Qwertzuiop Zzyx Holdings

Assessment

The subject has not been identified. No authoritative registry record was retrieved for the presented name, and consequently every mandatory identity attribute is missing. This is the governing finding of the report; it constrains the reliability of Sections 2 through 12.

The presented identifiers are limited to what the requester supplied: an entity name of "Qwertzuiop Zzyx Holdings", an entity type of COMPANY, and a jurisdiction of GB expressly flagged as user-provided. None of these has been corroborated by an independent source.

Evidence

What Was Searched

• Companies House (UK) was queried in the REGISTRY role and in the UBO role. Both calls are logged OK_DATA ("ran, returned data").
• The evidence narrative nevertheless records: "NO REGISTRY RECORD RETRIEVED — treat as elevated transparency risk and say so explicitly."
• No other registry, corporate database or company-information provider appears in the source ledger. No non-UK registry was searched, which matters because the GB jurisdiction premise is itself unverified (Section 9).

The Unresolved Contradiction

The OK_DATA label and the "no record retrieved" narrative cannot both be read at face value. Two readings are available:

1. 1.The connector returned a valid response envelope containing no matching entity — i.e. the search executed correctly and found nothing. This is the more probable reading and would mean no UK-incorporated company of this name was matched.
2. 2.A record was returned but was not captured downstream — a pipeline or parsing defect.

The distinction is material: reading (1) is an intelligence finding about the entity; reading (2) is a system defect that voids the registry evidence. The evidence supplied does not permit a choice between them. Pending resolution, the registry domain is treated as functionally uninformative on identity. Analysts must not interpret OK_DATA as confirmation that the company exists.

Observation on the Name

The presented string warrants comment because it bears on which remediation path is correct. "Qwertzuiop" corresponds to the top row of a QWERTZ keyboard layout (German/Austrian/Swiss/Central European) typed left to right; "Zzyx" is a non-lexical string of the type conventionally used to sort last in an alphabetical index. Neither element is a recognisable trading name, surname, place name or portmanteau.

This is a linguistic observation, not evidence, and no supplied source characterises the name. It is recorded because it generates a testable hypothesis — that the input is a test string, placeholder, typographical error or fabricated name — which, if true, means the file requires data remediation rather than a risk decision.

Risk Implication

• MLR 2017 reg. 27–28: the customer must be identified and identity verified from reliable, independent sources before the business relationship is established. That has not occurred. There is no basis for any CDD conclusion (Section 12).
• No unique identifier exists. Without a registration number, every screen in Sections 3, 5, 6 and 7 is a name search against an unresolvable name, carrying irreducible false-negative risk. A nil return in those sections therefore cannot be treated as a clean result.
• Undetectable hard stops. A dissolved or struck-off status would be a hard stop; status is unknown, so that check has not been performed rather than passed.
• Untestable shell indicators. Without a registered office, mass-registration/formation-agent address testing — one of the most productive single tests for shell networks — cannot be run. Without incorporation date, the recently-incorporated-shell pattern cannot be detected. Without a SIC code, no commercial-rationale test is possible (see also Section 8).

This section is the direct cause of the Transparency Risk score of 85/100 discussed in Section 11, and of the ownership void in Section 2.

Assessment

No beneficial owner, controller, director, officer or shareholder was identified. The evidence states plainly: "No beneficial owners could be established from available sources." [Source: Companies House / UBO call]

There is consequently not a single natural person named anywhere in this file. That absence is not merely a gap in this section; it disables person-level screening in Sections 3 (sanctions), 4 (PEP) and 5 (adverse media).

The 25% PSC Threshold

Under the UK PSC regime (Companies Act 2006 Part 21A) and MLR 2017 reg. 5, a person with significant control includes anyone who directly or indirectly holds more than 25% of shares or voting rights, holds the right to appoint or remove a majority of the board, or otherwise exercises significant influence or control. FATF Recommendation 24 and EU 5AMLD Art. 30 impose equivalent beneficial-ownership transparency obligations.

The 25% threshold could not be tested at all. No ownership percentage, however approximate, is available for any person or entity.

