Your NAICS Code Is Scoring You (And You Never Picked It)

There is a four-to-six digit number attached to your business inside every credit bureau, and it is doing more work than you think. You almost certainly did not choose it. You may never have seen it. And at least one major bureau uses it to decide which scoring model gets applied to you.

This is not speculation. Equifax says so in its own product sheet for OneScore for Commercial: "Configurable solution: 12 industry specific scorecards stemming from NAICS (North American Industry Classification System) and SIC (Standard Industrial Classification) codes." The twelve segments are Real Estate, Construction, Retail, Finance and Insurance, Healthcare, Manufacturing, Wholesale, Professional, Transportation and Warehousing, Agriculture and Mining, Accommodation, and Other.

NAICS and SIC are two different systems and you have both

NAICS is the modern one. It was developed under the Office of Management and Budget with Statistics Canada and Mexico's INEGI, and was adopted in 1997 to replace SIC. The revision currently in effect is 2022 NAICS. A 2027 revision was published for comment in the Federal Register on July 13, 2026 — it is still a proposal, not law.

SIC was supposed to die in 1997. It did not, because the institutions that use it never stopped. The SEC still assigns filing review responsibility by SIC code — its own page says the codes "are also used in the Division of Corporation Finance as a basis for assigning review responsibility for the company's filings." OSHA still hosts the SIC manual as a live lookup. And Dun & Bradstreet carries both: "Dun & Bradstreet provides both codes in its business information products."

So you do not have one industry code. You have several, sitting in different systems, populated from different inputs, with no mechanism anywhere that reconciles them.

Where your codes actually came from

Where the code shows up on your report

Experian's own sample Business Profile Report prints it twice — under Identifying Information as "SIC code: GROCERY STORES – 5411" and again under Operating Information as "Primary SIC Code." The report then benchmarks your payment behavior against that peer group directly: the sample shows "All industries: 8 DBT" alongside "Same industry: 3 DBT," with a monthly trend panel headed by the SIC code itself.

D&B shows a Primary SIC — defined as "a company's activity with the largest percentage of sales revenue" — plus up to six codes. It also runs a Payment Summary by Industry, showing how you pay suppliers across up to ten lines of business.

Equifax displays dedicated SIC and NAICS fields in the Business Information section, with room for six of each.

How much does industry actually move the number?

This is where most articles start guessing. Here is what each bureau documents, and where the documentation runs out.

That table is the honest answer, and it is more useful than the confident one. Industry classification is a documented, first-party input at Equifax and at D&B's credit limit recommendation and Rating. At Experian it is a documented benchmark and an unconfirmed scoring input. Anyone telling you all three bureaus weight your SIC code is asserting something none of the three has published.

The clearest proof a code can decide an outcome

Skip the bureaus for a second. The single cleanest documented case of an industry code determining a loan outcome is the Second Draw PPP Interim Final Rule, dated December 27, 2020.

A borrower may multiply its average monthly payroll costs by 3.5 only if the borrower is in the Accommodation and Food Services sector and has reported a NAICS code beginning with 72.SBA Second Draw PPP Interim Final Rule, Docket No. SBA-2021-0002

Everyone else got 2.5 months of payroll. The same rule also granted the 300-employees-per-physical-location eligibility test only to businesses "assigned a NAICS code beginning with 72." Two businesses with identical payroll received maximum loan amounts forty percent apart based on the first two digits of a code.

One more finding from that era, from SBA Office of Inspector General Report 25-14 dated May 1, 2025: the OIG excluded from its review any loans where "NAICS codes changed from origination to forgiveness." That exclusion is not a fraud finding. But it does confirm that industry codes changing mid-process happened at enough scale to require an explicit carve-out.

Restricted industry lists are written in English, not code

We pulled six published prohibited or restricted business lists — Stripe, PayPal, American Express Merchant Regulations, Bluevine, Relay Financial, and Finix. Not one of them references a NAICS or SIC code. They are written in plain category language: "check cashing," "credit restoration," "payday lending," "debt collection," "marijuana and CBD," "money service businesses."

