IBANforge

Compliance Check

check_compliance

Read-onlyIdempotent

Triage an IBAN's compliance risk before sending SEPA or cross-border payments. Returns a risk score, sanctions matches, FATF status, SEPA Instant reachability, and Verification of Payee readiness.

Instructions

Run a pre-flight compliance triage on an IBAN before sending a SEPA / cross-border payment. USE WHEN: the user is about to send a payment / payout / refund and wants to triage risk first, asks whether the payee's bank or its country is under sanctions, asks if a SEPA Instant transfer can reach the bank, or needs a numeric risk score for an internal payment-approval workflow. NOT A REGULATED AML/CFT PRODUCT — informational triage only. For regulated screening use Refinitiv, Acuris, or ComplyAdvantage. CHECKS: IBAN validity + sanctions lists (OFAC, EU, UN) matched on the payee's bank (BIC8), the country checked against a fixed list of sanctioned jurisdictions, never the payee's name + FATF status + SEPA Instant reachability + whether the EPC Verification of Payee (VoP) register lists the bank as ready; the name check itself is done by the payee's bank, never here. RETURNS: the full validate enrichment plus a compliance object with risk_score (0-100, 0 = safest), risk_level (low/medium/elevated/high/critical), sanctions matched_lists + fatf_status, reachability, vop status, and flags[] (e.g. sanctioned_country, fatf_grey_list, emi_issuer, no_vop). COST: 0.02 USDC.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`iban`	Yes	IBAN to run the compliance check against.

Output Schema

TableJSON Schema

Name	Required	Description
`bic`	No	null when the bank code resolves no BIC; the bank-level sanctions check then has no bank to screen (compliance.sanctions.bank_screened: false).
`iban`	Yes
`meta`	No	Scope + freshness disclosure. Read this before trusting the result.
`sepa`	No
`valid`	Yes
`issuer`	No
`country`	No
`cost_usdc`	No
`compliance`	Yes	The compliance bundle. Read the score at compliance.risk_score / compliance.risk_level.
`risk_indicators`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed13 schema fields changedv1.8.0Sep 26, 2026

addedOutput schema / properties / bic / description

Added value: +"null when the bank code resolves no BIC; the bank-level sanctions check then has no bank to screen (compliance.sanctions.bank_screened: false)."

changedOutput schema / properties / bic / properties / bank_name / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```

changedOutput schema / properties / bic / properties / city / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

changedOutput schema / properties / bic / type

Previous value: -"object"New value: +[
+  "object",
+  "null"
+]

changedOutput schema / properties / compliance / properties / risk_score / description

Previous value: -"0 = safest, 100 = highest."New value: +"0 = safest, 100 = highest. null when the IBAN failed validation: there was nothing to score (risk_level: unassessable)."

changedOutput schema / properties / compliance / properties / risk_score / type
```
Previous value: -"number"New value: +[
+  "number",
+  "null"
+]
```

changedOutput schema / properties / compliance / properties / sanctions / properties / fatf_status / enum

Previous value: -[
-  "member",
-  "grey_list",
-  "black_list",
-  "non_member"
-]New value: +[
+  "member",
+  "suspended",
+  "grey_list",
+  "black_list",
+  "non_member"
+]

changedOutput schema / properties / meta / properties / fatf_as_of / description

Previous value: -"YYYY-MM of the FATF plenary reflected."New value: +"YYYY-MM of the FATF plenary reflected; null when unknown."

changedOutput schema / properties / meta / properties / fatf_as_of / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```

changedOutput schema / properties / meta / properties / sanctions_as_of / description

Previous value: -"ISO timestamp of the last data refresh."New value: +"ISO timestamp of the last data refresh; null when unknown."

changedOutput schema / properties / meta / properties / sanctions_as_of / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
addedOutput schema / properties / meta / properties / sources / description
```
Added value: +"Comma-separated data sources; null when unknown."
```
changedOutput schema / properties / meta / properties / sources / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```

Changed19 schema fields changedv1.4.4Sep 2, 2026

addedOutput schema / properties / bic

Added value: +{
+  "properties": {
+    "bank_name": {
+      "type": "string"
+    },
+    "city": {
+      "type": "string"
+    },
+    "code": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

addedOutput schema / properties / compliance

Added value: +{
+  "description": "The compliance bundle. Read the score at compliance.risk_score / compliance.risk_level.",
+  "properties": {
+    "flags": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "reachability": {
+      "properties": {
+        "sct": {
+          "type": "boolean"
+        },
+        "sdd": {
+          "type": "boolean"
+        },
+        "sepa_instant": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "risk_level": {
+      "description": "unassessable = the IBAN failed validation, no screening was possible. Never treat it as low.",
+      "enum": [
+        "low",
+        "medium",
+        "elevated",
+        "high",
+        "critical",
+        "unassessable"
+      ],
+      "type": "string"
+    },
+    "risk_score": {
+      "description": "0 = safest, 100 = highest.",
+      "maximum": 100,
+      "minimum": 0,
+      "type": "number"
+    },
+    "sanctions": {
+      "properties": {
+        "bank_sanctioned": {
+          "description": "Bank-BIC level only — NOT the beneficiary.",
+          "type": "boolean"
+        },
+        "country_sanctioned": {
+          "type": "boolean"
+        },
+        "fatf_status": {
+          "enum": [
+            "member",
+            "grey_list",
+            "black_list",
+            "non_member"
+          ],
+          "type": "string"
+        },
+        "matched_lists": {
+          "description": "e.g. [\"OFAC\",\"EU\"].",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "vop": {
+      "properties": {
+        "participant": {
+          "type": "boolean"
+        },
+        "status": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

