canadian provinces and the three Canadian territories. US territories and the Canadian federal register sit outside that count and are discussed separately where relevant. An institution onboarding North American merchants is therefore reconciling sixty-four distinct subnational data regimes, none of which was designed to interoperate with the others and none of which was designed with a bank in mind.

Fragmentation is the familiar complaint, and it is real, but it is the lesser problem. Fragmentation is expensive; it is not a ceiling. Enough engineering and enough spend can normalise sixty formats into one schema, and several providers have done exactly that to a high standard. What engineering cannot do is add fields to sixty registers that never held them. Even a perfectly unified North American view of every state and provincial filing would return: legal name, entity type, jurisdiction, formation date, standing, filing number, registered agent, registered address, and in some states a partial and often stale list of officers. That is the ceiling. It is a thin dossier on which to make a payments risk decision about a business that intends to process seven figures a year.

The Corporate Transparency Act, and its reversal

The Corporate Transparency Act was the one federal attempt to raise the ceiling on the single most consequential missing field. From January 2024 it required tens of millions of US entities to file beneficial ownership information with FinCEN: name, date of birth, address and identification document for every individual holding 25% or more or exercising substantial control.

It did not survive. Following the Treasury announcement of March 2025 and the interim final rule published on 26 March 2025, the definition of a reporting company was narrowed to entities formed under the law of a foreign country and registered to do business in a US state or tribal jurisdiction. All entities created in the United States, and their beneficial owners, were exempted. Commentators put the practical effect at the removal of roughly 99.8% of originally covered entities from scope. The exemption is now final. On 11 August 2026, Treasury issued a final rule solidifying the position: entities formed in the United States and US persons who are beneficial owners are permanently outside the reporting requirement. The rule additionally exempts foreign companies from reporting US-person company applicants, and removes the obligation on US persons to update or correct the information behind a FinCEN identifier. Treasury grounded the decision in the statute's own instruction to minimise the burden that collection places on legitimate businesses, describing the outcome as a balancing test between generating useful information and limiting compliance cost.

We take no position on whether that was the right policy. The operational consequence is not in dispute. For a US-formed small business - which is to say very nearly every small business a North American payments company will ever onboard - there is no authoritative source of beneficial ownership. There is no register to query, no file to fetch, no vendor with privileged access. There is a form, sent by a compliance analyst, asking the owner to declare it. And then, in a material share of cases, a second form.

The state-level backstop that closed before it opened

New York is the only state-level regime within this paper's scope that requires beneficial-owner disclosure from a defined class of LLCs, modelled on the federal act. The LLC Transparency Act took effect on 1 January 2026. Two features of how it landed matter more than the fact of its existence.

First, its key definitions are tied to the federal act. The Governor's December 2025 veto of the decoupling amendment meant those definitions inherited the federal exemptions, so the New York register now applies only to LLCs formed outside the United States and authorised to do business in the state. US-formed LLCs, including New York LLCs, are out of scope.

Second, and more instructive for anyone designing a remedy, the disclosures are held confidentially rather than on the public record, and current Department of State guidance provides an access route for law enforcement rather than for supervised financial institutions. Even for the narrow population in scope, an institution conducting customer due diligence has no route to it. This is the distribution ceiling in its purest form: the state collected the data and closed it to the institutions carrying the obligation it was meant to serve.

Canada as the controlled experiment

The most useful thing about North America as a study region is that it contains its own counterfactual. Since 22 January 2024, corporations governed by the Canada Business Corporations Act have been required to file information on individuals with significant control with Corporations Canada, and a portion of that data is publicly searchable: name, jurisdiction of residence, description of control, and the date control began, with residential addresses withheld. Quebec goes further still, requiring ultimate-beneficiary disclosure on a publicly accessible enterprise register, extending to foreign entities that are required to register in the province.

The same field, for the same kind of business, at the same moment in history: filed and queryable in Ottawa and Quebec City, and structurally unobtainable in Dover, Albany and Sacramento. That comparison is the whole argument in miniature. Nothing about beneficial ownership makes it technically hard to collect. The ceiling is where a legislature put it.

Canada is not a solved market. Provincial coverage is uneven, several provinces require only internal registers that are never filed, and the federal register's population depends on annual return cycles. But the direction of travel is opposite to the United States, and any institution operating across the border now runs two materially different KYB realities under one policy.

The operating pattern is consistent across every institution we have observed, from twelve-person fintechs to global acquirers. A merchant applies. The institution retrieves what it can below the ceiling, presents a form for everything above it, and the merchant fills it in with whatever is to hand. An analyst reviews the submission, finds gaps - missing owner, unclear business model, statements from the wrong months, an address that does not match the registry, a document that is legible but not the right document - and sends a request. The merchant responds, usually not immediately. The analyst reviews again. Frequently a second gap surfaces, sometimes revealed by the answer to the first.

