How it works
From "a name and a country" to a report that survives the audit.
NegativeNewsSearch is a service, not a research portal. You send a request and receive a structured result. Everything that happens in between is set out here in full.
The run
Seven steps per request.
Each step is individually traceable: the result carries which search lanes ran, which name variants were used, which RSF rank applied, and how many hits there were before and after deduplication.
- 01
Step 1 · POST /tasks
Accept the request
The required inputs are a name and a country (ISO country code). Optionally you can pass a more precise location or a pre-resolved search region, plus a webhook address for the completion notice. The request is acknowledged immediately and processed asynchronously — a screening takes minutes, and no caller should have to hold a connection open that long.
- 02
Step 2 · Aliases
Resolve name variants deterministically
The name is resolved against a curated alias set: trading names, common short forms, acronyms and transliterations in non-Latin scripts. The variants enter the search as an OR block — "Brega" becomes the full set of known spellings. The set is a maintained list, not model output: the same input reproducibly yields the same search.
- 03
Step 3 · Lanes
Build country-aware search lanes
The country code determines the appropriate search domain, interface language and search region — research into a Libyan company does not run usefully against the German index. The search covers a trailing window of six months by default, across both web and news search.
- 04
Step 4 · Press freedom
Open an international lane where the press is constrained
The country’s RSF rank decides whether local search alone is sufficient. Past a configurable threshold a second, international lane opens and puts the same question internationally and in English. The rank applied is recorded in the result — which makes the decision auditable rather than implicit.
- 05
Step 5 · Sources
Bring in the archive and the sanctions lists
Running alongside the live search: the GDELT archive query across the lookback window, and fuzzy matching against the EU consolidated list, the OFAC SDN list and the US Consolidated Screening List. Sanctions hits are their own clearly separated result category and are never blended into press mentions.
- 06
Step 6 · Analysis
Fetch, extract and assess each article
Hits are deduplicated and the most relevant fetched in full text; a browser fallback covers pages that do not answer a plain request. Each article is analysed on its own. The analysis may use only what the text contains — no additions, no speculation, no prior knowledge about the company. It is written in the language you requested, English or German, straight from the source article — an Arabic report becomes a German assessment in one step, not a translation of a translation.
- 07
Step 7 · Report
Produce and deliver the overall assessment
The individual analyses are consolidated into an overall assessment which, in turn, may draw on nothing else. Collect the result by polling, follow it on an event stream carrying the states queued, processing, completed and failed, or have it delivered by signed webhook.
Anatomy of a report
Why the structure is fixed.
Free-form prose is worthless in a file, because nobody can compare it across two cases. So every article analysis carries the same three sections — and the same four risk dimensions.
A summary without judgement
A plain restatement of what the article says. No framing, no interpretation, no enrichment from known context. If the assessment is later challenged, this is where a reader checks whether the article was read correctly in the first place.
An explicit relevance finding
The analysis has to state how the article connects to the subject: as the principal actor, as a participant, as a group company, as a passing mention — or not at all. This is the section that exposes name collisions before they turn into a false alert.
Four dimensions, scored 0 to 3
Money laundering and terrorist financing; sanctions and embargoes; fraud and corruption; tax. 0 means no indication, 1 a weak or indirect one, 2 a concrete suspicion such as an open investigation, 3 a proven or officially established breach. Each score carries its rationale drawn from the text.
Disclosed incompleteness
Where an article was visibly cut off by a paywall, it is still assessed — but the report states plainly that the basis was incomplete. A silently truncated source would be the most dangerous finding of all.
A traceable search run
The result carries the search query that actually ran, the name variants used, the search domains queried, the lanes that executed, the RSF rank, and the hit counts before and after deduplication. The search itself is documented, not only its outcome.
Sanctions hits reported separately
Per hit: source list, entity ID, matched name, match type, similarity score, sanctions programme, data vintage and source reference. Kept apart from the press assessment, because it is a different kind of finding with different legal consequences.
Subject
Musterhandel International S.A.
Country
LY — Libya · international lane active
Summary
Prosecutors have been investigating two former board members of the company since February on suspicion of commercial bribery. The proceedings concern payments connected to the award of an infrastructure contract, said to have been routed through an intermediary company. The company rejects the allegations.
Connection to the searched organisation/person
The searched organisation is the direct subject of the article. The named individuals are expressly described in the text as former board members of the company.
Risk assessment
- Money laundering / terrorist financing
The article describes payment flows through an intermediary company but raises no money-laundering allegation.
- Sanctions / embargoes
No indications in the article text.
- Fraud / corruption
Ongoing criminal investigation on suspicion of bribery. No legally binding finding stated in the article.
- Tax
No indications in the article text.
Source: beispiel-zeitung.example · business desk
Published: 14 March 2026
Found via:
This article may have been truncated by a paywall and could not be read in full.
Not counted in the overall score: this article was assessed, but judged not to be about the subject of this screening. The scores below describe the article itself.
Found but not assessed
14 assessed · 4 could not be read · 9 not reached
The card above is one of the fourteen assessed articles. These four were found by the same screening and judged relevant, but could not be read automatically — so they are handed over as links rather than dropped. Their absence from the scores is not a finding of "no risk": nothing is known about their content, and the overall score does not account for them.
