Executive Summary: Can a Secretary of State API return the EIN? Rarely. Cobalt's help center says state registries generally do not publish EINs and names Florida as the only state that does, and even a Florida record carries the number only when the filer reported one. The EIN has to enter the loan file from the applicant's IRS paperwork, and a name-plus-EIN check against IRS records can only test a pairing you supply, never discover a number you lack.
Does a Secretary of State API Return the EIN in Most States?
What does a state registry actually publish?
A registry search identifies an entity and shows its standing: the registered name, the state's own filing number, status, and filing date, plus agent, address, and officer details where the state publishes them. The federal employer identification number is a tax identifier, and Cobalt's help center states the boundary plainly: Secretary of State registries generally do not expose Tax Identification Numbers or Employer Identification Numbers.[1] A second help-center answer names Florida as the only state that publishes them and says an EIN can be used only for TIN verification against IRS records, not to narrow a registry search.[2]
The EIN belongs to a different system. The IRS defines a taxpayer identification number as an identification number used in the administration of tax laws, lists the EIN among them, and issues every TIN other than a Social Security number.[3]
Does Cobalt's documented response include an EIN field?
It does. Cobalt's public API reference lists EIN and taxPayerNumber among the possible Secretary of State result fields, next to fields such as agentName, officers, sosId, and screenshotUrl.[4] The help center points integrators to a downloadable spreadsheet of field-level breakdowns by state,[5] and that spreadsheet marks the EIN field for Florida only and the taxPayerNumber field for Texas only.[6]
A field in a schema is a slot, not a promise. The developer reference for Secretary of State API fields shows what each populated field can prove.
What did a live measurement show?
Cobalt's own measurement on September 11, 2026 searched three large national companies by name in all fifty states and the District of Columbia: 153 probes, each with a 180-second ceiling. Of those probes, 113 returned a record, 110 live and three from Nevada's cache while that state's site was down for maintenance. Another 19 completed with no exact match, and 21 did not finish inside the ceiling.
Eight fields came back from every jurisdiction: the state entity identifier that Cobalt calls sosId, the registered name, status, filing date, the normalized forms of status and filing date, the state of registration, and a confidence score. Officer records came back from 32 jurisdictions. The measurement did not check the EIN, FEI, or taxPayerNumber fields, so it cannot show whether any response carried them.
The limits matter. One day and three well-formed names show what a state can return, not what it never returns, and nothing here is a service expectation.
Why Does Florida Differ, and How Far Should a Lender Trust It?
What does Florida law require on the annual report?
Florida's annual-report statutes ask for the number. The limited liability company statute requires the report to state "The company's federal employer identification number or, if none, whether one has been applied for."[7] The corporation statute uses the same construction: "The corporation's federal employer identification number, if any, or, if none, whether one has been applied for."[8]
Read those clauses as an underwriter. The filer supplies the number, the statute accepts "none" and "applied for" as complete answers, and neither section asks the state to check the number against IRS records. A Florida record can show an EIN, show none because the entity had none or had only applied, or show a number mistyped at filing, and the record alone cannot tell you which.
What has Cobalt said about a Florida EIN field?
The help center names Florida as the only state that publishes EINs,[2] and the field spreadsheet marks the EIN field for Florida only.[6] Cobalt's September 11 measurement did not check that field; check each Florida record for the number.
Where one appears, it is the number the filer reported, not one the state checked against IRS records, so treat it as a pre-fill the applicant confirms, never as a substitute for the applicant's paperwork.
Which other state systems touch the EIN, and what do they return?
Texas shows a different pattern. The Comptroller's Franchise Tax Account Status search accepts either the eleven-digit Comptroller taxpayer number or the nine-digit federal EIN as its search input, alongside entity name and Texas Secretary of State file number.[9] That is the Comptroller's franchise tax system, not the Secretary of State registry, and it answers a lookup for an EIN you already hold. Cobalt's public reference does not describe what its Texas taxPayerNumber field contains, so ask Cobalt before reading any part of that value as a federal number.
Delaware shows the other limit. Its online status service returns status and, in its fuller option, the last five filings, franchise tax assessment, and authorized shares, while officer and director names stay on annual-report images and are not available through that application.[10] None of it is a federal tax number.
How Is an EIN Confirmed When the State Record Does Not Carry It?
Which documents carry the EIN the applicant should produce?
