How Credit Rating Agencies Can Use Private Company Data APIs

Private company data can fill important gaps in a credit rating workflow, but only when it's reliable and easy to use.

The data API gives CRA teams programmatic access to identity, classification, corporate structure, and operational data in one workflow.

In this guide, we'll walk through how credit rating agencies can use these APIs for resolution, company enrichment, and ongoing monitoring.

Resolving Issuers and Obligors

The workflow must identify the legal entity responsible for the obligation being assessed.

A data API can support that identification, but ambiguous inputs may return multiple candidates or remain unresolved.

If it points to the wrong company, the profile you pull describes another business and the group structure you map follows a different line of work. 

A profile can look complete while describing the wrong company, so populated fields alone do not establish that the match is correct.

For private issuers and obligors without a Legal Entity Identifier (LEI), the available input may be a name plus whatever other attributes the source system holds.

That means you're left with matching on names and other attributes, which is where errors begin.

To settle that manually, you have to check registries and company websites record by record.

Veridion's entity resolution makes this step easier. 

The explainability layer helps your team assess the match and route ambiguous or inferred results for review before accepting them as the issuer or obligor.

Using the Match & Enrich API, you send a company name, website, address, phone number or a registry ID such as an LEI. 

Each result comes back with an explainability layer of three parts: 

Veridion's documentation recommends reading the score together with the scenario and the match details rather than relying on a threshold alone. 

Veridion's documentation gives an example in which a fuzzy match on an alternate commercial name may be acceptable when the address matches fully or the overall score is 0.8 or higher. This illustrates an acceptance rule, rather than a universal threshold for CRA workflows; the scenario and match details still need to be assessed.

This customer's case study shows how far this step reaches. 

A structured-finance rating agency sent Veridion an input list that looked like company names. 

Many entries held securitization trusts and special-purpose vehicles, legal entities that were created to hold assets and issue securities, separate from the institutions behind them. 

Instrument names did not always identify the operating institutions behind the transaction, making straightforward company-name matching unreliable.

Veridion mapped each instrument to the entities behind it and classified their roles, including parent, sponsor, depositor, and loan seller.

The returned records included firmographic data to support the agency's analysis.

Every mapping had a written justification and was checked against SEC filings and rating agency reports. 

The agency received the result as a batch delivery rather than through live API calls, but the standard it set applies to any resolution API you evaluate.

Enriching Private-Company Profiles

The API's next job is to return a structured profile of that company, removing the need to research each name manually. 

For private companies, public financial information may be limited.

In fact, according to a 2025 case study from S&P Global Market Intelligence, the amount and quality of information on private companies falls as the firms get smaller. 

Location, industry, and size provide a starting point for enrichment. The fields required for credit analysis depend on the agency's methodology and the entity being assessed.

S&P also notes that anchoring on peers leaves millions of SMEs without financials with the same score.

Two companies in one cohort can look identical on those three fields and still differ in how many sites they run or which activities earn their revenue. 

A profile worth pulling into a credit workflow has to go below the cohort level.

When you test a provider, request profiles for a sample of your issuers and check each group. 

Look especially for size and revenue that come labeled as extracted or modelled. 

Validating Industry and Activity Classification

A registered industry code records what a company declared at a certain time. 

A private company data API should classify companies by what they do now and return that classification with its taxonomy version attached.

This classification has peer groups at the top of its field. 

A CRA team that builds a peer group from a code lookup has two limits built into the code itself.

The first limit is that a primary code may be too broad and represent only one activity.

A single company often carries out more than one economic activity, and the primary one is the one that gets selected.

So two companies can share a code while earning their revenue from very different mixes of activity, and the code gives you no way to tell them apart.

The second limit is that older taxonomies may not distinguish newer business activities.

The Office for National Statistics (ONS) published UK SIC 2026 in July 2026, 19 years after the 2007 revision that preceded it. 

In this report, ONS singles out the emergence of AI-related activities as a reason to update. 

Older taxonomies may place emerging activities in broad categories that do not distinguish the business models relevant to peer comparison.

Relying on that code alone can produce a peer group that reflects a broad classification rather than the company's current business mix.

