AML / Compliance

AML & Financial Crime
MCP Services

Ten MCP services for the AML & Financial Crime team — each callable by any AI assistant to deliver shell company detection, business legitimacy scoring, domain forensics, beneficial ownership research, and suspicious activity pattern recognition using web scraping, AI analysis, and the 100M+ domain database.

1Shell Company Website Detector

Analyzes websites for signs of shell companies — thin content, stock photos, no real operations, recently registered domains. Uses web scraping + AI vision to screenshot and analyze pages + domain DB for domain age and registration data.

1
MCP Tool Definition
Web Scraping Vision AI GPT-4o Domain DB
shell_company_website_detector domain: string — Target domain to analyze (e.g. "globaltrading-llc.com") depth: string — "quick" (homepage only) or "full" (all discoverable pages) screenshot_analysis: boolean — Enable AI vision analysis of page screenshots (default: true)
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Scrape target domain homepage, /about, /contact, /services, /team pages Step 2: Take full-page screenshots for AI vision analysis of stock imagery Step 3: Query domain DB for domain age, registration country, IAB category, PageRank Step 4: Send scraped content + screenshots to GPT-4o with shell company detection prompt Step 5: AI evaluates: content depth, image originality, operational evidence, contact legitimacy Step 6: Cross-reference claimed business activity against domain DB IAB classification Step 7: Generate shell company probability score with itemized red flags
3
Example Output
MCP RESPONSE — shell_company_website_detector ════════════════════════════════════════════════════════════ globaltrading-llc.com | IAB: Business Services | PageRank: 0.8/10 | Age: 87 days SHELL COMPANY PROBABILITY: 92/100 (Very High) CONTENT ANALYSIS: Total pages found: 4 (homepage, about, services, contact) Average word count per page: 63 words (extremely thin) Unique content ratio: 22% — boilerplate template detected Services listed: "Global trade facilitation" — no specifics provided VISUAL ANALYSIS (AI Vision): Hero image: Stock photo — Shutterstock ID #1847293 (handshake) Team photos: None — "Our team" section has no images or names Office photo: Stock photo — generic skyline, no actual office REGISTRATION SIGNALS: Domain age: 87 days (registered 2025-12-05) Registration country: Panama (PA) PageRank: 0.8/10 — near-zero web authority OPERATIONAL EVIDENCE: Physical address: Virtual office address (Regus, Panama City) Phone number: VoIP number, not answered on 3 attempts Employee profiles: Zero employees listed anywhere Client references: None found VERDICT: HIGH CONFIDENCE SHELL — Recommend enhanced due diligence

2Business Legitimacy Scorer

Multi-signal scoring using AI on website content, checking for real business operations, employee profiles, physical addresses, legitimate products. Uses web scraping + GPT-4o to produce a comprehensive legitimacy assessment for KYC workflows.

1
MCP Tool Definition
Web Scraping GPT-4o Domain DB
business_legitimacy_scorer domain: string — Target business domain to score industry_claim: string — Industry the business claims to operate in (for verification) check_modules: array — ["operations","employees","address","products","financials"]
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Scrape target domain: homepage, /about, /team, /products, /contact, /careers Step 2: Query domain DB for IAB category, PageRank, domain age, country code Step 3: Send all scraped content to GPT-4o with multi-factor legitimacy assessment prompt Step 4: AI evaluates: operational evidence, employee reality, product specificity, address validity Step 5: Score each dimension (0-100) and calculate weighted composite legitimacy score Step 6: Compare against industry benchmarks from domain DB peers Step 7: Return structured legitimacy report with pass/fail recommendation
3
Example Output
MCP RESPONSE — business_legitimacy_scorer ════════════════════════════════════════════════════════════ northstarlogistics.net | Claimed industry: Freight & Logistics LEGITIMACY SCORE: 38/100 (Low — EDD Required) OPERATIONAL EVIDENCE (25/100): Service descriptions: Vague — "comprehensive logistics solutions" Case studies: None found Certifications: Claims ISO 9001 but no certificate number Industry terminology: Generic — lacks freight-specific language EMPLOYEE REALITY (15/100): Team page: Lists 3 names with no photos or LinkedIn links Careers page: Does not exist CEO profile: "John Smith, CEO" — no biography, no photo Staff count claim: "200+ employees" but no evidence ADDRESS & CONTACT (45/100): Address: Real commercial address but shared office building Phone: Local number — rings to generic voicemail Email: Domain-based email (not Gmail/Yahoo) PRODUCT SPECIFICITY (35/100): Product pages: 3 service pages with minimal detail Pricing: No pricing, rates, or quote tools Fleet/assets: No mention of trucks, warehouses, or routes DOMAIN DB COMPARISON: IAB category: Business Services (not Transportation) PageRank vs logistics peers: Bottom 5th percentile RECOMMENDATION: FAIL — Requires enhanced due diligence before onboarding

