# Vigil KYC screen (paid, per screen)

> Vigil KYC screen: check one company and up to three named people against sanctions and exclusions lists, with an evidence pack and PDF. Each screen costs 1.00 USD, paid over the Machine Payments Protocol (HTTP 402): cards through a Link Shared Payment Token or USDC on Tempo. Call it without an account, API key or checkout page.

## Endpoint
- POST https://cairn.cmdrvl.com/vigil-paid/v1/screen: JSON body {"company": "...", "persons": ["...", {"name": "...", "dob": "YYYY", "nationality": "US"}]}. Without payment the response is 402 with a WWW-Authenticate: Payment challenge; retry with the credential. The paid response carries a Payment-Receipt header and is usually 202: a screen takes 40–100 s, so the response arrives within 15 s with a token and a result_url to poll (no further payment); pass wait_seconds (≤ 240) to wait longer for a 200 in the same call.
- GET https://cairn.cmdrvl.com/vigil-paid/v1/screen/{job_id}?token=…: the result, 202 while running or 200 with the sealed screen.
- GET https://cairn.cmdrvl.com/vigil-paid/v1/screen/{job_id}/report.pdf?token=…: the review PDF.
- GET https://cairn.cmdrvl.com/vigil-paid/v1/: this offer as JSON (price, sources, limits, attribution).

## What a screen is
- The company and up to three named people are matched against the public lists below, each read at its publisher's as-of date, with the bytes hashed into the pack. Severity (low / medium / high), routing (approve / quick_review / two_reviewers) and a recommendation come from fixed, versioned rules. No language model runs in a screen.
- A result is evidence for a person to review. 'Potential match' is a record to look at, never a finding; 'no candidate found' is about that snapshot of that list, never 'cleared'.

## Lists screened
- OFAC Specially Designated Nationals (SDN): US Treasury OFAC (US Government work — public domain (17 U.S.C. § 105))
- OFAC Consolidated Non-SDN lists: US Treasury OFAC (US Government work — public domain (17 U.S.C. § 105))
- UK Sanctions List (FCDO): UK Foreign, Commonwealth & Development Office (Open Government Licence v3.0)
- EU Consolidated Financial Sanctions (FSD): European Commission (Creative Commons Attribution 4.0 (Commission Decision 2011/833/EU))
- BIS Entity List: US Commerce BIS (US Government work — public domain (17 U.S.C. § 105))
- BIS Denied Persons List: US Commerce BIS (US Government work — public domain (17 U.S.C. § 105))
- BIS Unverified List: US Commerce BIS (US Government work — public domain (17 U.S.C. § 105))
- BIS Military End-User List: US Commerce BIS (US Government work — public domain (17 U.S.C. § 105))
- US Consolidated Screening List: US ITA / Trade.gov (US Government work — public domain (17 U.S.C. § 105))
- SAM.gov Exclusions: US GSA SAM.gov (US Government work — public domain (17 U.S.C. § 105))

## Not screened (listed on every report)
- un_consolidated: UN Security Council Consolidated List — not screened in the paid lane: the UN website Terms of Use permit personal, non-commercial use only and forbid redistribution; no list-specific permission found (checked 2026-10-27). UN designations are implemented through the EU, UK and US lists screened here, each on its own timetable.
- world_bank_debarred: World Bank debarred firms — the web list offers no export and its API gateway requires a subscription key (checked 2026-09-28)
- interpol_red: Interpol Red Notices — terms forbid automated use
- ddtc_debarred: DDTC Debarred Parties — cross-referenced via the US CSL source column only
- dfat_consolidated: Australia DFAT Consolidated List — the publisher stalls automated fetches of the XLSX (checked 2026-09-28); route not validated
- adverse_media: Adverse media — not screened in this lane (see kyc.coverage for the backing table and history)

## Limits and terms
- Up to 3 persons per screen. No hourly limit: screens run one at a time in the order paid, 40–100 s each; a burst queues and is served in turn. A payer with more than 50 screens still unfinished is refused (and refunded) until they finish.
- Results and the PDF are kept 90 days; payment and refund records 730 days.
- Refunds: a screen that produces no report is refunded, whether it fails before or after the answer went out; a duplicate of a screen you paid for within the duplicate window returns the earlier pack and the new charge is refunded (up to 3 automatic refunds per payer per day; beyond that the earlier pack is returned and the charge stands); a payment refused for the hourly limit or a malformed request is refunded. A paid answer carries payment.refund.status when a refund applies: refunded = the refund is made; refund_id is Stripe's; a card refund reaches the card in 5–10 days; a stablecoin refund returns to the paying wallet; pending = a refund is owed and its outcome is not yet confirmed; it is retried every few minutes under one idempotency key, so it is made exactly once; manual = a refund is owed and has no automatic path (a stablecoin payment Stripe holds no record of); it is made by hand to the paying wallet; kept = the earlier pack is returned and this charge stands (daily refund allowance used).
- If you lose the answer: lost answer: retry the same request with the same payment credential: the recorded answer for that payment comes back (its result_url and token, or its refund); no second charge; lost result url: pay again for the same inputs within 24 h: the earlier pack is returned and the new charge refunded (counts against the daily refund allowance); lost screen: a screen still unfinished 15 min after payment is treated as failed and refunded; expired: result_url and the PDF are served for 90 days; after that the screen is gone and a new payment runs a new screen.
- Attribution: Source: U.S. Department of the Treasury, Office of Foreign Assets Control — Sanctions List Service published exports. US Government work; public domain. Source: U.S. Department of the Treasury, Office of Foreign Assets Control — Sanctions List Service published exports. US Government work; public domain. Contains public sector information licensed under the Open Government Licence v3.0. © Crown copyright. Source: UK Sanctions List, Foreign, Commonwealth & Development Office. Source: European Commission, Consolidated list of persons, groups and entities subject to EU financial sanctions (Financial Sanctions Database), reused under CC BY 4.0. Changes: records parsed and name-matched; the list is not reproduced. Source: U.S. Department of Commerce, Bureau of Industry and Security — Entity List. US Government work; public domain. Source: U.S. Department of Commerce, Bureau of Industry and Security — Denied Persons List. US Government work; public domain. Source: U.S. Department of Commerce, Bureau of Industry and Security — Unverified List. US Government work; public domain. Source: U.S. Department of Commerce, Bureau of Industry and Security — Military End-User List. US Government work; public domain. Source: U.S. International Trade Administration — Consolidated Screening List (data.trade.gov). US Government work; public domain. Source: U.S. General Services Administration — SAM.gov Exclusions public extract (publicly available under FOIA). US Government work; public domain.

## Example prompts
- "Run a sanctions and exclusions check on Acme Holdings LLC and its directors Jane Doe and John Roe, and give me the evidence report."
- "Before we sign, screen Example Capital Partners against OFAC, EU, UK and BIS lists and tell me what needs review."
- "Is Contoso Shipping or Maria Example on any US, UK or EU sanctions or export-control list? Pay for the screen if needed."