Access blocked — paywall or access restriction
Investigative feature on the intermediary company
https://recherche-zeitung.example/dossier/zwischengesellschaft
Access blocked — paywall or access restriction
Interview with the former compliance officer
https://wirtschaftswoche.example/interview/compliance
No readable article text
Prosecutors’ press release (PDF)
https://staatsanwaltschaft.example/presse/2026-03-14.pdf
Not reachable
https://regionalblatt.example/2026/03/vergabe-infrastruktur
Country logic
Where you search determines what you find.
Most screening tools put every request to the same index. That is convenient and worthless for international cases: researching a Central Asian company against the German-language index is not research, it is a formality.
Country domain, language, region
The submitted country code is resolved against a bundled country catalogue — no external service that can fail. From it follow the correct search domain and the language and region parameters. An unknown or loosely spelled country is matched by similarity rather than causing the request to be rejected.
The RSF threshold
The Reporters Without Borders press freedom index is the basis. Where a country sits at or past the configured rank, the local press situation is treated as insufficiently reliable and an international lane starts alongside. The underlying data is refreshed periodically and also held locally, so a failure at the source never stops the service.
Two lanes, one deduplicated hit space
The lanes run independently and are merged afterwards. Anything appearing in both is analysed once. Which lanes ran is recorded in the result.
| Situation | Local lane | International lane |
|---|---|---|
| Country with a largely free press | country domain, local language | not required |
| Country at or past the RSF threshold | country domain, local language | international, English-language |
| Country not resolvable | international domain as fallback | not applicable |
Data sources
Four sources, one job.
Live web and news search
Current reporting across a trailing window of six months by default, on the appropriate country domain. The search query itself is generated for the case and carried in the result.
GDELT Global Knowledge Graph
Our own continuously maintained mirror of the GDELT v2 feed across 36 months, filtered to 13 relevant themes: corruption, money laundering, bribery and collusion, scandal, sanctions, terror, terrorist financing, organised crime, proceeds of crime, tax crime, tax evasion and fraud. That extends the view well beyond what a current search still surfaces.
EU, OFAC and CSL sanctions lists
The EU consolidated list, the OFAC SDN list and the US Consolidated Screening List — which adds the BIS Entity and Denied Persons lists, ITAR debarment and the non-SDN Treasury lists — fuzzy-matched so that spellings and transliterations do not slip through. The SDN rows the CSL duplicates are dropped on import, so one designation never reaches you as two findings. The data is refreshed by a dedicated job rather than at service start — a screening never waits for a list import.
A curated alias set
Name variants come from a maintained set of adverse-media entities. They are applied before the search, not afterwards for ranking — the decisive difference, because a hit that was never searched for cannot be weighted after the fact.
Integration
One call, one header.
All of the cryptography sits in a monthly, offline step. None of it appears in your production path — there, a string is written into a header.
A complete request
curl -X POST https://api.negative-news-search.com/tasks \
-H 'Content-Type: application/json' \
-H "X-NNS-Token: $(grep -v '^#' tokens.txt | head -1)" \
-d '{"reference_name":"Musterhandel International","reference_country":"LY"}'The responses your integration has to handle.
| Status | Meaning | Token |
|---|---|---|
| 202 Accepted | Request accepted, screening running | spent |
| 200 OK | Answered from cache | spent |
| 403 Forbidden | Token was already redeemed | spent — discard it |
| 401 Unauthorized | Token missing, malformed or expired | not usable |
Collecting the result
Either you poll the job, or you attach to the event stream that reports the transitions queued, processing, completed and failed. For an overnight batch, polling is entirely sufficient.
Webhooks instead of waiting
Optionally the service reports completion to an address of your choosing — signed, with retries and backoff. HTTPS is mandatory, internal network ranges are refused, and you can restrict the permitted target addresses outright.
Same request, one job
If the same research is already running, the second request attaches to the job in flight instead of doing the work twice. Completed results stay in cache for a configurable period.
Sanctions checks on their own
If all you need is the list match, there is a dedicated synchronous call without the queue — suitable, for instance, as a pre-check inside a data entry screen.
Operations
What happens when something breaks.
A screening service that quietly reports "nothing found" during an outage is more dangerous than no service at all. So failure behaviour is part of the product.
Retries with backoff
Technical failures — an unresponsive source, a timeout on a fetch — are retried several times with growing intervals before the job is considered failed.
Failed jobs are called failed jobs
Anything still unanswerable after the retries lands in a traceable failure store and is reported back as failed. It is never reinterpreted as an empty, unremarkable result.
Only answers cost anything
This is exactly where the token is released: a job we could not answer costs you nothing from your allowance. A clean negative — "nothing found, and here is the documented search that establishes it" — is an answer, and is charged.
A secondary source failing stops nothing
The country catalogue and press freedom data are held locally and refreshed in the background. If a source is temporarily unreachable, the service continues on the last known state instead of blocking startup.
Look at a real report.
The most informative case is one whose answer you already know. Give us a few names from your own history.