addedOutput schema / properties / cost_usdc
```
Added value: +{
+  "type": "number"
+}
```

addedOutput schema / properties / country

Added value: +{
+  "properties": {
+    "code": {
+      "type": "string"
+    },
+    "name": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

removedOutput schema / properties / fatf

Removed value: -{
-  "properties": {
-    "list": {
-      "description": "FATF mutual evaluation status.",
-      "enum": [
-        "none",
-        "grey",
-        "black"
-      ],
-      "type": "string"
-    }
-  },
-  "type": "object"
-}

removedOutput schema / properties / flags

Removed value: -{
-  "description": "Boolean flags rolled up into risk_score.",
-  "properties": {
-    "emi": {
-      "type": "boolean"
-    },
-    "fatf_high_risk": {
-      "type": "boolean"
-    },
-    "sanctions_match": {
-      "type": "boolean"
-    },
-    "sepa_unreachable": {
-      "type": "boolean"
-    },
-    "viban": {
-      "type": "boolean"
-    }
-  },
-  "type": "object"
-}

addedOutput schema / properties / issuer

Added value: +{
+  "properties": {
+    "name": {
+      "type": "string"
+    },
+    "type": {
+      "type": [
+        "string",
+        "null"
+      ]
+    }
+  },
+  "type": "object"
+}

addedOutput schema / properties / meta

Added value: +{
+  "description": "Scope + freshness disclosure. Read this before trusting the result.",
+  "properties": {
+    "disclaimer": {
+      "type": "string"
+    },
+    "fatf_as_of": {
+      "description": "YYYY-MM of the FATF plenary reflected.",
+      "type": "string"
+    },
+    "sanctions_as_of": {
+      "description": "ISO timestamp of the last data refresh.",
+      "type": "string"
+    },
+    "scope": {
+      "description": "Sanctions are screened at the bank BIC, NOT the beneficiary name.",
+      "enum": [
+        "bank_bic_only"
+      ],
+      "type": "string"
+    },
+    "sources": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

removedOutput schema / properties / recommended_action

Removed value: -{
-  "description": "Suggested workflow gate.",
-  "enum": [
-    "allow",
-    "review",
-    "block"
-  ],
-  "type": "string"
-}

addedOutput schema / properties / risk_indicators
```
Added value: +{
+  "type": "object"
+}
```

removedOutput schema / properties / risk_score

Removed value: -{
-  "description": "0 = safest, 100 = block. Combines sanctions, country risk, FATF flag, vIBAN/EMI flags.",
-  "maximum": 100,
-  "minimum": 0,
-  "type": "number"
-}

removedOutput schema / properties / sanctions

Removed value: -{
-  "properties": {
-    "bic_sanctioned": {
-      "type": "boolean"
-    },
-    "country_sanctioned": {
-      "type": "boolean"
-    },
-    "lists": {
-      "description": "List of matched sanctions sources (e.g. [\"OFAC\", \"EU\"]).",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    }
-  },
-  "type": "object"
-}

removedOutput schema / properties / sepa / properties / instant
```
Removed value: -{
-  "type": "boolean"
-}
```
addedOutput schema / properties / sepa / properties / member
```
Added value: +{
+  "type": "boolean"
+}
```
removedOutput schema / properties / sepa / properties / reachable
```
Removed value: -{
-  "type": "boolean"
-}
```

addedOutput schema / properties / sepa / properties / schemes

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / sepa / properties / vop_required
```
Added value: +{
+  "type": "boolean"
+}
```

removedOutput schema / properties / vop

Removed value: -{
-  "properties": {
-    "participant": {
-      "type": "boolean"
-    }
-  },
-  "type": "object"
-}

changedOutput schema / required

Previous value: -[
-  "iban",
-  "valid",
-  "risk_score",
-  "recommended_action"
-]New value: +[
+  "iban",
+  "valid",
+  "compliance"
+]

Addedv1.2.2Apr 30, 2026
Removedv1.2.1Apr 30, 2026
Addedv1.2.0Apr 29, 2026

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, and the description reinforces this by calling it 'informational triage only' and noting it 'never' checks the payee's name. It also discloses the tool's scope and limitations (not regulated). However, it doesn't explicitly state that the tool is read-only or doesn't access external real-time data beyond what is implied, but given the strong annotation coverage, the description adds sufficient context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is comprehensive but structured with clear sections (USE WHEN, NOT A, CHECKS, RETURNS, COST) making it easy to scan. It front-loads the purpose and usage, with detailed return info at the end. Every sentence adds value, though it's slightly long, but the structured format keeps it efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multiple checks, risk scoring), the description is thorough. It details all checks performed, the return object with fields, and even the cost. The output schema exists, so description needn't list every field, but it highlights key ones. The description covers prerequisites (payment intent) and boundaries (not regulated). Nothing an agent needs to decide when to use this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes the 'iban' parameter fully (100% coverage), but the description adds crucial context about what the tool does with that IBAN (e.g., checks against sanctions lists, returns risk score). It clarifies that the IBAN is used for more than just validation, enhancing the parameter's meaning beyond a simple string input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: running a pre-flight compliance triage on an IBAN, specifically for payment risk assessment. It is distinguished from siblings like validate_iban (which likely only validates IBAN format) and lookup_bic, by emphasizing sanctions screening and risk scoring. The verb 'run' and resource 'compliance triage' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit 'USE WHEN' examples and clearly states what the tool is NOT for (regulated AML/CFT screening), directing users to alternative tools (Refinitiv, Acuris, ComplyAdvantage). It also clarifies the boundary between this tool and the payee's bank for name checks, preventing misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server