Third-party due diligence that traces who is really behind a distributor before the contract is signed
Every third party risk-tiered before the contract is signed, from its real owners.
See one case, screen by screen ↓Software that takes a distributor, agent, consultant or vendor from a business request to a risk-tiered, documented decision before the contract: questionnaire, ownership, screening, adverse media, contract terms and conditions. Third-Party Due Diligence adds agents that trace every owner to a person as a graph and set the anti-bribery tier from the graph and the questionnaire together, for the risk lead to decide and sign.
How to choose AI solutions for life sciences →
Updated
A pharma company sells, registers, imports and runs trials through distributors, customs brokers, regulatory consultants, CROs and event agencies, and many of them deal with public hospitals and officials. The due diligence questionnaire they return is self-declared. A 30% stake listed as “other investors”, or a “No” to government links, passes a checklist review unless someone traces it.
Tracing by hand means pulling a registry extract, an offshore company record, a PEP report and local-language news, then drawing the connections in a slide. For a High-risk review that takes weeks, and the tier is often set before the tracing is finished. The cost of a miss is a bribery case that runs through the distributor: enforcement, a monitorship and lost tenders.
Estimated split for one High-risk distributor review, by hand and with the solution. Waiting for the third party's answers does not get shorter; the tracing, screening and writing do.
Agents trace every owner to a person, screen each one and set the tier from the graph; the risk lead decides and signs.
Minh Tran asks for Halvora Medical Trading Co., a distributor in Ho Chi Minh City, to take Corventa to public hospitals in four provinces, tender bids included — USD 2.4 million a year. Here is what happens next, screen by screen, in the working solution.
Minh raises the request with term sheet v2 and his business reason. The risk scorer pre-screens it High — public hospital tenders in an Elevated-risk country — and the questionnaire goes out in Vietnamese and English the next morning. Halvora joins the register of 18 reviews with a 30-day clock, assigned to Dana Okafor.
Sponsor note: “Halvora is the only distributor with tender registrations in all four provinces before the November tender round.”
Sixty-two answers, signed by the director Pham Quoc Bao. The graph shows what they say: Pham Quoc Bao 45%, Do Minh Chau 25%, and “other investors” 30%, not named in answer 3.1. A Singapore bank account asked for in 9.1 and three provincial resellers named “after signing” in 7.2 are already red flags. As declared, the score is 62 — Medium.
“This is only what Halvora declared.”
Dana clicks Trace ownership and the graph grows node by node. The registry shows the 30% is Lotus Ridge Holdings Ltd., a British Virgin Islands company that took the stake in March 2022. The offshore record shows Lotus Ridge is 100% owned by Le Thu Hanh, born 1979, and has no other holding on record. The As traced bar climbs as each source lands.
Unknown owners are reported, never assumed.
Le Thu Hanh matches a PEP record on full name, year of birth and city: she is the spouse of Tran Van Khoa, Deputy Director of the Provincial Department of Health and a member of the provincial drug procurement and tender board since 2021. That board approves the results of medicine tenders for public hospitals in the province. The questionnaire answered “No” to government links.
“Rule fired: a government link makes a third party High.”
Six weighted factors set the score: country 15 of 20, government touchpoint 22 of 22, compensation 20 of 20, ownership transparency 20 of 20, adverse media 5 of 10, sanctions 0 of 8. The graph moved three of them — ownership +10, government touchpoint +5.5, adverse media +5 — each with its citations. Seven red flags, every one opening its source passage beside the dossier.
Every factor is shown, from the approved scorecard version.
Each answer is a claim checked against the registry, screening and news. 3.1 and 4.2 are contradicted by the registry and the PEP record; 8.3 leaves audit rights “subject to discussion”, though policy requires them in every High-risk contract; 9.1 asks for payment outside Vietnam. 8.4 said “No” to any inquiry in five years, but Halvora was named in a 2024 provincial tender review.
“The questionnaire was signed by the director as complete and accurate.”
