Does a Secretary of State API Map Parent Companies and Subsidiaries? What Actually Links

Executive Summary: A Secretary of State API cannot map parent companies and subsidiaries, because state registries record filings rather than owners. It can return the fields that join a domestic record to its foreign registrations, an assumed-name array where a state exposes one, and, through Cobalt's related-businesses parameter, other entities that list the same officer or registered agent name, with corporate agents filtered out. This guide explains what each link proves, where it breaks, and which sources record ownership, so risk, compliance, and platform teams can write rules around the evidence they have.

What Does a Secretary of State Record Actually Say About Ownership?

Why do state registries record filings instead of owners?

A state registry records that an entity was formed or authorized, who accepts service of process for it, and whether its filings are current. Ownership is not part of that record in most states. Delaware answers the question directly in its Division of Corporations FAQ, which also says alternative entities are not required to list members or managers.^[1]

"This information is not on file with the Division of Corporations. That information is maintained by the corporation itself." Delaware Division of Corporations FAQ, on shareholder and owner names.

Congress recorded the same point in the Corporate Transparency Act, stating as its sense that most or all states do not require information about the beneficial owners of entities formed under their laws.^[2] Cobalt's help center agrees from the data side: public officer data is returned when available, beneficial owner information is generally not provided by SOS registries, and officer records are public registry information, not validated identity proof.^[3]

What can officer and agent fields tell you, and what can they not?

Two people fields appear on many records: officers, the executives or key people listed in state filings when available, and the registered agent for service of process.^[4] Neither is an ownership field. A person can be an officer of a company they do not own, and an agent can be a commercial service with no tie to the entity beyond the appointment.

Coverage is uneven. Cobalt's own measurement on September 11, 2026 searched three large national companies by name in each of the 50 states and D.C. Of its 153 probes, each with a 180-second ceiling, 110 returned a record live, 3 returned Nevada records from the cache while that state's site was down for maintenance, 19 completed with no exact match, and 21 timed out. Across the 51 jurisdictions that returned a record, officers came back from 32 and an agent name from 49; no record from the other 19, including California, Delaware, and Ohio, carried officers. One day and three well-formed names show what a state can return, not what it never returns, and set no service expectation.

Cobalt's help center says nearly all states publish registered agent details, with New Jersey and D.C. as exceptions where availability is limited.^[5] Cobalt's public feature-support spreadsheet, which the help center links, marks agent names for every jurisdiction except New Jersey.^[6] On the measurement, every New Jersey and D.C. record carried an agent name and no Florida or Missouri record did, though all three Florida records carried agentStreetAddress, agentCity, agentState, and agentZip. The spreadsheet also marks officers for 35 of its 52 jurisdictions, including Illinois, Kentucky, and New Hampshire, where the measurement returned none, but not New Jersey, where it did.^[6] Plan against the spreadsheet, and test your own names in the states your book draws from, Florida included. In some states, especially Delaware, the address on a record may be the agent's office rather than the business location.^[7]

Where does that leave the parent question?

A subsidiary is a separate legal entity with its own filing, status, and agent, and nothing in that filing names its owner unless the state collects it. Cobalt's public Find Related Businesses guide for CTOs notes the rare case of a corporation listed as an officer, which would still trigger a related-business match. That is the closest a registry gets to naming a parent.

Can an SOS Lookup Tie a Domestic Entity to Its Foreign Registrations?

What does a foreign registration look like in state data?

"Foreign" in registry language means formed under another jurisdiction's laws, including another U.S. state. Texas requires a foreign filing entity to file an application for registration if it transacts business there, and its statutes list activities that do not count rather than defining the term.^[8] Delaware defines a foreign corporation as one organized under the laws of any jurisdiction other than Delaware and bars it from doing business in the state until it has filed with the Secretary of State.^[9]

The result is one record per state: a Delaware LLC that qualified in Georgia and Texas has three records in three systems, each with its own file number, status, and agent, and no shared identifier across state lines.

Which fields make the domestic-to-foreign join possible?

Cobalt's response carries two fields for this: stateOfFormation, the home jurisdiction, and stateOfSosRegistration, the jurisdiction whose record was returned. When they differ, the record is likely a foreign registration, and some states also label the entity type as foreign.^[10] The Top 34 questions about the Secretary of State API hub explains the same stateOfFormation field in its question on foreign-registered businesses. Running the lookup across several states shows where a business is also registered, often revealing its operating state; many Delaware-registered entities operate elsewhere.^[11]

When the operating states are unknown, Cobalt's Full Verification searches all 50 states and D.C. and returns a separate entry for each state registration, as the Full Verification API guide describes. The join itself is yours: legal name plus stateOfFormation on the foreign record, matched to the domestic record in that state. The foreign qualification guide covers the underwriting use of that comparison.

