Overview
Data Validation is the foundational layer of the Graphite security architecture. It ensures that every piece of information entering the network is accurate, properly formatted, and verified against authoritative sources. While the Security Waterfall focuses on high-level identity and banking trust, Data Validation operates at the field level, serving as the primary gatekeeper for data integrity.
Validation is a continuous process. Any modification to "Protected Fields" (such as Tax IDs or Bank Account Numbers) immediately triggers a re-validation and re-initiates the relevant security protocols.
General Field-Level Validations
Graphite provides automated and manual validation for commercial fields to maintain a high-integrity vendor master file for all customers.
| Field Name | Validation Methodology |
| Website | Evaluated via automated authoritative domain engines to confirm the domain is active, reachable, and possesses a mature operational tenure. |
| Address | Processed through localized address validation services to auto-validate formats and ensure global deliverability. |
| Tax IDs | Cross-referenced using direct enterprise data syndication and industry-standard global routing networks.. |
| VAT Numbers | For VIES countries and Great Britain, the system automatically validates the VAT provided matches the Legal Company Name in Graphite. |
| Tax Documentation | Graphite leverages OCR technology to validate information on the document corresponds to the information entered in Graphite Connect. When this information cannot be verified automatically, Graphite reviews the document manually. |
| Routing | Routing numbers are auto-validated via industry-standard global routing networks to ensure accuracy. The bank name, branch address, and SWIFT code are automatically populated based on an approved routing number. Inaccurate routing numbers cannot be saved in Graphite Connect. |
| IBAN | IBANs are auto-validated via industry-standard global routing networks to ensure accuracy. The bank name, branch address, and SWIFT code are automatically populated based on an approved IBAN. Inaccurate routing numbers cannot be saved in Graphite Connect. |
| Account Numbers | Graphite verifies the account number entered corresponds with the uploaded bank document. Additionally, for countries utilizing an IBAN, the bank account number is automatically extrapolated from the IBAN. |
| Program Certification | Graphite verifies that documents uploaded to the Summary section are Certificates and confirms that they have not expired. |
| Email Fields | Disallows improper formatting (e.g., missing @ or domain) and ensures mature domains for users who modify banking information |
U.S. Tax Validation (Form W-9)
Graphite employs a multi-layered approach to W-9 validation, utilizing AI/OCR technology, third-party TIN matching, and manual review to ensure IRS compliance.
Requirements for Accuracy:
- Version Control: Form must be the March 2024 revision or later.
- Legal Name Matching: The name on Line 1 must match the Legal Company Name in the Graphite profile.
- DBA Logic: If a DBA is listed on Line 2, it must be reflected in the Graphite profile.
- Tax Classification: Only one checkbox may be selected. LLC types must be clearly indicated per IRS instructions.
- Address. A valid (standard format) address must be entered. This address can be a PO box.
- TIN Verification: EINs are preferred. SSNs are only accepted for "Individual/Sole Proprietor" or "Single-member LLC" classifications.
- TIN Matching: Graphite uses a third-party tool to verify that the TIN matches the Legal Name against IRS records.
- Signatures: Must be signed and dated; digital signatures are accepted.
1099 Defaults: Suppliers classified as Individuals, Partnerships, or LLC-Partnerships are automatically flagged as "1099 Eligible" in ERP connection data.
Foreign Entity Tax Validation (Form W-8BEN-E)
The W-8BEN-E form is a Certificate of Status of Beneficial Owner for United States Tax Withholding and Reporting (Entities). It is used to document the foreign entity status for purposes of chapters 3 and 4 of the U.S. Internal Revenue Code.
The following process details the verification of the form to meet the IRS requirements and ensure the accuracy of the information:
Requirements for Accuracy:
- W8’s version. The version of the W8 must be the October 2021 rev. or later.
- Name of the organization that is the beneficial owner. The company name must match the legal name entered on Graphite and government records.
- Country of incorporation or organization. The country of registration must be filled.
- Chapter 3 Status (entity type). Only one checkbox must be selected.
- Chapter 4 Status (FATCA status). A checkbox must be selected, and the follow-up section indicated for the chosen status must be filled out. This section may be bypassed if the company does not apply to any of the categories.
- Permanent residence address. The address, city/town, and country must be filled.
- U.S. taxpayer identification number (TIN), if required. “U.S. taxpayer identification number (TIN)" is a must ONLY if the supplier has entered it in his Graphite Profile and it is valid on the IRS records.
- Foreign TIN. This field must be filled in with one Tax ID. However, if the supplier has already answered question 8 (U.S. TIN) it's not mandatory. If the supplier checks the box for question 9c (Check if FTIN is not legally required), they are no longer required to answer question 8 or 9b.
- Claim of Tax Treaty Benefits (if applicable). If the company is claiming treaty benefits, they must fill Part III
- “Capacity to sign” checkbox. This checkbox, located at the end of the W8 form, must be checked.
- Signature, print name, and date. These fields must be completed. Digital signatures are valid.
Workflow: When Validation Fails
If data fails validation (e.g., a TIN mismatch or an expired W-9), the Non-Responsive Validation Workflow is initiated.
- Task Creation: A task is created for the supplier to update details. The Customer Business Owner is notified immediately via email.
- Reminder Sequence: The supplier receives four automated reminders on Days 1, 2, 5, and 7.
- Escalation: After the 7th day, the validation task is closed. A new "Non-Responsive Supplier" task is assigned to the Customer Business Owner.
- Owner Action: The Business Owner must then decide to either reopen the validation task (following manual outreach) or disconnect from the supplier due to non-compliance.
For more information, see Understanding the Nonresponsive Vendor Verification Process
Sanctions & Watchlists
When a company name or ownership detail is updated, Graphite performs an automated check against multiple global sanctions lists (OFAC, etc.) via integrated regulatory watchlists and enterprise compliance networks.
This data can be found in the supplier’s Connection Profile Risk page.
For more information, view our Sanctions Check article