Executive Summary: A borrower can be in perfect standing in the state that formed it and legally invisible in the three states where it earns money. Formation creates a domestic registration in one state, and operating in another state generally requires a second filing there, called foreign qualification. Most underwriting workflows check the first and never look for the second, so the file records an Active entity while the states where the collateral sits and the receivables originate hold no record of the business. This post covers how to detect that condition programmatically, why it changes almost nothing about where you file your lien, and what it should change about how you score the deal.
What Is the Difference Between Domestic Registration and Foreign Qualification?
Domestic registration creates the entity. Foreign qualification asks permission to operate somewhere else. The word foreign carries no international meaning here: a Nevada LLC is a foreign entity in Arizona.
The Small Business Administration states the rule in plain terms: "If your LLC, corporation, partnership, or nonprofit corporation conducts business activities in more than one state, you might need to form your business in one state and then file for foreign qualification in other states where your business is active."[1] The mechanism is a filing with the second state's business office, and the SBA names it: the business must "file a Certificate of Authority with the state," and "Many states also require a Certificate of Good Standing from your state of formation."[1]
Because there is no federal register of American companies, both filings live in state systems that do not talk to each other. The explainer on the US corporate registry landscape covers why that fragmentation exists; the point here is narrower. Two filings, two states, and nothing in either record announcing the existence of the other. The National Association of Secretaries of State confirms both sit in the same office type: "Most NASS member offices handle the registration of domestic and/or foreign corporations (profit and non-profit)," with the reminder that "Fees vary from state to state."[2]
What Does Transacting Business Actually Mean in a State?
Each state defines the trigger itself, as a general standard plus a list of carve-outs. California defines transacting intrastate business as "entering into repeated and successive transactions of its business in this state, other than interstate or foreign commerce," then excludes activities that do not count on their own, including maintaining bank accounts, "Soliciting or procuring orders, whether by mail or through employees or agents," creating debt instruments or security interests, and "Conducting an isolated transaction completed within a period of 180 days."[3]
Texas is more concrete. Its Secretary of State explains that registration is required when an entity "has an office or an employee in Texas or is otherwise pursuing one of its purposes in Texas."[4] The SBA lists four common triggers: physical presence in the state, frequent in-person client meetings there, a significant portion of revenue from the state, or any employee working there.[1]
The underwriting implication is immediate. Selling into a state by phone and mail usually does not require qualification. Putting a warehouse, a service crew, or a salaried employee there usually does. That distinction is invisible in a credit application and highly visible in bank statements and a certificate of insurance.
What Does a Foreign Qualification Filing Add to the Record?
It adds a searchable record in the second state, with its own status field, its own annual obligations, and its own registered agent. California's requirement is representative: "A foreign corporation shall not transact intrastate business without having first obtained from the Secretary of State a certificate of qualification," and the statement filed must name the state of incorporation, the principal office address, the principal California office address, and an agent for service of process inside California.[5]
That last field is the one lenders undervalue. A qualified foreign entity has named someone inside the state who can be served. An unqualified one has not.
Why Is a Borrower Operating in Three States Registered in Only One?
Usually for one of four reasons, and only one of them is fraud.
The most common is formation-state convention. Delaware reports 2,287,728 registered entities and 334,461 new formations in 2025, "a more than fifteen percent increase over 2024,"[6] and states that "More than 66% of the Fortune 500 have chosen Delaware as their legal home."[7] Almost none of them operate there. Formation state and operating state differ by design, so a single-state record tells you nothing about where the business runs.
The second reason is cost avoidance. The SBA notes that "Foreign qualified businesses typically need to pay taxes and annual report fees in both their state of formation and states where they're foreign qualified."[1] Texas charges most foreign filing entities a $750 registration fee, and its late filing fee is calculated by "multiplying the number of whole or partial calendar years that have passed since the date the entity initially transacted business in Texas times the registration fee."[4] A four-year delinquency in Texas is a four-figure catch-up payment.
The third is growth outrunning administration: the company opened a second location in March and nobody knew the rule. The fourth is deliberate concealment, which is rare in isolation and almost never the only anomaly in the file.
Which Activities Cross the Qualification Line Most Often?