Evidence

Analytical Note — The Significance of the Missing Negative Statement

A registered UK company that has no identifiable PSC, or that is exempt, or that has withheld PSC details, would ordinarily still generate a statement to that effect on the register. Each of those statements would itself have been informative — and a "details withheld" entry would have been an escalation trigger in its own right.

Here there is no entry and no statement. That pattern is consistent with the hypothesis in Section 1 that no registered entity of this name was matched, rather than with the profile of a registered-but-opaque company. It is not proof of that hypothesis, and the alternative reading (a downstream data loss) remains open.

Terminology discipline: there is no confirmed UBO, no declared UBO and no potential UBO in this file. The correct characterisation is that beneficial ownership is unestablished. It must not be recorded as "none", "no PSC" or "direct ownership assumed".

Note on the Entity's Self-Description

The presented name includes the word "Holdings", which conventionally implies a parent entity holding interests in subsidiaries. No parent, subsidiary, affiliate or shareholding of any kind was identified. A holding company for which no holding can be evidenced has no evidenced commercial purpose. This observation is contingent on the name being accurate, which Section 1 does not establish.

Risk Implication

• MLR 2017 reg. 28(4) requires the firm to identify the beneficial owner and take reasonable measures to verify that identity so that it is satisfied it knows who the beneficial owner is. That requirement is not met.
• No sanctions or PEP exposure via ownership can be excluded. A designated or politically exposed individual could sit behind this structure and nothing in this file would reveal it. This directly limits the conclusions available in Sections 3 and 4.
• The ownership void is the principal driver of Transparency Risk 85/100 in Section 11 — the highest single input in the model, and the one carrying the least weight.
• Remediation is not optional. Until at least one natural person is identified and verified, person-level screening cannot begin, and the CDD file cannot be completed (Section 12).

Assessment

Sanctions screening ran and returned no matches against the presented entity name. The screen is logged OK_EMPTY — meaning it executed and genuinely found nothing.

However, the result carries materially reduced assurance value for a specific and documentable reason: the screening was performed against a name that could not be resolved to any legal person (Section 1), and against no natural persons at all, because none were identified (Section 2).

Screen Detail

Key Findings

• No exact sanctions match was returned against the presented name on the OFAC, UK OFSI or UN lists.
• No possible or partial name match was returned either. The distinction matters: this is a nil return, not a discounted hit.
• No entity-level identifiers were available to strengthen the screen. Sanctions screening is most reliable when run against a registration number, incorporation date and registered address alongside the name. None of those was retrieved (Section 1), so the screen was a name-only match.
• No person-level screening was performed. Section 2 established that no natural person is named in the file. Sanctions exposure held through an unidentified individual owner or director therefore remains untested, not cleared.
• No EU consolidated list, HM Treasury asset-freeze extended dataset, or law-enforcement watchlist appears in the source ledger. Only the three named lists were screened.

Third-Party Content Integrity Note

The "No findings returned" statement for this domain was delivered inside the UNTRUSTEDRETRIEVEDCONTENT markers and has been treated as data. It contained no directive or attempt to influence the assessment, and no red flag arises under that control.

Risk Implication

• Under MLR 2017 and the Sanctions and Anti-Money Laundering Act 2018, sanctions compliance is a strict-liability obligation. A nil return against an unverifiable name does not discharge it.
• The correct record for this file is: "OFAC / UK OFSI / UN screened on the presented name; no match returned; screen not corroborated by registration number and not extended to any natural person because none was identified."
• It must not be recorded as "sanctions clear". The Sanctions factor nevertheless carries the single largest applied weight in the model at 34.1% (Section 11) — a weighting concentration that is the principal reason the composite understates risk.
• Re-screening is mandatory once a registration number and officer/PSC names are obtained, and should include the full designated-person datasets for any additional jurisdiction identified under Section 9.

Screen status: NOT RUN

Assessment

PEP screening was not performed. The source ledger records: "No PEP screening provider configured [PEP] → SKIPPED." The coverage statement confirms PEP is a "risk domain NOT reflected in the composite score".

No conclusion may be drawn in either direction. This report does not state that the subject or its controllers are PEPs, and it does not state that they are not. The status is UNDETERMINED.

