INFINITUM CAPITAL LIMITED

Assessment

Core identity is VERIFIED against an authoritative registry. Identity resolution for screening purposes, however, is weak, because the name "Infinitum Capital" is demonstrably shared with at least one other legal person in another jurisdiction (Section 5) and appears as a keyword collision in unrelated text (Section 7).

Registry Record

Not Retrieved — Material Identity Gaps

• SIC code / stated nature of business — NOT FOUND. The company's declared activity is unknown. This is the reason no meaningful business-model risk assessment appears in this report.
• Filing history and accounts filing status — NOT FOUND. Whether accounts have ever been filed, whether they were dormant, and whether the company is currently up to date on filings is unestablished (Section 8).
• Previous names — NOT FOUND. No former-name data was retrieved, so name-change history cannot be excluded.
• Trading names / websites / LEI — NOT FOUND. The OPEN SOURCE INTELLIGENCE domain returned no findings, so no corporate web presence was identified for cross-matching.
• Number of shares, share capital, shareholder register — NOT FOUND (bears directly on Section 2).

Registered Address Analysis

The registered office is a care-of address at a third party, at No.1 Royal Exchange, a prestige City of London location. The evidence establishes the address string only; it does not establish the nature of Goldwyns London LLP's business, and this report makes no assertion on that point. The pre-synthesis brief characterised the address as "care-of an accountancy firm" — that characterisation is UNVERIFIED on the supplied evidence and is not adopted here.

The compliance-relevant inference is narrow and defensible: a care-of registered office conveys no information about where the business is actually conducted. It is lawful and extremely common. It means operating premises, staff presence and physical footprint must be established separately during onboarding, and it removes the registered address as a corroborating data point for the entity's operational substance.

Risk Implication

Identity is sound for registry purposes. The exposure is in screening precision: with no SIC code, no website, no LEI and no confirmed trading name, the screening layer had nothing but the literal string "Infinitum Capital" to match on. That directly produced the false positives quantified in Sections 5, 7 and 11.

Assessment

Control is partially established. One officer is confirmed from the authoritative registry. One controller is self-declared by the company and not independently verified. No ownership percentage, nature-of-control statement, or corporate chain was retrieved. The ultimate beneficial ownership of INFINITUM CAPITAL LIMITED is therefore NOT VERIFIED.

Identified Individuals

No other officers, secretaries, corporate PSCs, shareholders or intermediate holding entities were returned.

The 25% Threshold

Under the UK PSC regime (Companies Act 2006 Part 21A; PSC Register), a person is registrable where they, directly or indirectly:

1. 1.hold more than 25% of the shares; or
2. 2.hold more than 25% of the voting rights; or
3. 3.hold the right to appoint or remove a majority of the board; or
4. 4.otherwise exercise, or have the right to exercise, significant influence or control; or
5. 5.exercise such influence or control over a trust or firm that itself meets any of the above.

Which of these five limbs applies to Shruti Luthra was not retrieved. This matters practically: limb 4 can be satisfied with no shareholding at all, whereas limbs 1–2 imply a quantified stake. Without the nature-of-control statement, the file cannot state whether the declared PSC is a >25% owner, a controlling influence, or both — and cannot demonstrate that all registrable controllers have been captured.

What Is Missing and Why the Opacity Is Itself a Risk

• Nature-of-control statement — NOT RETRIEVED. See above.
• Ownership percentage — NOT RETRIEVED. Source-of-funds analysis and control-based sanctions analysis (OFAC 50% rule / UK ownership-and-control tests) cannot be performed without it. This directly limits Section 3.
• Date of birth, nationality, country of residence for either individual — NOT RETRIEVED. These are the fields required to disambiguate common names in sanctions and PEP screening. Their absence is a principal reason the PEP gap in Section 4 cannot be closed by inference and must be closed by a provider search.
• Corporate chain to ultimate natural persons — NOT ESTABLISHED. No corporate PSC or parent entity was returned. This is consistent with a flat structure with a single natural-person controller, but the evidence does not confirm that; the absence of a returned corporate PSC is not proof that none exists.
• Relationship between the director and the declared PSC — NOT ESTABLISHED. The report makes no inference about any connection between BHATNAGAR, Dhruv and Shruti Luthra. None is supported.

