Kbis Extract: What it Proves, What it Doesn't, and When to Use It

Key takeaways

• A Kbis extract proves a company legally exists at the greffe (commercial court registry), nothing more: it says nothing about solvency, bank details, or whether social contributions are paid.
• There is no legal expiry date on a Kbis, but almost every bank, buyer and public body refuses one older than 3 months, so treat that as your internal rule too.
• Any single operation worth €5,000 excluding VAT or more triggers the donneur d'ordre's duty of vigilance: you must collect a URSSAF attestation de vigilance at signature, then every 6 months.
• Fake-supplier and fake-IBAN fraud cost French businesses €183 million in 2024 according to the Banque de France payment security observatory, up 12% in a year, and a Kbis check does nothing to stop it. Bank details need a separate callback.

What does a Kbis actually prove, and what does it not prove?

A Kbis proves one thing: the company is registered at the Registre du Commerce et des Sociétés (RCS, the trade and companies register) on the date the extract was issued. It is the only official document attesting to the legal existence of a commercial company, issued by the clerk of the commercial court after registration.

What it contains is useful and narrow: the clerk's identity, the extract's update date, the legal entity's details (company name, RCS number, legal form, share capital) and the identity of its officers. It will also flag collective proceedings, which is the single most valuable line for an accounts payable team: a Kbis can mention ongoing procedures such as a liquidation or a redressement judiciaire.

What it does not prove: that the supplier pays its social contributions, that it is VAT-registered under the number printed on the invoice, that the bank details you were sent belong to it, or that it can deliver. A pristine Kbis plus a fraudulent IBAN is the most common fraud pattern there is.

A Kbis tells you a company exists. It never tells you that the bank account on the invoice belongs to it.

How old can the Kbis be?

Three months, in practice. The Kbis has no legal validity period set by any statute, but in the vast majority of cases the bodies requesting it demand a document less than 3 months old; beyond that, it is treated as obsolete and refused.

The exception worth knowing: Moselle and Alsace apply a maximum 3-month validity, and the extract there is obtained from the greffe of the tribunal d'instance of the registered office rather than the commercial court.

Why the convention exists is straightforward. Companies change: registered office, activity, legal form can all be modified at any moment, which is why a Kbis never formally expires. A document from 2022 might describe a company that has since moved, changed directors, or entered insolvency.

Practical rule for a 40-person accounting firm handling 300 supplier invoices a month: refuse anything dated more than 90 days back, and ask for a fresh extract at each annual supplier review. A Kbis downloaded from Infogreffe or MonIdenum has the same legal value as the paper version and carries a verification code (QR code or alphanumeric) letting the recipient check its authenticity online on the greffe website. Scan it.

What should I check line by line before creating the supplier in my accounting system?

Seven checks, in order, before the supplier record is opened.

1. Issue date under 3 months, and the verification code scanned against the greffe.
2. SIREN and company name identical to the invoice header and to the quote or contract. A letter-level mismatch in a domain or a company name is the signature of a lookalike entity.
3. Registered office matching the address on the invoice.
4. Officers: the person who signed your contract should appear, or hold a documented delegation.
5. Declared activity: a company registered for retail sale that invoices you for construction work is a problem, both commercially and for VAT.
6. Collective proceedings: any mention of sauvegarde, redressement or liquidation changes your payment terms and your credit exposure immediately.
7. Share capital: €1 is legal and common, but it tells you what you can recover if things go wrong.

Then, and separately, the bank details. Never take an IBAN from the same email that carried the invoice.

When do I need more than a Kbis, and what exactly?

As soon as one operation reaches €5,000 excluding VAT. These checks apply to any operation of at least €5,000 excluding VAT and must be carried out when the contract is concluded, then renewed every six months until it is fully performed. The obligation sits in articles L.8222-1 to L.8222-6 of the Code du travail, which require every donneur d'ordre (the ordering party) to verify its providers' social compliance.

The trap is cumulation. The threshold is assessed cumulatively, not invoice by invoice: several small invoices totalling €5,000 excluding VAT trigger the obligation, even if each one is €800. Courts can add up repeated missions with the same subcontractor and treat them as a single contract with successive performance, so tracking the cumulative amount per supplier is what stops you crossing the threshold unnoticed.

