Sweep the supplier base again after onboarding, on a stated cadence no law prescribes, record what each sweep saw and when, and raise what changed to a named risk owner.
A supplier is designated, and blocking attaches that hour, with no grace period anywhere in it.
02
A payment blocks in flight, and 31 CFR 501.603 gives ten business days, then an annual report.
Reason
03
An ownership changes, and 31 CFR 587.406 blocks the entity with no listing anywhere.
04
A running contract meets it, and performance is prohibited, leaving a wind-down licence.
05
A wind-down licence expires at a stated hour, so the answer is a clock, not a decision.
Decide
06
A re-screening interval is sought, and OFAC FAQ 28 leaves it to your own written policy.
07
A supplier is debarred, and FAR 9.405 binds agencies, reaching you via FAR 52.209-6.
Out
08
A supplier files, and 11 U.S.C. 365(e)(1) voids the insolvency clause you drafted.
09
Execute write actions only inside the approval boundaries agreed during implementation.
→Product statement
Sweeping, recording and raising belong to the agent. Blocking, stopping a payment, terminating and filing belong to a named risk owner, who does all four.
Example workflow
One supplier, sweep to escalation
AgentHuman
1Supplier base receivedSupplier master records, ownership data, watchlist feeds, exclusion records and court dockets
2Sweep run and recordedThe lists checked, the ownership read, the hour the sweep ran and what it could not reach
3Change raisedThe event, the supplier it attaches to, the sources under it and confidence
4Controls appliedMatch checks, ownership checks, source-currency checks and detection confidence
No human action required
Stages 1 to 4 run unaided, and nothing is blocked or filed at any of them — the agent is sweeping, and the risk owner lane opens at the escalation gate.
5DecisionSplits at the escalation gate
Event matched and sourced
Goes to the named risk owner.
Anything unresolved
Adds a compliance counsel read first.
Risk owner review
The event is held with its sources, the hour it was seen and what the sweep could not check.
Escalate · Add source · Send to counsel review
Decided — by the named risk owner▼
6Supplier and payment records updatedOnly where write access and records policy allow it
7Outcome evaluatedDetection lag, source coverage, owner corrections and what review found
Corrections
Each risk owner correction is counted in the evaluation.
What should not run autonomously
Human approval stays in control
Outside the boundary — human approval required8 items
Deciding that a supplier is blocked.
Stopping or releasing a payment in flight.
Terminating a contract with a supplier.
Filing a report with a regulator.
Automation boundaryAgent acts unaided
✓Sweep the onboarded supplier base on the stated cadence.
✓Record what each sweep saw and the hour it ran.
✓Raise what changed since the last sweep to the named risk owner.
✓Show which suppliers the sweep could not reach, and what blocked it.
Nothing is blocked or filed except by a named risk owner, inside the agreed boundaries.
Judging whether an ownership crosses the rule.
Telling a regulator what was found and when.
Setting the cadence a supplier base is swept at.
Changes to the cadence, escalation or watchlist rules.
Example output
One risk event, annotated
This serves a procurement team who may have to show when a designation was seen and who was told; below is one event exactly as the agent leaves it.
Sweep record · single supplierIllustrative example
Supplier
Recorded as
Event
Evidence of record
Confidence
Held for
Tier-two component supplier
Ownership crossed the rule
Designation, hour recorded
Watchlist feed, 3 August 2026
Held unescalated
The named risk owner
As receivedRead from the watchlist feed and the ownership record on file, and it claims nothing beyond them.
What the record holdsWatchlist feedOwnership recordCourt docket index
Why no escalation hereDeciding a supplier is blocked is a judgement the risk owner makes.
ActionEscalateAdd sourceSend to counsel review
What the score decidesBelow the configured threshold the event gets a counsel read before the owner sees it.
Value
Where AI adds value
The same four claims, placed at the point in the workflow where each one applies.
Where the value landsValue 01 – 04
Every sweepAgainst the supplier base on file
03Evidence
What the sweep read
Forced-labour import evidence answers for goods stopped at the border; this is the supplier who was clean at onboarding and is not clean now.
01Approved path
Clean at onboarding, not now
The fifty percent rule needs no regulator: ownership moves, and the entity is blocked with nothing published anywhere.
02Human review
What was checked, and not found
Checked across the instruments surveyed: no rule makes an ordinary buyer re-screen a supplier it already onboarded, the ongoing-monitoring duties bind banks and funds, and the filings run only after a find.