For the borrower profiles that dominate revenue-based and merchant cash advance portfolios, four fact patterns account for most of the exposure:
• A leased physical location. A second shop, warehouse, or clinic is the clearest trigger under both the SBA's physical-presence test and the Texas office test.[1]
• Payroll in the state. Any employee working in the state is on the SBA's list, and the tax authority usually learns of it before the business office does.[1]
• Repeated on-site service work. Contractors, mobile medical, and equipment servicing produce "repeated and successive transactions" rather than the isolated transaction California excludes.[3]
• A state-issued operating license. Licensing boards frequently require proof of authority as a condition of issue, so a license with no qualification record is an inconsistent pair.
The trigger tracks physical footprint while the credit application tracks legal entity. Only one of those is verifiable against a government record.
Why Does the Formation-State Choice Make Detection Harder?
Because a Delaware or Wyoming formation gives you a home-state record that is clean, cheap to verify, and almost content-free about operations. It confirms the entity exists, when it was formed, and who its agent is. It will not tell you the business has been running out of Georgia for six years. Searching the formation state and stopping is the most common way a multi-state exposure goes unrecorded, and it is what a single-state lookup workflow encourages. The pillar guide to Secretary of State API solutions surveys the vendors built to search across states rather than one at a time.
How Do You Detect Where an Entity Is Registered Versus Qualified via API?
By running the same lookup against every state in the borrower's operating footprint and comparing what comes back. No single call returns a national registration map, because the underlying records are not national.
What Does a Multi-State Sweep Look Like in Practice?
One request per state, keyed on the same business name, with the state code varying:
curl --location 'https://apigateway.cobaltintelligence.com/v1/search?searchQuery=Sierra%20Freight%20Systems%20LLC&state=georgia&liveData=true&screenshot=true' \
--header 'x-api-key: Your_API_Key' \
--header 'Accept: application/json'The response carries the field that resolves the domestic-versus-foreign question directly:
{
"status": "complete",
"statusCode": 200,
"requestId": "abc123-def456",
"results": [
{
"title": "SIERRA FREIGHT SYSTEMS LLC",
"filingDate": "2021-06-02",
"stateOfFormation": "Delaware",
"status": "Active",
"entityType": "Limited Liability Company",
"registeredAgent": {
"name": "CT Corporation System",
"address": "289 S Culver St, Lawrenceville, GA 30046"
},
"sosUrl": "https://ecorp.sos.ga.gov/BusinessSearch/...",
"screenshotUrl": "https://screenshots.cobaltintelligence.com/..."
}
],
"possibleAlternatives": []
}Compare `stateOfFormation` against the state you queried. A match is a domestic registration. A difference, as above, is a foreign qualification: Georgia holds a record for an entity Delaware formed. A state that returns no result while you hold evidence of operations there is a candidate qualification gap rather than a nonexistent business. Cobalt also documents a separate Full Verification product for cases where the state of registration is unknown at the outset, which searches all 50 states in one call.
How Do You Keep the Sweep From Producing Garbage?
Name matching is where multi-state sweeps fail, because the string that clears in the formation state may not be the string the second state indexed. Names get modified at qualification when the original conflicts with an existing name there. Five controls keep the results usable:
• Search by entity ID where you have one. The `sosId` parameter is exact and immune to name drift, though the identifier is state-specific and does not carry across.
• Read `possibleAlternatives` rather than discarding it. The API returns up to 10 close matches when the exact match is uncertain, and a qualification filed under a modified name often surfaces there.
• Use the confidence score as a routing threshold. High-confidence matches clear, mid-range matches queue for review, low-confidence matches are not treated as the applicant.
• Narrow with address filters. The `street`, `city`, and `zip` parameters cut candidate sets in states that return many hits on common names.
• Capture evidence at query time. Setting `screenshot=true` returns a timestamped image of the state page, alongside `sosUrl` for the record itself.
The exact-match versus fuzzy-search tradeoff is worked through in the company lookup API versus company search API comparison, and per-state depth is mapped in the SOS API data coverage checklist.
Why Does Foreign Qualification Not Change Where You File Your UCC-1?
This is the part that surprises credit teams, and getting it wrong costs perfection.
Which State's Law Governs Perfection?