Risk Implication

Under MLR 2017 reg. 28(4), a firm must take reasonable measures to verify beneficial ownership so that it is satisfied it knows who the beneficial owner is; reliance on the PSC register alone is expressly insufficient. FATF Recommendation 24 and EU 5AMLD Article 30 set the same direction of travel. A DECLARED PSC with no percentage and no identifying attributes does not discharge that obligation.

This gap also constrains other sections: the sanctions no-match in Section 3 was returned at entity level and cannot be relied upon as a controller-level clearance; the PEP position in Section 4 is unscreened; and the source-of-wealth analysis in Section 8 has no ownership anchor. The Transparency Risk sub-score of 8/100 in the model appears not to penalise these gaps and, in the analyst view, understates them (Section 11).

Assessment

Sanctions screening ran and returned a genuine no-match. This is one of the few unambiguously clean signals in the file. Its scope, however, is narrower than a full sanctions clearance.

Screen status: RAN — OK_EMPTY (genuine nil return).

Screening Detail

Scope Limitations — Explicitly Recorded

1. 1.Individual-level screening is not evidenced. The ledger records a single SANCTIONS run. It does not confirm that BHATNAGAR, Dhruv and Shruti Luthra were screened as named individuals. Under the UK regime and the OFAC 50% rule, an unlisted company can be caught through its ownership and control. Because ownership percentages were not retrieved (Section 2), an ownership-and-control analysis was not possible.
2. 2.List coverage is not exhaustive. OFAC, OFSI and UN were screened. The EU consolidated list, other national lists (e.g. Canada, Australia, Switzerland), and law-enforcement / debarment watchlists (e.g. World Bank, INTERPOL) are not recorded as screened.
3. 3.The FCA Warning List was not screened. This is a distinct control from sanctions and is unaddressed (Section 6).
4. 4.Matching methodology is not disclosed. Whether fuzzy/phonetic matching or exact-string matching was applied is unknown. Given that the wider screening layer demonstrably matched on isolated tokens (Section 7), the opposite failure mode — an over-tight sanctions match rule — cannot be excluded from the evidence supplied.

Risk Implication

On the lists screened, at entity-name level, no sanctions nexus was identified. That result properly supports the low Sanctions sub-score of 3/100, which carries the largest applied weight in the model (34.1%) and is the principal reason the composite lands in the Medium-Low band rather than higher.

The residual control action is proportionate rather than urgent: re-run screening at individual level on the confirmed director and declared PSC once identifying attributes (DOB, nationality) are obtained, and document list coverage and match thresholds on file to satisfy MLR 2017 reg. 28 and the OFSI/FCA expectation of demonstrable, auditable screening.

Assessment

Screen status: NOT RUN.

No PEP screening was performed. The source ledger records: 'No PEP screening provider configured [PEP] → SKIPPED'. The coverage statement confirms: 'Risk domains NOT reflected in the composite score: PEP.'

No conclusion on PEP, RCA or HIO status may be drawn from this report — positive or negative.

Status of Each Required Element

Individuals That Would Require Screening

1. 1.BHATNAGAR, Dhruv — director [CONFIRMED, Companies House officers register]
2. 2.Shruti Luthra — Person with Significant Control [DECLARED, Companies House PSC register]

Neither has been screened. Neither is asserted or implied to be a PEP. The absence of a PEP finding in this report is an absence of screening, not an absence of exposure.

A further practical obstacle: no date of birth, nationality or country of residence was retrieved for either individual (Section 2). Both names are common in multiple jurisdictions. A provider search without those attributes will generate name-collision noise of exactly the kind already demonstrated in Sections 5 and 7 — so the identity attributes should be obtained from Companies House officer/PSC detail before the PEP search is run, not after.

Regulatory Position

• FATF Recommendation 12 requires firms to have risk-management systems to determine whether a customer or beneficial owner is a PEP, and to apply enhanced measures where they are.
• FCA SYSC 12.1 and MLR 2017 reg. 35 require identification of PEPs, their family members and known close associates, senior management approval of the relationship, source-of-wealth/source-of-funds establishment, and enhanced ongoing monitoring.
• MLR 2017 reg. 28 requires beneficial-owner identification; the same identifying data supports the PEP determination.

No role-keyword matching or inference has been substituted for a PEP search, and none should be.

