See llms.txt for all machine-readable content.

Back to Templates

Review and monitor KYB ownership chains with GLEIF, OpenAI, and Gmail

Created by

Created by: AI Flow Packs || aiflowpacks
AI Flow Packs

Last update

Last update 20 hours ago

Categories

Quick overview

This workflow accepts KYB ownership-review requests via webhook, pulls corporate ownership-chain data from the GLEIF API, generates a structured risk memo with OpenAI, and manages human approvals and notifications through Gmail, while logging outcomes in n8n Data Tables and re-checking accepted clients weekly for changes.

How it works

  1. Receives a header-authenticated webhook request containing an LEI (or legal name and country) and validates the input, including ISO 17442 check digits for LEIs.
  2. Looks up the entity in the GLEIF API, ensures the match is unambiguous, and checks n8n Data Tables to prevent duplicate open reviews or reuse a recent accepted decision.
  3. Walks the GLEIF direct-parent chain up to a configured maximum depth, captures reporting exceptions, and also fetches the ultimate-parent relationship to complete the chain context.
  4. Applies rule-based KYB flags (for example FATF-listed country links, lapsed/withheld registry data, circular ownership, or declaration discrepancies) and calculates a minimum risk-rating floor plus a suggested document list.
  5. Uses an OpenAI agent (with optional GLEIF lookups and prior-review retrieval) to produce a structured memo and then emails a review pack to the reviewer via Gmail with a decision form link.
  6. Routes the reviewer’s decision to accept, request documents, escalate, or ask up to two follow-up questions to the OpenAI agent, and requires a second approver via Gmail for accepting high-risk cases.
  7. Writes the final decision to the kyb_reviews table, optionally upserts a monitoring baseline in kyb_monitoring for accepted cases, and notifies the requester and (if escalated) the compliance officer by email.
  8. Runs every Monday on a schedule to re-check monitored clients in GLEIF and, when the ownership fingerprint changes, reopens a review by posting back into the same webhook.

Setup

  1. Run the manual setup trigger once to create the kyb_reviews and kyb_monitoring n8n Data Tables (or confirm they already exist).
  2. Create credentials for Gmail, an OpenAI API key (Chat model), and an HTTP Header Auth credential for the intake webhook and for the “reopen review” HTTP request.
  3. Replace the placeholder reviewer, senior approver, compliance officer, and ops alert email addresses in the workflow settings nodes.
  4. Copy the production webhook URL for the intake endpoint into the monitoring configuration so the weekly checker can reopen reviews through the webhook.
  5. (Recommended) Set this workflow as its own error workflow so failures trigger the Gmail ops alert message.

Requirements

  • A recent n8n version with Data Tables, cloud or self-hosted (tested on n8n 2.44.4)
  • An OpenAI API key (gpt-4.1-mini by default, about 2 model calls per review)
  • A Gmail account for the review pack, the senior approval and the notifications; no key needed for GLEIF (free public API)

Customization

  • Edit severities, suggested documents, legal-form patterns and the rating thresholds in "Assess ownership risk flags", and REUSE_DAYS / OPEN_REVIEW_DAYS in "Check open reviews and reuse window".
  • Update fatf_black_list, fatf_grey_list and fatf_list_date after each FATF plenary, and add your own list in extra_high_risk_countries (for example the EU list of high-risk third countries).
  • Change MAX_FOLLOW_UPS and the senior approval rule in "Apply review policy", and the waiting times in the Wait and Gmail approval nodes.
  • Change the weekly schedule, or send the alerts to Slack or Microsoft Teams instead of Gmail.
  • Replace the OpenAI model with Anthropic, Gemini, Mistral or a local model through Ollama.

Additional info

Limitations: GLEIF Level 2 data shows accounting-consolidation parents, not beneficial owners; the workflow never names a natural person as beneficial owner and asks for a UBO declaration instead. Only entities with an LEI are covered (others get HTTP 422 and need a manual check). Parent data is self-reported and can be lapsed or uncorroborated; it is flagged but not corrected. No sanctions, PEP or adverse media screening is included. The FATF lists in the settings are dated 19 June 2026 and must be kept up to date. Client names, GLEIF data and declared owners are sent to your AI provider. This is decision support for trained compliance staff, not legal advice; a person always makes the decision.