Where does the join break?

Four cases need an exception path rather than an automatic match.

• Missing formation state. On the September 11 measurement, stateOfFormation came back from 37 of the 51 jurisdictions, against all 51 for stateOfSosRegistration. Where it is missing, the record says where it lives but not where the entity was formed, so the join runs on name alone.

• Assumed-name qualification. Delaware lets a foreign corporation whose name conflicts with one already on its records qualify under an assumed name, which it must then use when doing business in the state.^[9] The foreign record then carries a name the domestic record does not.

• Name drift. A strict string join misses "Acme Holdings, L.L.C." against "Acme Holdings LLC"; a loose join pulls in an unrelated Acme.

• Slow sweep. Full Verification is asynchronous: it returns a search ID, and a status check shows which states have responded so far.^[12] The Full Verification API guide says complete results take 5 to 30 minutes and that a callback URL can receive a POST when the search completes, so the multi-state join belongs in a background step before funding, not inside a form-fill decision.

How Do DBAs and Assumed Names Show Up, and Where Do They Not?

Which office holds the DBA in each state?

A DBA, also known as a trade name, fictitious name, or assumed name, may need to be registered with the state, county, or city where the business is located, and registering it does not provide legal protection by itself. The SBA lists it beside the entity name, a trademark, and a domain name as four ways to register a business name, and says each of these registrations is legally independent.^[13] Which office holds the DBA decides whether a Secretary of State source can ever see it.

Texas is the state-level model for entities. Since House Bill 3609 took effect on September 1, 2019, a business entity that files its assumed name certificate with the Secretary of State no longer has to file it with the county clerk, while sole proprietorships and general partnerships still file at the county. Texas law also does not authorize rejecting a certificate over a name conflict, so multiple certificates for the exact same assumed name can be on file at once.^[14] California is the county model: its Secretary of State says fictitious business names are filed with the county in which the principal place of business is located.^[15] So a California DBA sits in county records, outside Secretary of State data.

What does the API return for assumed names?

Where a state publicly provides DBA or fictitious-name data, Cobalt returns it in a dedicated array field; many states do not expose it, so availability varies.^[16] That field is assumedBusinessNames, and a search by a fictitious name may return that record, with the legal entity also shown under assumedBusinessNames and the matched input indicated.^[17]

Ranking matters for rules. Results are prioritized by confidence score and status, and an inactive record or a fictitious name can rank ahead of the legal entity when it scores higher on raw string similarity.^[18] A first-result rule can therefore select a trade-name registration instead of the entity behind it.

What does a DBA prove about the entity behind it?

Texas describes an assumed name certificate as information about the underlying business's identity and location, and says it does not prevent anyone else from filing the same assumed name or using the name to form a new entity.^[14] The DBA versus legal entity guide walks through the join from a submitted trade name to the legal borrower. An empty assumedBusinessNames array does not show that no alias exists, because the state may not expose aliases or the alias may sit in county records, and a populated one names a trade name, not a second entity and not a parent.

What Does Find Related Businesses Actually Link?

How does the match work?

Two prospects asked Cobalt versions of this question on demo calls: one whether Cobalt connects a parent corporation to its foreign registrations or handles DBAs and domestic-to-foreign links, the other whether one pull can tie a domestic filing to the same company's foreign filings in other states. Cobalt pointed both to the related-businesses parameter. On the call that raised DBAs, Cobalt stated the boundary: it does not draw ties across its data by default, and the parameter looks for the same people on other registrations, not for a legal parent-child structure.

The mechanism, per Cobalt's API reference: add findRelatedBusinesses=true to an SOS search, and Cobalt extracts the agent and officer names from the result, searches its full database across all states for other entities where those names appear, and returns any matches in a relatedBusinesses field.^[19] Cobalt's public Find Related Businesses guide for CTOs shows a sample response and fills in the rest. Per the guide, the field splits into byOfficer and byAgent, each entry carrying a true or false addressMatch indicator against the original result's address. Matching runs in two passes: exact on the uppercased name, then normalized to first and last name without middle initials or suffixes. Corporations listed as registered agents are filtered out. The query runs only against Cobalt's own database and adds one to two seconds at the top end. The feature launched in beta on February 25, 2026.

Why is a name link not an ownership link?

Consider what produces a link and what does not.

• Shared director, unrelated companies. One person sits on the boards of the applicant and two companies it has never dealt with. Where those states publish officers, both return under byOfficer.

• Common name. The normalized pass reduces "John F. Kennedy Jr." to "JOHN KENNEDY", so officers of that name on unrelated entities can link.

• Individual agent. Where the registered agent is a person rather than a corporation, byAgent returns other entities that list the same name, whether or not they share an owner.

