Private Company Data API vs. Public Market Data: What Changes for Risk Models?

Without explicit data-quality checks, your model may score stale or mismatched private-company data without flagging the problem.

A risk model built on public market data can rely on regular disclosures, standardized financial statements, and relatively stable entity identifiers.

Most private companies offer no such consistency, so adapting a public-company model takes more than filling in missing fields.

Public-company risk models may combine market prices and trading data with financial disclosures.

Private-company models often rely more heavily on company records, borrower-provided financials, and operational data delivered through a private company data API.

That’s why private-company risk models often need a company-intelligence layer, such as Veridion’s, alongside whatever financial data exists.

The following six data assumptions explain why the difference matters.

Public vs. Private Company Data at a Glance 

The sections below explain how each difference changes the data your risk model needs.

Disclosure Frequency and Update Cadence

Public and private company data differ in how new information becomes available.

This affects how you refresh model inputs, interpret stale records, and determine whether a risk score still reflects a company's current position.

Public companies typically disclose financial results on regulated schedules.

In the United States, domestic public companies generally file quarterly reports on Form 10-Q and annual reports on Form 10-K, subject to applicable filing requirements and exemptions.

These deadlines give risk models a predictable rhythm for incorporating new information and identifying overdue disclosures.

Private companies offer less consistent visibility.

Reporting obligations vary by jurisdiction and company type, and external data may come from registries, lenders, or commercial providers. 

A record retrieved today may contain financial information from two years ago, even when your data pipeline is working correctly.

A successful refresh doesn’t guarantee fresh data.

A daily API request may return the same outdated financial statement, while a newly filed document or material ownership change may warrant an immediate update.

Track when the underlying information applies, and when your system retrieved it, so a fresh data pull doesn’t make outdated information appear current. 

Refresh logic should also account for how quickly each input can become unreliable.

Set field-specific freshness thresholds and flag material values that exceed them for verification or review rather than silently treating them as current.

Crucially, distinguish between: 

• Overdue - Expected information hasn't arrived within the required reporting window.
• Unavailable - The information cannot be obtained from the available sources.
• Unknown update timing - No predictable schedule exists for the next update.

For overdue public-company filings, assess the delay against the known reporting deadline. 

A private company with no quarterly reporting obligation shouldn't trigger the same alert simply because no quarterly filing exists. 

Where update timing is unknown, assess each observation's age and provenance without assuming when new information should arrive.

When a material input is too old to support a reliable assessment, seek updated evidence or flag the uncertainty. 

The appropriate response depends on the variable and its importance to the risk decision.

Standardized Financials vs. Operational Proxies

Public-company risk models can draw on financial statements prepared under established accounting standards, with annual statements generally audited and quarterly disclosures subject to applicable reporting requirements.

In the United States, companies subject to SEC XBRL requirements submit machine-readable financial information. XBRL tagging helps identify financial concepts, but comparable model features still require checks on reporting periods, currencies, units, and whether figures cover the same entity or consolidated group.

Private companies often lack equivalent standardized, publicly available financials.

Depending on the company and jurisdiction, you may find partial financial statements, outdated filings, or no usable financial data.

Your model may therefore need operational proxies, such as employee count, business locations, industry classification, and business activity, to characterize a company when financial information is limited.

These signals provide context, but they don’t establish financial capacity. 

Headcount and operating locations may indicate a company's scale, for example, but they don't directly measure profitability, liquidity, or debt-servicing capacity. 

Treating operational proxies as substitutes for financial measures can distort credit risk assessments.

Veridion adds a structured company-intelligence layer to this process. 

Its API provides company and location data, including industry classifications, business descriptions, employee counts, revenue, and operational locations. 

For attributes such as revenue and employee count, Veridion distinguishes values extracted from digital sources from those modeled using proprietary algorithms. 

This helps risk teams assess the basis of each value without treating estimates as verified financial disclosures.

