# ComplyAdvantage > ComplyAdvantage screens people and companies against sanctions lists, watchlists, politically exposed person registers and adverse media, with ongoing monitoring and case management. Agents reach its Mesh platform through a REST API with a public OpenAPI spec. - Canonical: https://www.anchorterminal.com/tools/complyadvantage - Markdown: https://www.anchorterminal.com/tools/complyadvantage.md (~6,850 tokens) - Slim: https://www.anchorterminal.com/tools/complyadvantage.min.md (~1,780 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/complyadvantage.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-08 ## Overview **Grade D · 52.6/100 · rank #564 of 722 · #9 in Identity & business verification · not agent-ready · confidence medium** ## Assessment The Mesh API has a public OpenAPI 3.0.3 spec with 165 described operations, per-credential permissions and audit log endpoints, which suits an agent screening customers and working alerts. No status page, changelog, SDK, service agreement or subprocessor list was found in public, and access starts with a paid plan bought by a person. ## Facts | Field | Value | | --- | --- | | Vendor | IVXS UK Limited (trading as ComplyAdvantage) (https://complyadvantage.com) | | Kind | HTTP API | | Category | Identity & business verification (https://www.anchorterminal.com/categories/identity-verification) | | Transport | HTTP | | Endpoint | `https://api.mesh.complyadvantage.com` | | Auth | OAuth · The Mesh API uses the OAuth2 client credentials flow. A Mesh admin, or a custom role with the API credential permissions, creates a credential in the web application under Settings, Access Management, API Credentials, choosing its permissions and an optional expiry date. The integration sends the access key and secret to `POST /v3/token` and receives a bearer token valid for 24 hours, with no refresh. A credential can't be edited, its secret is shown once, and deactivating it invalidates tokens already issued. The older username and password flow at `POST /v2/token` remains supported for existing integrations. Accounts are opened by ComplyAdvantage after a Starter Plan purchase or a sales contract, so there is no self-serve key (https://docs.mesh.complyadvantage.com/docs/getting-started, https://support.complyadvantage.com/articles/5045588818-creating-api-credentials, checked 2026-10-08). | | Pricing | Paid ($119 / mo) · The Starter Plan is priced by monitored entities a month. Essentials runs from $119 a month for up to 100 entities to $383 for up to 2,000 on monthly billing ($99 to $319 on annual billing), and the Agentic version from $179 to $575. Entities over the allowance are charged at 1.5 times the unit rate. Enterprise, which adds transaction monitoring and payment screening, is priced on application. No free tier or trial was found. Sandbox and production logins come with a paid account, set up by staff within one working day, and the pricing page says the API is included. ComplyLaunch gives early-stage start-ups free access on application (https://complyadvantage.com/pricing/, https://complyadvantage.com/starter-plan/, checked 2026-10-08). | | x402 | No · No x402, MPP or L402 in the Mesh API docs, the OpenAPI spec or the pricing pages (checked 2026-10-08). | | Licence | Proprietary service. No service agreement is published, and the terms page on complyadvantage.com covers the website only | | Docs | https://docs.mesh.complyadvantage.com | | llms.txt | https://docs.mesh.complyadvantage.com/llms.txt | | Last release | 2026-09-16 | | API | Mesh REST API, OpenAPI 3.0.3 titled Mesh API v2.0, 165 operations on 124 paths (84 GET, 47 POST, 14 PATCH, 10 PUT, 10 DELETE) under `/v2` and `/v3`. Server in the spec is https://api.mesh.complyadvantage.com | | Regions | The webhooks guide names six regional hosts, api.eu, api.eu3, api.us, api.us2, api.ca and api.au under mesh.complyadvantage.com. Support confirms which one an account is on | | Screening | `POST /v2/workflows/sync/create-and-screen` creates a customer, scores risk, screens against sanctions, watchlists, politically exposed persons and adverse media, and raises alerts and cases. An asynchronous version and a rescreen workflow also exist | | Credentials | Access key and secret per integration with chosen permissions and optional expiry, exchanged for a 24-hour bearer token at `POST /v3/token`. Not editable. Deactivation is permanent and invalidates issued tokens | | Rate limits | 1,000 requests a minute in production and 300 in Sandbox by default, set per account. 