A cryptographically signed PDF that proves your business is real, verified and trading. Take it to a bank, lender, payments partner, factoring company, landlord or investor. The Ed25519 signature can be verified independently against the public key at /.well-known/did.json. No API call to Fluxa required.
What it is
A four-page PDF, generated from the merchant’s live ledger, signed with an Ed25519 keypair held by Fluxa Ltd.
Most merchants reply to a bank, lender or platform with a CSV export and a screenshot of a dashboard. A CSV can be edited; a screenshot is not signed. Neither carries enough proof to underwrite against without a phone call.
A Verified Commercial Identity is different. It is a four-page document that ties the merchant’s registered legal entity (Companies House) to the merchant’s real trading history (the Fluxa ledger), the merchant’s dispute record (the Card Schemes’ published thresholds) and the merchant’s statement descriptor (verified per card network). Every page is covered by the same Ed25519 signature. Tamper with one value and the signature fails.
Anyone with a copy of the document and the Fluxa public key can verify the signature offline. The public key is published at /.well-known/did.json as a W3C DID document before live VCI documents are issued. The verification step takes off-the-shelf Ed25519 code and finishes in milliseconds.
Set against what UK banks and lenders ask for routinely, here is what a VCI replaces in the underwriting pack:
What the bank or lender asks for
What a VCI provides
Twelve months of bank statements
Twelve months of Fluxa volume with monthly breakdown, net of refunds and chargebacks
Stripe or Square CSV export
Signed PDF that cannot be edited. Any change to any value fails the signature
SA302 and Tax Year Overview
Net revenue evidence with year-on-year comparison for the periods where two years exist
Accountant’s certificate of turnover
Independently verifiable signature against the Fluxa public key. No accountant in the loop
Companies House certificate of incorporation
Companies House details (number, address, status, SIC, VAT) embedded and signed
Statement-descriptor proof from the processor
Per-network descriptor (Visa, Mastercard) verified at generation, with last-change date
See the document
Four pages of bank-grade evidence. The mock below shows the cover page (Page 1) rendered in full. The other three pages follow the same structure with the trading-history, dispute-outcomes and signature-block sections.
The merchant data shown is illustrative (Companies House 12345678 / VCI-2026-00047 / verification code flx_v_8a3f9c1b). A live VCI substitutes the merchant’s actual figures from the Fluxa ledger, with a real document reference number and verification code.
Page 1 of 4
VCI-2026-00047
VERIFIED COMMERCIAL IDENTITY
Verified Commercial Identity
Prepared for Your Company Ltd
Generated 31 March 2026 ·
Data 1 Jan – 31 Mar 2026 ·
Ref VCI-2026-00047
Ed25519 verified · Active
Scan to verify
1Business Identity
Legal name
Your Company Ltd
Trading name
Your Brand
Companies House no.
12345678
Date of incorporation
14 March 2021
Company type
Private Limited Company
Registered address
47 Sample Street, London, EC2A 4NE
SIC code
62012 · Software development
VAT registration
GB 387 2914 08
Company status
Active
2Commercial Track Record
1,771
Transactions
£290,600
Gross volume
£284,498
Net revenue
After refunds
15
Months active
£164
Avg txn
312
Customers
Continuous trading, no gaps in monthly volume
Monthly revenue, last six months
Month
Volume
Net
Txns
Change
Mar 2026
£52,400
£51,310
324
+8.2%
Feb 2026
£48,420
£47,418
298
+3.1%
Jan 2026
£46,940
£45,983
289
−1.4%
Dec 2025
£47,610
£46,650
293
+5.6%
Nov 2025
£45,080
£44,170
277
+2.8%
Oct 2025
£43,840
£42,950
270
+4.0%
3Dispute Outcomes
Disputes raised
9 of 1,771 (0.51%)
Resolved in merchant’s favour
6
Resolved against
2
Pending
1
Industry benchmark
0.94% (UK card-not-present)
4Statement Descriptor
Trading descriptor
YOURBRAND*FLX
Verified per network
Visa, Mastercard
Soft descriptor enabled
Yes
Last change
14 March 2025
The full four-page VCI document. Tamper with any value and the Ed25519 signature on Page 4 fails verification.