Why This Gap Is Doubly Unresolved

The second layer is the more serious. Restoring a PEP provider alone would not close this gap; the ownership and officer gap in Section 2 must be closed first.

Evidence

No role-keyword or inference-based substitute has been used. No conclusion of "not a PEP" has been derived from the absence of political terms in web results, and none should be recorded on that basis.

Risk Implication

• FATF Recommendation 12 and FCA SYSC 12.1, together with MLR 2017 reg. 35, require firms to have systems to determine whether a customer or beneficial owner is a PEP, family member or known close associate, and to apply enhanced measures where they are. No such determination has been made.
• Where a PEP relationship exists, EDD, senior-management approval and enhanced ongoing monitoring are mandatory. Because the determination has not been made, the file cannot demonstrate that those requirements do not apply — which is a separate control deficiency from the identity failure in Section 1.
• The supplied disposition of "EDD required: NO" is therefore not supportable. It cannot be concluded that EDD is unnecessary when the principal EDD trigger has never been tested.
• The composite score in Section 11 excludes this factor entirely. That exclusion is correctly disclosed, but it means the composite is a partial figure and must not be presented as a complete risk measure.

Assessment

Adverse-media screening ran and returned no results (logged OK_EMPTY). No allegation, investigation, charge, conviction, regulatory finding or reputational claim of any kind was identified against the presented name.

This must be read as uninformative rather than reassuring. The coverage statement is explicit and load-bearing: "LOW WEB PRESENCE: no search in any risk domain returned a result, and a control search on the subject's name returned nothing either. The absence of adverse findings therefore reflects how little is published about this entity, NOT a verified clean record. Treat the web-derived sections as uninformative rather than reassuring."

Screen Detail

Key Findings

• Zero articles were returned. There is therefore no allegation to attribute to any publication, and no distinction between allegation, investigation, charge and conviction arises in this section.
• The control search failed to find the entity at all. A general search on the bare subject name returned nothing. This means the tool could not locate even neutral, non-adverse references — no website, no directory listing, no filing-aggregator entry.
• The screen was a single-provider, name-only search. Only Google Programmable Search was used for this domain. No dedicated adverse-media or structured negative-news database appears in the ledger.
• No natural persons were screened. Consistent with Sections 2 and 4, no officer or beneficial-owner name existed to search for adverse media.

Cross-Section Analysis

The absolute nil return here is corroborated by, and analytically inseparable from, the identical nil returns in Sections 6 (regulatory), 7 (litigation) and 8 (financial), and from the failure to retrieve a registry record in Section 1. Six mutually consistent nulls do not converge on a clean record; they converge on invisibility. Corroboration requires two or more independent positive observations; there are none here.

Risk Implication

• The Adverse Media factor was scored 4/100 with 22.7% applied weight (Section 11). That score is derived from an empty search against an unresolvable name and is among the least informative inputs in the file, yet it is the second-largest weight in the model.
• For a genuine trading company of any size, a total absence of any public reference — adverse or neutral — is itself anomalous. Two readings compete: (a) the name does not correspond to a real entity, or (b) the entity is real and its invisibility is a product rather than an accident. Under reading (b), the zero footprint is an escalation signal, not a comfort.
• Correct file wording: "Google Programmable Search returned no adverse media on the presented name; the same search returned no neutral references either, so the result is treated as uninformative. Adverse media has not been excluded."

Assessment

The regulatory and enforcement screen ran and returned no results (logged OK_EMPTY). No regulatory action, enforcement notice, penalty, licence condition, censure or supervisory intervention was identified against the presented name.

As with Section 5, this is a nil return against an unresolvable name and therefore does not establish a clean regulatory record.

Screen Detail

What Was Not Searched

This is the material point for this section. The screen was a general web search, not a direct interrogation of regulatory registers. The following were not consulted, and no entry in the source ledger indicates otherwise:

• FCA Register / FCA Final Notices and enforcement database — not searched directly. The report therefore cannot state whether the entity is authorised, exempt, unauthorised, or subject to any FCA action.
• HMRC supervised-business registers (e.g. money service business, trust or company service provider registers) — not searched.
• Companies House compliance record (overdue filings, confirmation statement history, strike-off notices) — not retrieved; see Section 1.
• Insolvency Service / director disqualification register — not searched, and un-runnable without officer names (Section 2).
• Non-UK regulators — none searched. Relevant because the GB jurisdiction premise is unverified (Section 9).