The debtor's location does, and the debtor's location is a statutory conclusion rather than an observation. The rule is uniform Article 9 text, adopted in materially identical form in every state, so it governs a Delaware debtor exactly as it governs a California one: "while a debtor is located in a jurisdiction, the local law of that jurisdiction governs perfection, the effect of perfection or nonperfection, and the priority of a security interest in collateral."[19] California's enactment carries the same language.[8]
Then the location rule itself: "A registered organization that is organized under the law of a state is located in that state."[9] A registered organization is one "formed or organized solely under the law of a single state or the United States by the filing of a public organic record."[10]
So the Delaware LLC operating in Georgia is located in Delaware for filing purposes, and the financing statement goes to Delaware, whether or not the entity ever qualified in Georgia. Foreign qualification does not relocate the debtor. It grants operating authority in a second state and leaves the perfection analysis where it was. Filing in the state of operations because that is visibly where the business runs remains one of the more expensive avoidable errors in secured lending.
The debtor name follows the same logic. A financing statement provides the name sufficiently only if it provides "the name that is stated to be the registered organization's name on the public organic record most recently filed with or issued or enacted by the registered organization's jurisdiction of organization."[11] The formation-state name governs. If the borrower qualified in Georgia under a modified name and your intake captured the Georgia version, the string you are about to file is the wrong one.
Entities that are not registered organizations follow a different rule. A debtor that is an organization "and has only one place of business is located at its place of business," and one with more than one "is located at its chief executive office."[9] For a general partnership running out of two states, identifying the chief executive office is a factual question the file must answer before anyone files.
What Happens When the Entity's Home State Changes?
The clock starts. Perfection under the prior jurisdiction's law survives only until the earliest of the time perfection would have ceased under that law, "The expiration of four months after a change of the debtor's location to another jurisdiction," or one year after a transfer of collateral to a debtor located elsewhere.[12] A borrower that converts from Delaware to Texas has handed its lenders a four-month refiling window, and nothing in the process notifies them. Practitioner guidance puts it plainly: "If a debtor relocates to a different state, the original filing may no longer be valid. A new UCC-1 must be filed in the debtor's new jurisdiction within four months."[13]
A name change carries a parallel four-month rule, which counsel summarizes as: "If a debtor changes its name such that the existing financing statement becomes seriously misleading, the secured party has four months to file an amendment."[14] Both events appear in registry data before they appear anywhere else in a lender's stack, which is the argument for rechecking formation-state records rather than treating them as static. Scheduled recheck mechanics are covered in the guide to automating filing status updates via API, and the pairing of registration and lien data in the UCC filings plus SOS status lien verification guide.
What Happens to a Borrower That Never Qualified?
It keeps operating, and it loses access to the courts in that state. The second consequence is a credit issue rather than a compliance footnote.
Can an Unqualified Business Enforce Its Own Contracts?
Not in the state it skipped, until it cures. New York is blunt: "A foreign corporation doing business in this state without authority shall not maintain any action or special proceeding in this state unless and until such corporation has been authorized to do business in this state and it has paid to the state all fees and taxes imposed under the tax law."[15] California bars a noncompliant foreign corporation from maintaining "any action or proceeding upon any intrastate business so transacted in any court of this state" until it complies "and has paid to the Secretary of State a penalty of two hundred fifty dollars ($250)," on top of a penalty of "twenty dollars ($20) for each day that unauthorized intrastate business is transacted."[16] The same bar reaches limited liability companies: "A foreign limited liability company transacting intrastate business in this state shall not maintain an action or proceeding" without registration.[17] Texas adds that an unregistered entity "cannot maintain an action, suit, or proceeding in a Texas court until it registers," alongside Attorney General injunction authority and civil penalties.[4]
A borrower can be perfectly Active in its formation state and legally unable to sue its own customers in the three states where it earns revenue. The registry that shows you the good news and the registry holding the bad news are two different registries, and only one of them gets searched.
What Does That Do to the Credit?
It reprices the receivables. A merchant cash advance is underwritten against future receipts, and a factoring line against invoices the borrower must be able to enforce. A business barred from filing suit in the state where its largest customers sit has a weaker collection position than its aging report implies, and the cure is a cash outflow: back fees, penalties, and in Texas a late fee multiplied by every year of delinquency.[4] Neither effect appears in a bank statement analysis. Both are computable from a registration sweep the day the application arrives.
How Do You Score Multi-State Exposure Without Guessing?