429 returns `API rate limit exceeded` | | Lists | `page_number` and `page_size` (default 50 on customers), attribute, range and substring filters, and `sort` with a minus sign for descending. The customers list returns at most 10,000 records, with exports for more | | Idempotency | `X-ComplyAdvantage-Idempotency-Key` header on the rescreen workflow. Create-and-screen and update-and-rescore are described as idempotent on resending the same request | | Audit | `GET /v2/audit/...` for the account, cases, customers, roles, transactions and users | | Older API | docs.complyadvantage.com documents the earlier search API at api.complyadvantage.com (EU), api.us and api.ap, limited to 600 calls a minute on a standard contract and 300 in Sandbox, with exponential backoff guidance for 429 | | Status | No public status page found. Outages are reported to support by email | | Certifications | ComplyAdvantage's own article of 21 January 2025 lists ISO 27001 and SOC 2 for Mesh. No trust centre or public report was found | | Data handling | The privacy notice of 12 June 2026 says ComplyAdvantage is controller of its screening database and processor or sub-processor when screening a client's customer data. No public data processing agreement or subprocessor list was found | | Capabilities | kyc.screening, kyc.cases | | Tags | hosted, paid, sandbox, oauth, openapi, llms-txt, webhooks, aml, sanctions, audit-log, iso27001, soc2 | | JSON | https://www.anchorterminal.com/api/v1/tools/complyadvantage.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 42 | 8.4 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 82 | 13.3 | | Agent ergonomics | 13% | 16.2 | 67 | 10.9 | | Security & auth | 14% | 17.5 | 68 | 11.9 | | Payments & pricing | 10% | 12.5 | 10 | 1.2 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 28 | 2.5 | | Transparency & trust (editorial 40, provenance 59) | 7% | 8.8 | 50 | 4.4 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **52.6 → D** | ### Why each score - Reliability 42: Graded on the Mesh REST API, hosted lines. No public status page was found. status.complyadvantage.com does not resolve and none is linked from the site, the docs or the help centre (0). No readable incident history (5). Default limits published as 1,000 requests a minute in production and 300 in Sandbox (15). `Ratelimit-Limit`, `Ratelimit-Remaining` and `Ratelimit-Reset` headers are documented, an idempotency key header exists on the rescreen workflow and two workflows are described as safe to resend, but the Mesh docs give no backoff guidance (12). No SLA found in public (0). The API is generally available (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 82: Public OpenAPI 3.0.3 spec with 165 operations on 124 paths (25). `llms.txt` and every docs page as Markdown (10). All 165 operations carry a summary and description, 124 name the permission needed, and some say when to use another endpoint, such as exports above 10,000 customers (15). 949 schemas with 441 enums and 682 required lists (13). 1,361 examples and an errors guide with a body for each status, though 429 is not declared on operations (12). A versioning policy and `/v2` and `/v3` paths, but no changelog was found (7). - Agent ergonomics 67: List responses are partial records sized with `page_size`. No field selection was found (15). `page_number`, `page_size`, attribute, range and substring filters and `sort` on 48 operations, described as most list endpoints (18). Errors follow one structure with title, status, detail, an identifier and a timestamp (16). `X-ComplyAdvantage-Idempotency-Key` on one operation, two workflows described as idempotent, and 409 on concurrent requests for one external identifier (12). No official SDK was found, and a token must be fetched every 24 hours. A Postman collection is published (6). - Security & auth 68: OAuth2 client credentials with per-credential permissions, optional expiry, 24-hour tokens and deactivation that invalidates issued tokens. Credentials can't be edited, and the older username and password token flow is still supported (28). View and manage permissions are separate and a creator can only grant permissions they hold. No confirmation step for deletes was found (14). Results include third-party adverse media text and customer-supplied data. No injection guidance was found (3). Audit log endpoints for the