.svg)
.svg)
.jpg)
Reusable KYB sounds like a filing problem. Verify a company once, store the result, stop asking for the same documents.
It is not a filing problem. The reason a company can be verified once and trusted again later is that the evidence changes shape. Instead of a scanned registry extract that someone has to read and believe, you hold a credential that carries specific fields, signed by the body that holds them.
So the useful question is what is actually inside one. There are two answers, because there are two company credentials, and they carry very different things.
European law already answers this for the company-law credential.
Directive (EU) 2025/25 inserted a new Article 16b into Directive (EU) 2017/1132, creating the EU Company Certificate. It entered into force on 30 January 2025. The certificate is issued by national business registers and must be accepted in all Member States as sufficient evidence, at the time of issuance, of the company's incorporation and of the information it carries. The Commission publishes a multilingual template in every official EU language.
The contents are specified rather than left to each register. For a limited liability company the certificate carries fifteen items:
For partnerships the list differs, dropping several items and adding the liability amounts of limited partners and the details of general partners.
Two details matter commercially. A company can obtain its electronic certificate free at least once per calendar year, and any fee is capped at administrative cost. And the certificate is exempt from legalisation and similar formalities, which Article 16d sets out, so no apostille.
One timing point, because it is widely skipped. Member States must transpose the directive by 31 July 2027, and it applies from 31 July 2028. The EU Company Certificate does not exist yet. What exists now is a specified contents list that anyone building company credentials can design against.
The EU Company Certificate comes from company law. The wallet ecosystem has its own company credential, and it is a much thinner thing.
Legal Person Identification Data, usually shortened to LPID, is the legal-entity counterpart to the Person Identification Data a citizen holds. Commission Implementing Regulation (EU) 2024/2977 specifies the data set in Section 2 of its Annex, split across a mandatory table and an optional one.
The mandatory list has two entries:
That is the whole requirement. Everything else is optional:
In the EU Digital Wallet Consortium's implementation profile, LPID is issued by authorised government bodies as an SD-JWT VC over OpenID4VCI, and the issuer is expected to verify representative rights and hold access to authentic business registry data before issuing.
Put them side by side and the design intent is obvious.
LPID identifies a company. The EU Company Certificate describes one.
The consequence for KYB is sharp. LPID tells you a company exists and gives you a name and an identifier you can resolve against a register. It does not tell you the legal form, the status, or, most importantly, who is authorised to sign. Those are EU Company Certificate fields.
So a wallet presenting only LPID answers one question. If your onboarding needs to know that the person in front of you can bind the entity, you need the second credential, or an attestation that carries representation powers explicitly.
Worth noting too that most of the identifiers your existing systems key on, the VAT number, the LEI, even the EUID, are optional in LPID. Designing a flow that assumes any of them will be present is designing for a credential you may not receive.
The field lists are only half of it. A scanned registry extract contains the same facts and is worth far less. Four properties do the work.
It is signed by the issuer. You check a signature rather than judge a PDF.
It is bound to a holder. The credential sits in a wallet controlled by the company, and presenting it proves control. A document proves nothing about who is sending it.
It is selectively disclosable. You can present the fact that a named person may bind the company without disclosing the subscribed capital.
It is machine-checkable. Verification happens in code, against the issuer's signature, in the time it takes to load a page.
That is why reusable KYB works. The credential is reusable because each presentation is verified fresh at source, not because you trusted it once and cached it.
Here is the limit, and it is the part most reusable KYB pitches skip.
Between them, the two credentials tell you the company exists, what form it takes, where it sits and who may sign. Neither says anything about beneficial ownership, about the source of funds, or about whether the counterparty can pay.
Beneficial ownership verification, sanctions and politically exposed person screening, risk assessment and ongoing monitoring all remain obligations under the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, which applies from 10 July 2027. A registry credential is strong evidence for one element of due diligence. It does not discharge the rest.
Company identity is a registry fact. One authority holds it, and that authority issues the credential.
Creditworthiness is not a fact in that sense. It is an assessment, made by a particular assessor, on a particular date, using a particular method. A credential carrying it has to answer three questions a registry credential never faces: who made the assessment, when, and on what basis.
So a credit credential needs fields neither company credential has. Alongside the subject company it carries the identity of the assessor, an assessment date, a validity period and an indication of method or scale, so a verifier can judge not just the score but whether the score means anything to them.
The lesson generalises. For every attribute you want to accept, ask which body holds it authoritatively. Where one authority holds it, the credential is simple. Where it is produced by judgement, the credential has to carry the provenance of that judgement, or the receiving party cannot use it.
The German EUDI Wallet sandbox, run by SPRIND with the Federal Ministry for Digital Affairs, opened to selected organisations on 15 December 2025. It began with Person Identification Data and added Electronic Attestations of Attributes in a second phase. Corporate business-to-business verification is among the use cases it supports, and registration requires a defined use case rather than open access.
Start from the field list, not the flow. For each check in your current onboarding, write down the single attribute that actually settles it, then find which credential carries it. Some sit in LPID, more sit in the EU Company Certificate, and a few sit in neither.
Separate registry facts from assessments. The first kind of credential is straightforward. The second needs provenance fields, and designing it like the first will produce something nobody can rely on.
Keep your AML obligations in their own column. Reusable KYB removes document collection. It does not remove due diligence, and AMLR has a fixed date.
Decide how you register. Accepting company credentials makes you a wallet-relying party, with the registration that implies. We covered the trade-offs in EUDI intermediaries: what they are and why they matter, and the groundwork in our beginner's guide to EU Digital Identity Wallets.
Hovi works across the Nordics and Baltics, and operates inside two of the ecosystems moving fastest.
Hovi Business Wallets let an organisation receive, manage and prove credentials, and sign with its wallet, in the cloud or on-premises. Issuance runs through Hovi Connect. Both are built on the EUDI standards that European Business Wallets are set to build on.
Moreover, Hovi is also part of the France Identité EUDI ecosystem and the German EUDI Wallet Deutschland sandbox, we can help you build and verify against real test wallets today, using Person Identification Data and age verification credentials, and issue Electronic Attestation of Attributes credentials into wallet units across the full credential lifecycle.
Want to explore business wallets and use-cases around them, schedule a meeting with us.
.svg)