A company operating in multiple sectors can therefore benefit from a profile that identifies its different activities.

Veridion's newer API versions return multiple activity classifications with estimated shares of the company's operations. Check which version exposes this structure and how the shares are defined before using them in peer analysis.

Activity shares describe estimated operations, rather than verified revenue contributions, and should be assessed alongside the underlying business description.

When you evaluate an API, test it on issuers whose registered code you already doubt. 

Compare the returned activity shares against that code, and check that every code arrives with its taxonomy version. 

Mapping Corporate Structure Across Jurisdictions

Corporate structure data identifies relationships relevant to group analysis. The agency then assesses whether those relationships imply support, constraints, or negative intervention under its methodology.

S&P Global Ratings builds its group analysis on that map. 

Its Group Rating Methodology opens with one step: "Identify the group parent and the group members." 

The group means the parent plus every entity it controls, directly or indirectly. 

Each member then receives a group status, from core to nonstrategic. That status informs the rating outcome under the methodology; ownership links alone do not establish a rating uplift.

A June 2022 S&P rating action on Suncorp-Metway shows how this plays out. 

At the time of the June 2022 rating action, Suncorp-Metway was Suncorp Group's banking subsidiary.

After the parent announced a strategic review of its banking operations, S&P judged the bank to be no longer a core part of the group and lowered its long-term rating to A+. 

It still applied a three-notch uplift above the bank's stand-alone profile, because it viewed the bank as a highly strategic business for the group.

The downgrade reflected a weaker assessment of prospective group support, even though the bank remained wholly owned by Suncorp.

You can only make that call when the entities that belong to the group, and the position of each one in it, are known. 

Across jurisdictions, registry formats and reporting conventions can differ.

Separately, a rating agency's analytical definition of a group may differ from the ownership or consolidation relationships returned by a data provider.

TRIS Rating, a credit rating agency in Thailand, counts entities over which a parent has control or influence, even where the parent holds less than half of their equity.

A subsidiary can therefore be inside one provider's group and outside another's, depending on which basis the data follows.

GLEIF Level 2 data illustrates one relationship model: it links entities to their direct and ultimate accounting consolidating parents using LEIs.

These relationships describe accounting consolidation, rather than every ownership or control relationship relevant to a rating agency's group analysis.

Missing parent relationships can have documented reporting exceptions, including:

• No accounting consolidating parent to report
• The relationship is not publicly disclosed
• The parent has no LEI

An absent link should not automatically be interpreted as evidence that no parent exists. Before relying on a provider's structured data, test a known group that spans two countries and check how the response handles its cross-border relationships.

Look for the identifiers on both sides and the stated basis of the link, then see what it says about any entity it could not connect.

Adding Operational Context to Sparse Financials

When a private company publishes little financial information, the private company's data API supplies facts about the business that you can read the remaining figures against.

Credit Benchmark aggregates anonymized internal credit assessments from more than 40 global financial institutions. 

It reports that its dataset covers more than 120,000 entities across 160+ countries, and that over 90% of them have no equivalent S&P, Moody's or Fitch rating. 

This figure, though, describes Credit Benchmark's dataset, not the market as a whole. It still shows how a large share of a bank-sourced universe sits outside agency coverage.

When you work from lists like this, a majority of the names arrive without an agency rating to anchor on. 

Agencies already handle that situation. S&P Global Ratings issues credit estimates, which are confidential, point-in-time indications of its likely rating on an unrated company.

This estimate comes from an abbreviated analysis and does not typically involve the company itself. 

It relies on information from the requesting party together with third-party sources that S&P considers reliable. 

S&P states that a credit estimate is not a rating and is not intended to substitute for one.

This is one example of how an agency uses third-party information in a defined analytical product. It does not mean that operational data alone is sufficient for a credit estimate or a rating.

A private company data API gets that outside evidence through: 

• Headcount 
• Location 
• Business Activity 

With headcount and activity from the API, you can check if a modelled revenue figure sits in a plausible range for companies of that size in that line of business. 

Location data can also support an assessment of geographic diversity and concentration.

S&P Global Ratings' Corporate Methodology considers both the markets a company serves and the geographic concentration of its facilities.

