KYB Complete — Germany

Comprehensive verification of a German company. Full compliance check including registry verification, sanctions screening, PEP screening, adverse media search, digital presence analysis, and a plain-language risk narrative.

13 steps x402 eligible Includes an AI-written summary kyb-complete-de

What it runs

German Company Data
Source: OpenRegister (api.openregister.de)
EU VAT Validation
Source: VIES (EU VAT Information Exchange System, European Commission)
LEI Lookup
Source: GLEIF (Global Legal Entity Identifier Foundation)
LEI Parent Lookup
Source: GLEIF Level 2 (Who Owns Whom)
Sanctions Check
Source: Dilisense consolidated (OFAC SDN, EU FSF, UN SC, UK Sanctions List, CH SECO, BIS, World Bank, EBRD, ADB + 125 national sanctions/debarment lists; full attribution at https://dilisense.com/en/sources/sanction-sources)
PEP Check
Source: Dilisense consolidated PEP database (230+ territories, EU C/2023/724-aligned, RCAs included; full attribution at https://dilisense.com/en/sources/politically-exposed-persons-list)
Adverse Media Check
Source: Dilisense Adverse Media (235k+ news sources, FATF-categorized) primary; Serper.dev (Google search) fallback
Domain Reputation
Source: Threat intelligence feeds (multi-source scoring)
WHOIS Lookup
Source: WHOIS protocol (ICANN-accredited registrar databases)
SSL Certificate Check
Source: TLS handshake (X.509 certificate from target server)
DNS Lookup
Source: DNS protocol (authoritative nameservers)
Email Validation
Source: Algorithmic (syntax) + DNS protocol (MX record verification)
Risk Summary Writer
Source: Claude Sonnet (Anthropic API)

Written by an AI model from the other steps’ results, for a person to review. It does not make the decision.

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`domain`	string	No	Company website domain (e.g., example.com)
`vat_number`	string	No	EU VAT number with country prefix (e.g. DE811128135). Auto-derived from registry data when possible.
`company_name`	string	Yes	German company name or registration number
`contact_name`	string	No	Name of contact person for PEP screening
`contact_email`	string	No	Contact email for validation

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/kyb-complete-de/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "domain": "example.com",
      "vat_number": "SE556059030801",
      "company_name": "Siemens AG",
      "contact_name": "John Doe",
      "contact_email": "[email protected]"
    },
    "max_price_cents": 250
  }'

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/solutions/kyb-complete-de \
  -H 'Content-Type: application/json' \
  -d '{
    "domain": "example.com",
    "vat_number": "SE556059030801",
    "company_name": "Siemens AG",
    "contact_name": "John Doe",
    "contact_email": "[email protected]"
  }'

The bundle’s published example input.