3Domain Registration Forensics

Analyzes domain registration patterns, WHOIS-adjacent data, domain age from DB, registration country patterns for suspicious entity detection. Identifies domains created specifically for illicit financial schemes through temporal and geographic analysis.

1
MCP Tool Definition
Domain DB Web Scraping GPT-4o
domain_registration_forensics domains: array — List of domains to investigate flag_age_under: integer — Flag domains younger than N days (default: 365) flag_countries: array — High-risk registration countries to flag (e.g. ["PA","VG","KY"])
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Query domain DB for age, registration country, PageRank for all input domains Step 2: Scrape each domain for claimed business formation date and incorporation data Step 3: Identify age discrepancies (website claims vs. actual domain registration) Step 4: Detect bulk registration patterns (multiple domains registered same day/registrar) Step 5: Analyze geographic mismatches (registration country vs. claimed country of operation) Step 6: AI synthesizes forensic timeline and flags suspicious registration patterns
3
Example Output
MCP RESPONSE — domain_registration_forensics ════════════════════════════════════════════════════════════ BATCH: 5 domains analyzed for entity "Pacific Rim Holdings Ltd." pacificrim-holdings.com Domain age: 142 days | Country: VG (British Virgin Islands) Claimed founded: "Established 2018" — domain registered 2025-10-12 PageRank: 0.4/10 | AGE DISCREPANCY: 7+ years pacrimtrade.net Domain age: 141 days | Country: PA (Panama) Registered: 2025-10-13 — one day after primary domain PageRank: 0.2/10 | Redirects to pacificrim-holdings.com pacificrimcapital.org Domain age: 140 days | Country: KY (Cayman Islands) Registered: 2025-10-14 — third consecutive day PageRank: 0.1/10 | Parked domain with no content FORENSIC FINDINGS: BULK REGISTRATION: 3 domains registered in 3 consecutive days MULTI-JURISDICTION: 3 different offshore jurisdictions (VG, PA, KY) AGE FABRICATION: Website claims 2018 founding, domain is 142 days old PRIVACY SHIELDS: All domains use WHOIS privacy services RISK ASSESSMENT: CRITICAL — Registration pattern consistent with layered shell structure

4Website-Business Verification

Cross-references website claims (industry, size, location) against domain DB data (IAB category, country, PageRank) to verify business authenticity. Detects mismatches between what a company says it is and what its digital footprint reveals.