Location data can support that assessment, but a site count alone does not establish revenue diversification.

Business activity explains how the revenue is earned. 

The same headcount and the same number of sites will have different revenue per person when one company sells software subscriptions and the other moves freight. 

A description of what a company sells, and to whom, tells you which of those drivers to look for.

These differences from financial data decide how you can use them. 

Headcount or location do not count as substitutes for audited statements. They show you where to look to fill sparse information. 

Decide, before integration, which operational fields you need for an unrated obligor, and check that the provider returns them with a label showing how each was obtained.

Screening Large Company Universes at Scale

Building coverage across thousands of unrated companies needs an API that accepts those companies in bulk.

To screen the whole list, first filter it down to the companies that fit your coverage criteria, then remove duplicates so each company appears once. Finally, rank what remains by priority.  

At the API level, each of these steps has a requirement on the data.

Filtering needs structured fields on every record, such as: 

• Size
• Activity 
• Country
• Company status

Deduplication needs one stable identifier per company across the batch, backed by the resolution evidence from the first step. 

Prioritizing needs the size and footprint fields that sparse financials leave out. 

If the API returns those fields one company at a time, you end up waiting on responses due to the request limits. 

The Companies House API allows up to 600 requests per application within a five-minute period. Requests above that limit receive a 429 response for the remainder of the window.

That is a nominal rate of 7,200 requests per hour under the default limit.

In a hypothetical integration requiring three requests per company, 50,000 companies would require 150,000 requests.

At the default rate, the nominal processing time would be about 21 hours, excluding retries and other delays.

The actual number of calls depends on the endpoints and data required by the integration.

The limit protects the service for every user. 

Companies House staff describe this API on their developer forum as designed for real-time retrieval of data as it is needed, not for collecting large data sets. 

The US Securities and Exchange Commission (SEC) does the same. Its developer guidance limits each user to 10 requests per second, regardless of the number of machines used. 

The SEC’s API documentation calls the bulk archive ZIP files, which are rebuilt nightly, the most efficient means to fetch large amounts of API data. 

Both services offer bulk options for large datasets. Companies House also provides streaming updates, so the appropriate integration may combine an initial bulk load with ongoing changes.

Global Legal Entity Identifier Foundation (GLEIF) issues three sets of Golden Copy files a day, and each set comes with four delta files that list only newly issued LEIs and revisions to existing records. 

A user can load a full file and then apply deltas for the corresponding update period, provided the base file and delta window are aligned.

A full export with update files lets you refresh the group by applying changes, as GLEIF's delta files do, instead of repeating a pass over every company. 

Monitoring Material Company Changes

Between formal reviews, a private company data API should tell you when a company's status, ownership or activity changes, so you stop rerunning manual lookups on a calendar.

Article 8(5) of the CRA Regulation requires a rating agency to monitor ratings and review them on an ongoing basis and at least annually.

In a multi-firm review published in May 2026, the Financial Conduct Authority found that many firms lacked defined processes to take ongoing monitoring beyond the annual review. 

Veridion's data methodology describes continuous profile refreshes, with update frequency varying by the type of data.

The API response includes last_updated_at, the date and time the company's information was last extracted and verified for updates.

It also includes company_status, the status provided by the registry, either Active or Inactive.

Use last_updated_at to identify profiles for reprocessing, then compare the relevant field values with the previous delivery. A newer timestamp alone does not establish a material company change.

Confirm the refresh cadence and delivery schedule for the fields your workflow uses. Refreshed company data can support ongoing surveillance, but it does not replace the agency's monitoring and review obligations.

Article 8 of the same Regulation says that changes in credit ratings are issued in accordance with the agency's published rating methodologies. 

Settle in advance which changes send a company to an analyst, such as a switch to inactive status, a new parent in the group structure, or a change in activity. 

Then ask each provider how it reports each of those changes and how soon after the event your team sees it.

Conclusion

A private company's data becomes more useful when it is treated as part of the rating workflow.

The right API can help a CRA resolve the correct entity, understand what it does, map where it sits in a group, and spot changes between formal reviews. 

But the quality of that workflow depends on the quality of the underlying data.