The applicant holds the evidence. The IRS gives three ways to confirm an EIN: request an entity transcript, download a digital CP575 from Business Tax Account if eligible, or call the business and specialty tax line and request Letter 147C, EIN Previously Assigned.[11] For a lost number, the IRS gives it over the phone only after verifying identity and only to a person authorized to receive it.[11] A lender cannot call the IRS and obtain a borrower's EIN, so it asks the applicant for one of these:
• Original assignment notice. The CP575A-J series notice the IRS issued when it assigned the number.[12]
• Digital CP575. The Business Tax Account notice that confirms the EIN, substitutes for the original series and for Letter 147C, and belongs in the business's permanent records.[12]
• Letter 147C. The IRS letter restating a previously assigned EIN.[11]
• Form W-9. The applicant's own statement of its name and TIN on the IRS Request for Taxpayer Identification Number and Certification.[13]
• Form SS-4 copy. The EIN application that created the number, with the legal name as first filed.[14]
None of these documents is a public record. Cobalt's help center makes the same point when it tells teams to show non-U.S. colleagues how U.S. TIN matching differs from VAT systems and why there is no public EIN lookup.[15] The IRS also issues EINs through its own online application at no charge,[16] so a paid filing service's receipt is not IRS evidence of the number.
Who can validate a pairing directly with the IRS?
The IRS operates its own validation service, with rules on who may use it and for what.
The TIN Matching service lets you validate TIN and name combinations before submitting an information return.
That is the IRS's own description.[17] The service is for payers of income subject to backup withholding: the IRS adds payers that filed Forms 1099 within the last two years to report backup withholding, and participation requires an application and an IRS account.[17] Publication 1281 sets out the backup withholding rules that follow a missing or incorrect name and TIN and notes which 1099 filers may be eligible for TIN Matching.[18]
The TIN Matching page also says who the service is for: "TIN Matching is only for payers and their authorized agents that submit information returns."[17]
What does the bank CIP rule require, and what can a non-bank lender take from it?
Banks operate under a Customer Identification Program rule that names the identifier: before opening an account, the bank must obtain an identification number, which for a U.S. person is a taxpayer identification number.[19] The rule also allows procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number.[19]
The rule binds banks, not a merchant cash advance funder or an equipment finance company outside a bank. Its applied-for exception is still a useful model: a written procedure for the gap between formation and EIN assignment, rather than a hard stop or a blind pass.
What Does TIN Verification Add, and What Can It Never Do?
What does a name-plus-EIN check actually confirm?
A TIN verification call asks the IRS whether a business name and a number go together. In Cobalt's API reference, the answer arrives as a status of Pending, TIN Matched, Did Not Match, or In Review, with the IRS code that explains it.[20] It returns no state registration details, so it cannot tell you the entity's address, officers, status, or formation date.[2]
Both inputs come from the applicant's paperwork: the legal name as filed with the IRS and the number, taken from the W-9 or an IRS notice. A match means the IRS accepted the pairing under its name-matching rules, explained below. It does not by itself prove that the applicant is the registered entity, which is why the state record stays in the file.
Why can the check never discover an EIN?
Cobalt's help center answers the search question directly: Cobalt does not support entity lookup by TIN, and TIN verification only checks whether a provided business name matches an EIN in IRS records.[21] There is no candidate list and no reverse lookup. If the applicant cannot produce the number, there is nothing to verify.
So the intake form, not the API, is the control. An application that leaves the EIN optional produces files with a blank where the pairing should be.
How do IRS name-control rules create false mismatches and false matches?
Cobalt's help center describes two rules, and both apply. The first is strict: the IRS check is one-to-one on the legal business name,[22] and legal endings such as Inc. or LLC are part of that name, so inaccurate formatting can cause a mismatch.[23] The second explains what the IRS compares: a name control, "usually the first four characters of the business name," so two similar names that share those characters can both return a valid match for the same EIN.[24] Cobalt removes only the dash from the TIN and sends the business name exactly as provided,[25] so whatever the lender types is what the IRS compares.
Read together, the two rules sort the results into groups:
• Trade name instead of legal name. A storefront name that starts differently from the IRS name fails under either rule.
• Name changed at the state but not at the IRS. A renamed entity can fail if the IRS still holds the old name, most clearly when the first four characters changed.
• Legal ending dropped or altered. In most names the ending falls after the first four characters and may not decide the result, but the help center treats it as part of the exact name, so send it as the applicant's IRS document shows it.
• Affiliate with a near-identical name. A sister company that shares the first four characters can match the same EIN, a false match rather than a mismatch.
• Number typed wrong. A transposed digit returns a not-issued code or a name mismatch, depending on whether the wrong number exists.
The last two point to the wrong entity or the wrong number. The IRS returns true or false for a match on the name it is sent,[2] so when that name comes from the applicant's self-certified W-9,[13] the check cannot catch an affiliate's EIN by itself. The comparison below adds the state record's legal name. Each group is a data-quality problem with its own fix.
