Your Business Address Has a Flag On It (And You Can Look It Up)

There is a single-character field attached to your business address in a USPS data product. It reads Y or N. It answers one question: is this address a mailbox service.

The field is called `dpv_cmra`, it ships as part of Delivery Point Validation, and any company that wants it can license it for $22,800 a year. Banks have it. Payment processors have it. Insurers have it. Dun & Bradstreet has it — D&B's own address API documentation publishes a `CMRAValue` field.

What a CMRA actually is

USPS defines it in the Domestic Mail Manual, section 508.1.8: "A Commercial Mail Receiving Agency (CMRA) is defined as a business that, in whole or in part, accepts the delivery of U.S. Mail on behalf of another person or entity as a business service."

That definition sweeps in more than you would guess. The UPS Store. Mailbox rental shops. And office business centers and reshipping services — meaning most virtual office operators.

One virtual office provider says so out loud. Davinci Virtual, on its own blog: "Most reputable providers operate as USPS-registered Commercial Mail Receiving Agencies (CMRAs). That designation means every customer completes USPS Form 1583, which ties the mailbox to a verified identity."

That is the industry describing itself accurately. It is also the industry telling you why the flag exists.

USPS requires the address to announce itself

This is the part most people never learn. USPS Publication 28, section 285: "Mail sent to an addressee at a CMRA must include either the PMB identifier or the #, followed by the appropriate private mailbox number."

PMB stands for private mailbox. The postal rules require the address itself to disclose that it is a mailbox. Writing "Suite 200" where the rules call for "PMB 200" is not a clever workaround — it is a deviation from the published address format, and it does not remove the flag, because the flag lives on the street address, not on the suite line.

The application paperwork tells the same story. PS Form 1583 requires two forms of identification, one government-issued photo ID, and a signature witnessed by the CMRA owner or acknowledged before a notary. Item 4 asks for the applicant's home address, and the operator "must verify the documentation to confirm that the addressee resides or conducts business at the permanent address shown."

One company publishes exactly what it does with the flag

Nobody in lending publishes an address policy. Stripe does, in developer documentation, in machine-readable form. Effective July 1, 2025:

To comply with financial partner requirements, Stripe verifies that all accounts have a physical presence in the United States. This means Stripe can no longer allow addresses for registered agents, mailbox services, or virtual address services.Stripe, Issuing address validation documentation

The rejection is not a human judgment call. Stripe publishes two error codes — `invalid_address_cmra_address` and `invalid_address_registered_agent_address` — and the customer-facing message: "The address you provided appears to be associated with a mailbox or virtual address service, which we can't accept."

Existing accounts got a 30-day grace period, after which Stripe "disables account capabilities until you provide a valid address." New accounts are blocked at onboarding.

Read the phrase "financial partner requirements" again. Stripe is telling you, in public, that its sponsor bank made it do this.

Why the bank cares: the CIP rule

Every bank account you open runs through 31 CFR 1020.220, the Customer Identification Program rule. It specifies four data elements, and it defines the address one by type. For an entity, the required element is "a principal place of business, local office, or other physical location."

For an individual it is stricter: "a residential or business street address," with the only written carve-outs being an APO/FPO box or the address of next of kin.

How firmly is that embedded? FinCEN had to issue a formal ruling to create an exception for domestic violence victims enrolled in state Address Confidentiality Programs. Ruling FIN-2009-R003 states the base rule about as plainly as FinCEN ever states anything:

A [financial institution] would not be in compliance with the rules if it accepts the [name of state ACP] post office box address to fulfill CIP requirements.FinCEN Ruling FIN-2009-R003, November 3, 2009

FinCEN's stated rationale: "law enforcement should be able to contact an individual customer at a physical location, rather than solely through the mail."

Opening a business account triggers two separate address collections. CIP takes the entity's physical location. The beneficial ownership rule at 31 CFR 1010.230 takes a "Residential or Business Street Address" for every owner at 25% or more and for one control person — that phrase is the literal column heading on FinCEN's own certification form.

The examiner manual names it as a red flag

Bank examiners work from the FFIEC BSA/AML Examination Manual. Appendix F lists money laundering red flags. One of them, verbatim: "Transacting businesses share the same address, provide only a registered agent's address, or have other address inconsistencies."

FinCEN's 2006 shell company advisory uses nearly identical language and describes shell companies as having "no physical presence (other than a mailing address)," naming mail-forwarding services and "a local street address" as components of a legitimacy package.

This is the mechanism, and it is worth being precise about it. Nobody publishes "we deny CMRA addresses." Regulators publish "a mail-only address is a shell company red flag," examiners test against that, and banks build private policy on top. By the time it reaches you, it is a decline with no stated reason.

Three states say no in writing

Registered agent addresses are the one place this is regulated in plain text, and Texas is the most explicit jurisdiction in the country:

It cannot, however, be a post office box that is part of a commercial mail or message service unless that commercial enterprise is the registered agent.Texas Secretary of State, on Tex. Bus. Orgs. Code § 5.201(b)

Note the irony in Delaware — the state most associated with paper companies statutorily prohibits its own registered agents from operating as pure virtual offices.

Florida draws the cleanest line of the five: PO Box fine for mail, street address only for the agent. That distinction is the correct mental model. You do not have one business address. You have three, they are governed by different rules, and mixing them up is where the damage happens. See how to register an LLC for where each one is filed.

Google will not list you

Google's guidelines for representing your business are unusually direct: "If your business rents a physical mailing address but doesn't operate out of that location, also known as a virtual office, that location isn't eligible for a Business Profile." Also: "P.O. boxes or mailboxes located at remote locations aren't acceptable."

The co-working carve-out is narrower than people assume. Businesses "can't list an office at a co-working space unless that office maintains clear signage, receives customers at the location during business hours, and is staffed during business hours by your business staff." Your staff and your signage — not the operator's.

What the bureaus actually publish — which is nothing

This is where we part company with most of the internet, and it matters.

Dun & Bradstreet publishes no statement that a CMRA or virtual address affects D-U-N-S issuance, PAYDEX, the D&B Rating, the Failure Score, or the Delinquency Predictor. Experian Business publishes no address-type requirement and nothing about address type affecting Intelliscore Plus. Equifax publishes nothing about business address at all — we could not locate a single page.

We also searched for a documented case: a regulator report, a court decision, a CFPB action, an analysis of complaint data showing a CMRA address causing a credit denial. There is none. If a competitor article implies otherwise, ask it for the citation.

The options, and the paper each one produces

Underwriters do not evaluate addresses in the abstract. They evaluate the documents an address can produce. Stripe publishes its accepted proof list, and it is a good proxy for what everyone wants: a lease or rental agreement naming you as tenant, a mortgage statement from the last six months, business liability or property insurance, filed tax documents showing the address, a financial account statement from the last six months, a utility bill from the last six months, or formation documents showing the principal address.

SBA gives the cleanest published definition of what makes an address real. For HUBZone purposes, 13 CFR 126.103 requires "a deed or an active lease" with a start date at least 30 days before review and an end date at least 60 days after — and then adds five words that summarize this entire page: "The concern must conduct business at this location."

What to do this week

An address is a symptom, not the diagnosis

Almost nobody gets declined for one thing. The address that reads as a mailbox usually sits next to an entity name rendered four different ways, a bank account opened at a different address than the state record, and a file with two payment experiences when three is the minimum for a score to exist at all.

Each of those is a week of work. None of them appears in a decline letter. Find out which ones are currently true about your business before you spend a hard inquiry discovering it the expensive way.