Cross-Document Verification: Checks That Catch Bad Files

Cross-document verification means taking one fact (a name, an address, an income, an IBAN, a company number, a date) and checking that every document in the file, and every official register you can reach, says the same thing about it. Most incomplete or inconsistent files are not forged. They contain a payslip from one employer, a bank statement in a slightly different name and a proof of address that is five months old. Each document looks fine alone. The file does not.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of October 2026 and cover the United Kingdom unless stated otherwise. Consult a qualified professional for your situation.

What does cross-document verification compare?

It compares a field on one document with the same field on another document or on a public register, then routes any difference to a human with a defined next step. It is a consistency control, not an authenticity test: two documents can agree with each other and both be wrong.

In the UK, regulation 28 of the Money Laundering Regulations 2017 requires regulated firms to verify identity using documents or information from a reliable source independent of the customer, so a second, independent source is the baseline, not a bonus (MLR 2017, reg. 28). The same logic applies to lettings agents, recruiters and lenders who are not regulated for AML: the value of a second source is that an error or a lie has to survive two independent documents.

For the wider method, see our document verification guide. For why extracting text is not enough, read cross-document validation beyond OCR.

The seven cross-checks, field by field

Seven comparisons cover most of what goes wrong in an applicant file. Each one has a source field, a comparison field, a typical mismatch and a reviewer action.

Dates sit across all seven. A document issued after the application date, a payslip for a month the employment contract had not started, or an expiry date that falls before the decision date are cross-checks in their own right.

How does the income triangle work in practice?

The income triangle compares a payslip, a bank statement and a tax document, because each is produced by a different party. The employer writes the payslip, the bank writes the statement and the tax authority writes the tax record.

Take an illustrative case. A payslip shows net pay of £2,314.60 for September, paid on 28 September. The bank statement shows a credit of £2,314.60 on 28 September from "NORTHWAY LOGISTICS LTD". The name on the payslip is "Northway Logistics Limited". Amount, date and payer line up, and the legal-form suffix is a harmless variant. Now change one thing: the statement shows £2,980.00 from the same payer. That gap is either a bonus the payslip does not include, a different employment, or an edited document. The reviewer does not decide which. The reviewer asks for the October pair and a contract, and records the reason.

Three rules keep this check useful:

• Compare net pay to the credit, not gross pay. Gross is never what lands in the account.
• Match on amount first, then date (allow a few days either side), then payer name.
• Compare at least two months. One matching month proves little; a pattern of matches or misses proves a lot.

Our guide to income consistency checks on rental files applies the same logic to letting applications.

Where do name, address and bank-detail mismatches hide?

They hide in formatting differences that look like fraud but usually are not, and in real differences that look like formatting.

Names: variants versus different people

A name mismatch is benign when the surname and date of birth agree and the difference is an abbreviation, a dropped middle name, a hyphen or an accent. It needs a question when the surname differs, which happens after marriage, divorce or a legal name change. It needs escalation when the first name and surname both differ and no change document exists. Write these three tiers down so every reviewer applies them the same way.

Addresses: one-line differences

An address comparison fails more often on form than substance: "Flat 3, 14 High St" against "14 High Street, Flat 3". Normalise abbreviations, then compare postcode and house number. A different postcode on a document dated after a move is expected; the same postcode with a different house number is not.

Bank details: holder name is the real field

The checksum on an IBAN (the ISO 13616 mod-97 test) catches typing errors, not misdirected payments. The field that matters is the account holder name. A valid IBAN in a third party's name is a valid number and a failed check. In the UK, compare sort code, account number and account holder name together.

How do you cross-check a company file against the register?

You compare the company name, number, status, registered office and officers on the contract or invoice with the public record. In the UK the register is Companies House, which publishes company status, registered office address and officers free of charge (Companies House search).

Four comparisons do the work:

1. Company number on the contract against the register entry for that name.
2. Status: active, dissolved or in administration on the date of signature.
3. Registered office against the address on the letterhead or invoice.
4. Signatory against the list of current officers, with appointment dates.

A register lookup proves that a company exists with that number and who is listed as its officers on that day; it does not prove that the document in front of you is genuine, or that the person signing has authority beyond what the register shows. The mismatch pattern to watch for is a trading name on the invoice with no link to the registered name. Ask the supplier to explain it before adding them.

What does a mismatch look like, and what does the reviewer do?

A mismatch falls into one of three classes, and each class has a fixed response. Without that, the same discrepancy gets accepted by one reviewer and rejected by another.

A file is complete when each of the seven checks has a result, not when each document is present. A missing statement and a failed comparison are different states and should be reported as different states.

Questions people ask about mismatched files

People who handle applicant files on forums and in professional communities tend to ask the same things. These are the two that come up most.

"The name on the payslip is slightly different from the ID. Do I have to reject it?" No. Check surname and date of birth first. If both match, treat it as a variant and record the rule you applied. Reject or escalate only when surname or date of birth differ without a supporting document.

"The tenant's bank statement shows lower income than the payslip. Is it fake?" Not necessarily. Pay can be split across two accounts, reduced by an advance or paid late. Ask for the next month's statement and a second payslip. Treat it as unexplained only if the gap persists and the applicant has no explanation.

Reviewers also ask whether a clean OCR extraction is enough. It is not: extraction reads each document separately, and the comparison across documents is a separate step.

Automating the comparisons

A validation tool should extract the same fields from each document, normalise them and show a field-by-field comparison with a reason for each difference. Whether a mismatch is acceptable stays a policy decision for your team, and the comparison should only use fields you need, in line with the ICO's data minimisation principle under UK GDPR. CheckFile compares fields, dates and register data across a file and flags differences for review; it does not certify that any document is authentic. To see how this works on a financing file, read about our solution for financing and leasing, check pricing or review our approach to security and data handling.

Frequently Asked Questions

What is cross-document verification?

It is the comparison of the same field (such as name, address or income) across several documents and official registers in one file. Differences are classified and sent to a reviewer with a defined next step.

Which documents should be compared first?

Start with the ID document, the proof of address and the income documents. Name, date of birth and address on these three catch the largest share of inconsistent files, and they are the cheapest to compare.

Does cross-document verification detect forged documents?

Not by itself. It finds inconsistencies between documents. A well-made forgery that agrees with the rest of the file would pass, which is why a register lookup or an issuer check is added where one exists.

How many months of bank statements should be matched to payslips?

At least two. One month can match by coincidence or fail for an innocent reason; two months show whether the pattern holds.

What should the reviewer record?

The check, the fields compared, the result, the rule applied and any document requested. That record is what you show an auditor or a regulator if the decision is questioned.