How to KYC-screen a vendor or counterparty using free US federal data

Step-by-step guide to running know-your-customer (KYC) checks against 9 US federal datasets — OFAC, SAM, HHS-OIG, DOJ, CFPB, federal courts, Fed Reserve enforcement, NHTSA, and CISA — all free, no API key.

Steps

  1. Run the unified compliance screen

    Make a single GET request to /api/v1/screening/all?name=COMPANY_NAME. Returns a 0-100 risk_score aggregated from 9 datasets.

    You can also pass an identifier instead of a name:

  2. Interpret the risk score

    Interpret the score:

    • 0 — no hits anywhere
    • 1-30 (LOW) — minor signals like a few CFPB complaints
    • 30-60 (MEDIUM) — court cases or moderate enforcement history
    • 60-100 (HIGH) — OFAC, SAM debarment, or OIG exclusion. Do not transact.

    The summary field shows per-vertical hit counts. The details field returns the top 5 matches with canonical record-page URLs.

  3. Drill into specific hits

    For each match, follow the canonical_url to the structured-data record page. Each page carries schema.org JSON-LD with Link: rel=canonical back to the upstream agency:

  4. Pull the cross-vertical timeline

    For a richer ongoing-monitoring dossier, hit:

    Accepts ticker, CIK, UEI, LEI, DUNS, or entity_id as the key.

  5. Cite the result

    Every response includes provenance such as data_provider, generated_at, primary_source, and source-specific license or terms_of_use fields. Cite as:

    AI Analytics, [dataset or record], retrieved [date] from [endpoint]; primary source: [source URL]; source terms: [license or terms URL].

    Works authored by US federal employees as part of official duties are generally public domain under 17 USC §105, but non-federal, SRO, and third-party material retains its source terms. AI Analytics-authored metadata and normalization are CC0 1.0 only where expressly stated. Free or keyless access does not change source terms.

FAQ

What if I only have an NPI for a healthcare provider?
Pass ?npi=NPI_NUMBER. The endpoint checks the OIG exclusion table directly by NPI (the most precise match) and returns the canonical /oig-exclusion/{id} URL if the provider is excluded.
Is there a rate limit?
No API key, no rate limit beyond ordinary Cloudflare anti-abuse. Cache the response — D1 reads are sub-100ms but the canonical URLs themselves cache for 1 hour.
How fresh is the data?
Source cadence and indexed freshness vary. Check /api/v1/freshness for source-level SLA status and /coverage for recorded row counts and refresh timestamps before relying on absence.