Risk Intelligence API
AI-powered composite risk scoring for businesses and individuals.
What it checks
The Risk Intelligence API produces a 0–1000 composite risk score for any business or individual by aggregating data from the Consolidated Screening List (OFAC SDN, BIS Entity List and other U.S. lists), HHS OIG LEIE, SEC EDGAR and enforcement data, FMCSA, ATF FFL, court records, and adverse media. AI models synthesize 70+ risk factors across 7 categories with industry-adjusted weights, producing an executive summary, key findings, risk narrative, mitigating factors, and recommended actions. Supports sync scoring and async batch jobs with webhook, polling, PDF, and S3 delivery.
- 0–1000 composite risk score with 4 bands: LOW, MEDIUM, HIGH, CRITICAL
- Entity disambiguation — each match scored for confidence (HIGH/MEDIUM/LOW) with automatic false-positive suppression
- Entity resolution metadata — shows identifiers provided, identifiers missing, and confidence warnings
- 35 business risk factors across 7 categories (sanctions, regulatory, legal, financial, media, industry)
- 35 individual risk factors across 6 categories (sanctions, regulatory, legal, professional, media)
- Custom-trained advanced AI scoring with rule-based fallback when AI is unavailable
- Industry-adjusted weights for 7 verticals (financial, healthcare, govcon, transport, firearms, aviation, trade)
- Data aggregation from 10+ government and public sources via existing ComplianceGrid APIs
- Accusation-based factors clearly flagged — distinguishes allegations from confirmed findings
- Low-confidence matches automatically suppressed; MEDIUM matches scored at 75%, LOW at 50%
- Input completeness warnings — API recommends additional fields when input is too thin for reliable resolution
- Response field filtering via ?include= query parameter — up to 96% payload reduction
- Self-documenting /attributes endpoint — describes all 13 response fields with types and examples
- Async batch scoring for 2–100 entities with polling delivery and paginated results
- Factor taxonomy endpoint — inspect all scored factors, categories, and score bands
- FCRA disclaimer — not a consumer report, for informational due diligence only
Scenarios to try
Each scenario demonstrates a different risk profile. They are in the Postman collection.
Chinese telecom on BIS Entity List and OFAC CMIC list. Tests sanctions screening, jurisdiction risk (CN=HIGH), and multi-list matching.
Iranian national airline on OFAC SDN list. Tests comprehensive sanctions detection and SANCTIONED jurisdiction (IR).
Chinese telecom with BIS Entity List history. Tests export control screening and regulatory enforcement signals.
Established US consumer goods company (NYSE: PG). Clean sanctions, no regulatory issues. Demonstrates low-risk baseline with full identifiers.
Large US retailer (NASDAQ: COST). Clean compliance profile. Tests entity resolution with EIN and stock identifiers.
US agricultural machinery manufacturer (NYSE: DE). Clean profile. Tests scoring for manufacturing industry vertical.
Endpoints
| Method | Path | What it does | |
|---|---|---|---|
| POST | /v1/risk/business | AI-powered composite risk score (0–1000) for a business entity. Aggregates data from sanctions lists, SAM.gov, OIG LEIE, SEC EDGAR, adverse media, and 35+ risk factors with industry-adjusted weights. Includes entity disambiguation — each match is scored for confidence (HIGH/MEDIUM/LOW) and low-confidence matches are suppressed to reduce false positives. | Docs |
| POST | /v1/risk/individual | AI-powered composite risk score (0–1000) for a natural person. Checks sanctions, regulatory actions, court records, professional history, and social media signals across 35+ factors. Entity disambiguation scores each match for confidence and suppresses likely false positives. | Docs |
| POST | /v1/risk/batch | Submit 2–100 entities for async risk scoring. Returns a job ID immediately. With WEBHOOK or CALLBACK_URL delivery, results are POSTed as a signed risk.batch.complete event (see Webhooks). Jobs are visible only to the client that submitted them. A production job needs prepaid credit for every entity up front, and is billed per successfully scored entity when it finishes. Jobs are stored: they survive restarts, and an interrupted job closes as PARTIAL or FAILED with a note. | Docs |
| GET | /v1/risk/batch/{jobId} | Check the status of an async batch risk scoring job. | Docs |
| GET | /v1/risk/batch/{jobId}/results | Retrieve results for a completed batch job. | Docs |
| GET | /v1/risk/factors | Returns the complete factor taxonomy — all 70+ scored factors for both business and individual assessments, industry weight profiles, and score band definitions. | Docs |
