Credential Registry - Port 8900

Settlement Verification Services

12 real-time verification services power every JIL settlement. Sanctions screening, identity verification, fraud detection, corridor risk assessment, velocity monitoring, and continuous re-screening - all backed by live data from government and regulatory sources.

12 Verification Services
18,707 OFAC SDN Entries
5,367 Disposable Email Domains
24h Continuous Re-screening
← All Proof API Reference ↓

Tier 1 - Mandatory Compliance

Required for every settlement
🛡

OFAC Sanctions Screening

Real-time fuzzy name matching against 18,707 OFAC SDN entries. In-memory cache with 1-hour TTL delivers sub-30ms screening. SHA-256 checksum dedup prevents redundant ingestion.

  • Jaro-Winkler + Levenshtein + token reorder matching
  • Configurable threshold (default 85/100)
  • Auto-ingestion every 24 hours from treasury.gov
  • In-memory cache: ~3MB, sub-30ms per query
POST /api/v1/verify - type: "sanctions"
POST /api/v1/sanctions/ingest (admin)
📍

Address Validation

US address validation via Census Bureau Geocoder with Nominatim (OpenStreetMap) fallback. Returns standardized address, coordinates, and match confidence. Non-US addresses receive partial validation.

  • Census Bureau Geocoder (primary) - free, no rate limit
  • Nominatim/OpenStreetMap (fallback) - global coverage
  • Returns matched address + lat/long coordinates
  • Non-US: partial outcome with explanation
POST /api/v1/verify - type: "address"
✉

Email Validation

DNS-based email verification with MX record check, SPF/DMARC policy validation, RDAP domain age lookup, and disposable email blocklist (5,367 domains). Multi-signal risk scoring.

  • MX record validation (mail server exists)
  • SPF and DMARC policy checks
  • RDAP domain age lookup (young domains flagged)
  • 5,367 disposable email domains blocked
POST /api/v1/verify - type: "email"
☎

Phone Validation

International phone number validation using libphonenumber-js. Format verification, number type detection (mobile, landline, VOIP, toll-free), country extraction, and risk tier classification.

  • ITU E.164 format validation
  • Number type detection (mobile, VOIP, toll-free)
  • Country code extraction and validation
  • Risk tiers: VOIP/pager high, toll-free medium
POST /api/v1/verify - type: "phone"
🏢

Business Verification

Multi-source business entity verification. Checks GLEIF LEI registry, SEC EDGAR filings, and OpenCorporates registry. Composite scoring from three independent data sources.

  • GLEIF LEI lookup (Legal Entity Identifier)
  • SEC EDGAR company filings search
  • OpenCorporates global registry check
  • Composite score: +0.5 LEI + 0.25 SEC + 0.25 OC
POST /api/v1/verify - type: "business"
🏛

PEP Screening

Politically Exposed Person screening using OpenSanctions match API with Wikidata SPARQL fallback. Filters for PEP-related datasets and political position keywords.

  • OpenSanctions match API (primary)
  • Wikidata SPARQL query (fallback)
  • Filters: PEP datasets, political positions
  • Returns matched names, scores, sources
POST /api/v1/verify - type: "pep"

Tier 2 - Enhanced Due Diligence

Triggered by risk signals
🚨

Fraud & Enforcement Check

Cross-references party names against OIG LEIE (healthcare exclusions) and SEC enforcement actions. In-memory cache with weekly auto-refresh. Same ingestion pattern as sanctions screening.

  • OIG LEIE excluded individuals/entities
  • SEC enforcement actions (EDGAR search)
  • Fuzzy name matching with configurable threshold
  • Auto-ingestion every 168 hours (weekly)
POST /api/v1/verify - type: "fraud"
POST /api/v1/fraud/ingest (admin)
📰

Adverse Media Screening

Real-time news monitoring via GDELT Doc API. Searches 90-day news window for compliance-relevant keywords (fraud, sanctions, indictment, money laundering). Negative tone filtering removes false positives.

  • GDELT Doc API - 90-day rolling window
  • 15+ compliance keyword categories
  • Negative tone filtering (GDELT tone threshold)
  • Article count and source diversity scoring
POST /api/v1/verify - type: "adverse_media"
🌍

Cross-Border Corridor Risk

Assesses bilateral corridor risk using FATF grey/blacklist designations, OFAC comprehensive sanctions programs, and targeted sanctions. 4 risk levels with automatic EDD triggers.

  • FATF blacklist: KP, IR, MM (blocked/high)
  • FATF greylist: 18 jurisdictions (elevated)
  • OFAC blocked: CU, IR, KP, SY, RU, BY
  • 10 high-risk bilateral corridors tracked
POST /api/v1/verify - type: "corridor"
POST /api/v1/corridor-risk
GET /api/v1/country-risk/:countryCode

Tier 3 - Continuous Monitoring

Ongoing, automated
⚡

Velocity & Structuring Detection

In-memory sliding window (48h) per party detects BSA/AML structuring patterns - multiple transactions just below the $10,000 CTR threshold. Also monitors transaction rate and daily volume limits.

  • CTR structuring: 3+ transactions in $8,500-$10,000 range
  • Rate limits: 20 tx/hour, 100 tx/day
  • Daily volume cap: $500,000
  • Round amount pattern detection
POST /api/v1/verify - type: "velocity"
POST /api/v1/party-credentials/:id/velocity
🔄

Continuous Re-screening

Automated 24-hour re-screening cycle processes all active party credentials in batches of 50. Re-runs sanctions, PEP, and fraud checks. Automatically downgrades attestation status on new matches.