Key Findings

• No regulator has been identified as having taken any action against the presented name in the search performed.
• Authorisation status is unknown. Whether the entity requires, holds or lacks any regulatory permission cannot be stated. If the entity is presented as conducting regulated activity, this is a direct gap requiring an FCA Register check.
• A general web search is a weak proxy for a regulatory-register check. Enforcement matters that are published but poorly indexed, historic, or held on register rather than in news coverage would not surface via this method.

Risk Implication

• The Regulatory & Enforcement factor was scored 4/100 with 20.4% applied weight (Section 11) — the third-largest weight in the model, resting on a single empty web search.
• Under FCA SYSC 6.3 and MLR 2017 reg. 28, understanding the customer's regulatory status is part of understanding the nature of its business. That is not established.
• Required next step: once a registration number and legal name are obtained (Section 1), run direct checks against the FCA Register, Companies House filing history, the Insolvency Service register and the disqualified directors register, and re-run in any additional jurisdiction identified.
• Correct file wording: "No regulatory or enforcement matter identified via web search on the presented name; regulatory registers were not searched directly; regulatory status unestablished."

Assessment

The litigation screen ran and returned no results (logged OK_EMPTY). No proceeding, judgment, claim, insolvency event or class action was identified against the presented name.

Court records were not searched directly. The only source used for this domain was Google Programmable Search — a news and general-web index. This is a material limitation that must be stated on the face of the file.

Screen Detail

Sources That Were Not Consulted

• UK court and tribunal records — no direct search of the Business and Property Courts, County Court judgment register, or tribunal decisions appears in the ledger.
• The Gazette / insolvency notices — not searched. Winding-up petitions, administration and strike-off notices would ordinarily be published there and would not reliably surface through a general web search.
• Insolvency Service records — not searched.
• Charges and mortgages register — not retrieved (Section 1), so secured lending and enforcement over assets are invisible.
• Non-UK court records — none searched; the jurisdiction premise is unverified (Section 9).

Pattern Analysis

The following patterns are specifically flagged as untested rather than absent, because the search method used could not reliably detect them:

Risk Implication

• The Litigation factor was scored 4/100 with 11.4% applied weight (Section 11), derived from one empty general-web search rather than any court record.
• Because no allegation, claim or proceeding was identified, no adverse assertion is made about the subject in this section, and none may be inferred from it. Equally, litigation exposure has not been excluded.
• Correct file wording: "No litigation identified via web search on the presented name; court records, The Gazette and insolvency registers were not searched directly; litigation exposure unestablished."

Assessment

No dedicated ESG data source was consulted. No ESG, sustainability, human-rights, labour, environmental or data-protection database appears in the source ledger. ESG and conduct risk are therefore unassessed, not clean.

The only sources capable of surfacing an ESG matter incidentally were the Google Programmable Search runs for ADVERSEMEDIA and OSINT, both of which returned **OKEMPTY** against a name with no discoverable web presence at all (Section 5).

Evidence

Key Findings

• Governance risk is the ESG dimension most clearly implicated, and it is implicated by absence. A company whose directors, PSCs and filed accounts are all unretrievable (Sections 1, 2, 8) cannot demonstrate any governance framework. That is a documented transparency deficiency, distinct from any allegation of misconduct — and none is made.
• Applicability of the ESG reporting regimes cannot be determined. The UK Modern Slavery Act s.54 threshold, CSRD scope and TCFD applicability all turn on entity size, turnover, listing status or jurisdiction. Every one of those variables is unknown.
• No ESG allegation of any kind is identified in this report. No environmental, labour, human-rights or data-protection claim is attributed to the subject, and none should be inferred from this section.