1
MCP Tool Definition
Web Scraping GPT-4o Domain DB
website_business_verification domain: string — Target business domain to verify claimed_industry: string — Industry stated in KYC documentation claimed_country: string — Country of operations from application claimed_size: string — "small","medium","large","enterprise" from KYC
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Query domain DB for IAB category, country, PageRank, domain age Step 2: Scrape website homepage, /about, /contact, /products for claimed attributes Step 3: Use GPT-4o to extract: industry signals, geographic indicators, size indicators Step 4: Compare AI-extracted data vs. KYC-claimed attributes Step 5: Compare AI-extracted data vs. domain DB classification Step 6: Flag all mismatches with severity scoring and confidence levels
3
Example Output
MCP RESPONSE — website_business_verification ════════════════════════════════════════════════════════════ eurotech-solutions.de KYC Claims: IT Consulting | Germany | Medium enterprise (50-250 staff) VERIFICATION RESULTS: INDUSTRY CHECK: KYC claim: IT Consulting Domain DB IAB: Technology & Computing Website content: Mixed — IT terms present but heavy import/export language detected AI assessment: 60% IT consulting, 40% trade intermediary language PARTIAL MISMATCH — Dual business activity suspected GEOGRAPHY CHECK: KYC claim: Germany Domain DB country: DE (Germany) Website language: English only (no German content) Contact address: Cyprus (+357 phone prefix detected) MISMATCH — Claimed Germany, operational indicators point to Cyprus SIZE CHECK: KYC claim: Medium enterprise (50-250 staff) PageRank: 1.4/10 — inconsistent with medium enterprise Team page: 6 employees listed (not 50-250) Careers page: Does not exist MISMATCH — Digital footprint suggests micro-business, not medium OVERALL: 2 of 3 claims show material mismatches — flag for EDD

5High-Risk Jurisdiction Scanner

Scans domains for connections to FATF-listed jurisdictions using country data from domain DB, content language detection, and geographic indicators from website content. Automatically flags entities with links to sanctioned or high-risk countries.

1
MCP Tool Definition
Domain DB Web Scraping Gemini Pro
high_risk_jurisdiction_scanner domains: array — List of domains to scan for jurisdiction risk fatf_list: string — "black" (call-to-action), "grey" (increased monitoring), or "both" include_indirect: boolean — Scan for indirect jurisdiction links in content (default: true)
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Query domain DB for registration country, TLD, and hosting location Step 2: Cross-reference countries against current FATF black/grey lists Step 3: Scrape website content for geographic references, addresses, phone numbers Step 4: Detect content language and script (Arabic, Farsi, Cyrillic, etc.) Step 5: Use Gemini Pro to identify indirect jurisdiction connections in text Step 6: Aggregate all jurisdiction signals and generate risk heat map
3
Example Output
MCP RESPONSE — high_risk_jurisdiction_scanner ════════════════════════════════════════════════════════════ BATCH: 12 counterparty domains scanned | FATF list: both HIGH-RISK HITS (3 of 12 domains flagged): meridian-commodities.com Domain DB country: GB (United Kingdom) INDIRECT HIT: Website references office in "Yangon, Myanmar" Myanmar is FATF grey-listed (increased monitoring) Phone numbers found: +95 prefix (Myanmar) on /contact page Trade routes mentioned: Myanmar-Thailand-Singapore corridor silk-road-import.ae Domain DB country: AE (UAE) INDIRECT HIT: Content references operations in "Damascus" and "Aleppo" Syria is FATF black-listed (call to action) Language detected: Arabic + English bilingual content Shipping partners: References to Syria-based logistics firms caspian-energy-group.com Domain DB country: TR (Turkey) INDIRECT HIT: References partnerships in "Tehran province" Iran is FATF black-listed (call to action) Currency references: Iranian Rial (IRR) found on pricing page CLEAN (9 of 12): No FATF jurisdiction connections detected for remaining 9 domains ACTION REQUIRED: 3 entities require immediate compliance review

6Beneficial Ownership Web Researcher

Extracts ownership, leadership, and corporate structure information from /about, /leadership, /legal pages using AI entity extraction. Maps beneficial ownership chains by discovering directors, officers, and parent companies from public web content.

