How a SONAR KYB report is made

What every report checks

One run screens the company, then every director and owner the registries return. The same checks run in the web app, the API and the MCP server.

Registry record

Legal name, number, status, legal form, incorporation date and registered address from the national register: Companies House, SIRENE, KRS, ARES, KBO, KVK, Brreg, CRO, CVR, PRH, ACRA and others, plus GLEIF (LEI) and VIES (VAT).

Directors and owners

Officers, and persons with significant control or ultimate beneficial owners where the register publishes them. For UK companies, the Companies House PSC snapshot.

Sanctions

The company and each extracted person against 8 lists: OFAC SDN, EU Consolidated, UN Security Council, UK sanctions list, Swiss SECO, Australian DFAT, World Bank Debarred and OpenSanctions Consolidated.

Politically exposed persons

Directors and owners against the OpenSanctions PEP dataset.

Offshore leaks

The ICIJ Offshore Leaks Database: Panama, Paradise and Pandora Papers, Offshore Leaks, Bahamas Leaks.

Regulatory status

FCA Register for UK firms, SEC EDGAR for US filers, the UK disqualified directors register.

Adverse media

Press coverage with legal and regulatory terms (fraud, sanctions, enforcement, insolvency) over a 10-year window.

How a verdict is reached

Each check returns one of four results. The headline verdict is the worst of them, with one rule on top: a check that could not run caps the headline at REVIEW, so a failed screen never reads as clear.

• PASS / CLEARThe source answered and returned nothing that needs action.
• REVIEWA person should look: a partial record, an adverse-media hit, an unauthorised firm, a stale dataset.
• FLAGA finding that should stop onboarding until resolved, such as a sanctions match.
• NOT RUNThe source was down or timed out this run. Never counted as clear.

Registry, ownership and sanctions tables are built directly from source data, not written by a language model. Claude (Anthropic) writes the summary and the risk flags from the collected evidence, and every flag points back to a source in the report.

Receipts and "data as of"

Every report includes a receipt for each source that returned data: the source name, a link to the record or the registry ID, and when SONAR retrieved it. Reference datasets are downloaded and screened locally, so the report also shows how old each one was at screening time, and the age limit it has to meet:

A dataset over its limit, or missing, is shown in red in the report and turns the Data Freshness check to REVIEW. Stale data is never silent.

What SONAR is not

• Not a regulated AML / KYC provider, and not a substitute for an obliged entity's own customer due diligence.
• No identity verification of individuals: no document checks, no liveness, no address proof.
• No ongoing transaction monitoring.
• Not legal advice and not a credit rating.

Where it fits: checking a vendor, partner, reseller or supplier before you sign, or a client's counterparties, when the check is good practice rather than a legal obligation.

Known limits

• Coverage follows the registers: many countries don't publish beneficial owners, and some publish no directors.
• Name matching can miss transliterations and can return false positives. Every match shows the matched name and source so you can judge it.
• Adverse media covers what is indexed and public. Paywalled and local-language press can be missed.
• A report describes the company on the day it ran. Re-screen before renewals and large payments.

How we handle your data: Security · Subprocessors