The core document is the URSSAF attestation de vigilance, an official document certifying that a company is up to date with its social obligations, issued by URSSAF only if the company is current on its payments. It must be less than six months old, and you are expected to verify its authenticity with URSSAF.

Several €800 invoices that add up to €5,000 put you in exactly the same legal position as one €5,000 invoice.

What happens if I skip these checks?

You lose your shield against joint liability. The absence of the attestation exposes the company to financial penalties and to joint and several liability in cases of concealed work. In concrete terms, URSSAF can reassess the unpaid contributions of your supplier against you.

The criminal ceiling is high: in cases of established travail dissimulé (undeclared work), penalties can reach €45,000 for an individual or €225,000 for a legal entity, plus up to 3 years' imprisonment under articles L8224-1 and L8224-5 of the Code du travail. Exclusion from public contracts and loss of contribution exemptions sit alongside that.

This is not theoretical enforcement. In 2024, URSSAF recovered a record €1.6 billion from its fight against undeclared work.

Keep the paperwork: attestations should be retained for at least 5 years after the contract ends, covering URSSAF's prescription periods (3 years, extended to 5 in cases of undeclared work).

How do I stop fake-supplier fraud, since the Kbis won't?

By confirming bank details on a channel the requester did not choose. Every IBAN change must be confirmed through a different channel from the one that carried the request: a call to the supplier's already-known number, never the one in the new message. That out-of-band callback breaks the fraudster's script.

The scale justifies the friction. In 2024, fake transfer orders rose 29% in volume at French companies, with losses estimated at €45 million a year for French SMEs alone, and the attacker needs no malware: an email with a modified IBAN is enough.

Paying the wrong account does not clear your debt. The victim suffers a double penalty: it must pay the real creditor a second time while having lost the funds sent to the fraudster. Banks usually refuse to refund, because in fake-IBAN fraud it is your company that authenticated the order, validated the IBAN and clicked.

Three controls that cost nothing: callback for any bank detail change, dual approval above a set amount (€5,000 is a sensible line), and a rule that no supplier record is created without the Kbis, the attestation and a verified IBAN all present. Teams processing hundreds of invoices a month often push these checks into their intake workflow; Sygnet builds document extraction used for supplier and vendor onboarding and publishes a KYC document collection checklist that covers the same ground for regulated onboarding.

Does e-invoicing change any of this?

It changes how invoices arrive, not who you have to verify. Since 1 September 2026, all VAT-liable companies established in France must be able to receive electronic invoices, while large companies, mid-caps and members of a single taxable entity must also issue them and transmit their e-reporting data. Issuing becomes compulsory for SMEs, very small businesses and micro-enterprises on 1 September 2027.

One practical consequence for supplier onboarding: all VAT-liable companies established in France must register in the central annuaire before 1 September 2026, including those whose issuing obligation only starts in September 2027. A new supplier who cannot give you a valid reception address is a supplier whose invoices may not reach you at all.

Structured invoices do make the SIREN-level matching easier, since the identifier travels in the data rather than in a scanned header. The duty of vigilance, the 3-month Kbis convention and the IBAN callback survive untouched. If you want the French rules in detail, see Sygnet's note on e-invoicing in France and the 2026-2027 deadlines and penalties for SMEs.

FAQ

Is a Kbis older than 3 months legally invalid?

No. Legally yes, it remains valid provided nothing about the company has changed; in practice no, because almost all organisations and partners refuse it. The one real exception is Alsace-Moselle, where a maximum 3-month validity applies. Treat 90 days as your internal cut-off regardless, because insolvency proceedings and director changes appear on the extract and nowhere else in your file.

Do I need an attestation de vigilance for every supplier?

No, only where one operation reaches €5,000 excluding VAT. Verifications are compulsory for any operation of at least €5,000 excluding VAT under article R.8222-1, whatever the sector or company size, covering subcontracted works as well as service providers in cleaning, maintenance, transport or IT. Many teams request it at the first contract anyway, even below the threshold, which avoids chasing documents later.

My supplier emailed a new RIB with a copy of its Kbis. Is that enough?

No. The Kbis says nothing about bank accounts, and the email itself may come from a compromised mailbox. Attackers read the thread, create an address with one modified character in the domain, copy the logo and layout, and slip a new RIB into the conversation. Call the number you already hold in your records, confirm with a named person, log the call, then update the record under dual approval.