Risk Implication

This is an unmitigated coverage gap in a mandatory control, and it is one of the two reasons overall confidence in this report is stated as LOW (the other being the score-attribution problem in Section 11). The composite score of 37/100 is silent on PEP exposure; it is arithmetically incapable of reflecting it, because the weights were renormalised across only the domains that ran.

Required next step: obtain officer and PSC identifying attributes from Companies House, then run PEP/RCA screening on both named individuals through a configured commercial provider. Until that is done, no final residual-risk rating should be recorded for this relationship.

Assessment

The Adverse Media domain returned 2 adverse items, both classified HIGH severity. On examination, neither is attributable to INFINITUM CAPITAL LIMITED (10206158). One concerns a differently-constituted legal person in another jurisdiction; the other pre-dates the subject's incorporation by nearly 17 years and concerns a differently-named entity. The residual entity-specific adverse-media signal is nil.

This conclusion aligns with the pre-synthesis brief and is independently supported by the evidence set.

Search Parameters

No titles, dates, publishers or content were supplied for the 8 neutral items. They therefore cannot be assessed, and no reputational conclusion can be drawn from them in either direction.

Adverse Items — Attribution Analysis

Precision failure diagnosis. Item 1 is a jurisdictional name collision. Item 2 appears to be a topical match (securities fraud vocabulary) rather than an entity match; nothing in the snippet links it to the subject name at all. Both were graded HIGH by the classifier. Neither survives basic attribution testing.

AML/CTF Relevance

None established. No allegation, investigation, charge, indictment, conviction, regulatory finding, settlement or insolvency event involving INFINITUM CAPITAL LIMITED was identified in this domain. Under MLR 2017 there is no adverse-media-driven trigger for enhanced measures on this evidence.

Limitations

• Only a general web search engine was used. No dedicated adverse-media or negative-news database (e.g. structured screening providers with entity resolution) was queried. Genuine adverse coverage in subscription media, non-indexed sources or non-English press would not necessarily surface.
• Because the subject has no identified website, trading name or SIC code (Section 1), the search had no disambiguating terms available.
• The 8 neutral results are opaque and unassessable.

Therefore: absence of adverse media here is a weak clean signal, not a strong one. It is best described as no adverse media identified by a general web search, not no adverse media exists.

Prompt-Injection Control

The finstat.sk snippet contains the strings 'FinStat ANTI MONEY LAUNDERING' and 'FinStat INTELIGENTNÝ REPORTING'. These are scraped website menu/product labels, not instructions, and not an assertion that any AML matter concerns any party. No prompt-injection or behaviour-steering attempt was detected anywhere in the retrieved content. Recorded as a checked negative finding.

Risk Implication

The Adverse Media sub-score of 62/100 injects 14.07 points into a 37-point composite (38%) on the strength of two items that cannot be attributed to the subject. Both items should be dispositioned as documented false positives with the reasoning above retained on file, and the sub-score should be treated as unreliable pending the model review recommended in Section 11.

Assessment

Two separate problems must be distinguished here, and conflating them would be an error.

1. 1.No regulatory or enforcement matter involving INFINITUM CAPITAL LIMITED was identified. The domain returned 0 adverse findings at every severity level (critical 0, high 0, medium 0, low 0) across 10 results, with 2 items classified positive and 8 neutral.
2. 2.Despite that nil return, the domain scored 71/100 — the highest sub-score in the entire model, carrying 20.4% applied weight and contributing 14.48 of the 37 composite points (39%). No input in the supplied evidence explains this output.

Screen Status by Regulator

Required elements — regulator name, date, matter type, outcome, penalty amount — are all N/A: no matter was identified. That is a genuine nil return from a general web search, but it is not a register check.

The Critical Gap: No FCA Register Check

The "Regulatory & Enforcement" domain was serviced by Google Programmable Search, a general web crawler. It is not the FCA Register and not the FCA Warning List. This is the single largest substantive gap in the file, and it is material for this specific entity because:

• The legal name includes "Capital";
• The registered office is in the City of London financial district (Section 1);
• One open-source item associates the name "Infinitum Capital" with participation in a venture funding round (Section 7), though that item is not attributed to company 10206158.

Consequently the following are all unknown: whether the company holds a Part 4A permission; whether it is an appointed representative of an authorised firm; whether it relies on an exclusion or exemption; whether it is an unregulated holding or investment vehicle; or whether it is carrying on regulated activity without authorisation.