Request and response
const API = "https://api.compliancegrid.ai";
const headers = { "x-api-key": process.env.CG_API_KEY!, "Content-Type": "application/json" };
const post = (path: string, body: unknown) => fetch(API + path, { method: "POST", headers, body: JSON.stringify(body) }).then((r) => r.json());
// Score a business (include identifiers for best accuracy; officers are screened too)
const biz = await post("/v1/risk/business", {
name: "Tesla, Inc.",
country: "US",
industry: "Automotive",
});
console.log(biz.data.score, biz.data.band); // band: LOW 0-200, MEDIUM 201-400, HIGH 401-850, CRITICAL 851-1000
console.log(biz.data.entityResolution.confidence); // HIGH, MEDIUM or LOW
console.log(biz.data.summary.executiveSummary);
for (const f of biz.data.factors) console.log(f.factorCode, f.points, f.description);
console.log(biz.data.meta.unavailableSources); // sources that could not be queried: absence of a hit is not a clean result there
// Score an individual (dateOfBirth improves accuracy)
const ind = await post("/v1/risk/individual", {
firstName: "John",
lastName: "Smith",
country: "US",
dateOfBirth: "1985-03-15",
employer: "Acme Corp",
});
console.log(ind.data.score, ind.data.band, ind.data.entityResolution.confidence);{
"success": true,
"data": {
"id": "risk_abc123",
"entityType": "BUSINESS",
"entityName": "Tesla, Inc.",
"score": 258,
"band": "MEDIUM",
"categoryScores": [
{
"category": "REGULATORY_ENFORCEMENT",
"categoryName": "Regulatory & Enforcement",
"score": 258,
"maxScore": 330,
"factorCount": 3
}
],
"factors": [
{
"factorCode": "BIZ_CFPB_COMPLAINTS_HIGH",
"points": 96,
"maxPoints": 120,
"severity": "CRITICAL",
"description": "720 CFPB consumer complaints (0 closed with monetary relief). Top category: Vehicle loan or lease",
"source": "CFPB Consumer Complaints Database",
"accusationOnly": false
},
{
"factorCode": "BIZ_OSHA_VIOLATION",
"points": 90,
"maxPoints": 90,
"severity": "CRITICAL",
"description": "1 OSHA inspection(s) with willful/repeat/serious violations",
"source": "OSHA Inspection Data",
"accusationOnly": false
}
],
"summary": {
"executiveSummary": "Risk assessment for "Tesla, Inc." identified 3 risk factor(s) with a total score of 258/1000. 2 regulatory enforcement action(s) found",
"model": "compliance-grid-risk-scoring-model"
},
"entityResolution": {
"confidence": "MEDIUM",
"confidenceReasons": [
"No unique identifier provided (ein, duns, uei, leiCode, taxId, registrationNumber). Entity resolution relies on name and corroborating fields only.",
"No address provided — cannot distinguish entities in different locations."
],
"inputCompleteness": 13,
"identifierCount": 2,
"identifiersProvided": [
"country",
"industry"
],
"identifiersMissing": [
"ein",
"duns",
"uei",
"leiCode",
"taxId",
"registrationNumber",
"website",
"address",
"aliases",
"legalName",
"naicsCode",
"sicCode",
"parentCompany",
"stateOfIncorporation"
],
"warnings": [
"Moderate entity resolution confidence. Adding a unique identifier (ein, duns, uei, leiCode, taxId, registrationNumber) would improve match accuracy."
],
"suggestedFields": [
{
"field": "ein",
"reason": "US Employer Identification Number. Uniquely identifies a US business for IRS purposes.",
"example": ""12-3456789""
},
{
"field": "duns",
"reason": "Dun & Bradstreet 9-digit number. Globally unique business identifier used in government contracting.",
"example": ""123456789""
},
{
"field": "uei",
"reason": "SAM.gov Unique Entity Identifier. Required for all federal contractors; replaces DUNS for government use.",
"example": ""ABC1DEF2GHI3""
},
{
"field": "leiCode",
"reason": "Legal Entity Identifier (ISO 17442). 20-character code for entities in financial transactions.",
"example": ""5493001KJTIIGC8Y1R12""
},
{
"field": "taxId",
"reason": "Tax identification number for non-US entities (e.g., VAT number, corporate tax ID).",
"example": ""GB123456789""
},
{
"field": "registrationNumber",
"reason": "State or country business registration number. Helps verify legal entity status.",
"example": ""C1234567" (California Corp#)"
},
{
"field": "website",
"reason": "Official website helps verify entity identity and detect shell company indicators.",
"example": ""https://example.com""
},
{
"field": "address",
"reason": "Registered or headquarters address. Critical for distinguishing same-name businesses in different locations.",
"example": "{ "city": "Austin", "stateOrProvince": "TX", "country": "US" }"
},
{
"field": "aliases",
"reason": "DBA names, trade names, or former names. Improves match coverage in sanctions screening.",
"example": "["ABC Trading Co", "ABC International"]"
},
{
"field": "legalName",
"reason": "Full legal name if different from common/trade name.",
"example": ""ABC Trading Corporation Inc.""
