Sign up

Use case · Fraud & investigations

Shell Company Detection

Fraud, investigations and enhanced-due-diligence teams need signals they can defend to an examiner, not a black-box score. This page lists every signal the Prometiam API can actually surface for shell companies and phoenix directors — the endpoint and field behind each one, and where each signal runs out.

As at 7 November 2026: no API can say a company is a shell, and this one returns no risk score. It returns the registry facts an investigator checks by hand, one call per signal, so a reviewer decides. A six-call review card (the record, officer network, events, insolvency, a sanctions screen of the company name, UK ownership) costs about 12 credits; each further name screened adds 3.

SignalCall and fieldCreditsWhere
AgeGET /companies/search?founded_after=…, field founding_date1Where the register gives a founding date (none for Japan, Switzerland, Germany)
CapitalGET /companies/{id}, fields capital_amount and capital_currency1Where the register publishes a figure
Serial officersGET /directors/network, then GET /people/{id}2 eachNetwork list: Spain only. A person’s appointments: Spain, France, the United Kingdom, Norway
ChurnGET /company-events/search2Gazette events for Spain, France, the United Kingdom; register-change events (name, status, legal form, address) for the other monitored countries, dated when first seen in the register data
Status and insolvencyGET /companies/{id}; POST /insolvency/check1; 2 per companyStatus: every live country. Corporate insolvency notices: sixteen markets, never personal insolvency
Sanctions listsPOST /sanctions/screen3 per nameAny name; beta
UK ownershipGET /people/search?country=GB2United Kingdom only (PSC register)

Endpoints and fields checked against the published API specification on 15 September 2026

The problem

Fraud, investigations and enhanced-due-diligence teams at marketplaces, payment providers, lenders and fintechs see the same pattern on repeat: a counterparty clears a basic KYB check — the registry record is real, the entity is active — and still turns out to be a shell used to move money through and disappear. A single lookup does not catch that. The signal is almost always a combination: an entity a few weeks old, capitalised at the legal minimum, run by a director who has opened and closed a string of similar companies before.

No API can tell you a company is a shell, including this one. What Prometiam can do is surface the individual registry facts that investigators already check by hand, so a reviewer spends time on the handful of counterparties actually worth a second look instead of typing the same lookups into several portals.

The pattern

A shell-company review is a handful of calls against one candidate, not one call. Resolving the entity is the first and cheapest of them, and it is the anchor every other signal below builds on:

curl 'https://api.prometiam.com/functions/v1/risk-api/companies/search?country=ES&name=ACME+TRADING+SL&founded_after=2026-01-01' \
  -H 'Authorization: Bearer rk_live_...'

The id, founding_date, capital_amount, status and previous_names on that one response already cover three of the seven signals below. The rest come from separate, purpose-built endpoints.

Seven signals, not a verdict

  1. Age. founding_date and the founded_after filter on GET /companies/search. A counterparty incorporated last month proves nothing by itself, but it is the cheapest fact to check and the reason to look at the rest. See new incorporations feed for this filter as a standalone daily feed.
  2. Capital. capital_amount and capital_currency on the same company record — a company sitting at or near the jurisdiction's statutory minimum, transacting at a scale that does not match, is a classic under-capitalisation flag. Returned where the registry has published a figure; a null value is not itself a signal.
  3. Serial officers. GET /directors/network?country=ES&min_companies=N finds people linked to an unusual number of companies (add legal_entities=true to include corporate directors); GET /people/{id} then returns that person's full appointments[], each carrying is_current, appointment_date and end_date. Several non-current appointments whose companies dissolved and reappeared under new names is the phoenix pattern. Held for Spain, France, the UK, Norway, Poland and the Czech Republic (Polish natural persons are masked by the register itself; Czech natural persons are the name and the month and year of birth only) (Polish officers are on the company record only: natural persons are masked by the register, so there is no people search, person record or network); Ireland is company-level, so this signal does not exist there. See director-network analysis for the method in full.
  4. Churn. previous_names on the company record, plus address_change, name_change, director_change and capital_change events from GET /company-events/search — Spain, France and the UK, plus address_change and name_change register-change events for Ireland, Poland, Norway, Finland, Sweden, Belgium, Croatia, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus, Romania, Lithuania, Canada, Australia, Japan, Israel, Singapore, Colombia, Taiwan, Czech Republic, Brazil and the United States; Norway, Ireland and Poland have register-change events only, from 14 Oct 2026, no gazette. Worth widening the same search to dissolution and insolvency events on companies that share a director with your candidate.
  5. Status. status and dissolution_date on the company record; corporate insolvency across sixteen markets, Spanish concursal notices included, through POST /insolvency/check.
  6. Lists. POST /sanctions/screen of the company name and its known officers together, up to 50 names in one call — beta. A hit is a name match at a confidence score, not a determination.
  7. UK ownership. GET /people/search?country=GB draws on Companies House data, which returns People with Significant Control alongside officers and directors. Beneficial ownership on this API is UK-only: every other registry returns officers and directors, a different legal concept from beneficial ownership.

