Compliance infrastructure for cross-border commodity trade

Know before you structure the deal. Know before you wire a dollar.

The screening engine flagged a fake Chevron CEO in about 30 minutes, behind a pitched $50M cargo lift. We published the record and built the products around it: a sub-30-second pre-deal verdict for originators, first-party fraud-cluster intelligence, eight-list sanctions plus PEP screening, and 235-jurisdiction trade rules. Paste a deal and check it free.

What is the clearance gap? →

Real tradeEN59010ppm sulphur diesel

BlockedVirgin D2, ICPO + 2% PB, MT700 non-operative, ASWP, Hub Number

Compliance team? Run a free counterparty check →·

No signup to try. Run a free verdict, get it emailed, then go deeper when it's worth it: a $25 dossier on one counterparty, Solo from $99/mo, or an enterprise rollout for the desk.

Self-serve from $99/mo·KYC pay-as-you-go from $25/screen

Replay of a real investigationfirst surfaced 2026-05-28Read the evidence chain →

Where do you start

Two ways in. Both free to try, no signup.

Front office & originators

Know before you structure the deal.

Paste a proposed deal and get a clearance probability plus a restructure path in under 30 seconds, before you spend three weeks on something compliance will kill. The verdict comes to you, the originator, not as an alert to a gatekeeper weeks later. Try it live, no signup.

Try the Pre-Deal demo Pre-Deal pricing →

Compliance & risk teams

Say yes with your name on it.

Paste a company, person, or vessel and get an instant first-party scam-cluster pre-screen, free. When you need the full picture, the Counterparty KYC API runs eight-list sanctions plus PEP, company registration, and licence checks across 235 jurisdictions, with an evidence trail you can defend.

427 investigated entities · 63 countries in the cluster corpus

Run a free check KYC pricing →

What we run on, what we block

Real refinery trade has procedures. The scam ecosystem has performances.

If you've spent any time in this market you've seen the second column. We don't translate it, we don't soften it, and we don't introduce parties who quote it.

A broker pitched a $50M crude lift claiming to be Chevron’s CEO. It took 30 minutes to prove it was fiction.

2026-05-25Cargo-scale pitches start routing through one LinkedIn origin
25,000 MT RON 95 CIF Mombasa pitched as Chevron procurement; a light naphtha LR1/LR2 allocation follows on the same buyer routing.
2026-05-28Chevron leadership check fails
The profile claims Group CEO since 2002. Chevron's actual Group CEO is Mike Wirth, since 2018 — chevron.com/about/leadership.
2026-05-28Claimed employer has no registration
SSW Kafcima and its claimed JV partner NW Corp Singapore: no ACRA records.
2026-05-28The counterparty network is fictional
"Arrakis Development" is the desert planet from Dune (1965). "Exxon Global Distributor" is not a registered ExxonMobil entity.
2026-05-28Cluster published — three deals collapsed in 96 hours
Five entities documented with the full evidence chain intact. The first record in the Scam Cluster Intelligence Feed.

Read the evidence chain →Full case study →

Why trust the verdict

We don’t ask you to take it on faith. The work is published, the corpus is real, and the receipts verify in your own browser.

First-party-investigated fraud clusters

Each one investigated in-house with the evidence chain intact — not scraped, not bought. The live registry behind the free /check tool.

Browse the registry →

Published

A fake Chevron CEO, disproved — with the receipts

A broker pitched a $50M cargo lift claiming Chevron’s top job. We published the full teardown: every check, every source.

Read the evidence chain →

SHA-256

Receipts you can verify yourself

Every signed decision carries a tamper-evident hash. Recompute it in your own browser — no OilFlow code in the verification path.

Open the zero-trust verifier →

Buy it today

On a card in minutes. The dossier needs no account at all.

Start with a single $25 dossier (no signup), or a $99/mo subscription. The Cluster Feed, Workflow Suite, and Bank Enterprise tiers are sales-led — see full pricing or talk to us.

