How to Start a Data Enrichment, Data Cleansing or B2B Database Company in the USA from Abroad (2026), Without Visiting: LLC or C-Corp, EIN Without an SSN, Bank Account, Data Broker Registration, CCPA, CAN-SPAM and the FCRA Line

Data work has quietly become one of the biggest offshore industries serving the USA. Teams in Chennai, Cebu, Bogotá and Cairo verify contact records, append job titles and company sizes, de-duplicate CRMs, standardise addresses and build targeted prospect lists for US sales teams. Others license whole B2B databases: millions of companies and decision-makers, refreshed every month.

The work is entirely remote, and US buyers are used to buying it from abroad. What they are less comfortable with is contracting with an overseas entity, paying international invoices, and trusting that the data was handled lawfully. A US company helps with the first two. This guide also covers the third, because in data the US legal rules are what separate a real business from a liability.

In short: A foreign owner can form a US LLC or C-Corporation without visiting, get an EIN without an SSN or ITIN, and open a US business bank account remotely. If you only process clients' own data (cleansing, enrichment, de-duplication), you are a service provider: sign a data processing agreement and stay inside the client's instructions. If you sell or license personal data about people who are not your customers, including B2B contact data, you are likely a data broker and must register in California, Texas, Oregon and Vermont, and in California handle deletion requests through the DROP platform from 1 August 2026. Never sell data for credit, employment, insurance or housing decisions unless you are ready to be regulated under the FCRA.

Three kinds of data business

The US rules depend on which of these you do. Many firms do more than one.

Can you start a data company in the USA without visiting?

Yes. All the set-up is remote:

• Forming the company with the state, online, through a registered agent
• EIN without an SSN or ITIN: a foreign owner files Form SS-4, which the IRS processes manually
• A US business bank account without visiting, at a bank or fintech that accepts foreign-owned companies
• Client contracts and data processing agreements, signed electronically
• State data broker registrations, all filed online

Expect four to eight weeks from order to a working bank account. See opening a US company without visiting and EIN for non-residents.

Banking and payment platforms

Data cleansing and enrichment services are straightforward to bank. List and database sales get more questions, because some banks and payment processors treat bulk personal data as higher risk. Before you apply:

• describe the business precisely ("B2B firmographic and contact data for sales teams, licensed by subscription")
• have a public privacy notice, an opt-out page and your data broker registrations, if you need them
• read the payment processor's restricted business list before relying on card payments

See why banks reject non-resident applications and Stripe for non-residents.

US LLC or C-Corp?

US LLC formation for a data services firm

A single-member LLC owned by a non-resident is disregarded for US tax. When the data work is done outside the USA and the company has no US office, staff or agents, the income is generally not effectively connected with a US business, so there is usually no US federal income tax. The LLC files Form 5472 with a pro forma 1120 each year, with a $25,000 penalty for missing it. See Form 5472 explained.

A Wyoming LLC with EIN is $249, or $348 with a bank account, then $121 a year.

US C-Corp formation for a data company

A C-Corporation pays 21% on its profit. It suits a database business that will raise investment, sell to large enterprises that prefer a corporation, hire US sales staff, or eventually be sold. Data companies are acquired often, and buyers and investors usually want a Delaware corporation.

A Delaware corporation with EIN is $358, and $578 a year. See LLC vs Inc for non-residents.

Service provider work: cleansing and enrichment

When a US client sends you its CRM or customer file, you are handling its data under its instructions. Under the California Consumer Privacy Act (CCPA) and the other state privacy laws (Virginia, Colorado, Connecticut, Texas, Oregon and many more), that makes you a service provider or processor, and the law requires a written contract that:

• limits your use of the data to the services you are hired for
• forbids you from selling it, sharing it or combining it with other data, except as the law allows
• requires you to help the client answer consumers' requests
• requires reasonable security and notice of breaches
• lets the client check your compliance

US clients will send you their own data processing agreement or addendum. Read it carefully if you also run an enrichment database: a clause forbidding you from combining client data with other sources can clash with how enrichment works, so agree the scope in writing.

Security questionnaires

Larger clients will ask how you protect their files: encryption, access control, where the data is stored, who on your team can see it, and how you delete it after the project. A simple written security policy, role-based access and secure file transfer (not email attachments) answer most questions. Some clients will ask for ISO 27001 or SOC 2.

EU and home-country data

If your client's file contains EU residents, the GDPR applies, and transfers to your country may need standard contractual clauses. Your own country's privacy law also applies to what your team does, such as India's Digital Personal Data Protection Act.

Database and list sales: the data broker laws

Four states run data broker registries:

B2B contact data counts. California's temporary exemption for business-to-business data ended on 1 January 2023, so a database of names, work emails and direct dials of US professionals is personal information, and selling it usually makes you a data broker under California law.

California's Delete Act and DROP

California's Delete Act created DROP (the Delete Request and Opt-out Platform), where any California resident can ask every registered data broker to delete their data in one request. From 1 August 2026, registered data brokers must check DROP at least every 45 days and delete the matching records, and keep doing so. They also face independent audits from 2028.

For a database business, this is an operating cost, not paperwork: you need systems to match DROP records against your database and suppress them on every refresh.

Consumer rights under the other state laws

States with comprehensive privacy laws give residents the right to know, delete and opt out of the sale of their data. A database seller needs:

• a privacy notice that says what you collect, where from, and who you sell it to
• an easy opt-out and deletion process, and the staff to respond within the legal deadlines (usually 45 days)
• a suppression list, so deleted people do not come back with the next data refresh

Where your data comes from

The first question a serious US buyer asks is how you got the data.

