# Business document package review (KYB, small-business loans)

> **Since 0.5.0.**

A lender or a KYB team receives a company's documents: formation papers, a Form
W-9, bank statements, a tax return. Someone reads them one by one to answer the
same questions every time. `check_package` answers them **on the machine where
the files already are**, and cites the file, page and exact line for each
answer so a person can check it in seconds.

It prepares the review. It does not approve, decline or score anyone.

## What it checks

| Check | Fails when | Status if it cannot check |
|---|---|---|
| Required documents | A document the profile needs is not in the package | `missing` |
| Legal name | It differs between documents («Inc.», «INC» and «Inc» count as the same) | `missing` with fewer than two documents |
| EIN | Two documents carry different EINs | `missing` |
| Statement balance | Beginning balance + deposits − withdrawals ≠ ending balance | `missing` if a figure is absent |
| Running balance | A transaction row's change in balance is not its amount | not reported without a transactions table |
| Deposits vs. return | Annualized deposits are outside 0.5–2× the gross receipts (the message states the one-statement-per-month assumption) | — |
| Edited files | `info`: statement or return saved by an editor or word processor, modified after creation, changes appended after the first save, or a figure drawn in a font the other figures do not use | — |

Anything it cannot verify is reported as `missing`, never as `pass`.

Profiles: `kyb` (formation document, W-9, bank statement) and `lending` (also a
business tax return).

## Use it

From an agent (MCP), read-only:

```json
{ "tool": "check_package", "arguments": { "paths": ["applications/acme"], "profile": "lending" } }
```

From a terminal:

```bash
sirdas paquete applications/acme --perfil lending
```

## Privacy

The real values are compared locally. The result is then anonymized **as a
whole, with one map**: the model sees `[TAX_ID_1]` against `[TAX_ID_2]` and
knows the EINs differ without seeing either. A person at the terminal can pass
`--no-anonymize` to see the values.

Combine it with an access policy (`SIRDAS_POLICY`) to decide, per agent, which
fields of which document types it may receive at all.

## Limits

Tested on synthetic documents; real packages will find formats the rules do
not know yet. Document types today: Form W-9, Forms 1120, 1120-S, 1065 and
Schedule C, certificates or articles of incorporation and organization,
certificates of good standing, US bank statements and invoices. The edit
signals are reasons to ask the issuer for the original, not proof of fraud.