Build the score from the difference between two lists: the states where the borrower operates and the states where a registration record exists. Everything else is refinement.
The operating list comes from evidence you already collect: bank statement deposit locations, payroll state codes, certificates of insurance, equipment addresses, licensing records, and the application addresses. The registration list comes from the sweep. Five signals carry most of the discriminating power:
• Coverage gap count. Operating states with no registration record. One gap in a recently entered state reads differently from four across a mature footprint.
• Qualification lag. The interval between the earliest evidence of operations in a state and the `filingDate` on that state's record. A three-year lag says the business qualified under pressure, usually a lawsuit or a license renewal.
• Status divergence. Active in the formation state while a foreign registration elsewhere reads delinquent, revoked, or withdrawn. Divergence beats any single status as a signal, because it shows the borrower maintaining one record and abandoning another.
• Agent inconsistency. Different agents across states is normal. A commercial agent at home paired with an officer's home address in the operating state suggests the second filing was done without counsel.
• Name drift. A qualified name that differs from the `title` on the formation-state record, which is both a fraud signal and, more often, the reason your UCC search came back empty.
Weight those into three tiers rather than a continuous score, because the operational response is discrete. Clean sweeps proceed. Single-gap files proceed with a covenant to qualify inside a defined window and a recheck scheduled at that date. Multi-gap files with status divergence go to manual review, because the pattern that produces four missing registrations tends to produce other missing filings. For running the same sweep across an existing book, see the multi-state UCC monitoring guide.
What Can a Registration Sweep Not Tell You?
Its boundaries matter as much as its output, and a vendor that will not state them is selling confidence rather than data.
• It cannot tell you where the business actually operates. The sweep returns registrations. Operating footprint comes from your own evidence, and the gap analysis is only as good as that input.
• It cannot tell you whether qualification was legally required. That is a facts-and-law question governed by each state's statute and its carve-outs, including the lending-activity exemptions California grants foreign lenders.[3] A missing registration is a question to resolve rather than a finding.
• It cannot equalize officer data across states. Officer and director availability varies because state disclosure rules vary, and the API returns only what the state publishes.
• It does not remove state fees. Delaware sells online entity status in a $10 tier returning current status and a $20 tier adding the last 5 filings, franchise tax assessment, and total authorized shares, and that state charge passes through at cost.[18] New Jersey status data is restricted by statute with a fee attached.
• It does not run at uniform speed. Most states answer a live lookup in 10 to 30 seconds and Oregon can take up to five minutes, so a 12-state sweep is an asynchronous job using `callbackUrl` or `retryId` rather than a blocking call in an application form.
Two more limits deserve naming. Screenshot URLs stay valid for roughly 3 to 30 days, so the evidence has to be downloaded into your system of record or the audit trail expires with it. And Find Related Businesses, which surfaces other entities linked to the agents and officers on a result, is in beta and can add 1 to 2 seconds at the top end, making it a cross-entity signal rather than the basis for a hard decline rule. Freshness limits on any registry read are treated separately in the comparison of real-time SOS data and cached registry data.
Where Does the Foreign Qualification Check Belong in the Underwriting Sequence?
Immediately after the formation-state lookup clears and before anything expensive runs. The formation-state call establishes the entity, its legal name, and its `stateOfFormation`. That last field is the input to everything described here, because it fixes the UCC filing jurisdiction and defines which other states in the footprint are foreign rather than domestic.
The sequencing argument is economic. A 12-state sweep costs 12 credits and returns before a credit pull or a document review. It changes three downstream decisions: which state receives the financing statement, whether the borrower can enforce receivables in its largest markets, and whether the file needs a qualification covenant. Discovering any of those after funding converts a data question into a workout question. Teams weighing the sweep against building state coverage internally will find the arithmetic in the SOS API versus building in-house cost comparison, and the field-level view of a single verification in the entity validation API breakdown.
What the sweep measures is the distance between the borrower a credit file describes and the borrower the states have on record. A single-state check assumes those are the same document. For a business operating across a real footprint they rarely are, and the difference decides where your lien is valid, what your collateral is worth in a collection scenario, and whether the entity you funded can walk into a courthouse in the state where its revenue lives. For the range of verification services behind these checks, see what Cobalt Intelligence offers.
.jpg){kind=small}
.png)