Everything DAF Connect does, and exactly how far along each part is.
Verification, screening and fraud-intelligence capabilities, each marked with what it actually does today: live and running, ready and waiting on a credential or a switch, or still to come. Nothing here is marked live unless it runs.
Running now, on real submissions, with nothing left to set up. Some run by themselves and some a reviewer starts from the console — each card says which.
Built and on the platform, but not running for you yet: waiting on a credential, a per-customer switch, a dataset, or exposure to your reviewers where only our own administrators can run it today. Each card says which.
Not running yet. Either not built, or built and not yet connected to anything that calls it.
What runs on every submission, now.
A submission is format-checked, looked up against the IRS registry, screened against the Treasury sanctions lists and the federal exclusion list, scored, and written to an evidence record a reviewer and an auditor can both read. That is the floor. It runs by itself on an application filed through the nonprofit portal, and on an enterprise embed it runs on the submitted-status automation or when a reviewer starts it from the console.
IRS 501(c)(3) status gate
Every EIN is format-validated and looked up against the IRS Business Master File through ProPublica’s mirror before any paid check runs. A revoked, suspended or confirmed non-501(c)(3) status is a disqualification and rejects the application automatically, with the reason written to the record. A name mismatch or an EIN the file does not carry routes to a reviewer instead.
OFAC sanctions screening
The organization, every officer and every board member are screened against the Treasury lists with fuzzy matching. A confirmed high-confidence match rejects the application automatically; a weaker fuzzy match routes to a reviewer. If a source fails to load the result is recorded as inconclusive — partial coverage is never treated as a pass.
Federal exclusion screening
Officer and organization names are matched against the HHS OIG exclusion list, with the same similarity threshold as sanctions screening. The published exclusion file carries no EIN column, so this is a name match. Route-to-review only, never an auto-reject.
SAM.gov debarment screening
Built and wired alongside the OIG check, and waiting on a SAM.gov API key. Until that key is set the screen runs OIG-only and records on the evidence row that SAM was skipped, and anything reading that row says the federal coverage is incomplete rather than clean. SAM.gov has no sandbox, so a sandbox or demo workspace is screened against fixed fictional records instead, labelled as emulated on every row and never mistaken for a real SAM result.
IRS Pub. 78 corroboration
A second IRS registry cross-checks Pub. 78 listing and deductibility against what the Business Master File already gave us, and raises a flag when the two disagree. Waiting on the platform’s registry key; without it those two rows record as skipped, while the BMF-sourced rows keep running.
EIN / Tax-ID verification
Stripe Connect verifies the EIN against the legal entity, catching typos and name mismatches at intake. Part of the Stripe rail, switched on per customer.
Signer identity verification
Stripe Identity verifies the human signer with document and selfie checks during onboarding. Part of the Stripe rail, switched on per customer.
Bank account verification
Stripe Financial Connections proves live ownership of the bank account the organization submitted — no voided-check PDFs. Part of the Stripe rail, switched on per customer.
Account-title ownership match
On the Stripe rail the bank account holder’s name is matched against the nonprofit’s legal name, and a mismatch is raised for a reviewer. Submitted bank details satisfy the onboarding gate on their own, so this is a review signal rather than a hard stop.
Second verification rail (GIACT)
GIACT, part of LSEG Risk Intelligence, runs sanctions, business identity with a live IRS TIN match, email intelligence and bank verification as an alternative to Stripe. Built and wired; pinned to GIACT’s sandbox until production credentials are issued, and results are labelled as such.
Composite trust score
Every submission carries a 0–100 score that starts at 100 and deducts for each failed, missing or suspicious signal, with the per-signal breakdown reviewers and auditors can inspect. The deduction table is published in the documentation.
Structured reviewer queue
Approve, reject, or request more info — every decision requires a written reason, is stamped with the decider from their session, and lands in the audit log.
Escalation chain
Rank-based escalation routes hard calls to senior reviewers with full context attached, and only the assignee or an admin can escalate.
Organization trust score
A separate 0–100 score across five weighted factors — IRS status, address, contacts, banking and freshness — that tracks the organization across submissions rather than judging one application.
Web research (OSINT)
Automated web-presence research assembles a red-flag / green-flag profile, and a reviewer can re-run it against the current site from the console.
Per-tenant payment risk rules
Each enterprise sets its own payment-decision thresholds and disqualifiers in Risk Config, and the payment check reads them. Submission auto-approval uses its own separate threshold.