Some of this is irreducible. Any process whose inputs live outside the system of record must ask for them, and the institution cannot validate a field it has not received or know which fields will be wrong until they arrive. But not every round trip is irreducible. Incomplete requirement design, weak prefill, fragmented case management and context loss between rounds generate avoidable requests on top of the necessary ones, and Section 09 sets out what to do about those.

Anatomy of one cycle

A single request cycle contains six distinct costs, only one of which is usually measured.

1. Detection. An analyst identifies the gap. This is the only step that looks like compliance work.
2. Composition. The request is drafted, often into a template that does not carry the case context, and dispatched.
3. Latency. The clock runs while the merchant is doing something else. This dominates elapsed time and is entirely outside the institution's control.
4. Retrieval by the merchant. The owner locates a statement, asks an accountant, photographs a document, or asks a co-owner for a date of birth. This is unpaid work performed by the customer.
5. Re-review. The analyst reconstructs the case from memory or from notes, because in most stacks the follow-up arrives as a new ticket with no thread back to the original assessment.
6. Recurrence. A material share of responses generate a further gap, and the loop restarts.

Step five deserves particular attention because it is the most fixable and the least discussed. In several large institutions each additional information request opens a fresh case object with no context inherited from the previous one. An analyst who has already spent twenty minutes understanding a merchant's corporate structure spends much of it again on the next touch. The cost of a request is therefore not linear in the number of requests; it is superlinear, because context is discarded between rounds.

Observed case: a global payment service provider

The following is drawn from internal operating data shared with Detected under confidentiality by a global payment service provider, and is presented in abstracted form. Absolute volumes, product names, internal system names and segment identifiers are withheld. Ratios and durations are reproduced as reported. Scope and definitions, as supplied: North American SMB applications across more than one acceptance product, first half 2026; durations are reported as averages rather than medians or percentiles, and as calendar days; the underwriting figure covers applications entering the full review band and does not separate out integration-dependent cases; the decline share counts applications refused on fraud or risk grounds and excludes applications that lapsed, were withdrawn, or were closed as technically incomplete. This is a single non-representative illustrative case. It is presented because the pattern matches what we observe across institutions, not because one operator can stand for a market.

The operator runs SMB merchant onboarding across more than one acceptance product, splitting applicants into review bands by expected processing volume: a lighter risk-scored review for the lower band, and a full underwriting and compliance review above it. The published customer-facing experience is a self-serve account creation flow that takes about ten minutes.

The gap between that ten minutes and the actual time to first transaction is the entire subject of this paper.

Three details in this dataset carry more weight than the headline.

The stated cause of the difference between one day and one week is touchpoints, not workload. The operator's own characterisation of the identity review stage distinguishes clean submissions, resolved within a business day, from submissions requiring multiple merchant touchpoints, which take up to a week. Same analysts, same queue, same regulation. The variable is how many times the merchant had to be asked.

Context loss between requests is named internally as a bottleneck. Each additional document requirement generates a new internal ticket, and context is not carried between tickets. The operator identifies this explicitly as adding days to resolution. This is step five above, observed in the wild at scale, in an organisation with world-class engineering resources. It persists because it is nobody's KPI.

The document list above the ceiling is long and almost entirely attestation-only. The full review band requires two years of audited or company-prepared financial statements or corporate tax returns; interim year-to-date financials; three months of bank statements; processor statements; organisational chart and corporate structure; inventory receipts or supplier information; products, services and pricing; professional licences; and key vendors and suppliers. Not one of these is retrievable from any register. Every one is a potential request cycle.

The ratio that should trouble the industry

In the same reporting period, the share of SMB applications declined on fraud or risk signals was under 5%.

Read that against a seventy-day average. A process consuming roughly ten weeks of elapsed time, on both sides of the relationship, resolves to a decline in fewer than one case in twenty. The remaining applications were ultimately approved. We cannot observe what would have happened to them under a different process, but they were not under active assessment for most of those seventy days; they were waiting for a document, or waiting for someone to notice a document had arrived.

Reported churn during the process was under 4% at this operator - a managed segment with named account teams actively shepherding merchants through. That is a managed best case rather than a typical one. We are not able to quantify attrition in unmanaged self-serve SMB onboarding, where nobody chases, and we have seen no published benchmark for it. We would expect it to be materially higher, and the abandonment range in Section 05 is set wide for that reason.

One. Operational drag that scales with growth, not with risk

Request volume is a function of merchant count, not of merchant risk. Doubling merchant acquisition doubles the number of request cycles regardless of whether the incremental merchants are riskier. This is why compliance headcount grows in step with commercial success and why the relationship feels, to every commercial leader who has lived it, like a tax on growth rather than a control. It is a tax on growth. The control is the review; the tax is the retrieval.