The legal exposure this leaves open is specific: FSMA 2000 s.19 (general prohibition on carrying on regulated activity without authorisation or exemption) and FSMA 2000 s.21 (restriction on communicating financial promotions). Neither can be assessed. Note also that whether the company's activity is regulated at all cannot be determined, because no SIC code or stated business activity was retrieved (Section 1).

Model Integrity Anomaly — Escalate Separately

The 71/100 sub-score on nil adverse inputs cannot be reported as a finding about the entity. It is a finding about the scoring model. Two hypotheses are consistent with the evidence:

• the domain score defaults high on sparse or unattributed data; or
• an undisclosed penalty (for example, for absence of an authoritative regulatory source) is being applied within the domain score rather than as a disclosed coverage adjustment.

The evidence supplied does not permit a determination between them. Either way, 14.48 composite points have no traceable evidentiary basis, and under FCA SYSC 6.3 expectations for adequate systems and controls this requires model-validation review before the score is used in a customer decision. This is carried into Sections 11 and 12.

Risk Implication

The correct statement of position, as at 18 August 2026, is: no regulatory or enforcement action against INFINITUM CAPITAL LIMITED was identified by a general web search; the FCA Register and FCA Warning List were not searched, and the company's authorisation status is unknown. That gap must be closed before onboarding, and the resolution is inexpensive: a direct FCA Register and Warning List search on the legal name and company number 10206158.

Assessment

The Litigation domain returned 3 adverse items, all MEDIUM severity. On examination, none constitutes litigation involving INFINITUM CAPITAL LIMITED. Two are token-level string matches across a sentence boundary in Facebook posts; the third is a funding-round announcement in which the word "lawsuit" appears only in an unrelated sidebar headline about different companies.

Critically: no court records were searched directly. Litigation exposure is therefore unassessed, not cleared.

Search Parameters

Item-by-Item Analysis

Pattern Analysis — Required Checks

Risk Implication

Two distinct compliance conclusions:

1. 1.The Litigation sub-score of 41/100 is not evidence-based. It rests on three items, two of which are text-parsing artefacts and one of which is not adverse and not attributed. All three should be dispositioned as documented false positives.
2. 2.Litigation exposure remains an open gap. Only a general web search ran. UK court records (including the Business and Property Courts, County Court judgment register and the London Gazette) were not searched. The correct statement is no litigation involving the subject was identified in web sources, not the subject has no litigation history.

The same token-matching failure mode identified here is present in the Adverse Media domain (Section 5); together they account for the score distortion quantified in Section 11.

Assessment

Screen status: NOT RUN — no dedicated ESG data source was consulted.

The source ledger contains no ESG, sustainability, human-rights, labour, environmental or data-protection data provider. The only inputs available were four Google Programmable Search domains (regulatory, financial, litigation, adverse media) and the Companies House registry. No ESG conclusion — positive or negative — can be drawn.

Required Elements — Status

Framework Position

• UK Modern Slavery Act 2015 s.54 applies to commercial organisations with turnover of £36m or more. The subject's turnover is unknown (Section 8), so whether the reporting obligation is engaged cannot be determined. No statement was searched for.
• CSRD / TCFD reporting obligations scale with size and listing status. On the evidence — a private limited company with no retrieved accounts — there is no basis to conclude either that these apply or that they do not.
• UN Global Compact signatory status was not searched.

Governance Observations (Registry-Derived Only)

The following are structural observations, not adverse findings, and none is evidence of misconduct:

• Concentrated control. One confirmed director; one declared PSC. Small private companies commonly have concentrated control; it does reduce the internal-challenge and segregation-of-duties expectation and is relevant to who must be verified and monitored.
• No independent operating premises evidenced. Care-of registered office (Section 1).
• Control transparency is incomplete. The declared PSC is unverified with no ownership percentage (Section 2). This is the one governance-adjacent matter that materially affects AML risk, and it is captured in Section 2 rather than here.

Risk Implication

ESG risk is UNDETERMINED, not low. ESG is not a weighted factor in this scoring model (Section 11) and contributes nothing to the composite of 37/100; it reaches the score only indirectly, if at all, through Transparency Risk (8/100). Firms with ESG-linked risk appetite or reputational-risk policies should note that this dimension is entirely unscreened and should commission a dedicated search where policy requires one. For AML/CTF purposes specifically, the absence of ESG screening is not a regulatory breach under MLR 2017.

