How Coris checks work

Coris supplies the data behind your KYB decisions, and your team makes the decisions. This page is for risk and compliance leads, and nothing here is legal advice.

How to read Coris scores

Ratings

biz_rating, website_rating

1 best5 worst

Lower is better: 1 is the lowest risk and 5 the highest.

CorShield risk score

fraud_score

0 lowest risk100 highest risk

Higher is riskier. It is a risk score, not a probability of fraud.

Data sources

Source	What it gives you	Field
Secretary of State and other registries	Legal name, status, filing date, officers	`legal_entity_registrations`, `personnel`
License records	Licenses on file	`legal_entity_licenses`
The business website	Policies, contact details, a rating	`establishment_website`
Web search, maps and reviews	The business match, reviews	`business_search`, `establishment_reviews`
Imagery of the location	What is at the address	`establishment_merchant_vision`
News, social media, court records	Adverse media, litigation	`establishment_adverse_media`, `establishment_litigation_checker`
Sanctions and AML lists	Screening hits	`hits`
IRS TIN matching	A TIN and name match	`match_details.tin_match`
Email, phone, IP, domain, bank	CorShield inputs	`fraud_score`

Coverage

Registration data covers all 50 US states and DC, plus Canada, Australia, the UK, Ireland and France. Outside the US, send the two-letter country code.
If Coris finds no registration, it still creates a record with legal_entity.status UNKNOWN. Sole proprietors often land here. Review these by hand.

Sanctions and AML screening

Coris screens the legal name with its country of registration, or with US when that country is unknown. Each screening request runs a new check and stores the result.

Question	Answer
Which lists?	Global sanctions and watchlists, such as OFAC SDN, PEP lists and the OSFI Canadian sanctions list.
How often do lists refresh?	As regulators publish them.
How does matching work?	Matching is fuzzy, so close spellings and transliterations also match. Each hit has a `name_match_score`, so your team can judge how close it is.
What does a hit return?	`name`, `name_match_score` and `hit_types`, plus `date_of_birth` and its score when listed.
Who decides?	Your compliance team decides if each hit is a true match. The response may include the screening provider's own status. Treat it as a signal, not a decision.
Are accounts screened again?	It depends on your monitoring setup. Coris can rescreen at onboarding, on a schedule, or when account details change. Set it up by API or in the portal, and ask Coris if you need help.

Coris can limit the hit types your workspace receives.

What Coris checks and what stays with you

Coris checks against a source	Coris collects for review	Your program owns
Registration status	Licenses and registry officers	Identity checks on people (CIP)
An IRS TIN match, on request	Website, reviews, media, litigation	Finding and verifying beneficial owners
Sanctions and AML hits	Industry and MCC	Risk rating, ongoing due diligence, the final decision

personnel lists people on file with the registry, not beneficial owners. Add owners to an account as persons. Coris screens each person you add against the same lists, when you add them and during monitoring.

Turnaround

These are typical ranges, not service levels.

Merchant Profiler: most profiles finish in 2 to 5 minutes, and partial results (206) arrive sooner.
CorShield: most results finish in 2 to 5 minutes.

The CorShield model

CorShield scores a business application. Each of its two models must be turned on for your workspace.

Model	The risk it scores
Third-party	Someone applies in the name of a business they do not represent.
First-party	The business itself is not credible.

Inputs include registration, the website and its domain age, email, phone and IP signals, reviews, search results and bank details.

fraud_score runs from 0 to 100, and higher means more risk. It is not a probability of fraud, so set your own thresholds. The third-party model also groups the score into coris_risk_bucket, from 0 to 10.

adverse_reasons gives plain-language reasons for the score. Show them to your reviewer.

Coris tests each model change against past applications with known outcomes before release. For a model-risk review, ask Coris for details.

Audit trail

Each record has a timestamp.

Record	User recorded
Merchant alert status, queue and assignment changes	Yes, with before and after values
Alert resolutions	Yes, with the reviewer's note
Account notes	Yes, with the last editor
Account and transaction tags	Yes
CorShield results on an account, one per run	No
Sanctions screenings	No, they are system checks

You can see each record's history in the portal. Ask Coris for a full export. For retention and deletion when you leave, see the Coris trust center.

Next: Verify a business at onboarding