By Pat Kinsel, CEO, Proof and Hicham Oudghiri, CEO, Enigma

A regional bank onboards a new business customer. KYB runs clean. The account opens.

Six months later, that customer initiates a multi-million dollar wire to a vendor it has never paid before. At that moment, the six-month-old verification starts to show its age. Who owns the business now? Does the person sending the wire still have the authority to do so? Is the business even still operating the same way it was when the account opened? The vendor can't prove the receiving account is legitimately its own.

A verification record is a timestamp. It answered the question the day it was run and is trusted long after the facts beneath it have changed. This is not an edge case. It is how business identity has worked for decades.

Wiring money is just one scenario we hear from customers. However, the same gap shows up everywhere a business has to be trusted: a press release attributed to your company that your communications team never wrote, an account statement your finance team never issued, a vendor contract circulated under your letterhead. Fraudsters aren’t just redirecting payments. They are impersonating entire businesses by spoofing email domains, fabricating executives, or generating content in your brand’s identity because there is no credential that proves otherwise. This is why Proof and Enigma are partnering to help solve it.

The problem is bigger than transactions

FinCEN's analysis of identity-related suspicious activity found false records which, including fake identification, forged documentation, or manipulated records, ranked as the second largest fraud category across 1.6 million Bank Secrecy Act filings, representing part of $212 billion in  suspicious activity. False records aren't just a payments problem. They are announcements, account statements, contracts, and authorizations that carry a business's name without carrying its verified identity.

In 2025, deepfake incidents surged to over 8 million, up from 500,000 in 2023. AI-generated content has reached a point where visual inspection is no longer a reliable sanity check. One response to help gaining regulatory momentum is C2PA, a cryptographic provenance standard for media. C2PA has the support of over 6,000 organizations. We're building C2PA support into Business Certificates. That means a business can use the same verified credential to sign a wire, a press release, a video statement, or a contract — with a full auditable trail back to a verified identity.

What we're launching

Proof and Enigma are issuing Business Certificates: verified credentials that bind a current business identity to the delegated authority of the people and systems authorized to act on that business's behalf.

Each certificate is issued by Proof, following the same identity verification standard that has underpinned more than $640 billion in real estate transactions and $150 billion in annual authorizations over the past decade. FIPS Level 3 certified. WebTrust audited. The rigor a notary, regulator, or counterparty can rely on now extends across every high-trust business interaction, not just the ones that happen to involve paper.

The identity underneath is maintained by Enigma. Our graph resolves more than 100 million U.S. legal entities across billions of government filings and 80 million officers and principals, refreshed continuously against state registries, federal records, sanctions watchlists, and beneficial ownership submissions. When a business's status changes, the credential reflects it. We don't sell snapshots. A snapshot is precisely what fails the moment a business stops being what it was.

The certificate isn't just shown. It's used to sign. Bound to a wire, a vendor contract, a release, an agent instruction, the signature carries verified identity into whatever the business puts into the world. Every act becomes traceable back to a real, verified business and a real, authorized person or system.

The wire, resolved. And everything else.

The same wire arrives with a Business Certificate attached. The customer can confirm the instruction came from someone currently authorized to send it. The bank can confirm the business is still in good standing. The vendor can prove the receiving account is actually its own.

The records still sit in the past. The credential answers in the present.

The same logic extends to every channel and transaction where a business's identity can be stolen or spoofed: ACH changes, vendor contracts, press releases, account statements, email domains, and the AI agents acting on a business's behalf with no human in the loop. Each one stops being a record waiting to be reconciled and becomes a signed act with identity baked in.

For decades, notaries answered part of this question for paper. For digital in the era of AI, business identity needs to work the same way consumer identity already does: verified once, portable everywhere, and impossible to credibly fake.

Business Certificates are how we get there.

Talk to us about Business Certificates >