Assessment

The financial profile of INFINITUM CAPITAL LIMITED is unestablished. The FINANCIAL domain returned 10 general web results (0 adverse, 3 positive, 7 neutral) and no filed financial statements. For a company incorporated 31 May 2016 and still active more than nine years later, the file contains no revenue figure, no balance-sheet data, no turnover, no asset position, no profitability indicator and no dormancy status.

This is a due-diligence deficiency, and it should be recorded as such rather than presented as a low-risk financial profile.

Required Elements — Status

The 3 items classified "positive" in this domain were supplied as counts only — no titles, publishers, dates or content. They cannot be assessed and provide no probative value on the entity's financial substance. No inference of financial health may be drawn from that classification.

The One Open-Source Financial Reference — and Why It Does Not Help

The Ayar Labs Series C article (Section 7) names an "Infinitum Capital" among participants in a $130M Series C round (snippet dated Apr 27, 2022). This is the only open-source indication in the entire evidence set that any "Infinitum Capital" deploys investment capital. It is UNVERIFIED as to entity identity — the evidence does not establish that the named participant is company 10206158 rather than a similarly-named firm in another jurisdiction. No figure, stake or commitment attributable to the subject may be recorded from it. The report deliberately does not carry any dollar amount forward as a fact about the subject.

Note the analytical tension this creates: the entity's name and possible investment-activity association bear directly on the unresolved FCA authorisation question in Section 6. If the subject does deploy third-party capital, regulated-activity analysis becomes materially more important, not less.

Red-Flag Screen

Risk Implication

Under MLR 2017 reg. 28(2)–(4) a firm must understand the purpose and intended nature of the business relationship and, for higher-risk relationships, the source of funds and wealth. None of that is possible on the current file. The Financial domain in this report has zero probative value on the entity's actual financial substance and must not be represented otherwise — a point on which the pre-synthesis brief is correct and which is adopted here.

Required action: obtain the full Companies House filing history and all filed accounts (or confirm dormant filings), obtain the SIC code, and obtain from the customer a documented explanation of business activity, source of funds and expected transaction profile. Until then no source-of-wealth conclusion may be recorded.

Assessment

The country of incorporation is the United Kingdom — verified from Companies House and consistent with the user-provided jurisdiction. The UK is a FATF member and is not a listed high-risk jurisdiction. However, operating jurisdictions are entirely unestablished, and no external reference dataset (FATF listings, EU high-risk third countries, Transparency International CPI) was actually retrieved as part of this assessment.

Verified Geographic Facts

Reference Datasets — Disclosure of What Was Not Consulted

The Jurisdiction Risk sub-score of 35/100 therefore appears to be an internal model parameter. The evidence set contains no jurisdiction reference data from which it can be reproduced or audited.

The Slovak Name Collision Does Not Create a Slovak Nexus

The finstat.sk item (Section 5) concerns INFINITUM CAPITAL s. r. o., a Slovak-registered legal person with a Slovak registry identifier. It is a distinct legal entity. It does not evidence any Slovak operation, subsidiary, affiliate or connection of company 10206158, and no Slovak geographic exposure is recorded for the subject on that basis. Any future model iteration should not treat that item as a jurisdictional signal.

Similarly, the Facebook items (Section 7) reference New York and San Juan; both are token-level false positives and create no US or Caribbean nexus for the subject.

Risk Implication

Geographic risk on incorporation is low. The unresolved element is operational geography: with no SIC code, no website, no accounts and a care-of registered office, the file cannot state where the company actually does business, who its counterparties are, or whether it has exposure to higher-risk jurisdictions. That question must be answered by the customer directly during onboarding and cross-checked against expected transaction geography, per MLR 2017 reg. 28(2)(b) and reg. 33(1)(b) (which triggers EDD where a business relationship involves a high-risk third country). On present evidence there is no basis to assert such exposure, and no basis to exclude it.

Assessment

Composite: 37/100 — Medium-Low. Coverage: PARTIAL. Confidence in the score: LOW.

The score is reproduced below exactly as supplied. It is then subjected to attribution testing, because two of its largest components do not survive that testing.

