Sanctions screening of individuals and legal entities, delivered as an API
Screen clients and counterparties against the UN, OFAC, EU, ARDFM and other sanctions and compliance lists with a single HTTP call. The service returns a structured screening result; the decision on the client stays with you.
{
"requestId": "8f14e45f-ea0b-4c1f-9f2b-71a3c7d55e10",
"status": "REVIEW",
"matchScore": 0.87,
"matches": [
{
"listName": "OFAC SDN List",
"entityId": "SDN-24815",
"matchedFields": ["fullName", "dateOfBirth"],
"confidence": 0.87
}
],
"processedAt": "2026-09-09T11:24:03Z",
"listsChecked": ["UN", "OFAC", "EU", "ARDFM_KZ", "OFSI"]
}
We return the data. You take the decision.
The service acts solely as a technology instrument and returns screening results as structured data. The final decision to accept or reject a client, to process a transaction or to apply any other measure remains entirely with the acquiring company.
- The service stores no client decisions and has no access to your business logic.
- Payment data — card and account numbers — is never processed.
- Personal data of screened subjects is not retained after the request has been processed.
Four steps from request to audit log
Synchronous mode for single checks; asynchronous mode for batches of up to 1,000 subjects with webhook notification.
Request
Name, date of birth, citizenship, national or business ID, passport, jurisdiction and address, as available.
Normalisation
Cyrillic ↔ Latin transliteration, parsing of name variants, aliases and abbreviations, support for non-Latin scripts.
Matching
Exact matching across all fields plus fuzzy search with a configurable similarity threshold, 80% by default.
Response and audit
Status, match score, the array of matches and the list of sources checked. An immutable request log with list version and timestamp.
Sanctions and compliance lists
Individual lists can be enabled or disabled per client. Changes appear in the service within 4 hours of official publication.
| Source | List | Refresh | Priority |
|---|---|---|---|
| UN | Consolidated Sanctions List | Real time | Mandatory |
| OFAC, US | SDN List, Non-SDN Lists | Daily | High |
| European Union | EU Consolidated Sanctions | Daily | High |
| ARDFM, Kazakhstan | Persons linked to TF and ML | On publication | Mandatory |
| United Kingdom | OFSI Consolidated List | Daily | Recommended |
| Interpol | Red Notice, public part | Weekly | Recommended |
| PEP | Politically Exposed Persons | Weekly | Configurable |
| Adverse Media | Negative media mentions | Daily | Optional |
Name, date of birth, citizenship, national ID, passport
Name, business ID, country of registration, address
Name, national or business ID
Name, ownership share from 25%
Request, response, statuses
REST, versioned via /v1/. Authentication uses an API key with an HMAC request signature; OAuth 2.0 is supported.
POST /v1/screen/person
Authorization: ApiKey lav_live_9c2f…
X-Signature: hmac-sha256=8f31c0…
Content-Type: application/json
{
"fullName": "Ivanov Petr Sergeevich",
"dateOfBirth": "1974-03-18",
"citizenship": "KZ",
"identifier": {
"type": "IIN",
"value": "740318300123"
},
"threshold": 0.80
}
HTTP/1.1 200 OK
{
"requestId": "b71e4d90-2a55-4f13-8c07-9de4f2a1b884",
"status": "CLEAR",
"matchScore": null,
"matches": [],
"processedAt": "2026-09-09T08:42:04Z",
"listsChecked": [
"UN", "OFAC", "EU", "OFSI", "ARDFM_KZ"
]
}
| Status | Meaning | Recommended acquirer action |
|---|---|---|
| CLEAR | No matches found | Continue the standard process |
| HIT | Match found with high confidence | Escalate to a compliance officer, hold until a decision is made |
| REVIEW | Potential match requiring verification | Manual review by a compliance officer |
| ERROR | Request processing error | Retry the request or contact support |
| Method | Endpoint | Description | Mode |
|---|---|---|---|
| POST | /v1/screen/person | Individual screening | Sync |
| POST | /v1/screen/entity | Legal entity screening | Sync |
| POST | /v1/screen/batch | Batch screening, up to 1,000 records | Async |
| GET | /v1/screen/{requestId} | Retrieve a result by request ID | Sync |
| GET | /v1/lists | Active list sources | Sync |
| POST | /v1/webhook/subscribe | Subscribe to list change notifications | Sync |
| GET | /v1/audit/{requestId} | Audit log for a single request | Sync |
ARDFM requirements and AML/CFT standards
Penetration tests at least once a year, conformance with the OWASP API Security Top 10.
TLS 1.3 in transit, AES-256 for sensitive data at rest.
API key with HMAC signature, key rotation without downtime, OAuth 2.0.
Raw personal data is not retained after the request completes.
Client data is isolated at storage level, with per-client thresholds and list selection.
RBAC: administrator, operator, auditor. Per-client IP whitelisting.
An immutable record: input, result, list version, timestamp. Export to CSV and JSON.
From 100 RPS in normal operation and from 500 RPS at peak, under a 99.9% SLA.
RTO within 4 hours, RPO within 1 hour, backups every 4 hours.
Frequently asked questions
If your question is not here, add it to the request form and we will answer it together with the documentation.
Does the service take decisions about clients?
No. The service returns a status, a match score and the list of matches. The decision to accept or reject a client, to process a transaction or to apply other measures is made by the acquirer.
Is personal data of screened subjects stored?
Subject data is used only to process the request and is not retained after the response. An immutable log of the request itself — input, result, list version and timestamp — is kept for at least 5 years in line with ARDFM requirements.
How quickly are lists updated?
UN lists in real time; OFAC, EU and OFSI daily; PEP and Interpol weekly; the ARDFM list on publication. The target for changes to appear in the service is within 4 hours of official publication.
Can the match threshold be configured?
Yes. The match score threshold is set per client and defaults to 80%. Individual lists can be enabled or disabled for a specific client.
What happens when lists change?
A webhook notification fires when a new subject is added, and previously clear subjects can be rescreened on demand. A list change log with full history is maintained.
Is on-premise deployment possible?
Yes, on request. The default option is cloud deployment; Docker and Kubernetes containerisation applies in both cases.
Lavender is a vendor of compliance technology
We build and operate sanctions screening as a product: our own matching engine, aggregation of official list sources, an immutable audit log. We do not provide legal or compliance advisory and take no decisions about our customers' clients.
Independently scalable microservices, event-driven processing of list updates, separated read and write paths.
Cloud or on-premise on request. Docker and Kubernetes, CI/CD with lint, test, staging and production stages.
Mon–Fri, 09:00–18:00 (Astana). Critical incidents answered within 30 minutes. A dedicated Telegram or Slack channel.
Documentation and sandbox access
We will send the OpenAPI specification, the integration guide with code samples and a test key. Reply within one business day.