Check a new vendor against OFAC before you pay their invoice

To check a vendor before the first payment, type their name and website into the free check on pyxmark.com, or have your AI assistant call due_diligence_report. In seconds you get a report that says hold, review or clear, with the time each sanctions list was last synced and a link to every source.

A finished check

We ran Uline through due_diligence_report with its website and the state set to Wisconsin:

due_diligence_report
{ "name": "Uline", "domain": "uline.com", "state": "WI" }

Real output, shortened, run Oct 25, 2026 (6:11 pm Pacific time).

Step by step

1. Get the vendor’s details

   You need the name on the invoice. Their website, or the domain of the email address the invoice came from, adds the domain check. In the MCP call, the US state where the vendor is registered adds a link to that state’s business search.

2. Run the check

   On the web, go to the check form on the home page. Enter the name under Company or person and the domain under Website or email domain, then press Check. Screening can take up to 15 seconds.

   In an AI assistant connected to Pyxmark, ask for a due diligence report on the vendor, or have it make this call:

   due_diligence_report
   { "name": "Acme Supply Co.", "domain": "acmesupply.com", "state": "OH" }

   Does it cost anything? No. Single checks are free, 25 a day per IP address, with no account or key. Every tool call counts as one lookup, and a full report is one call.

3. Read the verdict

   The report ends in one of three verdicts. Here is what each one means and what to do:

   Hold

   A sanctions match scoring 0.95 or higher, an exact match on an identifier a listing gives, or a domain registered less than 30 days ago. Don’t pay or onboard until a person has compared the match with the official entry.

   Review

   Something weaker was flagged: a lower scoring name match, a domain under 6 months old, a missing MX, SPF or DMARC record, a risk SEC filing in the last 24 months, or a list that was out of date. Have a person look at the red flags before you pay.

   Clear

   The name was screened against every list and nothing was flagged. That covers only the sources checked, and it isn’t a guarantee.

   The match looks like a different company. Names are matched fuzzily, so a potential match can be someone else with a similar name. Each match links its official entry. Compare the country, address and ID numbers the list records with what you know about your vendor. A potential match is a lead to verify, not a finding.

   Why it matters: the maximum US civil penalty for dealing with a sanctioned party is $377,700 per violation, or twice the transaction value if higher, and you don’t have to know you did it to be fined (31 CFR 501, App. A).

4. Fill the gaps the report points to

   No SEC record? That’s normal for a private company. The SEC only covers companies that file with it, and most private firms don’t. Add the state to the MCP call (or call state_registry_link) and open the state’s business search to confirm the company is active, when it was formed and who its registered agent is. Pyxmark links the state registry; it doesn’t search it for you.

   SAM.gov exclusions aren’t synced yet. If federal exclusions matter for this payment, open the SAM.gov search link in the report and look there.

5. Keep the report

   Each report is dated and cites its sources, so you can file it with the invoice. Pyxmark doesn’t save the names you search or the reports it returns, so the copy you keep is the record.

   Who else sees what you enter? Our server, not your browser, runs the lookups. The name is matched against copies of the sanctions lists and the SEC company list that we keep, so the name itself isn’t sent out. If it matches an SEC filer, that company’s SEC number goes to SEC EDGAR. The domain goes to its registry, Cloudflare DNS and the Wayback Machine. If the registry’s lookup fails, the domain age lookup falls back to rdap.org, and then to the registry’s WHOIS server. Pyxmark runs on Cloudflare. Beyond those sources and Cloudflare, we don’t sell, rent or share what you enter with anyone else. The privacy policy has the full list.

If the bank details on the invoice are new or have just changed, also check the vendor’s email domain before you change their bank details.

Limits

• Results are informational, not a compliance determination or legal advice.
• Name screening can’t see hidden ownership. A front company that isn’t listed itself won’t match unless you give its owners or a list states the link.
• Pyxmark tries to sync each list daily, so a designation made today may not show until the next successful sync. Every report shows when each list was last synced.
• There are no bulk checks, watchlists or monitoring yet. A vendor that was clear when you first paid them isn’t rechecked for you.
• Pyxmark isn’t for consumer screening (credit, jobs, housing, insurance or tenancy).

How matching and verdicts work: sources, method and limits.

When you don’t need this

If your bank or accounts payable software already screens every new payee against these sanctions lists, and you can see its result, a second sanctions check adds little. The domain check may still be worth running when a vendor is new to you.

Refunds to consumers and payroll aren’t what Pyxmark is for. It screens the businesses and people you pay as vendors, contractors or partners.

Start with your next new vendor

Use the free check on the home page. Or connect your AI assistant (steps for every client) and ask, with your vendor’s details:

Run a due diligence report on Acme Supply Co., acmesupply.com, Ohio. Tell me the verdict and what I should do before paying.

To make Claude run this before every payment it handles, see have Claude screen a supplier before you approve a payment.