Scoring Table (Model as Supplied)

Applied weights are the renormalised figures supplied in the RISK SCORE block, redistributed across the six domains that ran. As supplied they total 99.9% (rounding).

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

• Sanctions & Watchlists: 3 × 0.341 = 1.023
• Adverse Media: 62 × 0.227 = 14.074
• Regulatory & Enforcement: 71 × 0.204 = 14.484
• Politically Exposed Persons: not run — 0 contribution, no weight
• Litigation: 41 × 0.114 = 4.674
• Jurisdiction Risk: 35 × 0.068 = 2.380
• Transparency Risk: 8 × 0.045 = 0.360

Total = 1.023 + 14.074 + 14.484 + 4.674 + 2.380 + 0.360 = 36.995 ≈ 37/100

The arithmetic reproduces exactly. The inputs, not the arithmetic, are the problem.

Attribution Test — What the Score Is Actually Measuring

The pre-synthesis brief calculated the Adverse Media + Regulatory share at 28.56 points (77%). That figure is verified as arithmetically correct (14.074 + 14.484 = 28.558; 28.558 / 36.995 = 77.2%). Including Litigation, the open-source-driven share rises to 89.8%.

Stripping the demonstrable false positives, the residual entity-specific adverse signal in this file is zero. The brief's conclusion on this point is supported by the evidence and is adopted.

Two Distinct Model Defects

1. 1.Search-layer precision failure. The adverse-media and litigation classifiers are matching on the isolated tokens "infinitum" and "capital", including across a full stop in the phrase "Ad infinitum. Capital improvement surcharges". Two of three litigation hits involve no company at all. This is not a finding about the entity; it is a defect in the retrieval and classification layer, and it materially inflates the composite.
2. 2.Unexplained domain output. Regulatory & Enforcement scoring 71/100 on nil adverse inputs has no traceable basis (Section 6). This must be referred to model validation and must not be carried into any customer file as a finding about the entity.

What the Score Omits

• PEP: not screened. Excluded from the composite entirely. The score is arithmetically incapable of reflecting PEP exposure (Section 4).
• FCA authorisation status: not checked. Not represented in any factor (Section 6).
• Financial substance: no accounts. Financial Profile is not a weighted factor and the domain returned no accounts (Section 8).
• Beneficial ownership verification: incomplete. Reaches the score only through Transparency Risk at 4.5% weight and a score of 8/100 — in the analyst view an understatement (Section 2).
• ESG: not screened (Section 10).

Analyst Conclusion on the Band

The directional conclusion is defensible but for the wrong reasons. A Medium-Low band happens to be a reasonable landing point for this entity — but the score arrives there by inflating unattributed noise and simultaneously under-weighting the real gaps. Two errors partially cancelling is not a control.

The honest position: entity-attributable adverse risk is nil on the evidence; residual risk is driven entirely by coverage gaps (PEP not screened, FCA status unknown, no accounts, PSC unverified). That is why the rating is MEDIUM with LOW confidence rather than LOW, and why the score should not be relied on as a final residual-risk determination until the model anomaly is reviewed and the named screens are completed.

Recommendation

Standard CDD scope — CONDITIONAL, subject to mandatory manual compliance review and completion of four outstanding screens before any onboarding decision is finalised.

The model output ("Standard CDD; EDD required: NO; Monitoring: ANNUAL") is accepted in substance but not as a final position, for two reasons: coverage is PARTIAL with a mandatory screen (PEP) missing, and the composite score is materially affected by unattributed inputs and one unexplained sub-score (Section 11).

Full EDD under MLR 2017 reg. 33 is NOT triggered by the evidence. There is no sanctions match, no verified adverse finding, no identified PEP, no high-risk-third-country nexus and no evidence of complex or unusually large transactions. Recommending EDD on this evidence would be a mis-calibration. Recommending closure of the file as clean would be worse.

Rejection is NOT recommended. No evidence supports it. Information gaps of the kind present here are ordinarily remediable through targeted information requests.