It also concentrates. Because most request cycles resolve into approvals, the analyst hours are disproportionately spent on merchants who were never going to be declined. The institution's scarcest expert resource is allocated by document completeness rather than by risk.

Two. Deferred and forgone revenue on both sides

For the provider, an application in the request loop is inventory. It has been paid for through acquisition spend, it consumes servicing cost, and it generates nothing. Extending average time to activation by ten days across a merchant book is a working capital event, not a customer experience event.

For the merchant, the delay lands at the worst possible moment. A business seeking payment acceptance is usually seeking it because it has demand it cannot currently serve. Ten weeks between signing up and taking a first payment is, for a seasonal business, an entire season.

Three. Adverse selection, which is the finding that should worry regulators most

A multi-round information request process may reward persistence more than it rewards integrity.

A legitimate owner-operator running a busy small business responds to a fourth document request with irritation and, often, with abandonment. They have alternatives, they are busy, and the request feels like a judgement. A professional bad actor responds to the fourth request promptly and completely, because completing onboarding is their objective and because fabricated documents are cheap to produce. The material required - a lease, an invoice, a statement, an org chart - is precisely the material that is easiest to falsify and hardest to verify at scale, because there is no independent record to check it against. That is what being above the ceiling means.

Friction, in this specific setting, should therefore not be assumed to be a proxy for control. It may disadvantage time-constrained legitimate applicants without improving risk selection. We do not claim the effect is dominant, and we cannot claim it is established, because we have not measured it. We state it as a hypothesis running counter to the intuition everyone holds, and we found no published study measuring completion rates split by eventual risk outcome. That study, proposed in the method note, is the test that would settle it.

Four. Risk decay, and why perpetual KYB cannot be built on this base

The industry has largely accepted that periodic review is inferior to continuous monitoring, and vendors have responded with event-driven products: registry change alerts, sanctions list updates, adverse media triggers, litigation and filing events. All of these monitor below the ceiling.

Above it, monitoring is structurally incomplete. A merchant declares an expected annual volume, an average ticket, a product range and a fulfilment model on the day of application. Each of those is accurate for as long as it is accurate, and no authoritative event exists that will tell the institution when it stops being true. A merchant that pivots from selling homeware to selling supplements, changes fulfilment from held stock to drop-shipping, or begins accepting pre-orders with six-month delivery windows has materially changed its risk profile without triggering any filing, listing or registry event. Partial signals may surface from transaction patterns, website changes, shipment data, complaints or adverse media, and mature programmes use them. They are lagging, non-universal, and rarely sufficient on their own to support the determination the institution is required to make, which means the practical detection mechanism remains transactional: the institution finds out from the chargebacks. The August 2026 final rule extends the same problem to the narrow population still in scope: by removing the obligation on US persons to update or correct the information behind a FinCEN identifier, it guarantees that even the data that continues to be collected will decay from the day it is filed.

This is a structural limit on perpetual KYB, and it is under-acknowledged in a market that sells continuous monitoring as though it were complete. Continuous monitoring cannot reliably refresh a customer-supplied fact without either a new independent source or a renewed confirmation from the customer. Monitoring the retrievable layer well is a genuine improvement over reviewing it annually. It says much less about the thirty-one fields that actually describe what the business does.

Five. Financial exclusion, concentrated exactly where policy says it should not be

The burden of the attestation layer is not evenly distributed. It falls hardest on businesses with the thinnest independent record, and the thinness of a business's record correlates with characteristics that have nothing to do with risk.

• Age. A firm formed six months ago has no trade payment history, no bureau depth and minimal web presence. Every Tier 3 inference fails, and everything falls back to attestation.
• Size. Around four in five US small businesses are nonemployer businesses, with no payroll beyond the owner, on SBA Office of Advocacy figures for 2025. There is no finance function to produce interim financials on request, and no administrator to chase a supplier for a letter.
• Structure. Sole proprietorships and partnerships frequently have no registry record at all, so even the nine Tier 1 fields are unavailable and the entire dossier is attestation-derived.
• Documentary fluency. Producing an organisational chart, a year-to-date balance sheet and a supplier schedule on request is a skill unevenly distributed across founders, and correlated with prior experience of formal institutions rather than with the quality of the business.

The consequence is that the merchants most likely to abandon are the newest, smallest and least institutionally fluent. They are also, on SBA Office of Advocacy figures, the population responsible for a substantial share of net new job creation in the United States. An onboarding process that filters this population out through documentary attrition is producing an exclusion outcome that no regulator intended and no institution measures. Nobody is doing anything wrong. That is precisely why it persists.

