Sign up

Use case · Professional services

Client Due Diligence API

Verify a client company, screen it against sanctions, and check for corporate insolvency — the record an accounting or law firm's client file needs. Run it from a REST API if you have a developer, or ask for it in plain language through Claude Desktop or Cursor if you don't.

Published 15 September 2026

The problem

Accounting firms, bookkeepers, gestorías and asesorías in Spain, expert-comptables in France, law firms, company-formation agents and trust or company service providers (TCSPs) are obliged entities under the UK Money Laundering Regulations 2017, Spain's Ley 10/2010, and France's Code monétaire et financier — and, from 10 July 2027, under the EU Anti-Money-Laundering Regulation. Before taking on a new business client, and again on a periodic review, the firm has to show it checked who it is dealing with.

Most of these firms are small, with no developer on staff and no budget for a platform priced for banks. What happens instead is often a manual check — a partner looks the company up on a registry website and saves a screenshot. It works until a reviewer asks how the check was run, on what date, and against which lists.

This is not legal advice — see What is KYB? for the underlying concept. What follows produces a record: what the registry said on a given date, and what the sanctions and insolvency checks returned. Whether that satisfies your obligations is a question for your compliance function or legal adviser.

Two ways to run a check

Both paths draw on the same registry data, for every registry the API covers, through one API key.

With a developer or a practice-management integration

The REST API takes a client identifier in and returns a company profile, a sanctions result, and an insolvency answer:

# 1. Resolve the client — NIF (Spain), SIREN/SIRET (France), or company_number elsewhere
curl 'https://api.prometiam.com/functions/v1/risk-api/companies/search?nif=A78053147&country=ES' \
  -H 'Authorization: Bearer rk_live_...'

# 2. Full profile: status, address, capital, officers — plus Spain's tax-debtor flag
curl 'https://api.prometiam.com/functions/v1/risk-api/companies/{id}?country=ES&include=risk_flags' \
  -H 'Authorization: Bearer rk_live_...'

# 3. Screen the legal-entity name against sanctions (beta)
curl 'https://api.prometiam.com/functions/v1/risk-api/sanctions/screen?name=Example+SL&threshold=80' \
  -H 'Authorization: Bearer rk_live_...'

GET /companies/search takes name, nif (Spain), siren/siret (France), or the generic company_number — which also carries the UK Companies House, Irish CRO, Polish KRS or Norwegian organisation number by country. The free company-id validator checks the format without an API key; the Spanish-language NIF tutorial covers the ES case end to end.

GET /companies/{id} returns status, address, capital and officers where held; add include=risk_flags for Spain's AEAT large-debtor flag, or include=insolvency. GET /people/search covers officers and, for the UK, Persons with Significant Control, across ES, FR, GB, NO and PL. GET /sanctions/screen is beta. POST /insolvency/check covers sixteen markets, Spain included, in one call, up to 100 counterparties; GET /search also covers Spanish concursal notices. GET /vat/{vatNumber} checks a VAT number against VIES before invoicing — see the VAT/VIES validation guide. POST /monitor keeps a client registered in every live country except France and Chile under ongoing watch instead of waiting for next year's review — see ongoing due diligence.

Without a developer: the MCP server

npx -y prometiam-risk-mcp runs the same API as an MCP server, with the same key, inside Claude Desktop or Cursor. Connected, a partner has seven tools for this — companies_search, company_detail, people_search, sanctions_screen, insolvency_check, vat_validate, monitor_subscribe — and asks for a check instead of writing one:

  • “Is Construcciones Ibérica SL active, and who are its current directors?”
  • “Screen Construcciones Ibérica and its directors against sanctions and show me the match scores.”
  • “Has this client's French subsidiary had any insolvency notices in the last year?”

This is one case of a broader pattern — see AI agents and company data — of an assistant answering from the registry, not its training data.

A real Python example

A CDD file needs a dated answer, not a live response someone has to re-derive later. This checks one client's registry status, current officers, a sanctions screen with its match score and threshold, and any Spanish concursal notice, and returns something to attach to the engagement file:

import os, sys, json, datetime, requests

API = 'https://api.prometiam.com/functions/v1/risk-api'
HEAD = {'Authorization': f'Bearer {os.environ["PROMETIAM_API_KEY"]}'}
THRESHOLD = 80

def cdd_record(nif: str) -> dict:
    found = requests.get(f'{API}/companies/search', params={'nif': nif, 'country': 'ES'}, headers=HEAD).json()['data']
    if not found:
        return {'checked_at': datetime.date.today().isoformat(), 'identifier': nif, 'status': 'not_found'}

    company = requests.get(f'{API}/companies/{found[0]["id"]}', params={'country': 'ES', 'include': 'risk_flags'}, headers=HEAD).json()['data']
    officers = [c['full_name'] for c in company.get('contacts', []) if c.get('is_current')]

    screen = requests.get(f'{API}/sanctions/screen', params={'name': company['company_name'], 'threshold': THRESHOLD}, headers=HEAD).json()
    concursal = requests.get(f'{API}/search', params={'vat': nif, 'country': 'ES', 'event_type': 'insolvency'}, headers=HEAD).json()['data']

    return {
        'checked_at': datetime.date.today().isoformat(),
        'identifier': nif,
        'registry_status': company.get('status'),
        'officers': officers,
        'sanctions_screen': {
            'threshold': screen['meta']['threshold'],
            'hits': [{'name': h['entity_name'], 'match_score': h['match_score']} for h in screen['data']],
        },
        'insolvency_notices': concursal,
    }

if __name__ == '__main__':
    print(json.dumps(cdd_record(sys.argv[1]), indent=2, ensure_ascii=False))

