Business Address Verification: Mail Drops, Virtual Offices, and Real Operating Locations

A business address is not one thing. It is one of six categories of physical location, only one of which is the place the business actually operates. A single LLC may file a registered office at a commercial agent’s address in Wilmington, receive mail at a UPS Store in Phoenix, list a Manhattan virtual office on its website, hold a county business license at the owner’s home in Queens, and conduct its work from a leased warehouse in New Jersey, each address true within its own record, none of them the same place.

A KYB check that verifies “the address” without typing it confirms only that some address exists. Address verification has meaning only when the verifier knows which kind of address is being verified and what that kind of address is expected to confirm.

The Six Categories of Business Address

Each of these is a legitimate kind of address and each appears on legitimate filings. They are not red flags. They are different categories of evidence.

Registered office

The address the business has designated with the state for service of legal process. Required of every formed entity. Maintained by a registered agent, who may be the owner, an attorney, or a commercial service.

What it confirms. The state has an address at which the entity can be served.

What it does not confirm. That the entity operates at the address. That the address is anything more than a forwarding location. That mail sent to the address reaches the business.

Operating address

The location where the business actually performs its work: the storefront, the office, the construction site, the warehouse, the kitchen, the studio. A business may have several, or none, depending on what it does.

What it confirms. That work is being done at a specific place.

What it does not confirm. That the operating address matches any address on the state filing.

Mailing address

The address at which the business prefers to receive mail. May be the same as the operating address, the registered office, a separate PO box, or a private mailbox. Often the address that appears on bills, invoices, and contracts.

What it confirms. Where the business expects to receive correspondence.

What it does not confirm. Where the business is. A mailing address tells you nothing about the physical location of the operation.

Virtual office

A commercial address provided by a business-center service: a Class A office building, a downtown business district, sometimes a building with a recognizable name. Comes with mail receipt, occasional reception services, and sometimes a few hours per month of conference-room access. The business does not work from the address.

What it confirms. The business has rented an address at a prestigious location.

What it does not confirm. Any operational presence at the address. Virtual offices are common among legitimate distributed businesses (consultancies, remote-first companies, sole proprietors who want a presentable address). They are also common in patterns that warrant scrutiny.

Commercial mail-receiving agency (CMRA) or private mailbox

A mailbox at a UPS Store, a Mail Boxes Etc., a private mailbox service, or similar. The USPS maintains a registry of CMRAs and requires Form 1583 for mail receipt. Addresses at CMRAs typically include a unit number or “PMB” suffix.

What it confirms. The business has rented a mailbox.

What it does not confirm. Any physical presence at the address beyond the mailbox itself. CMRAs are legitimate (small businesses use them for privacy, security, and reliability) but they are not operating locations.

Residential address

The home of an owner, officer, or employee. Used by sole proprietors and small businesses without separate premises. Increasingly common for distributed and home-based businesses.

What it confirms. A person associated with the business lives there.

What it does not confirm. That the business operates from the home, that customers visit the home, or that the address is suitable for the business’s stated activity. Many legitimate businesses operate from residential addresses; some misuse a residential address to avoid commercial verification.

A Note on Mass-Domicile Addresses

A subcategory of registered-office and virtual-office addresses warrants separate mention: addresses where a very large number of entities are domiciled. The Corporation Trust Center at 1209 N. Orange Street in Wilmington, the LegalZoom and Northwest Registered Agent service addresses, and similar high-volume locations appear in the registered-office field for hundreds of thousands of entities each.

A mass-domicile address is not a red flag. It is infrastructure: a known commercial service used by both Fortune 500 companies and small businesses. The signal value of the address is low (because it is so common); the signal value of the address combined with thin operating signal elsewhere is higher. See Registered Agents in KYB for the broader pattern.

How to Type an Address

Several signals indicate which category an address falls into. None is definitive on its own.

Unit suffixes. “Suite,” ”#,” “PMB,” “Unit,” or “Ste” with a number on a small commercial parcel often indicates a CMRA or virtual office.
USPS CMRA registry. The USPS publishes the list of registered CMRAs; an address that appears on it is by definition a CMRA.
Building tenancy. Looking up the address against commercial listings often reveals whether the building is a single-tenant operating space or a multi-tenant business center.
Parcel and zoning records. County tax assessor and zoning records reveal whether a parcel is residential, commercial, or mixed-use. A residential parcel hosting a stated commercial business is signal.
Reverse address volume. The number of distinct businesses claiming the same address is a signal. Two or three businesses at a small commercial address is unremarkable. Two thousand is a mass-domicile location, not an operating address.
Street-view evidence. A storefront, a sign, a parking lot, a loading dock, and a posted business name are all evidence of an operating address. The absence of any of these at a stated operating address is evidence of something else.