Risk Implication

• ESG & Conduct Risk is not a weighted factor in the supplied scoring model and contributes nothing directly to the composite. It reaches the score only indirectly through Transparency Risk (Section 11).
• The compliance consequence is that reputational and conduct exposure is unquantified. For a relationship of any materiality this would ordinarily require, at minimum, a sector-specific ESG screen — which cannot be scoped until the entity's activity is known (Section 8).
• Correct file wording: "No dedicated ESG source was consulted; ESG and conduct risk are unassessed. The incidental web searches that ran returned nothing on a name with no discoverable footprint, and are uninformative."

Assessment

No financial information of any kind was obtained. The financial screen ran via general web search and returned nothing (OK_EMPTY), and no filed accounts were retrieved from the registry because no registry record was retrieved at all (Section 1).

There is consequently no basis whatsoever for a source-of-funds or source-of-wealth assessment. This is an explicit due diligence deficiency, not a neutral gap.

Evidence

No financial figure is asserted anywhere in this report. No revenue, asset, turnover or valuation number appears in the evidence set, and none has been estimated or inferred.

Red Flag Framework — Detection Status

The standard financial red flags cannot be evaluated. They are recorded here as untested, which is materially different from absent:

Commercial Rationale

The core commercial-rationale test — does the declared business activity plausibly generate the expected transaction profile? — cannot be attempted, because neither term of the comparison is available. Compounding this, the presented name asserts a holding function while Section 2 establishes that no subsidiary, parent or shareholding of any kind was identified. On the evidence available, the entity has no evidenced commercial purpose. That statement describes the state of the evidence; it is not a finding that no purpose exists.

Risk Implication

• MLR 2017 reg. 28(2)–(4) requires the firm to understand the nature of the customer's business and, where relevant, its ownership and control structure. Neither is understood.
• Source of funds and source of wealth are unassessed. Where a customer's financial profile cannot be understood, transaction monitoring has no baseline against which to detect anomalies, so the monitoring control is materially degraded even if formally applied.
• Financial Profile is not a weighted factor in the supplied scoring model. Its influence reaches the composite only indirectly, through Transparency Risk (85/100 at 4.5% applied weight) — which is why the severity of this gap is almost invisible in the headline score. See Section 11.
• Required next step: obtain filed accounts (or a documented dormancy position) and a written source-of-funds/source-of-wealth statement supported by evidence, once the entity is identified.

Assessment

Jurisdiction is asserted but unverified. The report header records Jurisdiction: GB with Jurisdiction Confidence: user-provided. No independent source in the evidence set corroborates a GB nexus, because no registry record was retrieved (Section 1).

The supplied model scores Jurisdiction Risk at 35/100 (6.8% applied weight). That score therefore rests on an unverified premise, and is provisional.

Evidence

No FATF status, no EU high-risk designation and no CPI figure is asserted in this report, because no such value appears in the supplied evidence. Quoting one would be fabrication. The reference datasets named in the requirements (FATF grey/black lists, EU High-Risk Third Countries, TI CPI) do not appear in the source ledger and cannot be represented as having been consulted for this assessment.

The Linguistic Discordance — Stated as a Hypothesis

Section 1 noted that "Qwertzuiop" corresponds to the top row of a QWERTZ keyboard layout, which is used in German-speaking and Central European territories rather than in the UK (where QWERTY is standard). This is a weak, purely linguistic inference and no more. It is mildly discordant with a GB assertion and is recorded solely because it generates a testable question — is the asserted jurisdiction correct? — which the evidence cannot currently answer.

It is not evidence of a non-UK nexus, and no jurisdictional conclusion is drawn from it.

Risk Implication

• Jurisdiction determines the applicable screening perimeter. All screening in this file was performed against UK-oriented sources (Companies House; OFAC/OFSI/UN). If the entity is registered elsewhere, the registry search was directed at the wrong register and the nil return in Section 1 would carry a different meaning entirely.
• A lower-transparency jurisdiction cannot be excluded. If the entity is genuine and registered outside GB — potentially in a jurisdiction with weaker beneficial-ownership transparency — both the Jurisdiction Risk and Transparency Risk factors would require upward revision, and the composite in Section 11 would change materially.
• MLR 2017 reg. 33(1)(b) requires EDD where the customer is established in a high-risk third country. That determination cannot be made on this evidence, so it cannot be concluded that the provision does not apply — a further reason the supplied "EDD required: NO" is unsupportable (Sections 4 and 12).
• Required next step: establish jurisdiction from primary documents (certificate of incorporation, registry extract), not from customer assertion, and then re-run jurisdictional risk against the applicable FATF and EU datasets with their publication dates recorded.