What’s in the document
Four pages, four sections. Every figure traces to a specific source on the ledger or Companies House.
Page
Section
Key data points
1
Business identity
Companies House number, date of incorporation, registered office, trading address, SIC code, VAT registration, company status
2
Commercial track record
Twelve-month gross volume, monthly breakdown, transaction count, average value, net of refunds, active period, customer concentration
3
Dispute outcomes
Disputes raised, resolved in favour, resolved against, pending, ratio plotted against Card Schemes’ published threshold
Matched to Companies House at the time of generation. The trading name is verified against the merchant’s statement descriptor on Visa and Mastercard.
Companies House registration number
Eight-digit number, with the date of incorporation and the current company status (Active / Dormant / Liquidation).
Registered office and trading address
Registered office from Companies House. Trading address from the Fluxa onboarding record where the two are different.
SIC code
Standard Industrial Classification code for the merchant’s business activity, as recorded at Companies House.
VAT registration
VAT number where the merchant is VAT-registered, with a note where the merchant is below the threshold.
Page 2 · Commercial track record
Twelve-month volume
Total gross transaction value processed through Fluxa in the trailing twelve months, by month. The monthly breakdown shows trend; the headline is the twelve-month total.
Transaction count
Total successful captures in the same period, with the average transaction value derived.
Net of refunds
Net revenue after refunds and chargebacks deducted. Net is the underwriting-relevant figure.
Active period
First-transaction date and most-recent-transaction date. Consistency of trading is a primary signal for lenders.
Customer concentration
Share of revenue from the top one, top five and top ten customers, with industry benchmarks for the merchant’s SIC code where available.
Page 3 · Dispute outcomes
Disputes raised
Total card-network disputes raised in the period, with the disputes-to-transactions ratio.
Resolved in favour
Disputes where the merchant’s evidence won the chargeback under the Scheme Rules.
Resolved against
Disputes where the cardholder’s issuing bank ruled in the cardholder’s favour.
Industry benchmark
The Card Schemes’ published dispute-rate thresholds for the merchant’s category, with the merchant’s rate plotted against the threshold.
Page 4 · Statement descriptor and signature
Trading descriptor
The text that appears on the cardholder’s bank statement, verified per network (Visa, Mastercard). A clear descriptor reduces dispute rates.
Soft descriptor
Whether soft descriptor (per-product or per-event) is enabled, and when the descriptor was last changed.
Ed25519 signature
The signature block covers every value on every page. The signature is a 64-byte Ed25519 signature in base64 encoding, with the public key reference (the W3C DID document URL) printed alongside.
Verification QR code
QR code linking to the verification endpoint at fluxapay.co.uk/vci/verify/{document_id} for recipients who prefer an online check.
How verification works
Three steps. The recipient never calls Fluxa.
Step 1 · Open the document
The recipient (bank, lender, platform, landlord) opens the PDF. The signature block is on page 4, base64-encoded, with the key ID and the published-key URL printed alongside.
Step 2 · Fetch the public key
The recipient fetches the W3C DID document from https://fluxapay.co.uk/.well-known/did.json. This is a static JSON file containing the Fluxa Ltd issuer identity and the current Ed25519 public key in JsonWebKey2020 format once live VCI issuance begins. The DID document is cached and rotates on a published schedule.
Step 3 · Verify the signature
The recipient runs an Ed25519 verification against (a) the canonicalised document body and (b) the published public key. If the signature is valid, the document is authentic and unmodified. If any value on any page has been changed, verification fails.
The Ed25519 algorithm is the same one used in SSH keys, in TLS 1.3 and in modern signature schemes across the web. Off-the-shelf libraries exist in every major language. A bank’s underwriting team can verify a VCI without ever contacting Fluxa.