No true sanctions matches across OFAC SDN, EU consolidated, UK and UN. Two name hits are proposed as false positives: Pham Quoc Bao on OFAC (born 1958 against 1974) and Le Thu Hanh on the EU list (1962 against 1979). In the news, the province cancelled a cardiovascular tender in March 2024 over bid-rigging complaints and reviewed three distributors, Halvora among them; inspectors closed it in June with no action.
“Dispositions are suggestions until you confirm them.”
The proposed 18% margin is outside the 8–12% Vietnam hospital benchmark, and the 3% tender success fee is not permitted under policy 4.3. A USD 120,000 marketing fund at the distributor's discretion needs a control, and the Singapore account is outside policy 6.1. At 18% plus the fee, Halvora would earn about USD 216,000 a year above the top of the benchmark with no stated service behind it.
The dossier writer maps each red flag to a condition: a written recusal or sale of the 30% stake before signing, no success fee, the margin capped at 12% with the marketing fund only against an agreed plan, payment only to Halvora's account in Vietnam, audit rights, an anti-bribery clause with a corrected questionnaire and annual certification, the resellers named, and quarterly monitoring. Untick one and the screen shows which flag is left open.
Agent recommendation: “Approve with conditions — only if the recusal or sale of the 30% stake is in writing before signing. Otherwise reject.”
Dana signs with the meaning “I approve this third party with the conditions listed”. The eight conditions become contract clauses for Lena Ortiz, legal counsel, to approve; Priya Raman in procurement releases the vendor in the ERP only after contract signature. Halvora goes on daily monitoring, payments checked against the 12% cap, with a re-review due Oct 7, 2027.
If a red flag is left open, the approval goes to Omar Haddad, Chief Compliance Officer, as an exception.
The same distributor, seen by the five people who carry it — what their review looked like, and what it looks like now.
Agents trace every owner to a person, screen each one and set the tier from the graph; the risk lead decides and signs.
Reads the returned due diligence questionnaire — any format or language — and turns each answer into a claim to check: owners and shares, government links, sub-agents, bank account, audit rights, past investigations. Flags unanswered or evasive answers.
Pulls the business registry extract and offshore company records and traces every owner of 10% or more to a person, up to four levels, with share, date acquired and source page — and draws the ownership graph.
Screens the entity, owners, directors and beneficial owners against OFAC SDN, EU consolidated, UK and UN lists and the PEP and relatives database, and proposes a disposition for each hit with its match reasons.
Searches ten years of news, court and regulator sources in the local language and English for bribery, fraud, tender, sanctions and investigation terms, discards namesakes, and looks for follow-ups that change the picture.
Confirms the licence is valid for the service and region, and marks each commercial term — margin, fees, marketing funds, payment account — Within range, Needs a control or Outside policy against the country benchmark and the anti-bribery policy.
Scores six factors — country, government touchpoint, compensation, ownership, adverse media and sanctions — weights them to 100, applies the forcing rules and sets the tier from the graph and the questionnaire together.
Writes the due diligence dossier with every red flag cited, maps each flag to standard conditions, recommends approve, approve with conditions or reject, and drafts the clause pack for legal counsel.
Re-screens approved third parties every day against list updates and new adverse media, watches registry changes, licence expiry and certifications, and compares every invoice with the approved terms and caps.
Decides and e-signs. The agents propose; a named person decides.
Ask about a third party, a red flag, a rule or a re-review — or say what to change. Every answer points to its source.
Why is Halvora Medical high risk?
Score 82 — High. Four things drive it: the 30% owner is the spouse of a provincial tender board member; the questionnaire said “No” to government links; a 3% tender success fee and an 18% margin against 8–12%; and payments to a Singapore account. The 2024 tender review was closed with no action, so it weighs less. Approval only with a written recusal or sale of the 30% stake.
Is the Singapore account allowed?
No. Policy 6.1 requires payment to an account in the third party's name in the country of service. Halvora asked for a Singapore account “for currency reasons”. The proposed condition pays only to its Vietnamese account.
Which third parties are due for re-review this quarter?
Nine are due by year end, four of them High — from Saigon Event Partners (Medium, Oct 21) and Lagos Pharmalink (High, Oct 28) to Andes Medical Distribución (High, Nov 14, alert open). Andes is the priority because of yesterday's news alert.
