Enhanced Due Diligence (EDD): How SOS API Supports High-Risk KYB

When a financial institution, fintech platform, or compliance team onboards a business client, standard due diligence is rarely enough for high-risk relationships. Enhanced Due Diligence (EDD) demands a deeper, more rigorous verification process—one that traces entity legitimacy through authoritative government sources. For United States professionals, that means going straight to Secretary of State (SOS) records. The enhanced due diligence EDD SOS API workflow has become a cornerstone of modern KYB programs, and this guide explains exactly how to build one that satisfies regulators and scales with your business.

Why Enhanced Due Diligence Matters More Than Ever

The regulatory landscape for business verification in the United States has tightened dramatically over the past decade. The Bank Secrecy Act (BSA), enforced by FinCEN, requires covered financial institutions to implement Customer Due Diligence (CDD) rules—and for relationships that carry elevated risk, EDD is mandatory, not optional.

The Corporate Transparency Act (CTA), which took effect January 1, 2024, added another layer: Beneficial Ownership Information (BOI) reporting to FinCEN. Companies that fail to verify whether their business clients are properly registered—or whether they are shell entities with opaque ownership—now face serious exposure. OFAC sanctions screening, state-level licensing checks, and entity status verification are all part of a defensible EDD program.

Yet the biggest operational bottleneck in EDD remains the same: manually searching 50+ state Secretary of State portals is slow, inconsistent, and impossible to audit programmatically. An API that delivers SOS records in real time closes this gap and makes EDD defensible at scale.

What Qualifies as a High-Risk Business Relationship?

FinCEN guidance and the BSA identify several categories that typically trigger EDD requirements:

• Money services businesses (MSBs), including crypto exchanges and payment processors
• Cash-intensive businesses such as car dealerships, cannabis operators, and pawn shops
• Non-profit organizations and charities
• Foreign-owned U.S. entities or shell companies
• Businesses operating in high-risk geographies or sanctioned sectors
• Clients with complex ownership structures or multiple layers of legal entities

For each of these, the first verification step is confirming that the business actually exists as a properly registered legal entity in the state where it claims to be incorporated. That is where SOS data becomes the foundation of your EDD workflow.

The Role of Secretary of State Data in EDD

Secretary of State filings are the authoritative record of a business entity's legal existence in the United States. For EDD purposes, SOS data provides:

• Entity name and type — confirms the legal business name and structure (LLC, corporation, LP, etc.)
• Entity status — active, dissolved, revoked, or administratively dissolved
• Formation date — flags very recently formed entities, a common red flag
• Registered agent and address — identifies professional registered agent firms often associated with shell companies
• State entity ID — provides a stable, government-issued identifier for audit trails

When this data is returned via API in milliseconds rather than hours of manual research, compliance teams can integrate SOS verification into automated onboarding workflows, adverse media screening pipelines, and continuous monitoring programs.

OpenSOSData API: Purpose-Built for KYB and EDD

OpenSOSData provides a single REST API endpoint that covers all 50 U.S. states, Washington D.C., Puerto Rico, and the U.S. Virgin Islands—more than 34 million business entities. For EDD workflows, the key capabilities are:

• Real-time live lookups that pull directly from state SOS sources
• Cached lookups for cost-efficient bulk screening
• Consistent JSON response schema across all jurisdictions
• Pay-as-you-go pricing with no monthly minimums

Pricing is straightforward: live lookups cost $0.10 each (as low as $0.0314 at volume), and cached lookups cost $0.01 each (as low as $0.00314 at volume). For high-risk EDD cases, live lookups are recommended to ensure you are working with current government data.

Practical Code Example: EDD Live Lookup via Python

The following Python example demonstrates a live SOS lookup—appropriate for EDD workflows where you need current, authoritative entity status directly from state records:

import requests
import json

# OpenSOSData API endpoint
API_URL = "https://api.opensosdata.com/v1/lookup"

# Replace with your API key from https://app.opensosdata.com
API_KEY = "your_api_key_here"

def run_edd_lookup(entity_name: str, state: str) -> dict:
    """
    Perform a live SOS lookup for EDD purposes.
    Uses cache_preference=live_only to ensure data comes
    directly from the Secretary of State — required for
    high-risk KYB and Enhanced Due Diligence workflows.
    """
    headers = {
        "x-api-key": API_KEY,
        "Content-Type": "application/json"
    }

    payload = {
        "entity_name": entity_name,
        "state": state,
        # live_only: bypasses cache, queries SOS directly
        # Use this for EDD where data freshness is critical
        "cache_preference": "live_only"
    }

    response = requests.post(API_URL, headers=headers, json=payload)
    response.raise_for_status()
    return response.json()

def evaluate_edd_risk(entity: dict) -> list:
    """
    Apply basic EDD risk rules to the SOS response.
    Returns a list of risk flags for compliance review.
    """
    flags = []

