5 website mistakes that cause due diligence failures

Most due diligence failures at the website layer are not caused by anything exotic. They are caused by a short list of predictable, fixable gaps that appear on almost every site built quickly by a founder who was thinking about the product, not the compliance review.

Automated KYB systems from platforms like TrueBiz, Parcha, Persona, AiPrise, and Baselayer have made these checks consistent and fast. A crawler runs before a human ever looks at your application. What follows are the five website mistakes that appear most often in failed reviews, with the specific reason each one is a problem.

Mistake 1: No business email on your domain

Using a Gmail, Outlook, Yahoo, or any other free personal email address as the primary contact for your business is the single most consistent flag in automated KYB systems.

The reason is not that free email providers are inherently untrustworthy. The reason is that a business operating at any serious scale will have set up email on its own domain. The effort required is approximately 15 minutes using any major email provider (Google Workspace, Microsoft 365, Zoho, Fastmail). The cost is $6 to $12 per month.

A business that has not done this either does not know it is a standard expectation or has not bothered. Both interpretations are negative from a verifier's perspective.

What automated systems specifically check: the email addresses visible on your website and in your application are parsed, the domain is extracted, and an MX record lookup is run against that domain. If the MX records point to Google's personal Gmail servers rather than Google Workspace servers, or if there are no MX records at all, that is a flag.

The fix: set up Google Workspace, Microsoft 365, or an equivalent business email plan on your domain before submitting any application. Update every page on your site that shows an email address.

Mistake 2: No legal pages (or legal pages with no content)

A business website without a privacy policy, terms of service, and a contact page with real information reads to verifiers — both automated and human — as a site that was assembled for the application, not a site that was built for a real operating business.

The legal pages are not reviewed for legal quality during KYB. They are checked for existence and for minimum content. A privacy policy with three paragraphs that mention data collection, a terms page that describes the service and the relationship with users, and a contact page with a domain email and a physical or registered address are typically sufficient to clear the automated check.

What commonly fails: a site that has a footer link labeled "Privacy" that 404s, or a privacy page with the single line "We do not collect your data," or a terms page that is identical to a generic template that does not mention the business by name. Automated crawlers parse the page and score based on word count, keyword presence, and whether the company name appears in the content.

The fix: install real legal pages before you apply. They do not need to be drafted by a lawyer to pass the web check, though they should be legally appropriate for your jurisdiction if you are actually collecting user data. Services like Termly, GetTerms, or iubenda generate compliant boilerplate in minutes.

Mistake 3: An About page with no real names, no real team, no real story

The About page is often where human reviewers spend the most time during a manual hold. It is the page that answers: who are the actual people behind this business.

A generic About page — "We are a team of passionate professionals dedicated to delivering value" — with no names, no photos, no professional backgrounds, and no founding story does not answer that question. It performs the shape of an About page without providing the substance.

Automated systems also check the About page. They look for named individuals, titles, and biographical context. Persona and AiPrise, in particular, cross-reference names found on the site against professional databases to confirm that identified individuals exist and have relevant professional histories.

What fails: an About page that describes the company's mission without naming anyone, a team section with stock photos labeled "Our CEO" and "Our CTO" with no names, and pages that were clearly written before the company had a leadership team and were never updated.

The fix: name the founders or the primary operator. Include a one-paragraph professional background. Link to a LinkedIn profile. A single real person with a real name and a credible professional history on your About page is worth more than any amount of corporate language about mission and values.

Mistake 4: No contact page, or a contact page with only a personal Gmail

The contact page is the channel through which a verifier will test whether your business actually responds. During manual review, some compliance teams send a test email or fill out the contact form.

A missing contact page is an automatic red flag. A contact page that shows only a Gmail address (or only a contact form with no email visible) is a weaker version of the same problem. A contact page that shows a domain email address, a physical or virtual office address, and optionally a phone number is what the verifier expects to find.

What automated systems specifically check: the contact page is crawled, all email addresses found on it are parsed, and the domains are extracted. A page that shows yourbusiness@gmail.com will fail the domain email check. A page that shows no email at all — only a form — depends on how the system is configured, but it is generally scored lower than a page with a visible domain email.

The fix: create a /contact page. Show your domain email address prominently. Include the business address (registered address is acceptable). If you have a phone number, include it. Test the form if you have one.

Mistake 5: The website contradicts your registration information

This is the failure that causes the longest delays because it requires actual changes and then re-review rather than just document submission.

Common contradictions: the legal entity name on the application is "Larrazabal Consulting LLC" but the website says "Larrazabal" everywhere and never discloses the full legal name. The state on the application is Delaware but the website says "Based in California." The business category on the application is "software development" but the website only talks about marketing services. The address on the application is a New York virtual office but the website footer shows a Miami street address.

Automated systems that cross-reference data points — Middesk and Baselayer are particularly thorough at this — will flag any of these discrepancies and route the application to manual review. Human reviewers will then ask for an explanation. The explanation takes time, generates back-and-forth, and sometimes results in a denial if the reviewer concludes the discrepancies suggest misrepresentation.

The fix: before you submit any application, audit your website against three data points. First, the exact legal name as filed with your state. Second, the business activity as you have described it in the application. Third, the address and jurisdiction as they appear in your registration documents. Update the website to match all three before applying.

Why these mistakes are so common

These five problems share a root cause: the website was built to describe the business to potential customers, not to satisfy a compliance reviewer. Those are different audiences with different priorities.

A customer cares about whether your product solves their problem. A KYB reviewer cares about whether your business is real, consistent, and operating legally. The language, the pages, and the signals that serve one audience do not automatically serve the other.

PresenceReady builds business websites specifically for the compliance audience. The structure, the pages, and the content are calibrated against what automated KYB systems check and what human reviewers look for during manual holds. The five failure points above are handled in the standard setup.

If your website has any of these gaps and you are about to apply to Mercury, Brex, Relay, Wise, Stripe Atlas, or any other platform with a KYB requirement, fix them before you submit. The days you lose to a manual hold are typically much more expensive than the hours it takes to address the underlying issues.