Assessment

The supplied model returns a composite of 9/100, band Low, on PARTIAL coverage. The arithmetic is reproducible from the supplied inputs and is reproduced in full below. It is not disputed as arithmetic.

It is, however, rejected as a risk statement. The analytical determination of this report is UNDETERMINED risk with LOW confidence, for the structural reasons set out after the table.

Scoring Table — Supplied Model, Verbatim Inputs

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

``` Sanctions & Watchlists : 3 × 0.341 = 1.023 Adverse Media : 4 × 0.227 = 0.908 Regulatory & Enforcement : 4 × 0.204 = 0.816 Politically Exposed Persons: UNDETERMINED — excluded, no weight applied Litigation : 4 × 0.114 = 0.456 Jurisdiction Risk : 35 × 0.068 = 2.380 Transparency Risk : 85 × 0.045 = 3.825

Composite = 9.408 → 9/100 (band: Low) ```

Applied weights sum to 99.9% as supplied (34.1 + 22.7 + 20.4 + 11.4 + 6.8 + 4.5); the residual is rounding in the supplied figures. Weights were renormalised across the six domains that ran, PEP having been excluded.

Why the Composite Understates Risk — Structural Critique

The number is correct and the model is misapplied to this file. Three defects, all evidenced from the table above:

1. Weight is concentrated on the least informative evidence.

Sanctions (3), Adverse Media (4) and Regulatory (4) together command 77.2% of applied weight. Every one of those three scores is derived from an empty search result on a name with no discoverable web presence. The model's confidence is therefore overwhelmingly invested in evidence the coverage statement itself describes as "uninformative rather than reassuring."

2. The only genuinely adverse finding carries almost no weight.

Transparency Risk at 85/100 is the highest input in the file and the only one that reflects an actual finding rather than an absence of results. It carries 4.5% applied weight and contributes 3.825 points — approximately 41% of the total composite, but nowhere near enough to move the band. If Transparency Risk were weighted commensurate with its evidential significance, the composite would sit in a materially higher band.

3. Identity, ownership, financial profile and ESG are not weighted factors at all.

The four domains in which this file failed most completely — Sections 1, 2, 8 and 10 — have no direct representation in the model. Their influence reaches the score only indirectly, through the 4.5%-weighted Transparency Risk input. The model is not designed to register a total identity failure.

Conclusion on the score: 9/100 should be read as "we found nothing to score, and the model defaults toward low when starved of input," not as "this entity is low risk." Absence of data has been arithmetically converted into apparent reassurance. This caveat must travel with the number wherever it is quoted.

Risk Determination of This Report

UNDETERMINED is not a synonym for high risk. It is the statement that the file does not support a rating. It is also not compatible with recording "Low" as the outcome, which is why the supplied disposition is rejected in Section 12.

Cross-Section Dependencies

• The Transparency Risk 85 input is sourced directly from the identity void in Section 1 and the ownership void in Section 2.
• The Sanctions 3 input is limited by Section 2: with no natural person identified, person-level sanctions exposure was never tested.
• The PEP exclusion is doubly caused — no provider (ledger) and no names (Section 2).
• The Jurisdiction 35 input depends on an assertion that Section 9 shows to be unverified; if jurisdiction changes, this factor and Transparency Risk both move.
• The nil returns in Sections 5, 6, 7 and 8 are not independent corroboration of a clean record; they share a single common cause — the name does not resolve to anything searchable.

Recommendation

No CDD level can be assigned, and no onboarding or risk decision should be taken. Refer to manual compliance review as an identity-verification failure, and escalate to the MLRO.

The supplied disposition — Standard CDD / EDD required: NO / ANNUAL monitoring — is rejected.

This is not a recommendation to reject the relationship. Rejection is not warranted solely because information is unavailable. It is a recommendation that the file is not yet decidable, and that remediation must precede any decision.

Rationale

1. 1.Identity is unestablished. No registration number, registered legal name, legal form, incorporation date, registered office or company status was retrieved [Source: Companies House]. MLR 2017 reg. 27 requires CDD before the business relationship is established; reg. 28 requires verification from reliable, independent sources. Neither is satisfied.