About 30 lines, one identifier in. Swap the /search call for POST /insolvency/check when the client is French, German, British, Austrian, Swiss, Norwegian, Finnish, American or Dutch instead of Spanish — that endpoint takes up to 100 counterparties in one call, so it also doubles as the way to check a whole batch of clients at once. Every item in a batch still counts as one request against your rate limit and costs 2 credits.

What comes back

GET /companies/{id} returns company_name, legal_form, status, address, postal_code, city, province, capital_amount with capital_currency, founding_date, dissolution_date and previous_names — plus contacts (officer appointments): full_name, role, appointment_date, end_date, is_current. With include=risk_flags, a flagged Spanish company's identifier_source states whether its tax ID was read directly from the AEAT list or reconstructed with name corroboration.

GET /sanctions/screen returns entity_name, entity_type, aliases, source_list, program, listing_date, is_active, match_score and matched_on per hit, with your threshold echoed in meta. POST /insolvency/check returns a status of found, none, error or timeout per counterparty, up to five notices, and a latest_filing_date — none means no notice turned up, not proof of solvency.

Customer dashboard screenshot: a company profile with identifiers and signalsCustomer dashboard screenshot: a company profile with identifiers and signals
The same record in the dashboard: identifiers, registered office, and the insolvency, sanctions (beta) and register signals on one page. Shown for a UK company. Open it in the dashboard

Pricing fit

A firm with 300 business clients, each checked at onboarding (about 6 credits — 1 for the search, 1 for the detail, 3 for a sanctions screen, 1 for a VAT check) and re-checked yearly, plus a monthly screen of the whole book: onboarding the existing 300 files once is about 1,800 credits, more than the 14-day free trial's 500, so it takes two months on Starter (€9.99/month, 1,000 credits/month) or one on Professional. After that, steady state is about 900 credits/month for the screening pass (3 per name) plus roughly 150 more for the amortized annual re-checks: about 1,050, at the edge of Starter, so Professional is the comfortable fit.

A firm with 3,000 clients scales that by ten: about 10,500 credits a month in steady state, a little over Professional (€29.99/month, 10,000 credits/month), so Scale (€99.99/month, 50,000 credits/month) is the fit on volume. Professional is also where full sanctions and export-control screening access sits, and POST /monitor caps monitored companies by tier — 25 on Starter, 250 on Professional, 2,500 on Scale. A firm that size monitoring even its higher-risk clients needs Scale's cap.

Scope limits, stated plainly

  • No identity verification of people. The API verifies the company and its filed officers, not a photo ID or a liveness check on the individuals involved.
  • Beneficial ownership is UK-only. Persons with Significant Control is the only beneficial-ownership register in scope. Every other country returns officers and directors, which is not the same thing.
  • Ireland is company-level. No officer data yet. Norway has register-change events only, from 14 Oct 2026 (no gazette).
  • Sanctions screening is beta; PEP screening is beta and Spain-only, and never includes relatives or close associates (RCAs).
  • Insolvency notices are corporate only, across sixteen markets (FR, DE, GB, AT, CH, NO, FI, US, NL, DK, HR, SE, ES, LV, EE, SG). Spanish concursal notices are on /insolvency/search and also on GET /search.
  • Monitoring is every live country except France and Chile.
  • No credit scores. Financial statements for Spain cover listed companies only (their ESEF annual financial reports; not every report is held, and the reports of Spanish listed companies are available free of charge on the CNMV website); annual accounts of other Spanish companies are sold per document and are not part of the API (GB, FR, DK, SE, NO and FI, and listed companies in PL, HR and BE, are served from the Scale plan). The risk flag under include=risk_flags is Spain's AEAT large-debtor list (over €600,000), a point-in-time snapshot, not a live balance.

FAQ

Do I need a developer to run these checks?
No. The MCP server runs in Claude Desktop or Cursor with the same API key a developer would use — a partner just asks for the check in plain language. REST is the other option if you have a developer.

Does this verify the identity of the people behind the company?
No. Prometiam verifies the company and its filed officers; it does not check a photo ID or confirm who you are actually dealing with.

Does it cover beneficial ownership, not just directors?
Only for the UK, through Persons with Significant Control. Every other registry returns officers and directors, which is not the same thing as beneficial ownership.

What does a client due diligence check actually record?
A timestamped registry answer, the current officers where held, a sanctions result with its match score and threshold, and an insolvency answer. Not a legal opinion or a compliance certificate.

What will this cost a small firm?
A firm with a few hundred clients, checked at onboarding and re-checked yearly with monthly screening, typically fits Starter (€9.99/month). A few thousand clients usually fits Professional (€29.99/month).

Related