How a third-party risk platform built its screening engine on Veridion's company knowledge graph.

Stale data lets the risk cascade slip

The customer's third-party risk platform sits behind the third-party risk decisions made by major corporations, government agencies, and banks. Built on a stack of seven modules (KYB, sanctions cascade, UBO resolution, supplier risk, ESG signals, news monitoring, and category-specific risk lenses), the platform ingests data from multiple sources and applies AI models to score risk on every third party in a client's supply chain or counterparty universe.

The product bet is that AI-driven risk scoring is only as good as the data underneath it. Registry-rooted incumbents covered legal records well but went thin on operational reality: what each supplier actually does, where they actually operate, who actually owns them today, and whether anything has changed since the last audit. Sanctions-list-only providers covered watchlists but couldn't trace cascade through corporate-family structures fresh enough to matter. Trade-flow data saw shipments but not facility functions. None of them gave the platform's risk models the unified, weekly-refreshed view of every third party that the modules needed in order to score risk consistently.

The customer's own framing of the gap, captured during the engagement: stale location info creating blind spots. And on the corporate-linkage side: precise corporate linkage data to identify parent companies, subsidiaries, and ultimate beneficial owners … essential for sanctions screening and understanding how risks cascade across a corporate family.

Seven modules, one weekly refreshed graph

Veridion now sits underneath the platform as the company knowledge graph its seven modules read from. Each module asks the same data layer a different question: continuous monitoring asks what changed about this supplier this week; perpetual KYB asks is this entity still real, still doing what it claimed, still owned by whom it claimed; UBO drift and sanctions cascade ask whose risk does this third party's ownership graph really inherit; shell-company detection asks is this entity actually operating, or is it on paper; disruption response asks which of this customer's suppliers operate in the affected geography or facility class; ESG supply-chain asks what disclosures and operational signals attach to this supplier's facilities; the category lenses ask their own vertical-specific variants of the same questions.

The data layer carries: weekly-refreshed firmographics with normalized identifiers, jurisdictions, registration IDs, and activity classifications; the corporate-linkage and UBO graph fused from registry and digital rails; site-level location data with three-level facility-type taxonomy (manufacturing, distribution, office, R&D, logistics, retail, warehouse); product and service classifications across 3,047 companies in this delivery alone; ESG signals attached to the supplier facility graph; and digital-footprint signals that registry-only providers can't surface: dormancy, operational continuity, news velocity, and shell-company indicators.

Records are delivered through Veridion's Match & Enrich API at ~1.5-second response times, with the customer's input identifiers resolved to stable Veridion entity keys so the platform's modules join cleanly across firmographics, locations, ownership, products, and ESG.

Fused rail reaches 97% accuracy

The accuracy numbers tell the structural story. A digital-only data layer reaches 92%; a legal-only data layer reaches 68%; the fused rail reaches 97%. That delta is the difference between a TPRM platform whose risk models miss the cascade and one whose risk models catch it.

The platform now runs on a continuously refreshed data foundation. The seven modules read from a single weekly-refreshed knowledge graph; the AI models score against signals that represent each supplier as of this week, not as of the last vendor refresh; and the platform's customers (the corporations, agencies, and banks whose risk decisions the customer underwrites) get answers from a third-party risk view that doesn't go stale between audits.