How Should Intake Handle a Missing or Unverifiable EIN?
What should the application require before any vendor call runs?
The intake form should require the EIN as nine digits, the legal name as filed with the IRS in its own field separate from the trade name, and one IRS document, a CP575, a Letter 147C, or a signed W-9, as an upload. It should also capture the state of formation and, where the applicant has it, the state entity number. Cobalt's API reference lists that number, sosId, as a search input,[4] but the per-state spreadsheet marks search by sosId for Florida and Mississippi only,[6] so check the state's row before searching by it.
What does each IRS result say about the data?
Each IRS code describes the name and number that were sent. Cobalt's API reference gives the IRS meanings: 0 is a match; 1 is a TIN missing or not nine digits; 2 is a TIN not currently issued; 3 is a name and TIN that do not match IRS records; 4 is an invalid request; 5 is a duplicate request; and 6, 7, and 8 are matches on IRS SSN records, EIN records, or both, each of which can also report a match on ITIN records.[20] The help center publishes the same table.[26] Read as data-quality results, the codes point to these fixes:
• Code 0. The pairing matched as sent, and the W-9 and state-record comparison below still applies.
• Codes 6, 7, and 8. Read the IRS reason first. A match on EIN records fits a business applicant; go on to the comparison below. A match on SSN or ITIN records means an individual's number, which the Form W-9 allows for a sole proprietor or a disregarded single-member LLC's owner;[13] for any other applicant, request the entity's own EIN with its IRS notice.
• Code 1. Fix the intake field, because a missing or malformed number is a form error, not an IRS finding.
• Code 2. Go back to the applicant for the IRS document, because reformatting the name cannot repair a number the IRS has not issued.
• Code 3. Request a W-9 and run the name review above, because a real number with a differently formatted name fails this way. If the review does not explain it, request the applicant's digital CP575 or Letter 147C.
• Codes 4 and 5. Fix and resend the request, since both describe the request rather than the applicant.
Timing changes two of those fixes. The IRS says a new EIN can take up to 2 weeks before it passes TIN Matching,[11] so for a number issued in the last two weeks, recheck after that window before treating code 2 or 3 as a data error. Pending and In Review are not results yet, so record the final status when it arrives. When the IRS service status reports a slow service or an outage, retry on a schedule rather than recording a failure; the retry workflow for an unavailable IRS TIN Matching service covers the state machine that keeps an outage from becoming a false no-match.
The IRS regulation for the TIN matching program speaks to decisions directly. Paragraph (c) of 26 CFR 31.3406(j)-1 applies section 3406(f) confidentiality to any matching details a payor receives through the program and adds: "A payor may not take into account any such matching details in determining whether to open or close an account with a payee."[27] Whether that rule applies to a TIN check in your process, and how any result may be used, is a question for your compliance team to settle before the check goes live.
When should the W-9 name be compared with the state record?
Always, and before the decision: compare the W-9 name, which is the name the IRS check was sent, with the legal name on the state record. A disregarded single-member LLC is the exception: the Form W-9 instructions put the owner's name on line 1 and the LLC's on line 2, with the owner's SSN, or EIN if the owner has one,[13] so compare line 2 with the state record and read a TIN match as a check on the owner, not the LLC. For an EIN the LLC holds itself, ask for the LLC's digital CP575 or Letter 147C.
A W-9 made out to a sister company shows up here as a different name, even when the IRS matched the pairing. A W-9 that puts the applicant's own name next to a near-identical sister company's number can pass both checks, so when the W-9 is the only support for the number, ask for the applicant's digital CP575 or Letter 147C, which the IRS says banks and other institutions accept as written confirmation of an entity's EIN.[12] When the names differ, the lender holds two records that each verified something and a conflict between them. The escalation workflow for a TIN name that disagrees with the Secretary of State name walks through that comparison and its close. The two-source pattern for EIN verification and SOS data describes the sequence once the EIN is in hand; this article is the step before it, where the EIN gets into the file at all.
Which Routes Exist Before Choosing an API?
What does the manual route look like?
The manual route is document collection plus comparison: underwriting collects a W-9 or CP575 with every application, and an analyst compares that name to the state record. It leaves out the lender's own TIN Matching enrollment: Publication 2108 says the program "is solely intended to assist those members of the Third-Party Payor community, and their authorized agents, with meeting their obligation for filing accurate and complete annual Information Return documents,"[28] and the confidentiality rule above covers its matching details.[27] The route's limit is throughput, since a person is in the loop for every comparison.