  • Full cycle every 24 hours (configurable)
  • Batch processing: 50 parties per batch
  • Auto-downgrade: approved to hold on new match
  • Immutable audit trail for every downgrade
POST /api/v1/screening/cycle (admin)

API Reference

All verification endpoints are served from the Credential Registry service on port 8900. The unified POST /api/v1/verify endpoint accepts a check_type parameter to select the verification service.

Unified Verify Endpoint

Method Endpoint Check Type Description Tier
POST /api/v1/verify sanctions OFAC SDN fuzzy name screening 1
POST /api/v1/verify address US Census / Nominatim address validation 1
POST /api/v1/verify email DNS MX / SPF / DMARC / domain age / disposable check 1
POST /api/v1/verify phone libphonenumber format / type / country validation 1
POST /api/v1/verify business GLEIF LEI / SEC EDGAR / OpenCorporates lookup 1
POST /api/v1/verify pep OpenSanctions / Wikidata PEP screening 1
POST /api/v1/verify fraud OIG LEIE / SEC enforcement actions 2
POST /api/v1/verify adverse_media GDELT news monitoring (90-day window) 2
POST /api/v1/verify corridor FATF / OFAC bilateral corridor risk 2
POST /api/v1/verify velocity BSA/AML structuring / rate / volume detection 3

Admin & Utility Endpoints

Method Endpoint Description
POST /api/v1/sanctions/ingest Trigger manual OFAC SDN ingestion (admin)
POST /api/v1/fraud/ingest Trigger manual OIG LEIE + SEC ingestion (admin)
POST /api/v1/screening/cycle Trigger manual continuous re-screening cycle (admin)
POST /api/v1/corridor-risk Assess corridor risk for sender/beneficiary country pair
GET /api/v1/country-risk/:countryCode Get risk level for a single country (ISO 3166-1 alpha-2)
POST /api/v1/party-credentials/:id/velocity Query velocity metrics for a specific party credential
GET /health Service health check
GET /ready Service readiness check (DB connected)

Data Sources

All verification data comes from authoritative government and regulatory sources. No paid third-party data vendors - every source is public, auditable, and free.

OFAC SDN List

US Treasury Office of Foreign Assets Control Specially Designated Nationals list. 18,707 entries covering sanctioned individuals, entities, and vessels.

Auto-refresh: 24h

FATF Grey/Blacklist

Financial Action Task Force high-risk and increased monitoring jurisdictions. Updated 3x/year by the FATF plenary. Last update: February 2026.

Manual update: 3x/year

Census Bureau Geocoder

US Census Bureau address geocoding API. Free, no authentication required. Returns standardized addresses and lat/long coordinates for US addresses.

Real-time API

Nominatim / OpenStreetMap

Open-source geocoding service backed by OpenStreetMap data. Global coverage, free, community-maintained. Used as fallback for address validation.

Real-time API

GLEIF LEI Registry

Global Legal Entity Identifier Foundation. 2.7M+ LEI records worldwide. Validates legal entity names, registration status, and jurisdiction.

Real-time API

SEC EDGAR

US Securities and Exchange Commission Electronic Data Gathering, Analysis, and Retrieval system. Company filings, enforcement actions, and regulatory orders.

Real-time API

OpenCorporates

Largest open database of companies in the world. 200M+ company records from 140+ jurisdictions. Business name and registration verification.

Real-time API

OpenSanctions

Open-source sanctions and PEP data aggregator. Combines OFAC, EU, UN, and national sanctions lists with PEP databases. Fuzzy match API included.

Real-time API

OIG LEIE

HHS Office of Inspector General List of Excluded Individuals/Entities. Healthcare exclusions for fraud, abuse, and program violations.

Auto-refresh: 168h

GDELT Project

Global Database of Events, Language, and Tone. Monitors news from 65+ languages in real-time. Used for adverse media screening with compliance-relevant keyword filtering.

Real-time API

Wikidata SPARQL

Structured knowledge base. Fallback for PEP screening using political position (P39) and officeholder queries. Global coverage of elected and appointed officials.

Real-time API

RDAP / IANA

Registration Data Access Protocol for domain age and registrar lookups. Validates email domain registration date to detect recently created throwaway domains.

Real-time API

Architecture

The credential registry processes verification checks in a layered pipeline. Each layer can independently pass, fail, or escalate to the next tier.

Settlement and Verification Architecture - flow from Initiation and Submission through the JIL Sovereign Verification Layer (Beneficiary Binding, Policy Engine, Risk and Compliance, Adaptive Trust Engine) to Settlement Execution (Settlement Ledger, Routing/Transfer, Final Receipt)

Performance Characteristics

Sanctions Screening

In-memory cache, ~3MB RAM. Sub-30ms per query against 18,707 entries. Jaro-Winkler + Levenshtein fuzzy matching.

Address Validation

External API call. Nominatim typically responds in 200-500ms. Census Geocoder 500ms-2s.

Email Validation

DNS lookups: 50-200ms per check. Disposable list: in-memory, sub-1ms. RDAP: 200-500ms.

Velocity Detection

Pure in-memory sliding window. Sub-1ms per check. 48h retention, automatic pruning every 10 minutes.

Every check. Every settlement. Every time.

12 independent verification services ensure no settlement proceeds without comprehensive compliance validation.

Request a POC All Proof API Documentation