Methodology
How Sourcemark reaches a verdict
A risk verdict is only worth anything if you can defend it later. So the short version of our method is this: we check a business against official records, we add up what we find, and we attach the exact record behind every number. You never have to take the score on faith. You can open the source and see for yourself.
What happens when you run a scan
You submit a business URL. Sourcemark reads the site and, at the same time, queries thirteen official sources. Each one returns a signal: a sanctions match, a registry filing, a domain age, a mention in the news. Those signals run through a fixed set of scoring rules and come out as one number from 0 to 100, where higher means more risk, plus the list of rules that got you there. The whole thing takes about a minute and a half.
What we check
| Area | Sources | What it answers |
|---|---|---|
| Sanctions & watchlists | OFAC SDN, UN Consolidated, UK HMT, EU Consolidated | Does the business, or a person tied to it, appear on an official sanctions list |
| Politically exposed persons | OpenSanctions PEP data | Does an owner or officer hold, or recently hold, public office |
| Business registries | Companies House, OpenCorporates (140+ jurisdictions), SEC EDGAR | Is the company actually registered, and does it still file |
| Domain & registration | ICANN RDAP, Tranco | How old the domain is, who registered it, how established it is |
| Threat intelligence | URLhaus, OpenPhish | Has the domain turned up in malware or phishing feeds |
| Adverse media | GDELT | Is the business showing up in negative news coverage |
On top of those, we read the site itself: its certificate, how much real content it has, whether there's a way to contact anyone, and whether it shows up on review platforms. If you attach beneficial owners to a scan, we run their names against the sanctions and PEP data too.
How the score is built
Every check is a rule. When a rule fires it moves the score up or down and records the exact source it fired on. Good signs pull the number down. An established domain, an active registry filing, and infrastructure that serious businesses use all lower risk. Warning signs push it up.
The final number lands in one of four tiers:
| Tier | Score | What it usually means |
|---|---|---|
| Low | 0–24 | Nothing of concern surfaced in what we checked |
| Medium | 25–49 | Worth a look, often a thin online presence or a soft, unconfirmed name match |
| High | 50–74 | Several warning signs, or a borderline match that needs a person to review it |
| Critical | 75–100 | A confirmed sanctions match, a live threat-intel hit, or a stack of serious signals |
Where we draw hard lines, and where we don't
A confirmed sanctions match on the business or a named officer pegs the verdict to critical. That one isn't a judgment call, so we don't let a tidy website talk the score back down.
Most things are softer than that, and we treat them that way. A politically exposed person, or a name that only partly matches a watchlist entry, comes back as a flag for your analyst to clear, not an automatic fail. Common company words make weak name matches collide with unrelated entities in other countries, so a borderline match says "check this," not "guilty." We also cap the penalty for a quiet online footprint, because a small real business shouldn't fail a check for not running a big marketing site.
Every number has a receipt
This is the part that matters most. Each line in a verdict links to the record it came from, with a timestamp. Open the OFAC entry, the Companies House filing, the RDAP registration. You verify the finding instead of trusting our label.
The scoring is also deterministic. The same inputs produce the same verdict every time. There's no model quietly deciding the number in the background, which is what lets you explain a Sourcemark result to an auditor or a partner without hand-waving.
What Sourcemark is, and isn't
Sourcemark screens businesses against public and official records to make your team's decision faster and easier to defend. It doesn't replace that decision, and it isn't a regulatory sign-off. If a dataset wasn't loaded when a scan ran, a clean result means the business wasn't found in what we checked, and the verdict says exactly that rather than implying more.
Every verdict exports to PDF or CSV with its sources attached, so the reasoning travels with the decision and lands in your file, not just ours.
Want to see it on a business you know? Run a free scan and click into any line of the verdict. Start free, no card required.