Why Ed25519, not HMAC
HMAC-SHA256 is a symmetric construction: the same key creates and verifies the signature. There is no “public” HMAC key. If Fluxa published a verification key, anyone holding the key signs valid Fluxa-branded VCI documents. Ed25519 is asymmetric: the private key signs (held by Fluxa), the public key verifies (published openly). Public-key verification with HMAC is cryptographically impossible; Ed25519 is the modern standard for this exact requirement.
Standards used
Every layer of the verification stack is a public, published standard. No proprietary cryptography, no Fluxa-specific verification client.
Ed25519 signature algorithm
IETF RFC 8032 (Edwards-curve Digital Signature Algorithm). Implementations in Node.js (crypto.verify), Python (cryptography or nacl), Go (crypto/ed25519), Java (BouncyCastle), Rust (ed25519-dalek) and every other major language.
JsonWebKey2020 public-key format
W3C Linked Data Cryptographic Suite Registry, with the underlying JWK format defined in IETF RFC 7517.
did:web identifier scheme
W3C did:web Method Specification, served from the issuer’s domain at /.well-known/did.json. The DID document is a static JSON file; no DID resolver required.
JsonWebSignature2020 proof type
W3C VC Data Integrity 1.0 specification with EdDSA. The signature is over the canonicalised document body.
Where a VCI saves time
Five real scenarios where a single signed document replaces weeks of CSV exports, bank statements and confirmation phone calls.
Situation
Traditional approach
With a VCI
Opening a business bank account
Twelve months of bank statements plus a Stripe or Square CSV export plus screenshots of the dashboard
One signed PDF. The onboarding team verifies the Ed25519 signature and clears the trading-proof requirement
Business loan or asset finance
SA302 tax calculations, accountant’s certificate, three months of personal and business bank statements
Same evidence carried in signed form. The lender’s underwriting system ingests the data without re-keying
Invoice finance or merchant cash advance
Stripe export (editable, not signed). Tier set conservatively on assumed dispute rate
Signed dispute rate plotted against the Card Schemes’ published threshold. Lower rates support higher-tier eligibility
Marketplace or platform onboarding
Manual verification, follow-up emails, phone confirmations to the previous processor
Programmatic Ed25519 verification against the published public key. No human in the loop on the platform side
Lease, landlord or supplier due diligence
Letter from the accountant or the bank, dated and on letterhead. Often refused if older than 30 days
Signed twelve-month trading history. Verifiable offline by the recipient without contacting Fluxa
How a VCI compares
Set against the documents UK merchants normally hand to banks, lenders and platforms, the VCI is the only one that is signed by the processor and verifiable offline.
Document
Issued by
Trading history
Cryptographically signed
Independently verifiable
Fluxa VCI
Fluxa Ltd, the merchant’s processor
✓ Up to 12 months, monthly breakdown
✓ Ed25519 signature, public key at /.well-known/did.json
✓ Offline, off-the-shelf Ed25519 code
Stripe / Square CSV export
Self-generated from the merchant dashboard
✓ Available but unsigned
– Not signed
– Editable in any spreadsheet
Bank-issued processing letter
The merchant’s bank
✓ Often summary only
– Letterhead, no cryptographic proof
– Recipient must phone the bank to verify
Accountant’s certificate
The merchant’s accountant
– Annual or projected, not transactional
– Letterhead, no cryptographic proof
– Recipient must contact the accountant
Dun & Bradstreet / Experian business report
Third-party credit bureau
– Credit history, not transactional history
– Bureau-branded but unsigned
– Subscription or per-pull access only
Companies House extract
UK Government (Companies House)
– Identity only, no transaction data
– Web-issued, not signed
✓ Free, on the .gov.uk register
The VCI is the only artefact that combines processor-attested trading history with offline cryptographic verification. No other UK card processor issues a signed trading credential. The current alternative is a CSV export plus a bank-issued letter, neither of which the recipient can verify without picking up the phone.
Generating a VCI
From the merchant dashboard, in two clicks.