account, cases, customers, roles, transactions and users (14). ISO 27001 and SOC 2 are stated in the vendor's own article of January 2025, with CREST penetration testing. No security.txt, disclosure policy, bug bounty or trust centre was found (9). No deduction for the older API accepting a key in the query string, because the graded Mesh API takes the token in a header only. - Payments & pricing 10: No x402, MPP or L402 (0). Starter Plan prices are public by monitored-entity tier, from $119 a month, and Enterprise is priced on application. No per-call price (10). No free tier or trial was found. Sandbox comes with a paid account, and ComplyLaunch is free only to start-ups accepted on application (0). A person buys the plan and staff set the account up within a working day (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 28: No changelog or release notes were found, so dates come from docs page timestamps. The getting started guide was updated on 16 September 2026, the rate limiting guide on 28 August and the `/v3/token` reference on 12 August. Scored as within 90 days because a page edit is weaker evidence than a release (20). No dated changelog entries (0). Support by email and a ticket portal, with a help centre whose credential article was updated in September 2026. No public community channel found (5). No official SDK (0). The OpenAPI spec and Postman collection are current with the reference pages (3). - Transparency & trust 50: Closed service. The only public terms cover the website, and no service agreement or API terms were found (8). The privacy notice of 12 June 2026 sets out controller and processor roles, transfer safeguards and 30-day backup retention for removed database entries. No public data processing agreement or retention period for customers' screening data was found (14). A versioning policy lists what counts as backwards compatible, the older API's 2018 deprecation gave two years' notice with dates, and the Mesh spec marks 5 operations deprecated without dates (10). Six regional API hosts are named in the webhooks guide. No subprocessor list was found (8). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (20 items): https://www.anchorterminal.com/fixes/complyadvantage.md (JSON https://www.anchorterminal.com/fixes/complyadvantage.json) ### What we couldn't check - The lead's docs link, docs.complyadvantage.com, is the older API. New integrations are documented on Mesh at docs.mesh.complyadvantage.com, which is the surface graded. The 300 calls a minute Sandbox limit holds for both. - Whether new customers can still be given the older API was not established. - No status page was found. A private or customer-only page may exist. - No service agreement, API terms, data processing agreement, SLA or subprocessor list was found in public, so `provenance.terms` is left out. - unchecked: the Starter Plan checkout page at https://complyadvantage.com/checkout/ is drawn by script, so any terms linked from it were not read. - unchecked: the Mesh web application and support portal need a login, so credential permission names and any in-app release notes were not read. - No official SDK was found in the docs. Package registries were not searched for unofficial clients. - ISO 27001 and SOC 2 rest on the vendor's own article of 21 January 2025. No certificate or report was seen. ### Sources - Mesh docs index for agents: (seen 2026-10-08) - Mesh OpenAPI spec: (seen 2026-10-08) - getting started and authentication: (seen 2026-10-08) - API access token reference: (seen 2026-10-08) - rate limiting: (seen 2026-10-08) - errors: (seen 2026-10-08) - versioning: (seen 2026-10-08) - working with lists: (seen 2026-10-08) - webhooks and regional hosts: (seen 2026-10-08) - upgrade guide from the older API: (seen 2026-10-08) - older API reference: (seen 2026-10-08) - creating API credentials: (seen 2026-10-08) - how to contact support: (seen 2026-10-08) - pricing: (seen 2026-10-08) - Starter Plan prices: (seen 2026-10-08) - website terms and conditions: (seen 2026-10-08) - privacy notice: (seen 2026-10-08) - Mesh security and privacy article: (seen 2026-10-08) - security.txt, 404: (seen 2026-10-08) - domain registration: (seen 2026-10-08) ## Who's behind it (provenance 59/100, checked 2026-10-08) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | IVXS UK Limited (trading as ComplyAdvantage) | 20/20 | | Domain age | complyadvantage.com, registered 2014-07-05 (12 years) | 15/15 | | Endpoint