Screening methodology

Matching algorithm v1.1.0 · Disclaimer v1.0

This document explains how Clean Vendor Check screens vendors against the U.S. federal exclusions list, what each result means, and the limits of the method. It is provided to customers and their auditors.

What is checked

Every check searches the SAM.gov Exclusions Public Extract (V2), the official daily file of all active exclusion records published by the U.S. General Services Administration (GSA) through SAM.gov. It covers firms, individuals, vessels and special entity designations excluded by any federal agency, including suspension and debarment actions (FAR subpart 9.4 / 2 CFR part 180) and reciprocal exclusions such as HHS-OIG and OFAC listings that appear in SAM.

We download the full extract once a day (SAM publishes it each morning, U.S. Eastern time) and load it into a search index. Checks run against that index rather than calling SAM.gov's search for each vendor. This is what makes checks fast and lets us screen whole vendor lists, and it means every result is tied to a specific, identifiable extract file:

• Data as of: when the extract used for the check was imported.
• Extract file and SHA-256: the exact file searched. We keep every imported file, so any result can be reproduced.
• Record count: number of active exclusion records in that file.

If an import fails, checks continue against the last successful import and every result shows that date. If the data is more than 48 hours old, results carry a visible staleness warning.

Records that disappear from a later extract (terminated or removed exclusions) are kept as history. They are shown separately and never produce an active match.

How matching works

1. Identifiers (deterministic)

• UEI (SAM Unique Entity ID, 12 characters): exact match after removing spaces and hyphens.
• CAGE code (5 characters): exact match.

A UEI or CAGE match is reported as MATCH_FOUND. Supplying a UEI is the single most effective way to get a reliable result.

2. Names

Both the vendor's name and every name on each exclusion record are normalized the same way:

• Upper-cased; accents removed; & and + read as "and"; apostrophes and periods removed (so P.C. = PC, O'Neal = ONeal); other punctuation treated as spaces.
• Legal forms removed from the ends of the name: Inc, LLC, LLP, Ltd, Corp, Co, PC, PA, PLLC, GmbH, S.A. de C.V., OOO/AO/ZAO and their transliterated Russian equivalents, and so on. A leading "The" and honorifics (Dr, Mr, Ms) are also removed, as are generational and professional suffixes (Jr, Sr, III, MD, DDS).
• Common abbreviations are expanded consistently, for example Svcs → Services, Mfg → Manufacturing, Med → Medical, Eqpt → Equipment, Intl → International. Plural and singular forms are treated as equivalent.

Names searched on each exclusion record:

• the firm/entity name, or the individual's first + last name, with and without the middle name;
• any names joined by "dba", "aka", "fka", "d/b/a" or "doing business as" inside the name;
• every alias in the record's Cross-Reference ("also known as") field.

Names searched for the vendor: its name, any other names supplied (legal name, dba, "print on check as"), and both halves of any "X dba Y" name.

Name match tiers:

Similarity is a weighted comparison of the words in the two names. Distinctive words count for more than common ones (distinctiveness is computed from how often a word appears across all exclusion records), so a match on "Gueringer" counts for far more than a match on "Medical". Words can match through small spelling differences ("Gueringerr" vs "Gueringer"); single-letter initials only count as weakly as an initial.

3. Location corroboration

When the vendor's state, city or ZIP is supplied, it is compared with the address on the exclusion record:

• A state that differs lowers the similarity score by 0.06 and stops an exact name match from being called deterministic (the party may have moved, so it is still shown as possible).
• A differing UEI (vendor supplied one, record has a different one) means the record is very likely a different entity: only exact name matches are kept, as possible matches.

4. Match likelihood (for review)

Each matched record also gets a likelihood, so reviewers see the clearest cases first. It does not change the result state: a check that found a resemblance still says POSSIBLE_MATCH, and the evidence record keeps every matched record.

• High (likely your vendor): a UEI or CAGE match, or a deterministic MATCH_FOUND.
• Low (probably not your vendor): any one of these signs that the record is a different party:
• the record is a vessel (ship);
• the record is located outside the US and its territories while the vendor has a US state or ZIP;
• the vendor and the record have different UEIs;
• the record is a person while the vendor's name is a business name, and the names are not identical.

A fuzzy name match is also low when a weaker sign applies: the states differ, the names are less than 92% similar, the record is a person whose name is shared by three or more excluded people with nothing else corroborating, or the record is foreign and the vendor's location is unknown.