Rationale

Required Actions

Blocking — complete before onboarding decision:

1. 1.FCA Financial Services Register and FCA Warning List search on "INFINITUM CAPITAL LIMITED" and company number 10206158. Determine whether the company holds a Part 4A permission, is an appointed representative, is exempt/excluded, or is unauthorised. Document the result and the FSMA 2000 s.19 / s.21 analysis (Section 6).
2. 2.PEP/RCA screening through a configured provider on BHATNAGAR, Dhruv (confirmed director) and Shruti Luthra (declared PSC). First obtain date of birth, nationality and country of residence from the Companies House officer and PSC detail records, so that the search can be disambiguated (Sections 2 and 4).
3. 3.Verify the declared PSC independently. Obtain the PSC nature-of-control statement and ownership percentage, plus certified identity and address evidence. Confirm whether any further registrable person exceeds the >25% shares/voting-rights threshold or exercises significant influence or control. Reliance on the PSC register alone does not satisfy MLR 2017 reg. 28(4) (Section 2).
4. 4.Obtain the full Companies House filing history and all filed accounts (or confirm dormant-account filings), plus the SIC code. Establish whether the company has ever traded, its declared activity and its financial substance (Section 8).

Required — complete before final risk rating is recorded:

1. 1.Obtain a documented statement of business activity, source of funds, source of wealth, expected transaction profile and operating jurisdictions from the customer, and reconcile it against the registry record and the SIC code.
2. 2.Establish actual operating premises. The registered office is a care-of address and conveys nothing about where business is conducted (Section 1).
3. 3.Disposition all five false-positive items on file with the attribution reasoning in Sections 5 and 7, so the same hits do not re-escalate at each periodic review.
4. 4.Direct litigation and insolvency checks — UK court records, County Court judgment register, London Gazette and Insolvency Service — none of which were searched (Section 7).
5. 5.Confirm sanctions screening scope: whether the named individuals were screened separately, which lists and match thresholds were applied, and extend to the EU consolidated list (Section 3).

Escalation — separate track, not customer-facing:

1. 1.Refer to model validation / second-line risk: (a) the Regulatory & Enforcement sub-score of 71/100 returned on zero adverse inputs; (b) the token-level matching defect that produced adverse hits on the sentence fragment "Ad infinitum. Capital improvement surcharges"; (c) the absence of any FCA source from the "Regulatory" domain despite its name. Under FCA SYSC 6.3 these are systems-and-controls issues affecting every screening subject, not just this one.
2. 2.Configure a PEP screening provider. The current inability to screen PEPs is a firm-level control deficiency against FATF Recommendation 12 and FCA SYSC 12.1, not an entity-specific issue.

Trigger Events for Immediate Review

• Any FCA Register or Warning List result indicating regulated activity, appointed-representative status, or an FCA warning;
• Any PEP or RCA match on the director or PSC;
• Any change of registered office, director, or PSC filed at Companies House;
• Filing of a first set of non-dormant accounts, or a material change in reported turnover or assets;
• Any strike-off, insolvency, winding-up petition or CCJ notice;
• Any transaction inconsistent with the declared business activity or expected geography;
• Any genuine, attributable adverse media naming company 10206158;
• Introduction of a corporate PSC, offshore parent or nominee arrangement into the structure.

Monitoring Frequency and Next Review

• Interim: the relationship should not proceed to steady-state monitoring until Required Actions 1–4 are closed.
• Once closed and if no adverse finding emerges: ANNUAL review, consistent with the model recommendation and a Medium-Low residual band.
• If the FCA check shows the entity carries on regulated activity, or if a PEP match arises: re-rate immediately and reassess against MLR 2017 reg. 33 / reg. 35 for EDD and senior-management approval.
• Next review date: the evidence set contains no scheduled review date. It must be set by the relationship owner on completion of the blocking actions; this report does not assign one, because doing so without knowing the onboarding date would be unsupported.

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Source Ledger (Complete — as executed)

Date of assessment: 18 August 2026. Coverage status: PARTIAL.

