Noble Sight
What OFAC said failed, and the request that proves the control.
OFAC publishes an enforcement release with every civil penalty. Some of them describe a screening tool that failed. For each of those, Noble quotes the failure verbatim, states the control it applies, and gives a request you can run against production with your own key to see the response field that proves it. No adjectives, no paraphrased verdicts.
-
Four screening failures. Four requests you can run.
A watchlist not updated for five weeks; exact name-and-DOB matches classified low priority; an "alert suppression rule" that released payments; a single narrow lookback.
list_versions · matches[0].score · alert_id · screened_as_of -
The name changed. The phone number didn't.
A designated supplier renamed itself. The name screen returned nothing. The phone number on the shipping documents and the email Pegasus was writing to were on the SDN entry the whole time.
summary.verdict · matches[].matched_via · alert_id -
The system flagged it. A person closed it.
An alert on a blocked person was dispositioned as a false positive by one analyst; another sat unreviewed for more than a month. The four-eyes refusal, the registered-actor refusal, and the deadline on every alert.
alert_id · four_eyes_required · due_at · four_eyes_violation · invalid_actor -
The country field said Russia. The address said Simferopol.
Three virtual-asset firms, one gap: a non-embargoed country in the drop-down, a Crimean city or "Crimea" in another field, and a tool that read only the country. The requests that read the address, the city, the word that must stay silent, and a listed wallet address.
jurisdiction_risk · jurisdiction_nexus.source · matches[].matched_via -
OFAC listed the filter's defects. Here they are, one request each.
Weak algorithms that let close matches through; no screening for BICs even when the SDN entry carried one; flagged payments auto-released during a backlog; addresses in Crimea nobody read. Four clauses in OFAC's order, one request each.
summary.verdict · matches[].matched_via · due_at · jurisdiction_nexus.source -
Which of these releases does your integration resemble?
Most of the controls above only fire when the integration sends the field they need. One request reads your own screenings and alert activity and gives each control a status, with the release it answers and what to send. Three screenings on the page move the numbers so you can watch it measure.
controls[].status · inputs.date_of_birth.share · alerts.closed_by_named_analyst
And kept true. The contract behind every page is published as a machine-checkable manifest at /enforcement/probes.json: each page's requests, byte for byte, with the assertions the page makes about their responses. Royal Bank, Noble's customer zero, runs that manifest against production every night from its own account and files an issue on Noble's public tracker if any page's claim stops being true. A test in Noble's own build fails if a page and the manifest drift apart.