what proof must I provide that my business address actually exists
Extract from the Business Register usually suffices
The proof that onboarding usually wants to see is a recent extract from the Business Register of the Chamber of Commerce. It shows the business address as registered, and that is exactly what the customer wants to verify against what is filled in the onboarding form. An extract that is a few days to a few weeks old is considered current enough in practice; how strictly this is checked varies per customer and per sector. Some portals also accept a screenshot from the Chamber of Commerce website, others want the official PDF file with reference number.
Apart from the extract, onboarding sometimes requests additional proof that the address is also physically used: a recent energy bill in the name of the business, a lease agreement, or a confirmation from the landlord. This is especially the case with new relationships or in sectors where shell structures are a known risk. If you don't have that additional proof, the most honest answer is to provide the extract as your only substantiation and explain that there is no lease or energy contract in the name of the business — for example with a mailbox address at a shared office building. This is related to what your customer precisely means by the business address of the business: some formats specifically ask for the statutory address, others for the actual working address, and these two are not always the same. The registration number under which the business is registered also appears on that same extract, so these two questions are often answered with a single document.
On whom the registration obligation rests
That the Business Register is the source for the address follows from the Business Register Act 2007: every business is required to have its business details, including the address, registered, and this information is publicly accessible and can be proven with an extract.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.