For risk-modeling teams, these signals can complement available financial inputs when standardized financial statements are unavailable.

Preserve the distinction between reported figures and estimates, and validate operational proxies against known outcomes before using them in production. 

These signals can supplement financial evidence, but they should not replace it.

Entity Identifiers

A risk model can combine data reliably when it determines which records refer to the same entity.

Many public companies and other financial-market participants have a Legal Entity Identifier (LEI), a standardized 20-character code defined by ISO 17442. 

Where a private company has no LEI, reconcile registry identifiers, names, addresses, and provider IDs. Interpret registration numbers together with the issuing registry and jurisdiction.

One provider might identify a company by its registration number, another by its name and address, and a third by its website or an internal database ID.

This fragmentation extends beyond commercial data.

A December 2025 report from the Program Integrity Alliance notes that a large company can have more than 200 identification numbers associated with its legal-entity status across US federal and state sources.

The report attributes this to fragmented systems and the absence of a single, nationally recognized identifier. 

Without reliable entity resolution, a model might join one company's financial information to another company's operating profile or count the same business multiple times. 

These errors distort model inputs and can produce misleading risk assessments without obvious warning signs.

Entity resolution is, therefore, a core data-quality requirement for private-company risk models, not an optional enrichment.

Your workflow must reconcile inconsistent records while distinguishing separate legal entities, operating businesses, subsidiaries, and corporate groups. 

It should also retain supporting evidence and flag ambiguous matches without forcing a decision.

Veridion’s Entity Resolution service reconciles fragmented company records into a consistent identity, using signals from sources such as registries and company websites.

Its company graph also maps relationships between entities, helping downstream systems identify which organizations and connections matter to an analysis.

A global structured finance rating agency needed to identify the companies behind securitization deals, but its records often named trusts and special-purpose vehicles (SPVs), rather than operating businesses. 

Veridion mapped each deal to the entities behind it, classified their roles, enriched the records, and verified the mappings against SEC filings and rating-agency reports.

It also identified the public company whose disclosures were relevant to each deal.

This case illustrates why matching records is only part of the task: risk models must also identify what each entity represents and how it relates to others.

Corporate Hierarchy Visibility

Knowing which company a record represents is only the first step.

To assess risk accurately, you also need to understand how that company relates to its parent, subsidiaries, and wider corporate group.

Clare Rowley, Head of Business Operations at GLEIF, notes:

For risk models, incomplete corporate relationships can obscure group-level exposure or encourage unsupported assumptions about parent-company support.

Public-company filings and consolidated financial statements often document corporate structure.

The GLEIF also publishes Level 2 LEI data, which identifies direct and ultimate accounting-consolidating parents when entities report those relationships through the LEI system.

A missing parent relationship does not necessarily mean the record is incomplete.

Using GLEIF data dated July 25, 2026, FinObservatory found that 78 of 300 selected major US mortgage lenders reported an ultimate accounting-consolidating parent, while 220 filed reporting exceptions.

Only two had neither a reported parent nor an exception.

These figures illustrate why you must distinguish confirmed relationships from documented exceptions and unresolved information. 

An exception doesn’t necessarily mean that a parent exists but remains undisclosed.

Private company structures can be harder to reconstruct, particularly when ownership spans multiple jurisdictions with different registries, disclosure requirements, and identifiers.

A subsidiary may appear under its registered name in one source while another identifies its parent using a different name or identifier.

Without reliable relationship data, your model may treat affiliated companies as independent borrowers, understate group-level concentration, or attribute a subsidiary’s obligations and financial strength to the wrong parent. 

Keep borrower-level repayment obligations separate from group-level concentration measures. Assess guarantees, legal ring-fencing, control, and economic interdependence, and apply the relevant rules for aggregating connected counterparties.

Ownership doesn’t automatically imply financial support.

A financially strong parent isn’t necessarily obligated to guarantee its subsidiaries’ debts or fund them during distress.