When does a vendor route fit, and which kind?
Vendor routes come in two shapes. Onboarding and know-your-business platforms package verification with workflow, case management, and decision tooling for a lender that wants all of that from one vendor. A data-layer API returns records into the rules and case management the lender already owns, which also suits companies that build verification into their own products. Put the same two questions to every candidate: where does the EIN enter the file, and what does the vendor check it against? A vendor that cannot answer both in writing has not solved the problem this article describes.
What Should a Buyer Verify Before Relying on Any EIN Field?
Which questions belong in the vendor evaluation?
Ask the vendor to state in writing which states populate an EIN field, whether the number is passed through as filed or checked against anything, and what any other tax-number field contains. Read the EIN row of the per-state field spreadsheet rather than a sales summary.[6] Ask whether the TIN check exposes the IRS code, reason, and service status, how it reports Pending and In Review, and how old a cached result can be. Ask whether the vendor keeps a searchable history of your results or you must store them. If vendor security is part of the review, request current attestation documents from the vendor directly. The Top 34 questions about Secretary of State and business verification APIs collects the wider evaluation set.
What should the file record as evidence?
The evidence record should keep the source of the EIN visible: where the number came from, which document supports it, what the state record showed, what the IRS check returned, and which data fixes remain open. A lender-owned structure like the following, separate from any vendor schema, keeps those facts from blurring into one verified flag. The example is illustrative and is not a Cobalt response.
{
"applicationId": "app_48213",
"ein": {
"value": "XX-XXXXXXX",
"source": "applicant_w9_upload",
"supportingDocument": "w9_2026-09-18.pdf",
"stateRecordPrefilled": false
},
"stateRecord": {
"state": "FL",
"sosId": "FL-EXAMPLE-0000001",
"registeredName": "EXAMPLE LOGISTICS LLC",
"normalizedStatus": "Active",
"einFieldPopulated": false,
"retrievedAt": "2026-09-24T14:02:11Z"
},
"irsCheck": {
"businessNameSent": "EXAMPLE LOGISTICS LLC",
"status": "TIN Matched",
"irsCode": 0,
"irsServiceStatus": "RUNNING",
"lastIRSCheckDate": "2026-09-24",
"checkedAt": "2026-09-24T14:02:19Z"
},
"dataQuality": {
"w9NameMatchesStateRecord": true,
"openFixes": []
}
}An examiner can follow each block to its source, and a later reviewer can see that the EIN was never pulled from the state record.
Every route above starts from the state record and the applicant's own paperwork. What changes is who checks them, against what, and where the results land. The remaining question is what Cobalt's two calls return when it is the data layer, and in what order to run them.
How Should the State Record and the IRS Check Be Sequenced in Cobalt's Data Layer?
What does the Secretary of State call contribute?
Cobalt's Secretary of State API searches one named state by business name, or by entity identifier or person name where the state supports it, and returns the result fields described earlier.[4] The per-state spreadsheet marks person search for 50 of its 52 jurisdictions,[6] while the help center says it works in some states.[29] Some searches take longer than 30 seconds; the API then returns a retryId to check back with, or sends the business data to a callbackUrl when the search completes.[4] In the measurement, live searches that returned a record took 1.51 to 170.27 seconds, so the call belongs in an asynchronous step. For the EIN itself, the call contributes at most a Florida pre-fill.
What does the TIN/EIN Verification call contribute?
The TIN/EIN Verification API takes two inputs, tin and businessName, and returns name, tin, status, irsCode, irsReason, irsServiceStatus, and lastIRSCheckDate.[20] The reference describes lastIRSCheckDate as the last IRS check date of the cached result, so store it with the result and set a freshness rule for older checks. The service status reads RUNNING or reports that IRS TIN Matching is slow or in an outage, which is the signal for the retry path.[20]
Cobalt returns the code as data. It is a data source, not a decisioning engine, and the permitted-use question above stays with the lender's compliance team.
In what order should the two calls run?
Run the state lookup first, by name in the state of formation or by the state entity number where that state supports it, and take the registered legal name from the result. Then run the IRS check with the applicant's EIN and the legal name as filed with the IRS, which the W-9 or CP575 supplies and which may differ from the state name by an ending or an amendment. Store both results with timestamps and sources in the lender-owned record, work each IRS code through the fixes above, retry when the IRS service is down, and escalate a name conflict between the two records.
The state record can confirm the entity; only the applicant can supply the number. If your team wants to walk through where each field enters your intake and how the two calls fit your existing rules, schedule a workflow review with Cobalt.
.jpg){kind=small}
.png)