Auto-approve thresholds
High-scoring submissions can clear without a reviewer above a per-customer threshold, with hard blocks that no score can override on any sanctions, EIN or IRS failure. Off by default, and set on your account rather than self-serve. It governs approvals only — a confirmed sanctions or IRS disqualification rejects the application whether or not it is on.
Drift detection
Where an approved org’s IRS record, address, officers and banking details disagree across the sources we hold, the mismatch is raised as a drift record for a reviewer to work, with the conflicting values side by side. A reviewer starts it from the console with Re-verify, and it also runs as a step in the verification pipeline. The severity it finds lowers the organization’s trust score, and when the payment check runs it can return a hold decision: at high severity under a default rule your risk config can switch off, and at any severity for a grant above your high-risk threshold.
Tamper-evident audit log
Consequential actions are recorded with their actor and timestamp, sealed with an HMAC and chained to the entry before it, so any later edit or deletion is detectable. Until a dedicated audit-seal secret is provisioned the seal falls back to the platform system secret, which the Security page states in full.
Continuous velocity monitoring
A daily sweep flags revenue step-changes, officer bursts and address churn without anyone asking it to. It works 100 organizations a run by default, least-recently-checked first, so a larger portfolio rotates through rather than being covered every day.
Point-in-time IRS archive
A monthly job snapshots each tracked organization’s IRS status and keeps the row, so you can show what an org’s status was on the day you approved it — up to 500 organizations a run. The archive builds from its first sweep: it can only evidence dates after that, for organizations already on the platform.
Verification evidence records
Each check stores its result, reason code, source and timestamp — what was checked, when, and what came back.
Zero-trust controls
MFA on every account, per-user and per-IP rate limiting, an in-app request firewall, and a new-device / new-IP step-up check on any decryption of applicant PII.
Document virus scanning
Uploaded documents are scanned through VirusTotal and held as unscanned until a verdict comes back — an unscanned document is never asserted clean. Waiting on the VirusTotal API key.
Dark-web & breach screening
Klaw screens applicant contact email addresses against breach corpora. Reviewer-initiated from the console; waiting on the Klaw API credentials.
One iframe, any CMS
A single script tag embeds the full onboarding flow in Drupal, SharePoint, Wix or hand-coded HTML, against a per-enterprise public key and domain allowlist. The embed itself is finished; production still returns a header that refuses all third-party framing, so it renders once the edge header configuration is deployed.
Webhooks & API
Status-change webhooks fire on every submission transition, signed and with a delivery record per attempt, pushing decisions into your downstream systems.
White-label
Your logo, colors and copy throughout the applicant flow. DAF Connect branding can be suppressed entirely; that switch is set on your account rather than self-serve.
Nonprofit portal
Orgs manage their profile, documents, team and messages in a dedicated portal, and can see income synced from their own linked bank account, refreshed on demand, and reconcile each deposit against their own records.
Billing & usage metering
Per-verification metering writes an append-only ledger entry per submission per period, feeding invoices, usage warnings and admin billing summaries.
Built for the fraud a clean status check misses.
Current 501(c)(3) standing is a low bar: a shell, a conduit and a taken-over charity all clear it. These controls are the intelligence layer above the floor. Some run today, some are built and waiting on a credential or a dataset, and some are still ahead of us — each card says which, and we would rather tell you than let you find out.
The entity graph catches what single checks can't.
Fraud rings reuse bank accounts, officers, registered agents, addresses, phone numbers, email domains and signup IPs across "unrelated" charities — invisible to any single check, legible in a graph. The graph is built and reviewers work a connected component from the console; it needs the platform hashing key set before edges are written.
Cross-applicant entity graph
Shared bank, officer, registered-agent, address, phone, email-domain and signup-IP edges across applicants. Reviewers open a connected component from the console and route it to review. Edges are written once the platform hashing key is set.
Shared bank-account edge
The same routing number, account last four and normalized holder name appearing behind two applicants. Because the holder name is part of the fingerprint, this catches an account reused under one steward rather than two genuinely unrelated names — worth knowing before you read an edge. Same hashing key.
Cross-tenant beneficiary match
The same grantee bank account surfacing at two different sponsors — a signal only a shared platform can compute. Off until cross-tenant matching is enabled for the network.