Your model should distinguish documented guarantees or other enforceable support arrangements from assumptions that a parent would intervene.

Ownership, accounting consolidation, common management, and financial support are related concepts, but they aren’t interchangeable.

To avoid misattributing risk, distinguish confirmed parent-subsidiary relationships from inferred links and flag uncertain relationships rather than treating every connection as equally reliable.

Industry Classification

Industry classification helps risk models determine which sector benchmarks, economic conditions, and risk factors apply to a company.

For public companies, frameworks such as the Global Industry Classification Standard (GICS) provide a standardized way to group businesses by their principal activity.

Under the GICS methodology, a company’s classification is reviewed when a new annual report becomes available or significant corporate restructuring occurs.

Private companies present a different challenge.

A registered industry code may reflect the activity a business reported when it registered, not what it does today. 

Companies can diversify, change business models, or enter new markets without promptly updating their classifications. 

If your model treats an outdated code as authoritative, it may apply inappropriate sector benchmarks, risk assumptions, or stress scenarios.

Standardized codes can also be inaccurate.

In a study of SafeGraph location data acquired in January 2022, researchers assessed 202,750 US establishments assigned to six financial-services NAICS categories. Their classifications agreed with 102,380 assignments, yielding overall precision of 50.5%.

The findings varied by category, and the study examined establishments rather than private-company credit models. 

Nevertheless, it shows why you shouldn't automatically treat a populated industry-code field as ground truth: validate classifications against current evidence. 

For public companies, recent annual reports and revenue disclosures can help confirm a sector assignment. 

For private companies, compare registered codes with current evidence, such as company websites, product descriptions, and reported business activities. 

Retain the classification source, verification date, and confidence level. 

When sources conflict, or evidence is weak, flag the classification for review or limit its influence on sector-dependent model features rather than forcing a definitive assignment.

Missingness and Confidence Scoring

Public-company risk models can often draw on relatively consistent financial disclosures.

For private companies, financial information may be unavailable, outdated, or incomplete, making missingness a routine modeling challenge rather than an exception.

For example, filling every blank with a sector average can make a company with unknown revenue appear equivalent to one whose revenue is genuinely close to that average.

Preserve whether a value is missing, stale, or estimated, and validate imputation methods against the reasons data is unavailable.

This problem has practical consequences.

A 2025 survey of 350 financial services executives in the US and UK found that 57% cited inaccurate or incomplete records as the leading barrier to small business underwriting.

Because no single source provides a complete, current picture of every private company, compare evidence across registries, company websites, and business directories. 

Assess each source’s authority, recency, and independence, and flag conflicting information for review rather than automatically choosing one value.

Preserve provenance and confidence at the field level. 

Reported revenue isn’t the same as a modeled estimate, even when both share the same numeric field.

Retain the source, update date, and available confidence indicators so downstream models can distinguish stronger evidence from uncertain inputs. 

Depending on the use case, you can use these indicators as model features or apply thresholds to exclude low-confidence values from decisions requiring stronger evidence. 

Test the approach against actual outcomes: stricter thresholds may improve input quality but also exclude companies with sparse data.

Veridion provides field-level signals that support this process.

Veridion’s documented revenue object distinguishes extracted values from modeled estimates through revenue.type. Check the schema of your chosen delivery method before relying on revenue-specific confidence or freshness metadata.

These signals help risk teams assess how to use an input, but they don’t measure creditworthiness or replace model validation.

Conclusion

A private-company risk model isn't a public-company model with the gaps filled in.

It requires different assumptions from the start: reconcile entity identities, triangulate evidence across sources, and track confidence in reported values and estimates.

Without these safeguards, even a precise-looking risk score can rest on unreliable inputs.

Before extending your existing model to private companies, audit its assumptions against each dimension presented above.

Identify where your current pipeline relies on predictable disclosures, standardized financials, stable identifiers, or complete ownership data, and address those gaps before deployment.