• Medium (needs a closer look): everything else, including an exact name match without location and a very similar name (likely a typo) with no sign against it.

Monitoring raises an alert only for high and medium matches. Low-likelihood matches stay on the vendor's evidence record but don't create an alert or email. For each alert the app drafts a decision and note from these reasons (high: same party; low: different party). A person always confirms the decision, can edit the note, and the note they confirm is what gets recorded.

Result states

Exclusions whose termination date has passed are listed as historical and do not affect the result.

Evidence records

Every authenticated check creates an evidence record containing the inputs, the result, full copies of all matched exclusion records, the data source details above, the algorithm and disclaimer versions, and the regulatory references.

• Records are stored append-only, enforced by the database. Re-checking a vendor creates a new record and never edits an old one.
• Each record's SHA-256 is computed over its canonical JSON (keys sorted, no whitespace).
• Each record also contains the SHA-256 of the account's previous record. Together these form a hash chain: editing a record changes its hash, and replacing a record together with its hash breaks the link from the next record. A back-dated insertion cannot be made to fit the chain.
• Anyone holding a check ID can confirm a record is intact at /v/<check_id>. The PDF carries a QR code to that page.
• Decisions on monitoring alerts (false positive, confirmed match) are written into the same chain with the reviewer's note. A possible match can also be decided from the vendor list. If no alert was raised (for example, a low-likelihood match), the decision is recorded the same way, against the vendor's latest check. The check's own result is never changed: a vendor whose every matched record was marked "different party" is shown as Reviewed: different party, and its evidence record still says POSSIBLE_MATCH alongside the decision.

Monitoring

Monitored vendors are re-screened in full after every successful daily import. This also catches changes SAM makes to existing records, such as a newly added alias or UEI. A vendor alerts when it matches an exclusion record it did not match before, unless a person has already marked that record as a false positive for that vendor or the match has low likelihood (see above). Every monitored vendor also gets a fresh evidence record on the account's cadence (monthly by default), so the file shows a continuous history.

UEIs supplied by vendors

A vendor that has no UEI and whose result is "not enough info" or "possible match" can be asked for its UEI. The customer chooses the vendors, checks each address and previews the email. Clean Vendor Check then sends it on the customer's behalf, with replies going to the customer, and sends one reminder after 7 days. The link is single-use and expires after 30 days.

• The vendor enters a UEI, or says it isn't registered in SAM.gov. The form rejects anything that looks like a tax ID, and the vendor never sees screening results.
• A submitted UEI is saved to the vendor, which is then rechecked at once. That recheck is a normal evidence record, and its context records that the UEI came from the vendor (source: vendor_portal, with the request ID). The UEI is the vendor's own statement. It is not looked up in SAM.gov's entity registrations.
• Vendor contact emails are stored only to send these requests. They are never screened and never appear in evidence records. A vendor can opt out, and opted-out addresses aren't emailed again.

Limitations

• Name screening is probabilistic. Without a UEI, true matches can be missed if a name is spelled very differently from every name and alias SAM lists. Unrelated parties can also be returned as possible matches. Use UEIs wherever possible, and always review possible matches.
• Freshness. Agencies can add exclusions at any time. A check reflects the data as of its stated date, normally within 24 hours of SAM's publication.
• Scope. Only SAM.gov exclusions are searched. Other lists that may apply to your awards are not covered in this version: HHS-OIG LEIE beyond what SAM reciprocally lists, OFAC beyond SAM, and state debarment lists.
• Not legal advice. A result documents a search; it is not a determination of a party's eligibility. Confirm the identity of any match against the SAM.gov record before acting.
• Tax identifiers. SAM's search can use TINs, but this service never accepts or stores SSNs, EINs or TINs, so a check cannot match on them.

Regulatory references

• 2 CFR 180.300: before entering a covered transaction, verify the person is not excluded by checking SAM.gov exclusions, collecting a certification, or adding a clause or condition.
• 2 CFR 200.214: non-Federal entities are subject to the non-procurement suspension and debarment rules in 2 CFR part 180.
• 2 CFR 200.332: pass-through entities' responsibilities for subrecipients.

Covered transactions include procurement contracts at or above the threshold set in 2 CFR 180.220 and all subawards regardless of amount. Confirm current thresholds against the eCFR for your award.

Data attribution

Exclusion data: SAM.gov Exclusions Public Extract, published by the U.S. General Services Administration. Clean Vendor Check is not affiliated with or endorsed by GSA.