A real example

This scores nothing. It calls the endpoints above for one candidate and assembles the answers into a card for an analyst to read:

import os, requests

API = 'https://api.prometiam.com/functions/v1/risk-api'
HEAD = {'Authorization': f'Bearer {os.environ["PROMETIAM_API_KEY"]}'}

def review_card(name, country):
    """Collect registry signals for one candidate into a card for a human
    reviewer. Nothing here is scored, weighted, or turned into a verdict."""
    card = {'name': name, 'country': country}
    hit = requests.get(f'{API}/companies/search',
        params={'name': name, 'country': country, 'limit': 1}, headers=HEAD).json()['data']
    if not hit:
        return {**card, 'found': False}
    co = hit[0]
    card.update(found=True, company_id=co['id'], founding_date=co.get('founding_date'),
                capital_amount=co.get('capital_amount'), capital_currency=co.get('capital_currency'),
                status=co.get('status'), dissolution_date=co.get('dissolution_date'),
                previous_names=co.get('previous_names'))

    if country in ('ES', 'FR', 'GB', 'NO'):  # officers: IE/PL are company-level
        net = requests.get(f'{API}/directors/network',
            params={'country': country, 'min_companies': 5}, headers=HEAD).json()['data']
        card['serial_officers'] = [n['person_name'] for n in net if co['id'] in n['company_ids']]

    if country in ('ES', 'FR', 'GB'):  # corporate-event stream; Norway has none
        ev = requests.get(f'{API}/company-events/search',
            params={'country': country, 'company_name': name, 'limit': 20}, headers=HEAD).json()['data']
        card['recent_events'] = [e['event_type'] for e in ev]

    if country in ('ES', 'FR', 'GB', 'NO'):  # sixteen-market corporate insolvency
        result = requests.post(f'{API}/insolvency/check',
            json={'items': [{'country': country, 'name': name}]}, headers=HEAD).json()['data'][0]
        card['insolvency_status'] = result['status']
    # IE/PL: not insolvency markets today

    hits = requests.get(f'{API}/sanctions/screen',
        params={'name': name}, headers=HEAD).json()['data']  # beta
    card['sanctions_hit_count'] = len(hits)
    return card  # a card for an analyst to read, never a decision

About 40 lines and five calls covering six of the seven signals; add a sixth call for GET /people/search?country=GB — the UK-ownership signal — when the candidate is a UK entity.

What comes back

  • From GET /companies/search and GET /companies/{id}: founding_date, capital_amount / capital_currency, status, dissolution_date, previous_names[] (each with name, from_date, until_date).
  • From GET /directors/network: person_id, person_name, company_count, is_legal_entity, company_ids[], company_names[].
  • From GET /people/{id}: appointments[], each with company_name, company_number, role, appointment_date, end_date, is_current.
  • From GET /company-events/search: event_type, event_date, previous_value, new_value, source.
  • From POST /insolvency/check: a status of found/none/error/timeout per item, up to five notices, and latest_filing_date.
  • From POST /sanctions/screen: a status of match/clear, hits[] with match_score, source_list and is_active.