• Wholly owned subsidiary, separate management. The parent owns 100 percent, the subsidiary has its own officers, and both use a corporate registered agent service, which the filter removes. No link.

• Sister companies under one holding company. The two operating entities share no individual officer, and the holding company appears in neither record. No link, though the common parent is what the underwriter cares about.

• Agent's office address. A related entity shows an address match because both records list the same registered agent's office, which in some states is the only address the registry exposes.^[7]

The feature shows where else a person's name appears, a useful stacking and shell-entity lead, and is silent on who owns the entity. A hit deserves a review queue and a second signal, never on its own a parent assignment, a borrower merge, or a decline.

Which rules should the reader write around it?

Store each hit as a person link with its own evidence, separate from the entity records it connects. An illustrative record a lender might keep in its own system, not a Cobalt schema:

{
  "link_id": "lnk_000482",
  "subject_entity": {"sos_id": "DE-EXAMPLE-0000001", "state": "delaware", "title": "ACME HOLDINGS LLC"},
  "related_entity": {"sos_id": "TX-EXAMPLE-0000001", "state": "texas", "title": "ACME SERVICES LLC"},
  "link_basis": "officer_name_match",
  "matched_name_normalized": "JANE DOE",
  "address_match": true,
  "address_match_note": "both records list a registered agent office",
  "ownership_evidence": null,
  "relationship_status": "unverified_person_link",
  "source": "cobalt_sos_search_findRelatedBusinesses",
  "retrieved_at": "2026-09-24T14:05:00Z"
}

The important fields are ownership_evidence, which stays null until a source that records ownership fills it, and relationship_status, which never advances past a person link on registry data alone. Weight a byOfficer hit above a byAgent hit. Officers are the executives or key people a filing lists, while the agent is there for service of process,^[4] so a shared officer says more than a shared individual agent about who runs both entities. Send every hit to review, and let an officer hit plus one independent signal change a decision with or without an address match, since one officer on several entities at different addresses can be a stacking lead. Log the feature's beta status with each record. Cobalt also supports a person-name search through the searchByPerson parameters, though not in every state.^[20]

Where Does Parent and Subsidiary Evidence Actually Come From?

Which public sources record ownership relationships?

Two public sources record parent-subsidiary relationships, each for a bounded population. Public companies file Exhibit 21 with the SEC, listing the registrant's subsidiaries, the jurisdiction of each, and the names under which each does business.^[21] For an SEC registrant or a listed subsidiary, that exhibit is the ownership document.

The Global Legal Entity Identifier system publishes Level 2 data that answers who owns whom: entities that hold an LEI report their direct and ultimate accounting consolidating parents, and when those parents also hold an LEI the relationship is published with the child's record.^[22] Coverage therefore depends on how many applicants and their parents hold LEIs.

Commercial corporate-linkage data is the third option. Dun & Bradstreet's Global Family Tree report, for example, shows the target company's position within its family tree, can exclude branches, subsidiaries, and minority holdings, and traces the route to the global ultimate parent.^[23] Treat such a report as a separate, dated source beside registry data, not a replacement for it.

What changed with federal beneficial ownership reporting in 2026?

FinCEN issued a final rule on August 11, 2026, effective August 14, 2026, that exempts U.S. companies from beneficial ownership information reporting; only certain foreign companies registered to do business in the United States must still report, and they do not report U.S. persons as beneficial owners.^[24] The Federal Register text records that the rule carries forward the March 2025 interim final rule's exclusion of all domestic entities from the definition of a reporting company.^[25] Treasury described the removal as permanent.^[26]

So no U.S.-formed borrower now has to report its beneficial owners to FinCEN, Exhibit 21 reaches only the subsidiaries of SEC registrants, state registries generally do not collect ownership, and SOS data cannot fill that gap. Ownership evidence comes from the applicant and the bounded sources above.

What should the applicant supply?

The customer due diligence rule gives the shape. Covered financial institutions must identify and verify the beneficial owners of each legal entity customer, a category that includes an entity created by filing a public document with a Secretary of State or similar office, when a new account is opened. The beneficial owners are each individual who directly or indirectly owns 25 percent or more of the equity, plus one individual with significant responsibility to control the customer.^[27] The rule applies only to covered financial institutions, which it defines by pointing to 31 CFR 1010.605(e)(1).^[27] That paragraph lists banks required to have an anti-money laundering compliance program, securities brokers and dealers, futures commission merchants and introducing brokers, and mutual funds.^[28] Merchant cash advance funders and factors are not on that list, so the rule does not cover them. A bank partner or warehouse lender may still hold a funder to that standard, and the 25 percent prong is a workable threshold either way. Because the rule counts individuals, a stake held through a parent company points to the people behind the parent. Ask the applicant to name the parent too; the registry can then confirm only that the named parent exists and is active.