No signup

Counterparty Dossier

$25

one-off · no account

Paste one counterparty name, pay $25, get the full 7-step screen — 8-list sanctions + PEP, registration, licence, references, digital footprint, broker-scam patterns — emailed within the hour. No login, no subscription.

Order a dossier →

For developers

Regulatory Matrix API

$99

/mo developer

JSON API across 235 jurisdictions of physical-commodity trade rules — product tradability, payment-term constraints, licence requirements, sanctions-aware routing. Sandbox + production keys.

Start the API →

Recurring watch

Counterparty Monitoring

$29

/mo · re-screen + alerts

Name up to 5 counterparties. We re-screen each monthly against sanctions, the fraud-cluster corpus, and adverse media, and email you only when something materially changes. No account hunting — pay and name them at checkout.

Start monitoring — $29/mo →

For front office

Pre-Deal Copilot · Solo

$99

/mo · 50 checks

Paste a proposed deal, get a sub-30s clearance probability and a restructure suggestion before you invest weeks structuring. Built for individual brokers and originators.

Start Pre-Deal →

Trade-Compliance Workflow Suite

The white-label desk banks run counterparty intake through — spin up the demo tenant with fixture data, no signup.

IntakeKYCNCNDASPAAudit log

Demo tenant · fixture data

Against the incumbents

Already evaluating World-Check, ComplyAdvantage, or Sumsub?

Incumbent comparison · published claims only

4 vendors · 4 dimensions

Dimension	OilFlow	World-Check	ComplyAdvantage	Sumsub
Data provenance	First-party investigated clusters + 8 public sanctions lists + PEP	Aggregated lists + PEP research database¹	Aggregated lists + adverse-media graph²	Consumer ID verification + aggregated sanctions data³
Pre-deal front-office surface	Shipped: /predeal verdict in under 30s	Not publicly offered¹	Not publicly offered²	Not publicly offered³
Regulatory trade-rule coverage	235 jurisdictions; 79 deep country-KYC profiles	Sanctions only; no per-product trade rules¹	Not offered²	Not offered³
Per-screen entry price	$25/screen PAYG⁴	Quoted privately¹	Custom quote; mid-five-figure minimum²	Published (consumer per-verification tiers)³

Full comparison →

Competitor cells reuse claims from our published /compare pages; sources checked 2026-06-10. “Not published” means the vendor's public pages state nothing for that dimension.

Founder

Why I built OilFlow

I'm not an oil trader. The people I built this for are everywhere physical oil trades: refinery operators in Lahore, Mumbai, and Bilbao; thirty-year veterans of the Houston and Geneva trading floors; brokers working Rotterdam, Singapore, Karachi, and Lagos. I spent months listening to them describe the same thing. Deals that fell apart, not because the price was wrong. Because the counterparty turned out to be a broker of a broker. Because the documents never matched. Because no one could confirm who was actually shipping what. The story was identical in every timezone.

OilFlow is what I built after hearing that story enough times. A verification stack across 235 jurisdictions: a 7-step background check running sanctions screening against eight lists plus PEP (OFAC SDN, OFAC Consolidated, UN, EU, UK HMT, Canadian SEMA, Australian DFAT, Swiss SECO), company registration, regulator licensing, and trade references. All of it exposed as APIs.

In May 2026, the screening engine caught a verifiable Chevron-CEO impersonation in 30 minutes. It would have cost a buyer $50M. That moment changed what I thought OilFlow was. The commercially valuable thing wasn't the marketplace I had started building. It was the compliance infrastructure that caught the fraud. So I productized it: five products for bank, insurer, and trading-house compliance teams, and for the front office that wants a deal cleared before structuring it. Regulatory Matrix API, Counterparty KYC-as-API, Scam Cluster Intelligence Feed, Trade-Compliance Workflow Suite, Pre-Deal Copilot. Live today, self-serve from $99/mo.

We don't hold funds. We don't issue letters of credit. We don't arbitrate disputes. We do the unglamorous parts: verification, regulatory screening, fraud-pattern detection, document orchestration. And we license them to the people who already pay for compliance.