},
{
"field": "stateOfIncorporation",
"reason": "US state of incorporation. Distinguishes same-name businesses across states.",
"example": ""DE" (Delaware)"
}
],
"candidateEntities": [
{
"source": "SEC EDGAR",
"name": "Tesla, Inc.",
"identifiers": {
"cik": "0001318605",
"ticker": "TSLA"
},
"details": {}
},
{
"source": "SEC Enforcement",
"name": "Magnum Resources, Inc., Manakoa Services Corp. (n/k/a Teslavision Corp.), Maxus Technology Corp., Med/Waste, Inc., Medsearch Technologies, Inc., and Meisenheimer Capital, Inc.",
"details": {
"actionType": "ADMINISTRATIVE",
"actionDate": "2009-09-22",
"releaseNumber": "34-60703 (File No. 3-13582)"
}
},
{
"source": "SEC Enforcement",
"name": "Magnum Resources, Inc., Manakoa Services Corp. (n/k/a Teslavision Corp.), Maxus Technology Corp., Med/Waste, Inc., Medsearch Technologies, Inc., and Meisenheimer Capital, Inc.",
"details": {
"actionType": "ADMINISTRATIVE",
"actionDate": "2009-09-11",
"releaseNumber": "34-60655 (File No. 3-13582)"
}
},
{
"source": "SEC Enforcement",
"name": "Magnum Resources, Inc., Manakoa Services Corp. (n/k/a Teslavision Corp.), Maxus Technology Corp., Med/Waste, Inc., Medsearch Technologies, Inc., and Meisenheimer Capital, Inc.",
"details": {
"actionType": "ADMINISTRATIVE",
"actionDate": "2009-08-18",
"releaseNumber": "34-60517 (File No. 3-13582)"
}
}
]
},
"meta": {
"dataSourcesUsed": [
"ComplianceGrid CSL (OFAC/BIS/UN/EU)",
"SAM.gov via ComplianceGrid",
"SAM.gov Exclusions (federal debarments)",
"HHS OIG LEIE via ComplianceGrid"
],
"unavailableSources": [
"GDELT Project (adverse media)"
]
}
}
}Glossary
Regulatory acronyms and data sources referenced by this API.
OFAC
Office of Foreign Assets Control — U.S. Treasury department that administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals.
SDN List
Specially Designated Nationals and Blocked Persons List — OFAC's primary sanctions list. U.S. persons are generally prohibited from transacting with individuals and entities on this list, and their assets are blocked.
BIS Entity List
Bureau of Industry and Security Entity List — U.S. Commerce Department list of foreign parties subject to export license requirements. Being listed means U.S. exporters need a license (usually denied) to send controlled items to the entity.
CMIC List
Chinese Military-Industrial Complex Companies List — OFAC list of Chinese entities identified as operating in China's defense and surveillance technology sectors. U.S. persons are prohibited from purchasing or selling publicly traded securities of listed companies.
CSL
Consolidated Screening List — A unified U.S. government database that merges 13+ export screening lists (SDN, Entity List, Denied Persons, Unverified, Military End User, etc.) into a single searchable API maintained by the International Trade Administration.
SAM.gov
System for Award Management — The official U.S. government system for entity registration and federal procurement data. Contains exclusion records (debarments and suspensions) that bar entities from receiving federal contracts or grants.
HHS OIG LEIE
Health and Human Services Office of Inspector General — List of Excluded Individuals/Entities. Federal database of healthcare providers and entities excluded from participation in Medicare, Medicaid, and other federal healthcare programs due to fraud, patient abuse, licensing violations, or other offenses.
SEC EDGAR
Securities and Exchange Commission — Electronic Data Gathering, Analysis, and Retrieval system. Public database of corporate filings including 10-K annual reports, enforcement actions (AAERs), and litigation releases. Used to identify securities fraud, financial irregularities, and regulatory enforcement actions.
SEC AAER
Accounting and Auditing Enforcement Releases — SEC enforcement actions related to accounting fraud, auditor misconduct, and financial reporting violations.