More data sources

The reflexive institutional response to a coverage gap is to add a provider. Where the gap is genuinely a distribution problem - a jurisdiction not connected, a format not parsed - this works, and it is the right answer. Where the field is above the ceiling, adding a fifth provider to four existing ones adds cost, integration surface and reconciliation work while returning the same null. The diagnostic question before any procurement decision in this category is simply: is this field held by anybody at all? If the answer is no, no contract will change it.

Vendor consolidation and orchestration

Orchestration is genuinely valuable. Routing to the best source per jurisdiction, falling back gracefully, reconciling conflicting records and maintaining one schema across sixty regimes is hard, and doing it well materially reduces cost and latency below the ceiling. But orchestration is a distribution technology by definition. Consolidating five providers into one improves the economics and the engineering of retrieving the nine Tier 1 fields. The thirty-one Tier 4 fields are unaffected, because they were never in any of the five.

Institutions consistently overestimate what consolidation will do to cycle time for this reason. They measure the improvement in the retrieval step, which is real, and are then surprised that end-to-end time barely moves, because the retrieval step was never the constraint.

Better inference

Inference from digital footprint, transaction patterns and network signals is improving quickly and will continue to. Two limits apply. First, it degrades exactly where the volume is: the newest and smallest businesses have the thinnest signal, and they generate the most onboarding events. Second, an inferred value is not an attested value, and for a regulated determination the institution needs a record of what the customer stated, not a probability. Inference can prioritise a queue, flag an inconsistency and pre-fill a form. It cannot discharge an obligation to obtain and record a customer's own declaration.

Autonomous agents

This is the argument that will be made most often against this paper over the next eighteen months, so it deserves a direct answer.

Agents will substantially reduce the handling cost of a request cycle. They can detect a gap the moment a submission lands rather than when an analyst reaches the queue, compose a specific and well-targeted request, carry full case context between rounds - eliminating the context-loss problem described in Section 04 - chase at the right interval, validate on arrival, and reconcile answers against everything already known. Applied well, that is a large reduction in the institutional labour pool and a meaningful reduction in elapsed time. We expect it, and it is worth doing.

What an agent cannot do is retrieve a fact that exists in no system. When the required input is the percentage of an LLC held by a member who is a natural person, and no register anywhere records it, the agent's only available action is to ask the owner. It will ask faster, more precisely and more politely than a human, and the owner will still have to stop what they are doing, find the answer, and reply.

The economics of this are worth being precise about. Agents attack roughly 13% of the modelled cost, the institutional labour pool, and can plausibly take a large share of it. They attack merchant labour partially, by asking better and asking once. They do not directly reduce the merchant's latency, which is the dominant driver of elapsed time and therefore of abandonment. A world with excellent agents is a world where the same information is requested, from the same owner, with the same underlying delay, at lower cost to the institution. That is a good outcome. It is not a solution to the ceiling, and describing it as one will lead institutions to under-invest in the remedies that actually work.

For compliance and operations leaders at PSPs, acquirers and banks

• Tier your requirement set before your next vendor conversation. Classify every required field by whether an independent source exists. The proportion above the ceiling is the hard bound on any automation business case, and knowing it changes what you should be buying.
• Report requests per onboarding to your executive committee monthly. It correlates with time to activation more strongly than any metric currently on that report.
• Stop measuring progress in straight-through-processing rate alone. It systematically excludes the population that determines your cycle time. Pair it with mean and 90th-percentile elapsed time including all request cycles.
• Split your funnel by eventual risk outcome. If applicants later flagged for risk complete your process at a higher rate than those never flagged, your friction is selecting against you, and you can establish that from data you already hold.
• Treat data reuse rights as a first-order commercial term. In partner, white-label and processor agreements, the clause governing whether collected business data can be re-presented is worth more than most of the pricing schedule.
• Fix context loss before buying anything. It is the cheapest material improvement available and it requires no new data.

For policymakers and supervisors

• An obligation without a source relocates cost; it does not remove it. Requiring institutions to identify beneficial owners while exempting entities from filing beneficial ownership does not reduce burden. It moves the burden from a one-time structured filing onto a repeated unstructured request, borne by small businesses, several times a year, for the life of the business.
• Distinguish collection from distribution in the design of any register. A register that is collected and closed imposes the full compliance cost on business while delivering none of the operational benefit. If access is politically constrained, constrain it to supervised institutions performing customer due diligence rather than closing it entirely.
• Machine readability is a substantive policy choice, not an implementation detail. A field published only as a scanned image or a per-record paid lookup is, for operational purposes, above the distribution ceiling.
• Consider measuring documentary attrition as a financial inclusion indicator. Applications abandoned during information exchange, split by firm age and size, would reveal an exclusion channel that no current supervisory metric captures.
• Note the asymmetry the Canadian comparison exposes. Two adjacent jurisdictions, one common merchant population, one shared obligation, and radically different data availability. Cross-border institutions are absorbing that difference as operating cost today.