Some specifics worth knowing, since these are the categories most likely to surprise a legitimate operator. American Express names "credit restoration" — "a service aimed at improving credit ratings by disputing errors and outdated claims with credit bureaus" — as a flatly prohibited industry, not a restricted one. Stripe names "credit monitoring and repair services" under Lending and Credit as prohibited, and lists "telemarketing" and "door-to-door sales" under Unfair, Deceptive or Abusive Practices. Bluevine, which also underwrites lines of credit, restricts "businesses offering banking or financial services to third parties."

It is not just processors — the OCC found it at nine banks

In December 2025 the Office of the Comptroller of the Currency published preliminary findings from its review of large-bank debanking. The finding, in the OCC's words: nine banks "made inappropriate distinctions among customers in the provision of financial services on the basis of their lawful business activities" by "maintaining policies restricting access to banking services" between 2020 and 2023.

The nine named: JPMorgan Chase, Bank of America, Citibank, Wells Fargo, U.S. Bank, Capital One, PNC, TD Bank, and BMO. The sectors named include firearms and ammunition manufacturing, private prisons, payday and payroll lending, tobacco and e-cigarettes, adult entertainment, PACs and political parties, coal, Arctic oil and gas, and digital assets. The report notes restrictions "often extended beyond core financial risks and instead focused on the impacts to the banks' reputation."

To be precise, because precision is the point: the OCC report does not reference NAICS or SIC codes, and does not claim banks screened by code. It describes sector policies in plain language. We are citing it as evidence that sector-level restriction policies are real and documented at the largest banks — not as evidence about coding.

How to look up and correct each copy of your code

There is no single place to fix this. Each system holds its own copy and each has its own mechanism — or, in two cases, no published mechanism at all.

Where the line is between correcting and lying

This section is the reason to read the whole page, and it is the section most articles either dodge or get dangerously wrong.

No agency has published guidance on the specific question "may I change my NAICS code to a lower-risk one." We looked. IRS, SBA, Census, FinCEN, and the bureaus are all silent on it. So the answer has to be assembled from three separate authorities, and it assembles cleanly.

1. The standard is self-assigned, but it has a definition. New York: "You pick the code that best describes your business." The selection must reflect your principal business activity — the one generating most of your income. D&B's operational rule is the same: primary means "the largest percentage of sales revenue," and a secondary code requires at least 10% of annual revenue.
2. SBA determines your primary industry from your economics, not your typing. 13 CFR 121.107 has SBA look at "the distribution of receipts, employees and costs of doing business among the different industries." A code that contradicts your receipts distribution does not survive review.
3. Making a knowingly false statement to get credit is a federal crime. 18 U.S.C. § 1014 reaches anyone who "knowingly makes any false statement or report... for the purpose of influencing in any way the action of" an FDIC-insured institution, a credit union, a small business investment company, or the SBA. The penalty is up to $1,000,000 and up to 30 years.

What we could not find, and are telling you anyway

We searched for a documented case — a DOJ prosecution, a court decision, a CFPB action, an investigative report — of a specific business denied credit because of an incorrect SIC or NAICS code on a bureau file. We did not find one.

So be clear about what this article is arguing. The mechanism is documented: Equifax runs industry-specific scorecards, D&B benchmarks against industry averages, banks maintain sector restriction policies the OCC has now criticized in writing, and PPP proved a NAICS code can determine a dollar amount outright. The individual case is an inference from that mechanism. It is a strong inference. It is not a case file, and anyone presenting it as one is selling you something.

Your code is one of about a dozen invisible variables

The reason a wrong industry code is so frustrating is not that it is uniquely powerful. It is that it belongs to a whole category of things that sit in your file, get read by an underwriter, and never get explained to you. Your legal name rendered four different ways across four systems. An address a lender classifies as a mailbox. A stale UCC-1 from a lender you paid off in 2023. A D&B file with two payment experiences when the minimum for a PAYDEX is three.

None of those show up in a decline letter as themselves. They show up as "does not meet current credit criteria." Find out which ones are currently true about your business, before you spend a hard inquiry finding out the expensive way.