Open the dashboard at dashboard.fluxapay.co.uk and go to Settings → Verified Commercial Identity.
Click “Generate VCI”. The document is generated from the ledger in under sixty seconds, signed with the current Ed25519 key, and made available as a download.
Share the document by attaching the PDF to an email or uploading it to the recipient’s onboarding portal. The recipient verifies the signature against the public key on /.well-known/did.json.
The dashboard also records every VCI generated against the merchant account, with the generation date, the document reference number and the data window. Merchants can reissue a VCI at any time; only the most recent VCI is treated as authoritative.
Eligibility
VCI generation is available to every Fluxa merchant from the first day of live processing. The document carries more underwriting weight once the merchant has accumulated trading history.
Tier
Required trading
Identity
Dispute record
Track record
Day-one
First live transaction
✓ Full
–
Partial (current month)
Thirty-day
Thirty days of live processing
✓ Full
✓ Yes
Trending
Twelve-month
Twelve months of live processing
✓ Full
✓ Yes
✓ Full plus year-on-year
The twelve-month VCI is the version designed to function as a standalone underwriting document for UK lenders and platforms. The day-one and thirty-day tiers cover bank-account onboarding and platform onboarding where current-trading evidence is the requirement.
The VCI is included in every Fluxa merchant account at no additional cost. Founding-cohort merchants get direct support from the Fluxa team for the first VCI generation and for any bank or lender that wants the signature verified out of band.
Common questions
Is the signature legally binding?
The Ed25519 signature provides cryptographic proof that Fluxa Ltd generated the document and that the document has not been altered since generation. The legal weight of the document depends on the recipient’s policy. For UK bank-account onboarding, business-loan applications and platform onboarding, the document is designed as a direct equivalent to a bank-issued processing letter, with the added property that the recipient can verify it offline.
What if Fluxa is no longer operating when the recipient verifies the signature?
The public key is published at the W3C DID document URL. The recipient can verify the signature offline against the published key. The document remains verifiable even if Fluxa Ltd’s service is unavailable; the public key is a static file that can be archived independently.
Can the merchant edit the document before sending?
No. Any edit invalidates the signature. The document is signed at generation and the recipient verifies the signature against the unmodified content.
How is the public key rotated?
The public key is rotated on a published schedule once live VCI issuance begins. Old keys remain published in the DID document with their validity dates, so documents signed under previous keys remain verifiable.
What happens to a VCI after termination of the Fluxa account?
The signature remains valid. The document continues to verify against the published public key. The recipient does not need the merchant’s Fluxa account to be active to verify the signature.
Does the VCI replace Companies House records?
No. The VCI ties the merchant’s Companies House identity to the merchant’s real trading history. Companies House remains the authoritative source for the company’s legal status; the VCI demonstrates that the legal entity is actively trading.
Does Fluxa retain a copy of every VCI?
Yes. Every VCI is recorded against the merchant account with the document reference number, the generation date and the data window. The merchant can reissue or revoke a VCI from the dashboard.
How does revocation work?
The merchant revokes a VCI from the dashboard with a single click. Revocation publishes the document reference number to a revocation list at fluxapay.co.uk/vci/revoked. A recipient who has the verification QR code or document reference number can confirm a VCI is still valid by checking the revocation list. The Ed25519 signature on a revoked document still verifies cryptographically; the revocation list is the authoritative source for whether the document is current.
What if my company details change after generation?
Generate a new VCI from the dashboard. The new VCI carries the updated Companies House details, descriptor record and trading window. Revoke the old VCI from the dashboard. Most recipients accept the most recently issued VCI without question.
Generate a VCI for your business?
Every Fluxa merchant gets a VCI at no additional cost. Founding-cohort merchants get direct support from the Fluxa team for the first generation and for any bank, lender or platform that wants the signature verified out of band. Open a Fluxa account from the home page or write to Fluxa directly. Most applications get a response inside one working day.
Thanks, the Fluxa team will reply within one working day.