2. 2.Ownership and control are unestablished. No PSC, director or officer was identified — not even a negative PSC statement. The 25% PSC threshold could not be tested (Section 2). MLR 2017 reg. 28(4), FATF R.24 and EU 5AMLD Art. 30 are not satisfied.
3. 3.No natural person exists in the file to screen. This blocks person-level sanctions, PEP, disqualification and adverse-media screening (Sections 3, 4, 5).
4. 4.One screen did not run. PEP screening was SKIPPED (no provider configured) and is excluded from the composite. FATF R.12 / FCA SYSC 12.1 / MLR 2017 reg. 35 are not addressed.
5. 5.The clean signals are uninformative. Six OK_EMPTY domains, plus a nil control search on the bare name, evidence the unsearchability of the name — not the conduct of an entity.
6. 6.An open source contradiction remains. Companies House is logged OK_DATA for REGISTRY and UBO while the evidence states no record and no owners were retrieved. This must be resolved before the registry evidence can be relied on either way.
7. 7.Jurisdiction is unverified, so the entire screening perimeter used may have been misdirected (Section 9).

Outstanding Information Gaps

Required Actions

1. 1.Suspend any onboarding, activation or transaction processing pending resolution of identity. Do not record a risk rating of Low.
2. 2.Obtain from the customer or introducer the company registration number and a certificate of incorporation, plus a current registry extract.
3. 3.Re-query the registry on the registration number, and separately run a fuzzy/phonetic name search to confirm a genuine nil return on the presented string. Preserve the raw connector response.
4. 4.Resolve the ledger contradiction with the data-engineering owner: did the Companies House connector return an empty match set, or was a record lost downstream? Record the answer on the file.
5. 5.Verify jurisdiction from primary documents, not customer assertion. If non-GB, re-scope the registry and sanctions perimeter accordingly (Section 9).
6. 6.Identify and verify all PSCs above the 25% threshold and all directors/officers, then re-run sanctions, PEP, adverse-media and disqualification screening at person level.
7. 7.Configure a PEP screening provider and run it against the identified natural persons. Until then, PEP status stands as UNDETERMINED and must be recorded as such.
8. 8.Escalate to the MLRO with the following decision point: is this record a system test / data-quality artefact, or a live customer instruction? - If a test or data-quality artefact: close the file as void, do not retain a Low risk rating, and log the input as a data-quality defect. - If a live customer and CDD cannot be completed: MLR 2017 reg. 31 requires that the business relationship not be established (or be terminated), that no transaction be carried out, and that the firm consider whether a SAR is required. No suspicion is asserted here — the point is that the reg. 31 assessment must be performed and documented.
9. 9.Re-run the full assessment once items 1–7 are complete. The composite must be recalculated, not adjusted.

Trigger Events for Immediate Escalation

• Registry search on the registration number returns a dissolved, struck-off, in-liquidation or dormant status — treat as a hard stop pending review.
• Registered office proves to be a mass-registration or formation-agent address shared by a large number of entities.
• PSC register shows "details withheld", PSC exemption, or nominee/corporate officers in a lower-transparency jurisdiction.
• Any sanctions match (exact or partial) against the entity or a newly identified natural person.
• Any PEP, RCA or HIO identification once screening is enabled.
• Verified jurisdiction differs from the asserted GB, particularly if a FATF-listed or EU high-risk third country.
• The customer is unable or unwilling to produce a registration number or certificate of incorporation — treat as a material red flag in its own right.
• Transaction activity is attempted before identity is established.

Monitoring and Review

• Monitoring frequency: not set. The supplied ANNUAL cadence is rejected as premature.
• Next review date: not scheduled on a calendar basis. The next review is event-driven — it occurs on receipt of the registration number and certificate of incorporation, or on MLRO determination that the record is void.
• No file may be closed as "screened and clear" on this evidence.

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Assessment Parameters

No screen in the evidence set carries an individual timestamp. The report date is the only date available and is the date of assessment for every screen listed below.