Shared negative file
Hashed verified-fraud EINs, officers and bank fingerprints, with a dispute process. The write and read paths are built; the file is not yet populated, and nothing consults it on a submission.
State-AG enforcement history
Charity-regulator orders, consent judgments and bans joined into one person-keyed history. A curated seed of 26 actions across nine states and federal agencies is written and ready to load; ingest and querying are not yet wired to anything.
Out-of-band callback on banking changes
When the payment check returns a hold decision, the reviewer works a call-back checklist through a channel the requester does not control, and Record attestation stays locked until every step is acknowledged. Each outcome — keep the hold, record an attestation, or record do-not-pay — is written to the audit trail. None of them moves money or clears the hold: your own payment system sends or stops the grant.
Banking-change window rule
A banking change in the 14 days before a reviewer runs the payment check returns a hold decision, unless ownership was re-matched after the change. It reads banking records written by the Stripe or GIACT rail, so it needs one of those switched on.
Personal-account signals
The payment check flags a grantee bank account whose holder name reads as a person rather than an organization, and notes a savings account for a payee with no earlier approved payment decision. Same dependency: a banking record written by the Stripe or GIACT rail.
Payee account-type detection
BIN lookup at payment decision time so prepaid cards, P2P handles and crypto addresses can be flagged. Not built.
BEC mail-authentication check
Sender domain age, Reply-To mismatches and SPF/DKIM/DMARC regressions on banking-change requests. Not built; there is no inbound mail path yet.
990 XML schedule ingest
IRS 990-series XML pulled live per filing — Schedules G, I and M, Schedule L presence, and Parts VI, VIII and IX — powering the checks below. It needs no vendor key. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
True program-ratio recompute
Strip gift-in-kind out of revenue and expense and publish the marketed program ratio next to the recomputed one, flagging a gap above 15 points. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Grant-flow reconciliation
The eight largest grants a filer reports paying, across its three most recent filings, are matched against each recipient’s reported revenue. An unreconciled flow is strong conduit evidence. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Revenue step-change detection
Year-over-year total revenue compared across filings, flagging a jump above 3×. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Board-independence check
Organizations reporting two or fewer independent voting members are flagged, and the presence of a Schedule L related-party filing is recorded alongside. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Gift-in-kind concentration
Non-cash contributions above half of total revenue are flagged from the filing’s own Schedule M categories. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Insider-diversion flag
A checked material-diversion box on the 990 is surfaced as a high-severity finding for a reviewer to work. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Balance-sheet reconciliation
Phantom “investments” that never appear as assets, and restricted funds shrinking while deficits grow. Written and thresholded; not yet wired to anything that runs it.
Gift-in-kind valuation forensics
Valuation-method parsing and year-over-year revaluation swings on large non-cash categories. Written; not yet wired.
Site & beneficiary forensics
Census-tract population arithmetic against claimed beneficiary counts. Written and keyless; not yet wired, and no intake form collects the site list it needs.
Conduit & pass-through scoring
Three signals read straight off the 990s: an organization that regrants 80% or more of everything it spends, a fiscal sponsor fanning grants across an anomalous number of recipients for its revenue band, and a fundraiser keeping less than half of what it grosses. Grant-purpose wording is scanned for regrant and fiscal-sponsor language as corroboration. Every flag routes to review; none is a basis for an automatic rejection. It runs as part of any verification run that includes the 990 refresh, which a reviewer triggers from the console one submission at a time or in a batch, and the flags come back on the bank-ready CDD profile — the dedicated Channel scoring tab is visible to DAF Connect administrators only.
Charity name-similarity index
Fuzzy matching against a curated corpus of known charity names catches single-word impersonations of household brands. It runs inside the free-check pass, and a hit routes the application to a reviewer with the matched name and score attached — never an automatic rejection.
Entity-takeover detection
An aged EIN plus near-total officer turnover plus a mission change — the zombie-charity triple, diffed from the organization’s own filing history. It needs no vendor key. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Disaster-velocity signal
Entities formed within 90 days of a declared disaster with matching mission wording are surfaced, checked live against OpenFEMA’s keyless API. Generic relief vocabulary never anchors a match on its own. Same panel, same restriction as above.
Lookalike-domain detection
Domain-age checks through RDAP and certificate transparency, and edit-distance comparison against the charity-name corpus’s domains. Where RDAP has no record, the age is a lower bound read from the earliest certificate rather than a registration date, and the finding says so. Same panel, same restriction as above.