1
MCP Tool Definition
Web Scraping GPT-4o Domain DB
beneficial_ownership_web_researcher domain: string — Target entity domain to research entity_name: string — Legal entity name for cross-referencing depth: integer — Ownership chain depth: 1=direct, 2=parent, 3=ultimate (default: 2)
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Scrape /about, /leadership, /team, /legal, /investors, /corporate pages Step 2: Extract person names, titles, and roles via GPT-4o entity extraction Step 3: Identify parent company, subsidiary, and affiliate references in content Step 4: Look up discovered related entity domains in domain DB Step 5: Recursively scrape parent/affiliate domains for ownership chain mapping Step 6: AI constructs ownership hierarchy with confidence scores per relationship
3
Example Output
MCP RESPONSE — beneficial_ownership_web_researcher ════════════════════════════════════════════════════════════ alpine-wealth-mgmt.ch | Entity: Alpine Wealth Management AG OWNERSHIP CHAIN DISCOVERED: LEVEL 1 — Target Entity: Alpine Wealth Management AG — alpine-wealth-mgmt.ch Directors found: Viktor Petrov (Chairman), Elena Sorokina (Managing Dir.) Registered: Zurich, Switzerland | Domain age: 1,247 days LEVEL 2 — Parent Entity: "A subsidiary of Petrov Capital Group" found on /about page petrov-capital.com | Country: CY (Cyprus) | Age: 892 days Directors found: Viktor Petrov (sole director) No other officers or board members listed LEVEL 3 — Ultimate Ownership: Legal notice on petrov-capital.com: "Owned by Eastbridge Holdings Ltd." eastbridge-holdings.vg | Country: VG (British Virgin Islands) Age: 340 days | PageRank: 0.1/10 No directors, officers, or ownership information found BENEFICIAL OWNERSHIP FLAGS: Opaque UBO: Ownership chain terminates at BVI shell entity Single person: Viktor Petrov appears at all 3 ownership levels Offshore layering: Switzerland → Cyprus → BVI structure Nominee risk: Sole director at Level 2 may indicate nominee arrangement RECOMMENDATION: UBO cannot be verified — escalate for manual investigation

7Money Service Business Identifier

Identifies unlicensed MSBs by detecting payment/transfer language, currency exchange features, and crypto wallet addresses on websites using scraping + AI classification. Flags entities operating money transmission services without proper licensing disclosures.

1
MCP Tool Definition
Web Scraping GPT-4o Vision AI Domain DB
money_service_business_identifier domain: string — Target domain to analyze for MSB activity check_crypto: boolean — Scan for cryptocurrency wallet addresses (default: true) check_licensing: boolean — Verify licensing disclosures on site (default: true)
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Scrape full site: homepage, /services, /send-money, /exchange, /fees, /legal Step 2: Screenshot transaction pages for Vision AI analysis of payment interfaces Step 3: Use GPT-4o to detect: payment language, transfer forms, exchange calculators Step 4: Scan page source for cryptocurrency wallet addresses (BTC, ETH, USDT) Step 5: Check /legal and /licenses pages for MSB registration disclosures Step 6: Cross-reference domain DB IAB category vs. detected MSB activity Step 7: Classify MSB type and assess licensing compliance risk
3
Example Output
MCP RESPONSE — money_service_business_identifier ════════════════════════════════════════════════════════════ quicksend-pay.com | Domain DB IAB: Business Services | Age: 203 days MSB ACTIVITY DETECTED: YES — Multiple MSB Indicators PAYMENT/TRANSFER LANGUAGE: "Send money to 40+ countries" — /homepage "Transfer funds instantly" — /services "Best exchange rates guaranteed" — /exchange Fee schedule found: 1.5% for transfers under $5,000 TRANSACTION INTERFACES (Vision AI): Currency exchange calculator detected on /exchange page Send money form with recipient fields on /send-money Payment method selector: bank transfer, debit card, crypto CRYPTOCURRENCY FINDINGS: BTC address found: bc1q42lja79elem0anu8q860g3xxxxxx (footer) ETH address found: 0x71C7656EC7ab88b098xxxxx (/crypto page) USDT TRC-20 acceptance mentioned in FAQ LICENSING CHECK: FinCEN MSB registration: Not found on site State money transmitter licenses: No disclosures /legal page: Generic terms only — no regulatory information Operating as MSB without visible licensing disclosures CLASSIFICATION: Unlicensed MSB — money transmission + currency exchange + crypto ACTION: File SAR consideration — report to compliance officer immediately

8Sanctions Screening Web Enhancer

Enriches sanctions screening by gathering additional web intelligence on flagged entities — scraping their websites and using AI to extract identifying information such as aliases, addresses, associated entities, and corporate relationships that strengthen match confidence.