on the vendor's domain | api.mesh.complyadvantage.com | 15/15 | | Terms of service | not found | 0/10 | | Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 | | Status page | not found | 0/10 | | Changelog | not found | 0/10 | | security.txt | not found | 0/10 | The privacy notice (last updated 12 June 2026) names IVXS UK Limited, trading as ComplyAdvantage, 86-90 Paul Street, London EC2A 4NE, registered with the UK Information Commissioner under ZA054290, and covers its products and services as well as the website. No `terms` is given. https://complyadvantage.com/terms-and-conditions/ is the website's terms of use, and no service agreement, API terms or data processing agreement was found on the site, the docs or the help centre. The Mesh API answers at api.mesh.complyadvantage.com and regional hosts under mesh.complyadvantage.com. https://complyadvantage.com/.well-known/security.txt and /security.txt return 404. status.complyadvantage.com does not resolve, and no status page is linked from the site, the docs or the help centre. docs.mesh.complyadvantage.com/changelog returns 404. RDAP for complyadvantage.com gives a registration date of 2014-07-05. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0. **Privacy policy** (https://complyadvantage.com/privacy-notice/), read 2026-10-08, dated 2026-06-12, states 7 of the 8 things a reader expects. - Gives the date it was last updated. Last updated 2026-06-12. - Says how long data is kept. Names a period of 24 months. - Not found in the text. Says whether personal data is sold or shared for advertising. - Gives a privacy contact. Names a data protection officer. - Says where data is transferred or stored. Relies on standard contractual clauses. - Also in the text (2026-10-08). Anyone using the services agrees not to use them or the data for any purpose authorised under the US Fair Credit Reporting Act or for adverse action on a consumer application. "If you use any of our services, you agree not to use them, or the data, for any purpose authorized under the FCRA or in relation to taking an adverse action relating to a consumer application." ## Live (updated 2026-10-08 21:53 UTC) - Right now: up, HTTP 401, 40 ms, checked 2026-10-08 21:53 UTC (get on `https://api.mesh.complyadvantage.com`, asks for auth) - Uptime 24h 100.0% (28 probes) · 30 days 100.0% (28 probes) · p50 52 ms · p95 91 ms - Always current: https://www.anchorterminal.com/api/v1/live/complyadvantage.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Essentials Starter Plan, up to 100 monitored entities | $119 | per month (plan) | monthly billing; $99 a month on annual billing | | Essentials Starter Plan, up to 1,000 monitored entities | $323 | per month (plan) | monthly billing; $269 a month on annual billing | | Essentials Starter Plan, up to 2,000 monitored entities | $383 | per month (plan) | monthly billing; $319 a month on annual billing | | Agentic Starter Plan, up to 100 monitored entities | $179 | per month (plan) | monthly billing; $149 a month on annual billing | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - Public OpenAPI 3.0.3 spec with 165 operations, each with a summary and description, and 124 naming the permission the call needs - API credentials carry their own permissions and optional expiry, and deactivation invalidates tokens already issued - Six audit log endpoints cover the account, cases, customers, roles, transactions and users - Rate limits are published (1,000 requests a minute in production, 300 in Sandbox) with `Ratelimit-Limit`, `Ratelimit-Remaining` and `Ratelimit-Reset` headers - `llms.txt` on the docs site, and every guide and reference page is served as Markdown ## Weaknesses - No public status page or incident history was found. `status.complyadvantage.com` does not resolve - No changelog or release notes were found for the Mesh API - No service agreement, data processing agreement or subprocessor list is published. The terms page covers the website only - No free tier or self-serve trial. The Starter Plan starts at $119 a month and accounts are set up by staff within a working day - No official SDK was found. Access tokens last 24 hours with no refresh - Screening results carry third-party adverse media text, and no prompt-injection guidance was found ## Before you call it (notes for agents) 1. Exchange the access key and secret at `POST /v3/token` for a bearer token. It lasts 24 hours and can't be refreshed, so request a new