In the (vanishingly rare) case that a POM includes <scm><url> information, and is missing <licenses> information, it may be worth attempting to scan the SCM source repository for possible license information - either from metadata that repository might have, or by finding and matching probable license files (LICENSE, COPYING, etc.).