Complete Source Ledger — Reproduced in Full

Ledger status definitions as supplied: OKDATA = ran, returned data. OKEMPTY = ran, genuinely found nothing. FAILED = did not run, no conclusion may be drawn. SKIPPED = not applicable or not configured.

Note on FAILED sources: no source in this assessment is logged FAILED. The material problems are (a) one SKIPPED domain (PEP) and (b) the CONTRADICTED registry evidence — which is a distinct and, in this file, more consequential condition than a clean failure.

Methodology

1. 1.Source-ledger reconciliation. Every logged source was mapped to its evidence output, and each output classified as VERIFIED, NOT FOUND, CONTRADICTED, SKIPPED or FAILED. The Companies House entries were classified CONTRADICTED because the ledger status (OK_DATA) and the evidence narrative (no record; no owners) cannot both be taken at face value.
2. 2.Prior-brief evaluation. The pre-synthesis brief was treated as an input to test, not as fact. Its central contentions — that the entity is unidentified rather than low-risk, that the composite is arithmetically sound but substantively misleading, and that the registry OK_DATA label must not be read as confirmation of existence — were each checked against the supplied evidence and found supported. Its ranked hypotheses about the name (test string / name error / wrong jurisdiction / genuine-but-opaque) are carried forward as hypotheses only, and are labelled as such in Sections 1 and 9; none is adopted as a finding, because the evidence does not permit selecting between them.
3. 3.Arithmetic verification. The composite was recomputed from the supplied factor scores and applied (renormalised) weights. The result, 9.408 → 9/100, reproduces the supplied figure. No score or weight was modified. PEP was excluded with no assumed value.
4. 4.Absence discipline. No NOT FOUND result was converted to "none", no SKIPPED result to "no risk", and no OK_EMPTY result to "clear". Where a screen could not detect a pattern, the pattern is recorded as untested rather than absent (see Sections 7 and 8).
5. 5.Untrusted-content handling. Content between the UNTRUSTEDRETRIEVEDCONTENT markers was treated exclusively as data. It comprised six "No findings returned." statements and contained no directive, request or attempt to influence scoring. No injection red flag arises.
6. 6.Fabrication controls. No registration number, case number, date, monetary figure, person name, URL, FATF designation or CPI score has been introduced. Where a required field was unavailable, the gap is stated explicitly with its compliance consequence.

Limitations

• Identity unresolved. The most material limitation. Every downstream screen was a name search against a string that resolved to nothing.
• Registry evidence internally contradicted and therefore unusable on identity in either direction.
• No natural person identified, disabling all person-level screening.
• PEP domain not run, and unrunnable as configured even if a provider were added, absent names.
• Jurisdiction unverified, so the screening perimeter itself may be misdirected.
• Registers not interrogated directly: FCA Register, HMRC registers, court records, The Gazette, Insolvency Service, disqualified directors register, ICO enforcement.
• No reference datasets supplied for FATF status, EU high-risk third countries or TI CPI.
• No ESG source consulted.
• Single provider for five web domains (Google Programmable Search), with no date range, language coverage or index depth disclosed — a single point of failure for adverse media, regulatory, litigation, financial and OSINT alike.
• Financial profile, ESG and identity are not weighted factors in the scoring model, so the file's most serious deficiencies are structurally under-represented in the composite (Section 11).

Confidence

Overall confidence: LOW.

Principal reasons:

1. 1.The subject was not identified; no authoritative record supports its legal existence, form or jurisdiction.
2. 2.Coverage is PARTIAL — one risk domain did not run and is excluded from the composite.
3. 3.The registry evidence is internally contradicted and cannot be relied on either way.
4. 4.Every "clean" signal derives from an empty search against an unresolvable name, which the coverage statement itself directs be treated as uninformative.
5. 5.No corroboration exists anywhere in the file. Corroboration requires two or more independent positive observations; this file contains none.

A composite of 9/100 carries an implication of assurance that this evidence base does not support. The confidence rating is deliberately set to LOW to prevent that number being relied upon as a verified clean result.