DEV Community

Onizuka
Onizuka

Posted on

Can AI Handle KYC? Grounding LLMs For Due Diligence Tools

#ai #fintech #llm

#ai #kyc #compliance #duediligence #api #llm #fintech #rapidapi

AI Writes Code. You Still Own the Verdict.

ChatGPT can spin up a KYC dashboard in an afternoon. It will generate React components, SQL schemas, and swagger documentation that look production-ready. But ask it whether fintech-example.io is a legitimate payment processor or a sanctions-evasion shell, and it will confidently fabricate ownership records, misread registrar data, or hallucinate a clean bill of health.

That is the gap AI cannot close on its own: grounding. Large language models reason over tokens, not truth. A reliable due-diligence or compliance tool must anchor every LLM answer in real, verifiable, timestamped data—WHOIS records, IP geolocation, company registries, email infrastructure, and sanctions lists.

This article shows how to use the Portfolio Investigate API to feed your AI agents factual domain dossiers and compliance verdicts, turning a prototype into something a compliance officer can actually trust.

The Hallucination Problem in Due Diligence

LLMs are autocomplete engines. They predict what words should come next based on training data, not live facts. In a KYC context, that creates three failure modes:

  1. Stale knowledge — model weights freeze; a domain can change ownership next week.
  2. Fabricated citations — the model may invent registrar names or corporate addresses.
  3. Missing signals — an LLM has no built-in access to WHOIS history, IP blocks, or OFAC lists.

The fix is not to abandon LLMs. It is to constrain them: give them a structured evidence packet first, then let them summarize, classify, and answer natural-language questions on top of it.

That evidence packet is exactly what Portfolio Investigate API returns.

What Portfolio Investigate API Delivers

Portfolio Investigate API is a one-call domain investigation report. It aggregates five underlying portfolio APIs into a single dossier:

  • WHOIS — registration dates, registrar, name servers, privacy status.
  • IP Geolocation — where the domain actually resolves.
  • Company — linked corporate entities and registries.
  • Email — mail server reputation and deliverability signals.
  • Sanctions — cross-checks against restricted-party lists.

The response includes a plain-English verdict and an LLM Ask endpoint so you can ask follow-up questions grounded in the dossier rather than in the model's imagination.

One-Call Due Diligence Report

Let us start with the core report. The API returns a structured dossier you can store, display, or pass to an LLM as context.

curl -X GET "https://portfolio-investigate.p.rapidapi.com/investigate/fintech-example.io" \
  -H "X-RapidAPI-Key: $RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: portfolio-investigate.p.rapidapi.com"
Enter fullscreen mode Exit fullscreen mode

A trimmed response might look like this:

{
  "domain": "fintech-example.io",
  "risk_score": 42,
  "verdict": "MODERATE RISK",
  "summary": "Domain registered 6 months ago via privacy-protected WHOIS. Server hosted in a jurisdiction different from the stated company address. No sanctions matches found.",
  "whois": {
    "created": "2023-11-14",
    "registrar": "NameCheap, Inc.",
    "privacy": true,
    "name_servers": ["dns1.registrar-servers.com"]
  },
  "ip_geo": {
    "country": "NL",
    "asn": "AS49981"
  },
  "company": {
    "name": "Fintech Example B.V.",
    "jurisdiction": "Netherlands",
    "registry_url": "..."
  },
  "sanctions": {
    "matches": []
  }
}
Enter fullscreen mode Exit fullscreen mode

The verdict and risk_score give your compliance UI an immediate signal. The underlying objects give an LLM the evidence it needs to explain why.

How to Use Portfolio Investigate API

You can subscribe to the API on RapidAPI: (see RapidAPI). The GitHub repository with examples and client wrappers is at https://github.com/On13uka/portfolio-api.

Here is a minimal Python workflow that fetches a dossier, then asks a natural-language question against it using the LLM Ask endpoint.

import requests
import os

RAPIDAPI_KEY = os.environ["RAPIDAPI_KEY"]
HOST = "portfolio-investigate.p.rapidapi.com"
BASE = f"https://{HOST}"

headers = {
    "X-RapidAPI-Key": RAPIDAPI_KEY,
    "X-RapidAPI-Host": HOST,
}

def get_dossier(domain: str) -> dict:
    url = f"{BASE}/investigate/{domain}"
    r = requests.get(url, headers=headers, timeout=30)
    r.raise_for_status()
    return r.json()

def ask_about_domain(domain: str, question: str) -> str:
    url = f"{BASE}/ask"
    payload = {
        "domain": domain,
        "question": question,
    }
    r = requests.post(url, json=payload, headers=headers, timeout=60)
    r.raise_for_status()
    return r.json()["answer"]

# Example usage
domain = "fintech-example.io"
dossier = get_dossier(domain)
print(dossier["verdict"], dossier["risk_score"])

answer = ask_about_domain(
    domain,
    "Is this domain safe to onboard as a payment partner? List the specific risks."
)
print(answer)
Enter fullscreen mode Exit fullscreen mode

The POST /ask endpoint is the key to safe LLM use. Instead of asking an open model a vague question, you are asking a model that has been fed the dossier as context. The answer is grounded in the WHOIS, IP, company, email, and sanctions data the API just retrieved.

Building a Compliance Agent

You can go further by combining the API with an orchestration layer. A simple compliance agent might:

  1. Ingest a new merchant application.
  2. Extract the primary domain.
  3. Call Portfolio Investigate API.
  4. Store the dossier in your audit log.
  5. If risk_score > 70, flag for manual review.
  6. If risk_score <= 70, use POST /ask to generate a structured rationale. 
def review_merchant(merchant_name: str, domain: str) -> dict:
    dossier = get_dossier(domain)

    if dossier["risk_score"] > 70:
        return {
            "decision": "MANUAL_REVIEW",
            "reason": f"High risk score: {dossier['risk_score']}",
            "evidence": dossier,
        }

    rationale = ask_about_domain(
        domain,
        "Write a one-paragraph compliance rationale for approving this merchant."
    )

    return {
        "decision": "AUTO_APPROVED",
        "rationale": rationale,
        "evidence": dossier,
    }
Enter fullscreen mode Exit fullscreen mode

Because the dossier is preserved, every automated decision is auditable. A regulator or internal reviewer can trace the rationale back to real data points, not to a black-box model.

Conclusion

AI will not build a working KYC tool for you. It will scaffold the UI, draft the prompts, and speed up your iteration. But the hard part of compliance—verifying facts, cross-referencing records, and producing auditable verdicts—still requires a reliable data layer.

The Portfolio Investigate API provides that layer. With one call you get a unified dossier drawn from WHOIS, IP geolocation, company registries, email infrastructure, and sanctions lists. With the POST /ask endpoint you can let an LLM reason over that evidence without drifting into hallucination.

If you are building an AI-powered due-diligence or compliance product, start by grounding the model. Get the API at (see RapidAPI) and explore the sample code at https://github.com/On13uka/portfolio-api.

Top comments (0)