Talk to me about early-access pricing if you run a trade-finance compliance desk, a trade credit underwriting book, or a trading-house compliance team. If what I described doesn't fit, reply and tell me where I'm wrong. I read every message.

Rafae Musharraf

Founder · Karachi, Pakistan

FAQ

What compliance buyers ask us first

Questions bank, insurer, and trading-house compliance teams open with. If yours isn't here, /apply will reach us.

Five B2B SaaS compliance products. SKU #1 is a Regulatory Matrix API covering 235 jurisdictions of physical-commodity trade rules. SKU #2 is Counterparty KYC-as-API — seven-step pipeline, eight sanctions lists plus PEP. SKU #3 is a Scam Cluster Intelligence Feed of first-party-investigated fraud clusters. SKU #4 is a white-label Trade-Compliance Workflow Suite for bank trade-finance desks. SKU #5 is the front-office Pre-Deal Compliance Copilot — a sub-30-second clearance verdict for RMs and deal originators, before they spend weeks structuring. We are not a marketplace.

Compliance teams at three customer classes: trade-finance banks (Mashreq, HBL, Emirates NBD, Standard Chartered EM, HSBC EM), compliance desks at trading houses (Vitol, Trafigura, Glencore, Mercuria, Gunvor) — not the trading desks — and trade-credit / cargo insurers (Atradius, Coface, Lloyd's syndicates) plus inspection majors (SGS, Intertek, Bureau Veritas) and Big-4 commodity advisory teams.

OFAC SDN, OFAC Consolidated, UN Consolidated, EU Consolidated, UK HM Treasury, Canadian SEMA, Australian DFAT, Swiss SECO, plus PEP. Nine sources for the standard /api/v1/kyc/screen call. Continuous re-screening fires on every list update; webhook subscribers are notified on hit.

Three differentiators. (1) Physical-commodity domain specificity — our 235-jurisdiction matrix knows that Kenya crude is government OTS only, that Pakistan SBP requires LC, that Bangladesh refined imports route through BPC. Generic KYC tools don't. (2) First-party-investigated scam clusters — Simar Chahal Chevron-CEO impersonation, Ahmad Pinnacle mandate-chain, Russia-Türkiye dark-fleet routing. Competitors scrape adverse media; we investigate. (3) Embedded trade-document workflow (NCNDA + SPA + DocuSign) tuned for bank trade-finance desks.

SOC 2 Type II audit in progress. ISO 27001 follows. Today our infrastructure provider (Supabase) holds SOC 2 Type II in EU + US regions. EU data residency available on request for enterprise pilots; APAC residency on the roadmap. We publish our subprocessor list at /security.

No. We are not a bank, broker-dealer, MSB, or LC issuer. SKU #4 (Workflow Suite) generates bank-ready LC packets and orchestrates routing; the bank that has the licence and the balance sheet does the issuing.

Drafts are marked DRAFT — FOR REVIEW BY INDEPENDENT LEGAL COUNSEL. The Workflow Suite produces template-driven drafts that compliance, legal, and the counterparty review and sign via DocuSign. What gets signed is what binds. Nothing the API returns is legal advice.

SKU #1 (Regulatory Matrix API) is self-serve via Stripe: $99/mo developer (10K calls) or $999/mo production (250K calls). SKU #2 (KYC-as-API) is $25–50 per screen pay-as-you-go or $25–100K/yr seat-based for enterprise. SKU #3 (Cluster Feed) is $10–25K/yr read-only or $50–100K/yr API + alerts. SKU #4 (Workflow Suite) is $200K–$1M/yr per bank customer. All but SKU #1 are sales-led.

Stored in Supabase (SOC 2 Type II infrastructure). Our AI provider operates under a zero-retention DPA — your data is never used to train models. GDPR + CCPA programs in place; 72-hour breach-notification commitment. All API calls log to an append-only audit trail you can export.

99.0% monthly uptime target on production-tier endpoints. Self-healing watchdog + operator alerting. Public status page at oilflow.us/status. Webhook delivery has 6-attempt exponential-backoff retry with dead-letter queue + replay API.