# How to KYC-screen a vendor or counterparty using free US federal data

> Step-by-step guide to running know-your-customer (KYC) checks against 9 US federal datasets — OFAC, SAM, HHS-OIG, DOJ, CFPB, federal courts, Fed Reserve enforcement, NHTSA, and CISA — all free, no API key.

## Steps

### Step 1: Run the unified compliance screen

Make a single GET request to /api/v1/screening/all?name=COMPANY_NAME. The endpoint checks the entity across 9 datasets simultaneously and returns a 0-100 risk score with risk_level (NONE / LOW / MEDIUM / HIGH).

Endpoint: https://api.ai-analytics.org/api/v1/screening/all?name=Wells+Fargo

### Step 2: Interpret the risk score

risk_score 0 = no hits anywhere. risk_score 1-30 (LOW) = minor signals like a few CFPB complaints. risk_score 30-60 (MEDIUM) = court cases or moderate enforcement history. risk_score 60-100 (HIGH) = OFAC, SAM debarment, or OIG exclusion — do not transact. The "summary" field shows per-vertical hit counts; the "details" field returns the top 5 matches per vertical with canonical record-page URLs.

### Step 3: Drill into specific hits

For each match, follow the canonical_url to read the structured-data page. Examples: /sanction/{uid} (OFAC), /oig-exclusion/{internal_id} (HHS-OIG), /sam-debarment/{ext_id} (SAM.gov), /case/{docket_id} (federal court), /complaint/{complaint_id} (CFPB), /fed-enforcement/{action_id} (Federal Reserve), /nhtsa-recall/{campaign} (NHTSA), /doj-release/{uuid} (DOJ press), /cve/{cve_id} (CISA + NIST NVD).

### Step 4: Pull the cross-vertical timeline

For a richer dossier, hit /entity/{ticker}/timeline or /entity/{ticker} (HTML) to see regulatory events for the company across the 229-dataset catalog. Material events only (importance ≥ 60): /api/v1/entity/{ticker}/material-events.

### Step 5: Cite the result

Every response includes provenance such as data_provider, generated_at, primary_source, and source-specific license or terms fields. Cite as: "AI Analytics, [dataset or record], retrieved [date] from [endpoint]; primary source: [source URL]; source terms: [license or terms URL]." US federal employee-authored works are generally public domain under 17 USC §105, but non-federal, SRO, and third-party material retains its source terms. AI Analytics-authored metadata and normalization are CC0 only where expressly stated. Free or keyless access does not change source terms.

## FAQ

### What if I only have an NPI for a healthcare provider?

Pass ?npi=NPI_NUMBER. The endpoint checks the OIG exclusion table directly by NPI (the most precise match) and returns the canonical /oig-exclusion/{id} URL if the provider is excluded.

### Is there a rate limit?

No API key, no rate limit beyond ordinary Cloudflare anti-abuse. Cache the response — D1 reads are sub-100ms but the canonical URLs themselves cache for 1 hour.

### How fresh is the data?

Source cadence and indexed freshness vary. Check /api/v1/freshness for source-level SLA status and /coverage for recorded row counts and refresh timestamps before relying on absence.

---

*[How-to guides](https://api.ai-analytics.org/how-to) · [AI Analytics](https://api.ai-analytics.org) · Guide text CC0 1.0 · [Source record terms](https://api.ai-analytics.org/license)*