On paper, most risky businesses look ordinary. A storefront has a familiar brand on the awning, a tidy LLC on file in Delaware, and a mailbox that never misses a certified letter. An aggregator submits a neat spreadsheet of sub-merchants. A healthcare supplier shows a string of active registrations. Then the money starts moving — and only later do investigators learn the brand was a franchisee with no real operations, the sub-merchants were shells, and the supplier's “office” was a commercial mail receiving agency.
These failures result from treating registration artifacts as proof of a living business.
Modern KYB work lives in the gap between what a company says it is, what the filings imply, and what the operating signals can actually support. That gap is widest in familiar patterns: sole proprietors trading under DBAs, clusters of entities at the same registered-agent or virtual address, franchise locations whose legal entities don’t match the brand on the door, and networks that reuse phones, domains, and maildrops to obfuscate control.
This article looks at where KYB breaks down in the real world — and how to close those breaks with signals that reflect how businesses actually operate.
239,000 brands in Enigma’s business graph have valid registration artifacts — an LLC filing, a registered agent address, an “active” status — but show zero operating signals. No card revenue in the past 12 months. No customer reviews. No phone number or website. No open locations.
Some of these “paper-only” businesses are legitimately dormant — side projects, holding companies, structures awaiting activation. But many are the raw material of fraud: shells used to launder transactions, nominees that exist only to receive certified mail, or application-mill artifacts designed to pass automated onboarding checks.
The problem compounds when onboarding teams have seconds, not hours, to decide. A Delaware LLC with a registered agent and an “active” status looks identical whether it’s a real operating business or a front. Standard KYB checks — registry lookup, OFAC screening, address validation — are often not enough to separate paper presence from operating reality.
Registration addresses can lie — not always, but often enough to matter.
Enigma’s data reveals that 934 likely registered-agent or commercial mail receiving agency (RA/CMRA) addresses host extreme concentrations of brands — with one location hosting 1,913 brands. These locations host hundreds of entities with the same mailbox, and yet only 21% show card revenue in the past year.
These addresses are friction reducers. They let a new business incorporate quickly, receive legal mail reliably, and maintain a clean paper trail. They also generate opacity. When 300 LLCs share the same suite in Wilmington, Delaware, distinguishing the legitimate businesses from the shells requires more than a registry check.
Enigma’s address intelligence flags these patterns automatically: registration vs. operating address splits, virtual/CMRA indicators, residential vs. commercial classification, and deliverability context. When a merchant’s operating address is a real storefront in Brooklyn but its registration address is a mail drop in Dover, that mismatch is a signal — not proof of fraud, but enough to escalate the review.
But here’s the highest-risk pattern: entities that cluster at RA/CMRA addresses and show no operating presence anywhere else. These are candidates for the “shell merchant” pattern that enables transaction laundering and aggregator blind spots.
Not all industries carry the same KYB risk. Some sectors — religious institutions, cemeteries, certain holding structures — legitimately operate without generating card revenue or online reviews. Others show unusually high paper-only rates for less obvious reasons.
Among industries with 5,000+ registered entities:
High paper-only rates don’t always signal fraud — they often reflect legitimate business models where standard operating signals are sparse. But they do signal onboarding risk: these sectors require manual review because automated checks can’t distinguish dormant-but-legitimate from never-was-real.
Healthcare is a particularly complex case. 3,412 addresses host 5+ healthcare-related brands each, with a 33% revenue rate. Some of these are legitimate medical office buildings or hospital campuses. Others match the profile of nominee billing operations — entities spun up rapidly, clustering at shared addresses, showing minimal revenue or patient-facing activity.
Enigma’s edge: Cross-referencing address clusters with operating signals (revenue, reviews, multi-location presence, licensing context) helps distinguish real medical facilities from paper entities designed to submit claims.
The 2020-2021 PPP era offers a natural experiment in business formation patterns. During those two years, 974,000 new brands were formed — 21% more than in the prior two-year period.
Counterintuitively, the paper-only rate declined during the PPP era, from 2.1% in 2018-2019 to 1.4% in 2020-2021. This likely reflects:
The fraud signal is new formation + virtual address + no operating signals + sudden transaction activity — a multi-factor pattern that requires layered screening.
Perhaps the most insidious pattern is the zombie entity: a business registered years ago, dormant for its entire existence, then suddenly showing transaction activity.
Among entities 10+ years old, 2.5% are zombies — valid registration, zero operating signals, no historical revenue or reviews. That’s 140,000 zombie entities in the 10+ age cohort alone.
This pattern is consistent with:
Enigma’s edge: Operating signal timelines reveal when an old entity suddenly “comes to life” — a pattern invisible to static registry checks but obvious when you track revenue, reviews, and transaction history over time.
Twenty-seven US addresses show rapid entity proliferation — 10+ brands formed within a 3-year window, clustering at the same location. On average, these addresses have only 35% of brands showing card revenue.
This temporal clustering pattern is consistent with:
Enigma’s edge: Temporal clustering + operating signal correlation identifies suspicious networks that look legitimate when viewed individually but reveal their structure when analyzed as a graph.
Multiple brands sharing the same phone number or website can indicate:
When combined with other risk signals — RA/CMRA addresses, paper-only status, rapid formation — contact reuse becomes a key indicator of coordinated networks designed to evade KYB controls.
26,000 brand names appear with 3+ different legal entities, suggesting franchise structures, DBAs, or multi-entity operations.
The onboarding risk: Payment processors may onboard “McDonald's LLC #472” thinking it’s the corporate entity, when it’s actually an independent franchisee with different risk characteristics. Merchant acquirers may verify a storefront showing “Subway” without realizing the legal entity is “John’s Sandwich Holdings LLC” — a structure that obscures beneficial ownership and complicates chargebacks.
Enigma’s Brand Search Model resolves storefront → brand → legal entity, ensuring the correct entity is being onboarded. DBA mapping shows when “John's Pizza” is actually registered as “ABC Holdings LLC” — critical for beneficial ownership verification and UCC filings.
Enigma’s KYB v2 is designed for these edge cases. The core capabilities:
The gap between paper presence and operating reality is where KYB fails. Registration artifacts — an LLC filing, a registered agent, an active status — are easy to manufacture. Operating signals — revenue, reviews, deliverable addresses, phone validation — are not.
Enigma’s KYB v2 closes that gap with multi-signal verification that weights operating presence over paper artifacts. Confidence tiers escalate low-signal entities for manual review. Address intelligence flags CMRA/RA concentration. Person verification handles sole proprietors. OFAC integration keeps sanctions checks in-flow.
The result: fewer false positives, faster true-risk detection, and decisions that are auditable from day one.
Data source: Enigma’s full “Brands” database, a pre-flattened SQL delivery table combining brand profiles with embedded corporate registrations, addresses, contacts, and card transaction signals. December 2025. Universe: ~32.5 million brand entities.
Paper presence (0–3 points): Has registration (+1), registration active (+1), has registered agent (+1).
Operating presence (0–5 points): Card revenue in past 12 months (+1), customer reviews (+1), phone on file (+1), website on file (+1), open location (+1).
Confidence tiers: High (operating ≥4), Medium (2–3), Low (1), Paper-Only (operating=0, paper>0), Unknown (neither).
Address clusters (20+ co-located brands):
Temporal patterns:
Franchise detection: Same brand name with 3+ distinct legal entities across 5+ records.
Revenue signals are based on card transactions; cash-only businesses may appear as paper-only despite genuine operations. Some industries (religious institutions, cemeteries) legitimately lack card revenue or online reviews. Contact graph analysis (shared phones/domains) was limited by field availability.