    # Flag inactive or dissolved entities immediately
    status = entity.get("status", "").lower()
    if status not in ["active", "good standing"]:
        flags.append(f"CRITICAL: Entity status is '{status}' — not in good standing")

    # Flag entities formed within the last 12 months
    from datetime import date, datetime
    formation_str = entity.get("formation_date", "")
    if formation_str:
        formation_date = datetime.strptime(formation_str, "%Y-%m-%d").date()
        age_days = (date.today() - formation_date).days
        if age_days < 365:
            flags.append(f"WARNING: Entity formed only {age_days} days ago — recently formed entity")

    # Flag known professional registered agent firms (common in shell structures)
    registered_agent = entity.get("registered_agent", "").lower()
    shell_indicators = ["registered agents inc", "corporation service company",
                        "national registered agents", "ct corporation"]
    if any(indicator in registered_agent for indicator in shell_indicators):
        flags.append("INFO: Professional registered agent detected — review ownership structure")

    return flags

# --- Main EDD workflow ---
if __name__ == "__main__":
    # Example: onboarding a payment processor for EDD review
    entity_name = "Acme Payment Solutions LLC"
    state = "DE"  # Delaware — common for shell structures

    print(f"Running EDD SOS lookup for: {entity_name} ({state})")
    result = run_edd_lookup(entity_name, state)

    if result.get("entities"):
        entity = result["entities"][0]
        print(f"\nEntity Found:")
        print(f"  Legal Name:       {entity.get('name')}")
        print(f"  Type:             {entity.get('entity_type')}")
        print(f"  Status:           {entity.get('status')}")
        print(f"  Formation Date:   {entity.get('formation_date')}")
        print(f"  State Entity ID:  {entity.get('entity_id')}")
        print(f"  Registered Agent: {entity.get('registered_agent')}")
        print(f"  Agent Address:    {entity.get('registered_agent_address')}")

        # Evaluate EDD risk flags
        risk_flags = evaluate_edd_risk(entity)
        if risk_flags:
            print(f"\nEDD Risk Flags:")
            for flag in risk_flags:
                print(f"  ⚠ {flag}")
        else:
            print(f"\n✓ No automated EDD risk flags detected — proceed with standard review")
    else:
        print("No entity found — manual investigation required")

Full API documentation, including all request parameters and response fields, is available at opensosdata.com/docs.

EDD Workflow: From API Response to Compliance Decision

Running the API lookup is the first step. A defensible EDD program uses SOS data as one layer in a broader verification stack:

1. SOS existence check — confirm the entity is registered and in good standing
2. BOI cross-reference — compare disclosed beneficial owners against FinCEN BOI filings
3. OFAC screening — screen entity name, principals, and registered agent against sanctions lists
4. Adverse media and PEP screening — check key personnel for political exposure or negative news
5. Ongoing monitoring — schedule periodic re-checks using cache_preference: cache_first for cost efficiency, with live lookups triggered on risk events

Comparison: Manual SOS Research vs. API-Driven EDD

Regulatory Defensibility: What Examiners Look For

Bank examiners and FinCEN auditors evaluating your EDD program will look for evidence that your business verification process is systematic, documented, and risk-based. Using a programmatic API with timestamped JSON responses creates an immutable audit trail. Each lookup result can be stored in your case management system with a precise timestamp, the state queried, and the data returned—exactly the kind of documentation that demonstrates a controlled, repeatable process rather than ad hoc manual research.

For Delaware LLCs and other entities commonly associated with layered ownership structures, live SOS lookups provide formation dates and registered agent details that can support adverse findings in a Suspicious Activity Report (SAR) or serve as evidence of proper vetting if the relationship is ultimately approved.

Getting Started

You can create a free account and begin making API calls within minutes at app.opensosdata.com. No subscription required—pay only for the lookups you run. For integration guidance, visit the documentation to review the full request and response schema.

Frequently Asked Questions