Methodology

1. 1.Registry anchoring. Legal identity was established first from Companies House as the authoritative registry, and every open-source hit was then tested against that anchor rather than accumulated alongside it.
2. 2.Attribution testing of every adverse item. Each of the five adverse items was assessed on jurisdiction, legal form, date relative to incorporation (2016-05-31), and whether the matched string constituted an entity name at all. Items failing attribution were classified as false positives and excluded from the entity-risk conclusion, with the reasoning documented so it is auditable and re-usable at periodic review.
3. 3.Verification-tier discipline. Registry-confirmed (CONFIRMED), company-declared (DECLARED) and web/AI-derived (UNVERIFIED) data were kept strictly separate. The declared PSC is nowhere described as verified. No UNVERIFIED_LEAD entries were present in the evidence, and none were introduced.
4. 4.Distinction discipline. Allegation, investigation, enforcement action, and court determination were kept distinct throughout. The 1999 NASAA item is reported as a regulator-association paper stating that the SEC initiated an enforcement action concerning "AIF" — reported as a claim by that publication, with no outcome stated, and not attributed to the subject.
5. 5.Score reproduction and audit. The composite was recalculated from the supplied sub-scores and applied weights. The arithmetic reconciles to 36.995 ≈ 37. The inputs were then audited for attribution, which is where the failure lies.
6. 6.Evaluation of the pre-synthesis brief. The brief was treated as an analytical input requiring verification, not as fact. Its core conclusions — name-collision noise, the 77% distortion figure, the Regulatory-domain anomaly, and the negative prompt-injection finding — were verified against the evidence and adopted. One characterisation was rejected as unsupported: the brief describes Goldwyns London LLP as "an accountancy firm". The evidence establishes only the address string; the nature of that firm's business is not in evidence and is not asserted here. The brief's text was also truncated mid-sentence, so its later reasoning could not be evaluated.
7. 7.Untrusted-content handling. All third-party retrieved content was treated strictly as data. No prompt-injection or behaviour-steering attempt was detected. The string "FinStat ANTI MONEY LAUNDERING · FinStat INTELIGENTNÝ REPORTING" in the finstat.sk snippet was assessed and determined to be a scraped website menu/product label, not a directive and not an assertion about any party. Recorded as a checked negative control finding.

Limitations

Material — affecting the conclusion:

1. 1.PEP screening not performed (no provider configured). A mandatory control under FATF R.12 and FCA SYSC 12.1 is absent and is excluded from the composite score.
2. 2.No FCA Register or Warning List check. The domain labelled "Regulatory" was a general web crawler. Authorisation status is unknown, leaving FSMA 2000 s.19/s.21 unassessed.
3. 3.No financial statements, SIC code or filing history. Business activity, financial substance, dormancy status and source of funds are all unestablished.
4. 4.Beneficial ownership not verified. A single DECLARED PSC with no ownership percentage and no nature-of-control statement; no independent verification, contrary to the standard in MLR 2017 reg. 28(4).
5. 5.Regulatory sub-score of 71/100 is unexplained by any supplied input, yet contributes 39% of the composite. Model validation is required before reliance.
6. 6.Search-layer precision failure. Adverse hits were generated by token matches across a sentence boundary. Five of five adverse items fail attribution to the subject.

Secondary:

1. 1.Court records, insolvency registers and the London Gazette were not searched — litigation exposure is unassessed, not excluded.
2. 2.No FATF list version, EU high-risk list or Transparency International CPI score was retrieved; none is cited or estimated in this report.
3. 3.No dedicated ESG data source was consulted.
4. 4.Only a general web search engine was used for adverse media; non-indexed, subscription and non-English sources may not be represented.
5. 5.The 8 neutral adverse-media items, 8 neutral regulatory items, 7 neutral and 3 positive financial items, and 6 neutral litigation items were supplied as counts only, without titles, dates, publishers or content. They are unassessable and support no conclusion in either direction.
6. 6.Jurisdiction confidence for GB was user-provided, though it is corroborated by the Companies House record.

Confidence

Overall confidence: LOW.

Three reasons, in order of weight:

1. 1.Coverage is PARTIAL and the missing screen is mandatory. PEP was not run and is arithmetically absent from the composite.
2. 2.89.8% of the composite score derives from open-source keyword results, none of which is attributed to company 10206158, and one 20.4%-weighted sub-score has no visible supporting input at all. A score whose inputs cannot be traced to the subject cannot support a high-confidence conclusion.
3. 3.The registry-verified layer, while reliable, is thin. Identity and status are firmly established; ownership verification, business activity, financial substance and authorisation status are not.

Confidence in the narrow findings is materially higher than confidence in the score: confidence is HIGH that no sanctions match exists on the lists screened, and HIGH that all five adverse items fail attribution to the subject. Confidence is LOW that 37/100 represents this entity's actual risk — and the direction of that error is not one-sided, because the same file simultaneously inflates unattributed noise and under-weights genuine coverage gaps.