Add a rule: flag any success fee tied to a tender or approval
Done. Any success, contingency or award-linked fee in a term sheet now raises a High red flag and proposes the condition “remove the fee”, as policy 4.3 requires. It would have caught Halvora's 3% tender fee and Al Noor's registration fee. The rule is on in Settings and recorded in the audit trail.
13 screens from the working solution, on its sample data. Pick one to see it large.
The tiers, red-flag rules, re-review cycle, approvers and screening sources are settings — versioned and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| High tier from score | 70 | Step up or down, with a preview of how many reviews would be High |
| Medium tier from score | 40 | Step up or down, with a preview of how many would be Medium |
| Any government link makes a third party High | On | On · Off — owner, director or close family member who is a government official |
| Low tier clears on its own | On | On · Off — when screening finds nothing and the questionnaire is complete |
| Red-flag rules | 6 rules on | Compensation above the benchmark · Payment to a third country or another name · Answer contradicts evidence · Offshore or undisclosed owner of 10% or more · Refuses audit rights or the anti-bribery clause · Adverse media in local language |
| Re-review | High every 12 months · Medium every 24 | Step up or down; Low every 36 months |
| Approvers | High tier: Dana Okafor · clauses: Lena Ortiz · exceptions: Omar Haddad | High tier: Dana Okafor or Omar Haddad · clauses: Lena Ortiz or Omar Haddad · exceptions: Omar Haddad or Dana Okafor |
| Adverse media languages | Local language of every country, translated with the original kept | All 24 languages · English only |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate. Regulatory context: DOJ/SEC FCPA Resource Guide (2020) · DOJ Evaluation of Corporate Compliance Programs (2024) · UK Bribery Act s.7 · Stanford FCPA Clearinghouse. People, companies and products named on this page are characters and sample data in the working solution.
Software that takes a distributor, agent, consultant or vendor from a business request to a risk-tiered, documented decision before the contract: questionnaire, ownership, screening, adverse media, contract terms and conditions. Third-Party Due Diligence adds agents that trace every owner to a person as a graph and set the anti-bribery tier from the graph and the questionnaire together, for the risk lead to decide and sign.
The ownership tracer reads the business registry extract, follows each corporate owner of 10% or more through offshore company records until it reaches a natural person, up to four levels, and cites the page for every link. An owner the questionnaire did not name is reported as a red flag, never assumed.
Yes. The entity, owners, directors and beneficial owners are screened against OFAC SDN, EU consolidated, UK and UN lists and a PEP database that includes relatives and close associates. Each hit comes with a proposed disposition and the match reasons, and a person confirms it.
Each answer is a claim checked against the registry, screening and news. A contradicted answer is listed with what the evidence shows and raises a red flag, and the dossier asks for a corrected questionnaire as a condition.
Six weighted factors — country, government touchpoint, compensation, ownership transparency, adverse media and sanctions — make a score out of 100, from the approved scorecard. Forcing rules apply on top: any government link makes a third party High. The screen shows the score as declared and as traced, and what the graph changed.
Yes. Agents propose; a person confirms every screening disposition and decides every tier and approval. The risk lead e-signs High-tier decisions, legal counsel approves the clause pack, and approving with a red flag open goes to the Chief Compliance Officer as an exception.
Yes. Approved third parties are re-screened every day against list updates and new adverse media; registry changes, licence expiry, certifications and invoices against the approved caps raise alerts that a person triages. Each tier is re-reviewed on its schedule — by default High every 12 months, Medium every 24 and Low every 36.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your anti-bribery policy, questionnaire, scorecard and a sample of past reviews — and it goes live once every quality gate has passed. We will walk you through it on your own third parties first.
Every speaker program scored on the OIG's red flags, before and after it runs.
1-min demoOpen Payments Recipient ValidationEvery recipient matched to the right NPI and licence, with the evidence
1-min demoCompliance Investigation Case ManagementInvestigations close in a median of 18 days, every finding cited.
1-min demoWe'll run Third-Party Due Diligence on a sample of your own past questionnaires and reviews.