Limitations

OpenRegister allows 500 credits per rolling 30 days on the configured plan; a name lookup normally uses 11 credits and a `company_id` lookup 10. HTTP 402 indicates exhausted credits and HTTP 429 a short-term rate limit; the tool can be paused until usable credits are restored.
From step: German Company Data
What to do instead: Use `company_id` when known and reuse results within the permitted refresh window to avoid repeated lookups.
Beneficial ownership from the German Transparenzregister is not included.
From step: German Company Data
What to do instead: Request beneficial-ownership information directly from the Transparenzregister with authorised access.
Company records are refreshed at least every four weeks, with daily updates for financials and new incorporations. The tool does not request a live Handelsregister refresh.
From step: German Company Data
What to do instead: For same-day filings, check Handelsregister directly; `provenance.fetched_at` records retrieval time rather than the original filing time.
HRB and HRA numbers are unique only within their registration court, so the same number can identify different companies. Both `hrb_number` and `court` are required for a number lookup.
From step: German Company Data
What to do instead: Prefer 'company_id' (OpenRegister canonical, e.g. "DE-HRB-F1103-267645") when known — it skips the autocomplete step and consumes one fewer Free-tier credit.
VIES can be unavailable or throttle requests under unpublished per-member-state limits. Transient faults are retried, and cached results, including older fallback results, can be returned during outages.
From step: EU VAT Validation
What to do instead: Lookups within 48 hours can use cached results; if VIES is unavailable and no cached result exists, retry later.
Results can be cached for 48 hours, and national registry changes can take a further 24 hours to appear in VIES. Check the national tax authority directly for same-day registration or deregistration confirmation.
From step: EU VAT Validation
What to do instead: For real-time same-day verification, contact the national tax authority directly.
Swiss UID validation returns valid or invalid only, without a company name or address. This tool does not perform the separate enrichment lookup, whose public service is limited to 20 requests per minute.
From step: EU VAT Validation
What to do instead: For Swiss company name + address, call the swiss-company-data capability.
GB VAT numbers return a credentials-pending error when the HMRC connection is not configured.
From step: EU VAT Validation
What to do instead: Use vat-format-validate for GB format checks; it does not confirm VAT registration.
Covers entities with LEI registration via GLEIF — only ~2.5 million entities worldwide have LEIs, primarily financial institutions
From step: LEI Lookup
What to do instead: If no LEI is found, search by company name and jurisdiction; consider that smaller entities may not have an LEI
GLEIF L2 only contains relationship data for entities registered in the GLEIF system. Approximately 2.6M entities globally have LEIs, primarily large or regulated entities. SMEs without LEIs return no L2 data — pair with country-registry beneficial ownership lookups for full SME coverage.
From step: LEI Parent Lookup
What to do instead: For SMEs without an LEI, use country-specific UBO sources (e.g. Companies House PSC for UK, OpenOwnership BODS for UK/DK/SK).
Many entities report a structured "reporting exception" instead of naming a parent (NATURAL_PERSONS, NON_CONSOLIDATING, NO_KNOWN_PERSON, LEGAL_OBSTACLES, DISCLOSURE_DETRIMENTAL, BINDING_LEGAL_COMMITMENTS). The exception is structured data and is surfaced verbatim in direct_parent_exception / ultimate_parent_exception, but it does not name an ultimate beneficiary.
From step: LEI Parent Lookup
Entities self-report parent relationships in their annual LEI renewal. Stale data is possible for restructurings between renewal cycles. The lastUpdateDate on the underlying LEI record indicates currency.
From step: LEI Parent Lookup
Sanctions lists updated daily from OFAC, EU, and UN sources — newly sanctioned entities may take up to 24 hours to appear
From step: Sanctions Check
What to do instead: For same-day compliance, subscribe to OFAC's RSS feed and cross-reference against today's additions
Name matching uses fuzzy logic — common names may produce false positives. Always verify flagged results
From step: Sanctions Check
What to do instead: Filter results by match confidence score and verify flagged entities against the primary sanctions list PDF
Coverage depends on OpenSanctions dataset — may not include all national PEP lists
From step: PEP Check
Name matching is fuzzy — common names may produce false positives. Birth date strongly recommended for disambiguation.
From step: PEP Check
What to do instead: Provide birth_date parameter for disambiguation
PEP coverage varies by country — major economies and EU members have strong coverage, smaller nations may have gaps
From step: PEP Check
What to do instead: For countries with limited coverage, supplement with local registry checks or use the LLM fallback as a secondary signal
Name matching uses fuzzy logic — common names may produce false positives. Birth date strongly recommended for disambiguation
From step: PEP Check
What to do instead: Always provide birth_date when available to reduce false positives. Verify flagged results against official government records
PEP lists updated multiple times per day — recently appointed officials may take up to 48 hours to appear
From step: PEP Check
What to do instead: For time-sensitive checks on recently appointed officials, cross-reference with news sources
AI-classified results — may miss subtle risk signals or produce false positives
From step: Adverse Media Check
Limited to publicly indexed web content — paywalled news sources not covered
From step: Adverse Media Check
English-language bias — non-English media coverage may be underrepresented
From step: Adverse Media Check
Recency depends on search index freshness (typically 24-48h delay)
From step: Adverse Media Check
AI-categorized results — may produce false positives for common names or names that appear in unrelated news contexts
From step: Adverse Media Check
What to do instead: Review top articles manually to confirm relevance. Use entity_type parameter to improve precision
Screens 235,000+ sources but paywalled content may not be fully indexed. Non-English language coverage varies by region
From step: Adverse Media Check
What to do instead: For high-stakes screening, supplement with manual searches in local-language news sources
Articles typically appear in near real-time but some sources may have a 24-48 hour indexing delay
From step: Adverse Media Check
What to do instead: For breaking news events, supplement with direct web search
Reputation scores aggregate multiple blocklists — a single listing may not indicate actual malicious activity
From step: Domain Reputation
What to do instead: Check which specific blocklist flagged the domain in the response details and verify the listing reason before blocking
Blocklist data refreshed daily — recently resolved issues may still show negative reputation for 24-48 hours
From step: Domain Reputation
What to do instead: If a domain was recently cleaned, re-check after 48 hours and use the trend direction to assess improvement
Some registrars rate-limit WHOIS queries — bulk lookups may see slower response times
From step: WHOIS Lookup
What to do instead: Batch lookups with 1-2 second delays between requests, or use the RDAP protocol endpoint when available
GDPR-redacted registrations (common for EU domains) show limited registrant information
From step: WHOIS Lookup
What to do instead: Use the abuse contact email from the WHOIS response to request registrant details through the registrar's disclosure process
Checks the certificate presented on port 443 only — does not verify non-standard TLS configurations
From step: SSL Certificate Check
What to do instead: For services on non-standard ports, use ssl-certificate-chain with the specific hostname:port combination
Results reflect current DNS propagation — recent changes may take up to 48 hours to appear
From step: DNS Lookup
What to do instead: Query the authoritative nameserver directly (returned in the NS records) to see changes before full propagation
Disposable email detection covers major providers but new throwaway domains may not be flagged
From step: Email Validation
What to do instead: Check the domain’s age when investigating suspicious traffic.
No mailbox is contacted. A made-up or bouncing address can return valid if its syntax is correct, its domain has mail servers, and it is not flagged as disposable. Catch-all domains are one example; mailbox existence and delivery are never checked.
From step: Email Validation
What to do instead: Require confirmation through a verification link before relying on a mailbox.
Risk narratives are generated by AI and may oversimplify complex scenarios. The narrative should be reviewed by a qualified professional for high-stakes decisions.
From step: Risk Summary Writer
The AI is instructed to follow specific wording rules (e.g., never say "safe to pay") but adherence is not 100% guaranteed. Automated wording checks are recommended.
From step: Risk Summary Writer
Narrative quality depends on the completeness of input check_results. Missing or incomplete check data will produce less useful narratives.
From step: Risk Summary Writer