Pricing fit

A full review card touches roughly six endpoints: resolve the entity, pull its officer network, pull its recent events, check insolvency or concursal status, screen it against sanctions, and — for a UK counterparty — pull PSC data. At that rate, the free trial (500 credits over 14 days, card required, nothing charged for 14 days) covers around 40 review cards (about 12 credits each). Starter (€9.99/month, 1,000 credits) covers around 80 a month; Professional (€29.99/month, 10,000 credits) around 800, with the full sanctions and export-control screening scope included; Scale (€99.99/month, 50,000 credits) around 4,100.

Scope limits, stated plainly

  • Officers — and so the serial-officer and phoenix signal — exist for Spain, France, the UK, Norway, Poland and the Czech Republic (Polish natural persons are masked by the register itself; Czech natural persons are the name and the month and year of birth only) (Polish officers are on the company record only: natural persons are masked by the register, so there is no people search, person record or network). Ireland is company-level: no officers, no serial-officer signal there.
  • Corporate events (address_change, name_change, director_change, capital_change) exist for Spain, France and the UK, and address_change and name_change register-change events for Ireland, Poland, Norway, Finland, Sweden, Belgium, Croatia, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus, Romania, Lithuania, Canada, Australia, Japan, Israel, Singapore, Colombia, Taiwan, Czech Republic, Brazil and the United States. Norway has register-change events only, from 14 Oct 2026 (no gazette).
  • Corporate insolvency covers sixteen markets (FR, DE, GB, AT, CH, NO, FI, US, NL, DK, HR, SE, ES, LV, EE, SG) through POST /insolvency/check. Ireland and Poland have neither.
  • Sanctions screening is beta. PEP screening is a separate, optional addition to it (beta, Spain only, no relatives or close associates) and is not one of the seven signals above.
  • Beneficial ownership on this API is the UK PSC register only, via GET /people/search?country=GB. Every other registry returns officers and directors, not beneficial ownership.
  • Nothing above is scored. The only score-shaped field anywhere in the API is the sanctions match_score — a name-match confidence, not a risk score, not a verdict.

FAQ

Can the API tell me a company is a shell?
No. Prometiam returns registry facts and a sanctions match_score — never a risk score and never a verdict. This page lists the individual signals investigators already check, with the endpoint and field behind each one, so a human reviewer decides what to do with them.

How do I detect a phoenix director pattern?
Call GET /directors/network with min_companies to find people linked to an unusual number of companies, then GET /people/{id} for that person's appointments, which carry is_current, appointment_date and end_date. Several non-current appointments whose companies dissolved and reappeared under new names is the phoenix pattern. Officers are held for Spain, France, the UK, Norway, Poland and the Czech Republic (Polish natural persons are masked by the register itself; Czech natural persons are the name and the month and year of birth only) (Polish officers are on the company record only: natural persons are masked by the register, so there is no people search, person record or network); Ireland is company-level, so this signal does not exist there.

Does Prometiam verify beneficial ownership?
Only for the UK, through the People with Significant Control data returned by GET /people/search?country=GB. Every other registry in this API returns officers and directors, which is a different legal concept from beneficial ownership.

Which countries support the serial-officer and churn signals?
Officers, and so the serial-officer and phoenix signals, exist for Spain, France, the UK, Norway, Poland and the Czech Republic (Polish natural persons are masked by the register itself; Czech natural persons are the name and the month and year of birth only) (Polish officers are on the company record only: natural persons are masked by the register, so there is no people search, person record or network). Corporate events — address_change, name_change, director_change, capital_change — exist for Spain, France and the UK, and address_change and name_change register-change events for Ireland, Poland, Norway, Finland, Sweden, Belgium, Croatia, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus, Romania, Lithuania, Canada, Australia, Japan, Israel, Singapore, Colombia, Taiwan, Czech Republic, Brazil and the United States; Norway has register-change events only, from 14 Oct 2026 (no gazette). Ireland and Poland are company-level today.

Is sanctions screening included, and is it final?
POST /sanctions/screen checks up to 50 names — the company and its officers together — against the EU, UN, OFAC, UK, Australia (DFAT), French and US export-control lists in one call. It is beta: treat a hit as one signal among several, not as the sole control.

Related