1
MCP Tool Definition
Web Scraping GPT-4o Domain DB
sanctions_screening_web_enhancer domain: string — Domain of the flagged entity to investigate sanctions_match: string — Name/ID from sanctions list match to verify lists: array — ["OFAC_SDN","EU_CONSOLIDATED","UN_SANCTIONS","UK_SANCTIONS"]
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Scrape full website: all pages, footer, legal notices, privacy policy Step 2: Extract: entity names, aliases, addresses, directors, phone numbers via GPT-4o Step 3: Query domain DB for registration metadata, country, and associated domains Step 4: Compare extracted identifiers against sanctions match data points Step 5: Calculate match confidence: TRUE_MATCH / POSSIBLE_MATCH / FALSE_POSITIVE Step 6: Generate enrichment report with all discovered identifiers for analyst review
3
Example Output
MCP RESPONSE — sanctions_screening_web_enhancer ════════════════════════════════════════════════════════════ belgradesteelworks.rs | Sanctions match: "Belgrade Steel Industries d.o.o." OFAC SDN List Entry: SDGT-EO-13224-2024-0847 MATCH CONFIDENCE: 94% — PROBABLE TRUE MATCH IDENTIFIERS EXTRACTED FROM WEBSITE: Legal name (footer): "Belgrade Steel Industries d.o.o." — exact SDN match Trading name: "BSI Group" — matches SDN alias #2 Address: "Bulevar Kralja Aleksandra 73, Belgrade" — matches SDN address Director: "Dragan Markovic, CEO" — matches SDN associated individual Tax ID: PIB: 108234567 — found on /legal page DOMAIN DB ENRICHMENT: Domain country: RS (Serbia) — matches SDN country Domain age: 3,847 days | PageRank: 2.8/10 IAB category: Manufacturing — consistent with steel industry ADDITIONAL WEB INTELLIGENCE: Subsidiary found: "BSI Trading GmbH" referenced on /partners page Bank reference: Account at Komercijalna Banka mentioned in /terms Associated domain: bsi-trading.at — found in page links ANALYST SUMMARY: 5 of 6 SDN identifiers confirmed via website extraction 1 additional subsidiary and 1 associated domain discovered RECOMMENDATION: ESCALATE — High-confidence true match with new intelligence

9Trade-Based Money Laundering Detector

Analyzes import/export company websites for red flags: mismatched products/pricing, suspicious trade routes, shell trading company patterns. Identifies TBML indicators by cross-referencing website claims with domain intelligence and AI content analysis.

1
MCP Tool Definition
Web Scraping Gemini Pro Vision AI Domain DB
tbml_detector domain: string — Import/export company domain to analyze declared_goods: string — Goods category from trade finance application trade_route: string — Declared origin-destination (e.g. "CN-NG")
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Scrape website: /products, /services, /about, /partners, /shipping pages Step 2: Screenshot product catalogs for Vision AI analysis of goods/pricing Step 3: Use Gemini Pro to classify actual product types vs. declared goods category Step 4: Analyze trade routes mentioned on website vs. declared trade route Step 5: Check domain DB for shell company indicators (age, PageRank, country) Step 6: Detect TBML red flags: over/under-invoicing clues, phantom shipments, mismatched goods Step 7: Generate TBML risk score with categorized red flags
3
Example Output
MCP RESPONSE — tbml_detector ════════════════════════════════════════════════════════════ golden-harvest-trading.com Declared goods: Agricultural Products | Route: CN → NG (China to Nigeria) TBML RISK SCORE: 87/100 (High Risk) PRODUCT MISMATCH ANALYSIS: Declared: Agricultural Products Website /products page: Lists "electronics, consumer goods, textiles" Product images (Vision AI): Generic stock photos — no agricultural products RED FLAG: Zero agricultural content on an "agricultural trading" company TRADE ROUTE ANALYSIS: Declared route: China → Nigeria Website references: "Dubai re-export hub" mentioned on /shipping Partners page: References companies in UAE, Turkey, and Hong Kong RED FLAG: Multi-hop routing through free trade zones PRICING INDICATORS: Website shows: "Minimum order: $500,000" for consumer goods Market comparison: Prices ~40% above market rate for listed goods RED FLAG: Over-invoicing indicator — inflated minimum order values SHELL COMPANY INDICATORS: Domain age: 178 days | PageRank: 0.6/10 Team page: 2 names, no photos, no verifiable backgrounds Physical presence: Virtual office address in Guangzhou TBML TYPOLOGY: Over-invoicing + goods mismatch + multi-jurisdiction routing ACTION: Block trade finance facility — file STR with FIU