• Licensed sources. Buying data from other providers under a licence that allows resale is the safest route. Read the licence: many forbid resale.
• Public sources. Company websites, filings and press releases are commonly used, but "public" does not mean free of privacy law.
• Web scraping. US courts have found that scraping public pages is generally not "unauthorised access" under the Computer Fraud and Abuse Act, but sites such as LinkedIn forbid it in their terms, and contract claims and account bans remain a real risk. LinkedIn won its long dispute with hiQ Labs on contract grounds. Many enterprise buyers now refuse data scraped from platforms whose terms prohibit it.
• Contributory networks. Some providers collect contact data from users' email signatures or address books. This raises consent questions under US state laws and the GDPR.

Keep a data lineage record: for every field, where it came from and when it was last verified.

The FCRA line

The Fair Credit Reporting Act regulates consumer reporting agencies: anyone who assembles information on individuals that is used to decide their eligibility for credit, insurance, employment or housing. A consumer reporting agency must verify accuracy, check the buyer's permissible purpose, handle disputes and more. Penalties are heavy.

A B2B marketing database is outside the FCRA as long as it is not used for eligibility decisions. Protect that line:

• your licence terms must forbid using the data for credit, employment screening, tenant screening or insurance
• do not market your data for "background checks", "people search" or "tenant screening"
• turn away buyers who ask for those uses

What your buyers must do with the data

US buyers use your data to email and call people. Their compliance affects your reputation, and well-drafted contracts put the responsibility on them:

• Email: the CAN-SPAM Act applies to all commercial email, B2B included. Each message needs truthful headers and subject lines, a physical postal address and a working opt-out honoured within 10 business days. Penalties exceed $50,000 per email. B2B cold email is legal in the USA under CAN-SPAM, unlike in much of Europe.
• Phone and text: the TCPA restricts calls and texts to mobile numbers using autodialers or prerecorded voices without consent, and the Do-Not-Call rules apply to consumers. If you sell mobile numbers, label them, and require buyers to comply. See our guide to lead generation.
• Email verification: sell verified, current emails. High bounce rates damage your buyers' sending reputation, and they will cancel.

Sales tax on data and data services

The USA has no VAT, and state sales taxes treat data unevenly:

• Data cleansing and processing services are untaxed in most states, but some tax them: Texas, for example, taxes data processing on 80% of the charge.
• Information services and electronically delivered databases are taxable in some states, including New York and Texas.
• Mailing lists delivered as files may be taxable as digital products in some states.

Once your sales into a state pass its economic nexus threshold (often $100,000 a year), you may have to register and collect. See state taxes for foreign-owned companies.

Running the team abroad

• If you have a home-country company with the data team, put an intercompany agreement in place between it and the US company, priced at arm's length, and record related-party payments for Form 5472.
• If the US company pays researchers and data operators abroad directly, collect W-8BEN forms. Work done outside the USA needs no US withholding and no Form 1099. See paying contractors abroad.
• Control access to client data tightly: individual logins, no USB drives, no personal email, and logs of who opened what.

Indian residents investing in a US company follow the ODI rules; see ODI and FEMA.

Worked examples

These are illustrative examples, not client stories.

A data cleansing team in Chennai. Karthik's 40-person firm cleans and de-duplicates Salesforce and HubSpot data for US mid-market companies. It forms a Wyoming LLC, with an EIN and a US bank account, signs each client's data processing addendum, and works only inside clients' own systems through secure logins. As a pure service provider, it does not need to register as a data broker. The LLC files Form 5472; the profit is taxed in India.

A B2B database start-up in Bogotá. Two founders build a database of US construction companies and their decision-makers from licensed sources and public websites. They form a Delaware C-Corp to raise seed funding. Before launch they register as a data broker in California, Texas, Oregon and Vermont, publish a privacy notice and opt-out page, and build monthly DROP matching. Their licence forbids FCRA uses, and requires CAN-SPAM and TCPA compliance from buyers.

An enrichment provider in Cairo. Nour's company appends job titles and phone numbers to US clients' lead lists. The enrichment fields come from its own database, so it is both a service provider for the clients' records and a seller of the appended data. It agrees the scope with each client in writing, labels mobile numbers, and registers as a data broker in the four states.

Common mistakes

• Assuming B2B data is not personal data. In California, it has been since 2023.
• Not registering as a data broker while selling lists.
• No suppression list, so deleted people reappear after each data refresh.
• Selling to "background check" or tenant screening buyers, which brings the FCRA into play.
• Signing a client's processing addendum that forbids combining data, while doing enrichment.
• Scraping platforms whose terms forbid it, then losing enterprise deals over it.
• Emailing client files as attachments instead of using secure transfer.

Frequently asked questions

Can I start a data company in the USA from India without visiting? Yes. Company formation, the EIN and the bank account are all done remotely.

Do I need an SSN or ITIN for the EIN? No. Foreign owners apply on Form SS-4.

Do I need to register as a data broker for data cleansing work? Generally not, if you only process clients' own data under contract. Selling or licensing data you collected yourself usually requires registration.

Is it legal to sell B2B email lists in the USA? Generally yes, with data broker registration where required, a privacy notice, opt-outs and buyers who follow CAN-SPAM. It is far more restricted in the EU and UK.

Will my US LLC pay US income tax? Usually not, if the work is done abroad and there is no US office or staff. It still files Form 5472 each year.

How UCB can help

We form US LLCs and C-Corporations for data services firms outside the USA, get the EIN without an SSN, and help open a US business bank account without visiting, through our formation, EIN and bank account package. Each year we prepare Form 5472 with the pro forma 1120, Form 1120 or Form 1065, through our US tax filing service. We do not file data broker registrations or give privacy law advice.

Starting a data business for US clients? WhatsApp us at +1 315 961 2956 or email enquiries@ucbsolutions.com.