Screen new Stripe customers for sanctions and PEP hits at signup

Build an agent workflow that runs a KYC sanctions and PEP screen on every brand-new Stripe customer, then records the outcome back in Stripe and pings a compliance Slack channel on credible hits.

Trigger: a Stripe webhook subscribed to the customer.created event. Fire once per new customer.

When the workflow runs, do the following:

1. Read the new customer's name, email, and any address or business fields from the webhook payload. If the payload is missing fields you need (for example the name or address), call Stripe Retrieve Customer with the customer id to fill them in.

2. Call OpenSanctions Match Entities against a KYC-appropriate collection. Prefer the sanctions plus peps collection if the user has it available, otherwise use the default collection. Screen a Person entity for the customer, using name and any known aliases, country, and date-of-birth-like fields you can infer. If the customer looks like a company (business name, no personal name), also screen a Company entity with the business name and address. Use the default matching algorithm and a sensible threshold around 0.7 to 0.75.

3. Decide a verdict for each customer: clean (no results above threshold), review needed (weak-to-mid match, common name, or single low-confidence hit), or flagged (strong match on a sanctioned or PEP entity).

4. On flagged or review needed, send a Slack message via Send a Message to a configurable compliance channel. Keep it concise. Include the customer name and Stripe customer id, the matched entity name and OpenSanctions id, the match score, the reason for the flag (sanctions list name, PEP category, etc.), and a link to the OpenSanctions profile so a reviewer can act. Label review-needed clearly as review needed rather than blocked.

5. Regardless of verdict, call Stripe Update Customer to write the following metadata on the customer so downstream systems and audits can see the check ran: sanctions_screening_status (clean, review_needed, or flagged), sanctions_screening_score (the top match score, or 0 if no hits), and sanctions_screening_checked_at (an ISO 8601 timestamp).

Guidance to bake into the agent instructions: clean checks should update Stripe metadata silently and never post to Slack, so the compliance channel does not get spammed. Borderline matches (weak scores or very common names) should still notify Slack but be framed as review needed, not as a block. The workflow itself never blocks payments or cancels the customer; it only records the outcome and asks a human to decide.

Integrations to use: Stripe (customer.created webhook trigger, Update Customer, Retrieve Customer if needed), OpenSanctions (Match Entities), Slack (Send a Message).