Tax identity adds a trap. A single-member LLC that has not elected corporate treatment is disregarded for federal income tax and generally uses its owner's SSN or EIN for income tax information returns, but its own EIN for certain employment and excise tax requirements.^[29] A subsidiary LLC can therefore legitimately present its parent's EIN on one form and its own on another. A TIN match will not settle the relationship. Cobalt's help center says the IRS check is exact and requires the legal name, including endings such as Inc. or LLC,^[30] and that the IRS matches on a name control, usually the first four characters of the business name, so similar names sharing those characters may both return a valid match for the same EIN.^[31] Either way, a match confirms a name and number pair, not who owns whom.

How Should a Risk Team Build the Entity Graph Without Overclaiming?

Which record types belong in the graph?

Keep five record types and never let one stand in for another. Entity records, one per state registration, hold what the registry returned, including stateOfFormation where present and the assumedBusinessNames array. Join records connect a foreign entity record to its domestic one and carry the fields that made the join. Alias records connect a trade name to one entity and name the office of record. Person links hold related-business hits and person-name search results. Ownership assertions hold parent-subsidiary claims with the document that made them.

Each record carries its source and retrieval time, and a live pull should keep a saved copy of its screenshot, because the screenshot URL the API returns is short lived.^[19] The separation answers the question an examiner asks later, how you knew this entity belonged to that parent, with an Exhibit 21, a Level 2 record, a certification, or a linkage report, never a shared officer name.

Which evidence grades should each link carry?

• Registry identity. Highest grade: name, status, dates, and agent as the state returned them, with a saved screenshot where available.

• Foreign-registration join. High when stateOfFormation and the legal name both match the domestic record, medium when the join ran on name alone, and an exception when the foreign record carries an assumed name.

• Alias. Medium. A state-exposed DBA is registry data, but the office of record may be a county the API cannot see, and Texas allows duplicate certificates for one name.

• Person link. Low on its own. An officer hit plus a second independent signal grades higher with or without an address match, and an individual-agent hit grades below an officer hit.

• Ownership assertion. Graded by its document: an SEC exhibit, an LEI Level 2 record, a linkage report, or the applicant's ownership certification. Registry data cannot raise it.

• Address match. A modifier, not a grade: it strengthens a person link when the address is an operating location and means little when it is an agent's office. To tell which, check whether the original result's physical address is missing or matches its agentStreetAddress, and read the API reference's agentIsCommercial boolean,^[19] which the feature-support spreadsheet marks for 7 jurisdictions and the September 11 measurement returned from 10.^[6]

Write the grade into the record rather than leaving it to the reviewer's memory, so the same hit reads the same way in six months.

Which failure cases need an exception path?

Route to review, never to auto-match or auto-decline, when the formation state is missing and the name join is loose, when a foreign record carries an assumed name, when several certificates exist for the same trade name, when a related-business hit rests on a common normalized name, and when a parent named by the applicant has no registry link at all. That last case is the normal one for a subsidiary with its own officers and a corporate agent: the missing link is not a discrepancy but what the data model predicts.

Where Does Cobalt Fit, and What Should You Verify Before Relying on It?

None of this depends on any one vendor. The same fields, offices, and failure cases apply whether a team scrapes state sites itself, buys aggregated registry data, or licenses corporate-linkage reports. A vendor changes how much of the entity, alias, and person-link layer arrives normalized, and how much the team still builds. That is the narrow place Cobalt fits.

What does Cobalt supply, and what does it leave to you?

Cobalt supplies the entity and person-link layers described above: per-state records with the join fields, officers and assumedBusinessNames where states provide them, a confidence score, close alternatives, an optional timestamped screenshot, the findRelatedBusinesses person links, and the Full Verification sweep of all 50 states and D.C.

The ownership layer stays with you. Cobalt does not map parent companies and subsidiaries or return ownership percentages or beneficial owners. It is a data source, not a decisioning engine, so the join logic, the evidence grades, and the decision stay with the lender.

What should you confirm before you rely on it?

Three checks before the rules go live. Run your own applicant sample with findRelatedBusinesses=true and count how many hits, including those on common names, resolve to common control once a reviewer checks them; the rate on your book is the only rate that matters. Ask Cobalt which states currently populate assumedBusinessNames, since availability varies by state. Test the domestic-to-foreign join on entities you already know, including one that qualified under an assumed name. To walk through how these record types map onto your intake and review workflow, schedule a workflow review with Cobalt and bring the sample.

Registries record filings; owners are documented elsewhere. Build the graph so every link says which of the two it came from.