What Address Verification Confirms

The verifiable claim about an address depends on the category. Calibrated address verification asks a category-appropriate question of each address it encounters.

For a registered office. Confirm the address exists and the agent is current. That is all the address is expected to demonstrate.
For an operating address. Confirm operational signs of life: signage, license records keyed to the address, payment processing at the address, employer records, foot traffic, web mentions.
For a virtual office or CMRA. Confirm the address is what it is, and look elsewhere for the actual operating location. A virtual office is honest about being a virtual office only when the verifier reaches for the operating address separately.
For a residential address. Confirm the residential nature, confirm the person associated lives there, and assess whether the stated activity is plausible at a residence. A consultant working from home is plausible; a manufacturing operation from a one-bedroom apartment is not.

What Address Verification Does Not Confirm

A confirmed address, of any kind, does not confirm:

That the business is operating. Many shell entities maintain valid addresses. The address is the door; whether anyone is behind it is a different question.
That the address matches the activity. A liquor distributor with a virtual office address is not selling liquor at the virtual office.
That the address reflects the operating reality of the business. Operating addresses change; state filings often lag those changes by months or years. The address on file may be the address from three moves ago.
That the address is consistent across records. A single business often presents different addresses on different records. The state has one; the license has another; the payment processor has a third; the website has a fourth. The discrepancy is information.

Using Address Data in KYB

Calibrated address verification is structured around four discipline points.

Type before verifying. Determine which kind of address the verification is looking at before applying a verification standard. A CMRA verified as a CMRA is fine; a CMRA verified as an operating address is wrong.

Separate the registered office from the operating address. Most verification programs conflate these and produce false confidence. The state filing’s address is a registered office; the operating address has to be sourced from licenses, permits, employer records, payment activity, or direct evidence.

Read the consistency. Where multiple records exist (state filing, licenses, payment, web), check whether the operating addresses agree. Disagreement is not by itself a problem (businesses move; records lag), but persistent disagreement suggests the operating address is somewhere none of the records show.

Use mass-domicile presence as low-weight signal. A mainstream commercial agent’s address is infrastructure, not a flag. A small or obscure mass-domicile address is more meaningful but still weak. The signal strengthens only in combination with thin operating evidence elsewhere.

The Agentic Extension

An AI agent handling addresses has to be told what kind of address it is looking at. A human analyst will recognize a CMRA at a glance (the “Ste 200” at a small strip mall, the address that comes up in twenty thousand business records). An agent will not, unless the data layer has typed the address in advance.

Two failure modes follow.

An agent treating every stated address as an operating address will produce confident verifications of businesses that operate nowhere. A virtual office, a CMRA, and a real warehouse all read as “address verified” to an untyped check.

An agent treating every CMRA or virtual office as a fraud signal will produce false flags at scale on legitimate small businesses that use these services for ordinary reasons.

The calibrated treatment requires the data layer to type the address, mark its category, and provide the operating address separately when it is available from another source. The agent then verifies category-appropriate claims against category-appropriate sources, and does not generalize a confirmation in one category to a confirmation in another.

Key Takeaways

A business address is one of six categories: registered office, operating address, mailing address, virtual office, CMRA, residential. Each has different evidentiary weight.
A registered office tells you where the entity can be served; it does not tell you where the entity operates.
Virtual offices and CMRAs are legitimate services used by many small businesses. Their presence is not a flag; their presence in combination with thin operating signal elsewhere is.
Mass-domicile addresses (commercial agent addresses with very high entity volume) are infrastructure. The mainstream ones are not a signal; obscure or mismatched ones can be.
Operating addresses have to be sourced from licenses, permits, employer records, payment activity, or direct evidence. State filings rarely carry them reliably.
Address verification has meaning only when typed. An untyped check confirms only that some address exists; it does not distinguish a CMRA from a warehouse.
Agentic verification requires the data layer to type the address in advance. The agent cannot infer category at query time.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Virtual offices, CMRAs, and registered-agent addresses are legitimate services used by many lawful businesses. The presence of any particular address type is not evidence of wrongdoing.

Registered Agents in KYB: The mass-domicile pattern in registered-office addresses.
Anonymous LLC States: Why state files often disclose only a registered office.
Business License Verification: Where operating addresses actually appear.
Shell Company Detection: Address patterns among other signals.
Why AI Agents Hallucinate About Businesses: What untyped address verification produces.