one before expiry 2. Ask for a credential with only the permissions the task needs. Permissions can't be edited later, and each reference page names the ones a call requires 3. Create a screening configuration first and keep its `configuration_identifier`. Creating and screening a customer needs it 4. Give each customer a unique external identifier. A concurrent request for the same identifier returns 409 with a pointer to the first workflow 5. Read `Ratelimit-Remaining` and `Ratelimit-Reset` on every response. A 429 body is only `API rate limit exceeded` ## Connect First request: ```bash curl -X POST https://api.mesh.complyadvantage.com/v3/token \ -H 'Content-Type: application/json' \ -d '{"access_key": "", "secret": ""}' ``` Through letme (picks today, calling later): https://letme.dev/complyadvantage. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Didit | BB | 75 | 54 | kyc.screening, kyc.cases | no | https://www.anchorterminal.com/tools/didit.md | | Persona | B | 69.5 | 157 | kyc.screening, kyc.cases | no | https://www.anchorterminal.com/tools/persona.md | | Sumsub | B | 68.5 | 177 | kyc.screening, kyc.cases | no | https://www.anchorterminal.com/tools/sumsub.md | | Middesk | C | 59 | 440 | kyc.screening, kyc.cases | no | https://www.anchorterminal.com/tools/middesk.md | | Grep AI | B | 64.4 | 275 | kyc.screening | no | https://www.anchorterminal.com/tools/grep-ai.md | | ComplyCube | B | 63.7 | 299 | kyc.screening | no | https://www.anchorterminal.com/tools/complycube.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - ComplyAdvantage documents two APIs. The Mesh API at docs.mesh.complyadvantage.com is the current platform, and the older API at docs.complyadvantage.com (key in an `Authorization: Token` header, `POST /searches`) remains documented, with an upgrade guide to Mesh (source: ) - The Mesh OpenAPI 3.0.3 spec lists 165 operations on 124 paths, covering customers, screening configurations, cases, alerts and risks, transactions, payment screening, custom lists, webhooks, users, roles and audit logs (source: ) - Default rate limits are 1,000 requests a minute for production accounts and 300 for Sandbox accounts, with `Ratelimit-Limit`, `Ratelimit-Remaining` and `Ratelimit-Reset` response headers (source: ) - Webhooks are delivered at least once with a stable `webhook-id` header and three retries after 1, 5 and 10 seconds. HMAC-SHA256 signing is opt-in per account through support (source: ) - The docs site answers at `/mcp` with a message that the URL is for MCP clients. This is the documentation host's server for reading the docs. No MCP server for the product itself was found (source: ) - The Agentic Starter Plan adds two vendor-run agents, Cassie for onboarding cases and Otto for monitoring cases, which act on cases a person assigns to them (source: ) ## Compare - [ComplyAdvantage vs ComplyCube](https://www.anchorterminal.com/compare/complyadvantage-vs-complycube.md): D 52.6 vs B 63.7 - [ComplyAdvantage vs Didit](https://www.anchorterminal.com/compare/complyadvantage-vs-didit.md): D 52.6 vs BB 75 - [ComplyAdvantage vs Jumio](https://www.anchorterminal.com/compare/complyadvantage-vs-jumio.md): D 52.6 vs C 55 - [ComplyAdvantage vs Middesk](https://www.anchorterminal.com/compare/complyadvantage-vs-middesk.md): D 52.6 vs C 59 - [ComplyAdvantage vs Persona](https://www.anchorterminal.com/compare/complyadvantage-vs-persona.md): D 52.6 vs B 69.5 - [ComplyAdvantage vs Sumsub](https://www.anchorterminal.com/compare/complyadvantage-vs-sumsub.md): D 52.6 vs B 68.5 - [ComplyAdvantage vs Trulioo](https://www.anchorterminal.com/compare/complyadvantage-vs-trulioo.md): D 52.6 vs C 58.2 - [ComplyAdvantage vs Veriff](https://www.anchorterminal.com/compare/complyadvantage-vs-veriff.md): D 52.6 vs C 61.1 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on complyadvantage.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "complyadvantage", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html ComplyAdvantage on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![ComplyAdvantage on Anchor Terminal](https://www.anchorterminal.com/badges/complyadvantage.svg)](https://www.anchorterminal.com/tools/complyadvantage) ``` Plain link: ```html ComplyAdvantage on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say ComplyAdvantage is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/complyadvantage-dark.png - Light: https://www.anchorterminal.com/assets/share/complyadvantage-light.png