1023-EZ era scale signal
Organizations ruled in the 1023-EZ era that later report revenue above the $50,000 projected-receipts limit they attested to are surfaced for a closer look. This infers the short-form era from the ruling year rather than reading the filing itself. Same panel, same restriction as above.
Phoenix-entity detection
Successors of barred operators: name similarity against entities named in enforcement actions, officer overlap, and formation clustered near a predecessor’s shutdown. Two things stop it, not one — nothing calls it, so there is no panel or pipeline step that would run it, and the enforcement history above has not been loaded. Both have to change before it reports anything.
Private-benefit attestation
Structured goods-and-services declarations are required to file a grant request — galas, tickets, tuition and memberships become a lookup rather than a judgment call — and the §4967 quid-pro-quo check reads them.
Disqualified-person signal
Hashed identity matching between fund advisors and grantee officers surfaces donor-controlled grantees when a reviewer runs diligence on a grant, with no name crossing the boundary in the clear — the match returns a count. A structural proxy for the 35%-control test, not the ownership test itself. It compares against a published grantee-officer hash set, which is not yet populated.
Multi-hop sub-grantee screening
Sub-grantees declared on the grant request are screened a second hop down against sanctions and federal exclusions. The foreign-register hop needs a country on the sub-grantee, which the form does not yet collect. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Donor-controlled grantee signals
Residential addresses, single-sponsor revenue concentration, thin public support and payroll-cadence grants. The address and public-support legs read public filings and work now; the concentration and cadence legs need grant history on the platform before they say anything. Runs today, but only a DAF Connect administrator can run it — it is not yet exposed to your own reviewers.
Sponsor governance score
DAF sponsors scored from their own 990 filings on filing currency and payout ratios, from the grant-request page. Governance terms — turnaround, denial rate, portability, sunset — have no public source, so they score only when a reviewer supplies them, and a factor nobody supplies drops out of the weighting rather than scoring zero.
DAF-sponsor registry
Labelling every grant whose recipient is itself a DAF sponsor. A curated sponsor list is written; nothing loads it, and no grant is labelled from it yet.
Fundraiser channel scoring
Professional fundraisers scored separately from the charities they solicit for, off the Schedule G contractor rows: net kept over gross raised, flagged below half. Where Schedule G carries no contractor rows the ratio falls back to the fundraising-event lines, and the score records which source it used. It runs as part of any verification run that includes the 990 refresh, which a reviewer triggers from the console, and the flag comes back on the bank-ready CDD profile.
Full OFAC Consolidated list
Beyond the SDN list: the Consolidated list and both alias files are loaded and screened, with an alias hit resolved back to the primary entry it belongs to.
Foreign registry screening
UK, Canadian and Australian charity registries for international grantmaking, reached through sub-grantee screening when a sub-grantee carries a country. The grant form collects only a name and an EIN per sub-grantee, so nothing routes to it from the product today; each registry also waits on its own credential.
OFAC rejection reporting
Sanctions-driven declines generating the 10-business-day rejected-transaction filing. The clock and the filing record are built; nothing opens one yet.
Beneficial-ownership traversal
The OFAC 50-percent rule traversed through ownership chains. Not built.
Entity-level FCRA framing
Determinations are about organizations, never dossiers about people. Identity matching returns a count, never which person matched, and applicant-side names are masked.
Published risk taxonomy
A public line between financial-crime signals and politically-contested activity — scored versus excluded, in writing, at /risk-taxonomy. If a category is not listed there as scored, it is not scored.
Right of reply
An organization can appeal a determination, and the appeal is worked in the same reviewer queue with the same audit trail.
Vendor integrations, written and dormant.
Paid-vendor integrations, each written and dormant behind its own credential. None runs and none is billed. Setting a key is necessary but not sufficient for any of the four: none of them is called from anywhere in the product yet, so each also needs wiring into the check that would use it.
Secretary-of-State data
State good-standing, registered-agent and officer lookups. No registry vendor is contracted yet.
IRS TIN + name matching
Authoritative EIN-to-legal-name matching through a business-identity vendor. The GIACT rail above carries the same check and is the nearer path to it, once GIACT is out of sandbox.
Document forgery forensics
AI-generated and doctored determination-letter detection on uploaded documents.
CMRA / residential address verification
USPS-grade commercial-mail-drop and residential flags for donor-control screening.