FMCSA
Federal Motor Carrier Safety Administration — U.S. DOT agency that regulates the trucking and bus industries. Maintains safety records, compliance reviews, and out-of-service orders for motor carriers and drivers.
ATF FFL
Bureau of Alcohol, Tobacco, Firearms and Explosives — Federal Firearms License. ATF issues FFLs to dealers, manufacturers, and importers of firearms. The API checks for license validity, revocations, and enforcement actions.
CFPB
Consumer Financial Protection Bureau — U.S. agency that enforces consumer financial protection laws. Maintains a public enforcement action database covering banks, lenders, and financial service companies for unfair, deceptive, or abusive practices.
FINRA
Financial Industry Regulatory Authority — Self-regulatory organization overseeing broker-dealers in the U.S. Maintains BrokerCheck database with disciplinary actions, bars, suspensions, and customer complaints against registered representatives and firms.
FDA
Food and Drug Administration — U.S. agency responsible for protecting public health by ensuring safety and efficacy of drugs, medical devices, food supply, and cosmetics. Issues warning letters, import alerts, and enforcement actions tracked by the API.
EPA
Environmental Protection Agency — U.S. federal agency that enforces environmental laws. Maintains enforcement and compliance history (ECHO) database with violations, penalties, and consent decrees.
OSHA
Occupational Safety and Health Administration — U.S. Department of Labor agency that sets and enforces workplace safety standards. Inspection data and violation records are used as risk signals for labor and safety compliance.
BOI
Beneficial Ownership Information — filed with FinCEN under the Corporate Transparency Act. The BOI registry is not publicly searchable, so ComplianceGrid does not use it as a data source; BOI-related factor codes exist in the taxonomy but are not currently scored.
PEP
Politically Exposed Person — An individual who holds or has held a prominent public function (e.g., head of state, senior politician, military general, senior executive of a state-owned corporation). PEP status increases risk due to potential for corruption and bribery.
EDD
Enhanced Due Diligence — A more rigorous level of customer investigation applied to higher-risk entities. Involves deeper background checks, source-of-funds verification, and ongoing monitoring beyond standard KYC procedures.
KYC
Know Your Customer — Regulatory framework requiring financial institutions and other regulated entities to verify the identity of their clients. Includes identity verification, risk assessment, and ongoing monitoring.
AML
Anti-Money Laundering — Set of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. AML compliance typically includes transaction monitoring, suspicious activity reporting, and customer due diligence.
SAR
Suspicious Activity Report — A document filed by financial institutions with FinCEN when there is suspected involvement in money laundering, fraud, or other financial crimes. Filing is mandatory for transactions over certain thresholds or exhibiting suspicious patterns.
FCRA
Fair Credit Reporting Act — U.S. federal law that regulates the collection, dissemination, and use of consumer information, including consumer credit information. The Risk Intelligence API is NOT a consumer report under FCRA and must not be used for credit, employment, or tenant screening decisions.
ITAR
International Traffic in Arms Regulations — U.S. regulations controlling the export and import of defense-related articles and services on the U.S. Munitions List. ITAR violations carry severe criminal and civil penalties.
EAR
Export Administration Regulations — U.S. Commerce Department regulations governing the export of commercial and dual-use items. Items are classified by ECCN (Export Control Classification Number) and may require a license depending on destination country and end-use.
DUNS
Data Universal Numbering System — A unique nine-digit identifier assigned by Dun & Bradstreet to business entities worldwide. Used as a strong identifier for entity disambiguation in risk scoring.
UEI
Unique Entity Identifier — The official identifier for entities doing business with the U.S. federal government, replacing DUNS for federal procurement. Assigned through SAM.gov registration.
EIN
Employer Identification Number — A nine-digit number (XX-XXXXXXX) assigned by the IRS to U.S. business entities for tax identification. One of the strongest identifiers for entity resolution in the API.
LEI
Legal Entity Identifier — A 20-character alphanumeric code that uniquely identifies legally distinct entities that engage in financial transactions. Managed by the Global LEI Foundation under ISO 17442.
NPI
National Provider Identifier — A unique 10-digit identification number issued by CMS to healthcare providers in the U.S. Used as a strong identifier for individual healthcare professionals in risk scoring.
Good to know
- A score shows review priority, not a finding about a company. Check the factors behind it and any sources that were not available for the request.
- Turn AI off per request with aiMode: off or for the whole account.
- Every response carries its source and the list version, so the result can go in your audit file.
- The sandbox returns mock data and production returns live data. Build in the sandbox and switch your key to go live.