10Suspicious Domain Cluster Analyzer

Identifies clusters of related suspicious domains using domain DB data (shared IAB categories, similar PageRank, same country, similar age) and AI pattern analysis. Uncovers networks of connected shell entities that may be operating as a coordinated money laundering infrastructure.

1
MCP Tool Definition
Domain DB Web Scraping GPT-4o
suspicious_domain_cluster_analyzer seed_domains: array — Known suspicious domains to use as cluster seeds similarity_threshold: number — Similarity score threshold 0.0-1.0 (default: 0.7) max_cluster_size: integer — Maximum related domains to return per cluster (default: 25)
2
AI Processing Pipeline
PROCESSING PIPELINE ════════════════════════════════════════════════════════════ Step 1: Query domain DB for seed domain attributes: IAB, PageRank, country, age Step 2: Find domains with matching attribute clusters (same country + similar age + similar PageRank) Step 3: Scrape discovered cluster domains for content similarity analysis Step 4: Use GPT-4o to detect shared templates, copied content, identical legal text Step 5: Map inter-domain links, shared resources, and cross-references Step 6: Score cluster cohesion and assign network risk rating
3
Example Output
MCP RESPONSE — suspicious_domain_cluster_analyzer ════════════════════════════════════════════════════════════ SEED DOMAIN: oceanic-partners-global.com (flagged SAR entity) CLUSTER DISCOVERED: 8 related domains identified CLUSTER ATTRIBUTES (shared patterns): Registration window: All 8 domains registered within 14 days Country: All registered in VG (British Virgin Islands) PageRank range: 0.1 - 0.4 (all near-zero authority) Age range: 156 - 170 days IAB category: 6 of 8 classified as "Business Services" CLUSTER MEMBERS: oceanic-partners-global.com | Age: 163d | PR: 0.3 | SEED atlantic-ventures-intl.com | Age: 170d | PR: 0.2 | 92% content match pacific-trade-holdings.com | Age: 162d | PR: 0.4 | 88% content match meridian-global-corp.com | Age: 161d | PR: 0.1 | 91% content match horizon-capital-ltd.com | Age: 159d | PR: 0.2 | 87% content match summit-intl-trading.com | Age: 158d | PR: 0.3 | 79% content match pinnacle-advisory-grp.com | Age: 157d | PR: 0.1 | 93% content match zenith-worldwide-svcs.com | Age: 156d | PR: 0.2 | 90% content match CONTENT SIMILARITY: Identical HTML template across all 8 sites Same legal disclaimer text (word-for-word) on 7 of 8 Same stock photo library used across all sites Slight variations in company names and service descriptions only NETWORK RISK RATING: CRITICAL — Coordinated shell network detected ACTION: Flag all 8 entities across all bank systems — notify FIU
Get Custom MCP Services

Interested in Custom MCP Services?

We can build custom MCP services for your specific banking needs — powered by our 100M domain database and AI endpoints.

Build Powerful MCP Services with Domain Intelligence

Access 100M+ domains with AI-powered enrichment to build MCP tools that deliver real-time web intelligence to any AI assistant.

MCP Real-Time API View Pricing

Each MCP service can use web scraping, AI text/vision endpoints, and the 100M domain database.