How to KYC-screen a vendor or counterparty using free US federal data

Step-by-step guide to running know-your-customer (KYC) checks against 9 US federal datasets — OFAC, SAM, HHS-OIG, DOJ, CFPB, federal courts, Fed Reserve enforcement, NHTSA, and CISA — all free, no API key.

Steps

  1. Run the unified compliance screen

    Make a single GET request to /api/v1/screening/all?name=COMPANY_NAME. Returns a 0-100 risk_score aggregated from 9 datasets.

    You can also pass an identifier instead of a name:

  2. Interpret the risk score

    Interpret the score:

    • 0 — no hits anywhere
    • 1-30 (LOW) — minor signals like a few CFPB complaints
    • 30-60 (MEDIUM) — court cases or moderate enforcement history
    • 60-100 (HIGH) — OFAC, SAM debarment, or OIG exclusion. Do not transact.

    The summary field shows per-vertical hit counts. The details field returns the top 5 matches with canonical record-page URLs.

  3. Drill into specific hits

    For each match, follow the canonical_url to the structured-data record page. Each page carries schema.org JSON-LD with Link: rel=canonical back to the upstream agency:

  4. Pull the cross-vertical timeline

    For a richer ongoing-monitoring dossier, hit:

    Accepts ticker, CIK, UEI, LEI, DUNS, or entity_id as the key.

  5. Cite the result

    Every response includes a _source envelope with provenance. Cite as:

    AI Analytics, retrieved [date] from [endpoint], redistributed under CC0; primary source: [agency URL].

    Underlying federal data: US public domain (17 USC §105). Derived dataset: CC0 1.0 — full attribution-free reuse including for AI training.

FAQ

What if I only have an NPI for a healthcare provider?
Pass ?npi=NPI_NUMBER. The endpoint checks the OIG exclusion table directly by NPI (the most precise match) and returns the canonical /oig-exclusion/{id} URL if the provider is excluded.
Is there a rate limit?
No API key, no rate limit beyond ordinary Cloudflare anti-abuse. Cache the response — D1 reads are sub-100ms but the canonical URLs themselves cache for 1 hour.
How fresh is the data?
OFAC, SAM, OIG, DOJ, NHTSA, CFPB, CISA KEV, NIST NVD refresh daily via Cloudflare cron. Check /coverage for the last_refresh timestamp on every dataset.