TL;DR: A fake operating agreement is an LLC's internal contract on members, ownership percentages, and signers that was edited after creation, generated as a fresh document, or given a signature page that does not belong to the body. It is not a state-issued certificate of formation. GAO reported that FinCEN's domestic beneficial-ownership exemption covers over 99 percent of entities previously required to report, so a reviewer cannot look the member schedule up in a federal registry, and a clean signature page will not catch a competent edit.
What a Fake Operating Agreement Actually Is
An operating agreement is the members' contract for an LLC: who owns what percentage, who manages, and who may sign. Delaware calls the same instrument a limited liability company agreement. A fake one asserts that ownership and that signing authority without being the agreement the members actually made.
The file arrives in two production families. Edited-after-creation starts from a counsel draft, a prior entity's agreement, or a template, then changes the member schedule, a percentage, or the signature block. Generated-from-scratch builds the recitals, the schedule, and the signature page together, so the pages agree by construction. Both can sit beside a genuine formation filing. Neither is the filing.
Articles of organization, or a certificate of formation, are the public document that creates the LLC. Delaware's certificate of formation must be filed with the Secretary of State and must state the LLC's name and the registered agent and registered office. Members are not a required line. The operating agreement is a separate member agreement, and it may exist before, at, or after that filing. Some states later collect a manager or member name. That name is not a percentage schedule. The formation PDF is a different check, covered in how to spot a fake certificate of incorporation.
Federal lookup does not close the gap. GAO's May 2026 report found that FinCEN's exemption of domestic companies and U.S. persons from beneficial ownership reporting applies to over 99 percent of entities that previously were required to report. A KYB desk cannot pull a member schedule from a federal registry and compare it to the PDF. In the FATF-Egmont study of 106 case studies, more than half specifically referred to shell companies as the legal person used to obscure beneficial ownership. A shell can be formed in the ordinary way. The concealment sits in who the paperwork says owns it.
Tells That Still Work, and the Ones That Don't
Blurry scans and floating signatures still catch crude forgeries. They miss a schedule edited inside a real counsel PDF, and they miss a generated agreement whose pages were produced together. Real operating agreements are often templates, so a form-like layout is a weak tell.
The tells that still earn their place are disagreements. Percentages that do not sum, a member missing from the signature block, or a manager-managed clause beside a member-managed signature line are content failures. So is an effective date that puts the LLC in business before the certificate of formation, with no amendment to explain it. Name, jurisdiction, and registered agent should match the formation filing.
Signature-page substitution is its own class: a different font, a restarted page number, a legal name the recitals do not use, or a signature image pasted in as its own object. That catches a page attached after the body was finished. A file generated as one document will not look spliced, and absence of a splice is not authenticity. An unsigned agreement is not automatically fake, and a signed one is not automatically genuine. UBO identification is where the names and percentages have to resolve to people.
One operating agreement looks like ordinary counsel work. The same schedule, footer, or signature image on two unrelated LLCs is a pattern across files, and a first submission has no cousin yet.
How Detection Actually Works
Detection on an operating agreement is the file's story. The document usually has no government issuer, so the question is not whether the secretary of state printed it. Production method asks how the bytes were made: a law-firm export, a later office-suite edit, a design tool, or a generative pipeline. A counsel PDF and a design-tool replica do not share a path even when the headings match.
Timestamp trail asks whether that history fits the claimed execution. Agreements get amended, so an older effective date on a recently saved file is not automatically fake. Incremental firm drafts, then a signing certificate, read differently from a document born complete in one session with the member schedule as the last change.
Issuer matching binds the file to the formation record and to the people named. Legal name, jurisdiction, formation date, and registered agent have to agree with the certificate of formation and the live state search. Member names and percentages then have to agree with the application and the beneficial ownership certification. A state search that returns the LLC does not verify the schedule. Consistency is the same test turned inward: percentages, management type, and signature-block names have to agree with the body and with the rest of the packet. Generators produce that agreement by construction. Inconsistency is a fail.
31 CFR 1010.230 is why a matching packet can still be false. A covered institution must identify each individual who owns 25 percent or more of the equity, and one individual with significant control responsibility. The institution may rely on information the customer supplies, unless facts reasonably call that information into question. Documentary verification under the rule is of each owner's identity. The rule does not require a forensic read of the operating agreement.
Model artifacts are what a generated page leaves behind: prose with the same rhythm in every section, cross-references that point nowhere, layout that does not come from a firm's PDF printer. Document fraud in banking is the same failure mode on statements and identity documents. Recycled patterns close serial reuse through shared templates, repeated signature images, and repeated counsel blocks. Cousins in the queue are the tell. Those six checks are classes of evidence, not a method for producing a cleaner fake. A thin public record or a recent amendment that might be a real sale still needs a person.
What to Do with a Suspect File
Stop treating the upload as the ownership record. Compare name, jurisdiction, formation date, and registered agent to the certificate of formation or the articles. If those fail, the agreement is not this company's document until someone explains the amendment. If they match, compare every member and percentage to the beneficial ownership certification and to the signers on the application. A percentage that moved between those pages is the case.
When the text matches and the file still looks edited, ask whether the member schedule changed after the rest of the agreement was produced, and whether the signature page was produced separately from the body. A prior version or a signing certificate that belongs to this file settles it. The same agreement, footer, or signature image on two unrelated LLCs is enough to hold both files.
For a scored second look, check a document in the Watchdoc playground. The x-ray is production method, timestamps, issuer match, consistency, model artifacts, and recycled patterns. The playground does not replace the state search or the ownership work. The wider packet is covered in KYB document fraud detection.
Where Sphinx Fits
Sphinx Watchdoc runs the six checks on the operating agreement, shows the x-ray, and returns a verdict a reviewer can defend. Clean files clear in under 28 seconds. The verdict is correct 94.3 percent of the time, and the same checks catch 2.8 times more forgeries than a visual-and-template baseline, at $0.45 per document with no seats and no platform fee. The Watchdoc playground is free for the first file, no email required, on a 50-document free tier. Test the member schedule and the signature page against the file's history, and against the formation record, before the named owners are treated as real.
Frequently Asked Questions
How can you tell if an operating agreement is fake?
Compare the member names, ownership percentages, and signers to the certificate of formation, the beneficial ownership certification, and the rest of the KYB file. Visual defects still catch crude forgeries. Competent fakes fail when a schedule was edited after creation, a signature page was produced separately from the body, or the same agreement appears on an unrelated applicant.
What is the difference between an operating agreement and articles of organization?
Articles of organization, or a certificate of formation, are the public filing that creates the LLC. An operating agreement is the members' internal contract on ownership, management, and who may sign. A genuine formation filing does not authenticate the member schedule attached to it.
Does a secretary of state verify an operating agreement?
No. In Delaware, the filed certificate of formation must state the LLC's name and registered agent. Members are not a required field, and the operating agreement is a separate agreement of the members. Other states vary in what a later report collects, and a manager name on an annual report is not a full ownership percentage.
Can a bank rely on a customer certification instead of the operating agreement?
Under 31 CFR 1010.230, a covered institution identifies beneficial owners at account opening and may rely on information the legal entity customer supplies, absent facts that call that information into question. Verification under that rule is of each owner's identity, not a forensic check that the operating agreement is unaltered. A certification and an operating agreement that agree with each other can still both be false.
Should a reviewer reject an operating agreement that matches the certificate of formation?
Not on entity-existence grounds. A match confirms the LLC's name, jurisdiction, and registered agent line up with the public filing. It does not confirm the member list, the percentages, or the signature page. Those still have to be tested against the application and the file's own history.
.png)