04Build an evidence trail
The designation, the hour it landed and the person who was told stay together.
Integrations
Typical integrations
Five system groups connect to the same agent. Which of them are in scope is decided in discovery.
Sanctions and watchlist dataOFAC SDN · consolidated lists EU, UK and UN designation feeds
Ownership and corporate dataCompany registries · filings Beneficial-ownership records
Exclusion and court recordsSAM exclusion records · agency lists Bankruptcy dockets and filings
Agent
Supplier-risk monitoring
Sweeps the base Records the change Raises to the owner
Purchasing and payment systemsSAP Ariba · Coupa · Oracle ERP Payment runs and open purchase orders
An event-level detection figure can read clean while privately held ownership chains carry most of the corrections. Nestack reports the correction rate by risk event, not only in total.
Slice performance — reported separately, not only in aggregateIllustrative example
Slice
Failure rate
Lift
Lift vs. threshold
Status
Privately held ownership chains
11.5%
3.7×
Review
Suppliers with foreign parents
8.2%
2.6×
Review
Recently restructured suppliers
5.1%
1.6×
Watch
Listed public suppliers
2.5%
0.8×
Normal
Bar: correction-rate lift vs. listed-public-supplier baseline · scale 0–4.0× · tick marks the 2.0× review threshold2 of 4 slices over threshold
Evidence-linked improvement
What a week of not looking costs
A loop ends when the designation nobody saw for a week is a standing case. That suite is what the next sweep run is measured against.
Improvement cycle · five stagesSwitchback — the path turns at Improve and returns at Learn
01Detect
Correction rate rises on privately held ownership chains.
02Diagnose
The designation published on a Friday afternoon, against a supplier already on the payment run that goes out Monday, is worked back until one cause is left.
03Improve
The change leaves numbered, and the sweeps that caused it ride with it.
04Verify
Nothing ships while one sweep case is still failing.
05Learn
One case joins the suite, one line joins the escalation rules.
Learn → DetectThe return edge. The next sweep is measured against a suite one case longer.
Typical build scope
Twelve workstreams across six weeks
The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, feeds, sweep workflow, evaluation, integration, then production validation and handover.
WorkstreamWeek 1Week 2Week 3Week 4Week 5Week 6
01Monitoring scope and automation-boundary definition.
02Watchlist, registry and docket sources.
03Supplier-to-source and escalation-coverage mapping.
04Supplier-base ingestion and normalisation.
05Sweep, source and supplier binding.
06Detection scoring and escalation routing.
07Risk owner escalation workflow.
08Purchasing-system integration.
09Designation and ownership cases.
10Guardrails and escalation controls.
11Sweep-trail instrumentation.
12Deployment, documentation and Agent Care handover.
12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallelFinal scope and sequence confirmed in discovery
Engagement tiers
What each tier includes
Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.
Capability✓ in scope · — not at this tierPilotOne supplier base, one quarterProductionProduction monitoring workflowAdvancedMultiple regimes / entities
Introduced at Pilot
Supplier sweeps to your cadence✓✓✓
Named risk owner escalation✓✓✓
Supplier-base baseline✓✓✓
Introduced at Production
Reporting by risk event—✓✓
Counsel review workflow in your systems—✓✓
Approved write-back—✓✓
Watchlist-feed integration—✓✓
Introduced at Advanced
Multi-regime designation rules——✓
Cross-entity supplier packs——✓
Large supplier bases——✓
Multi-regime designation controls——✓
Build priceFrom $5,000From $8,000Custom quote
Final build priceConfirmed after discovery based on integrations, sweep cadence, supplier volume, approval controls and deployment requirements.
Separate from buildBuild pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.
What we need from you
What you bring, and what we build with it
Each input maps to a piece of build scope and a week in the delivery timeline.
You bringWe build with it
01Your live supplier base and the cadence each class is swept at→Supplier-base capture and cadence bindingWeek 1
02Representative suppliers, feeds and ownership records→Source binding, sweep logic and the supplier-base baselineWeek 2
03Your escalation rules and the risk owners they name→Cadence mapping, source binding and the automation boundaryWeek 1
04Access to relevant APIs, feeds or exports→Watchlist, registry and docket source assessment, then integration setupWeek 2
05Suppliers you would not want re-checked→Designation cases and the evaluation roundWeek 4
06What no risk sweep may clear→Detection scoring, escalation routing, guardrails and release controlsWeek 3
07A named risk owner who takes the escalation→Release to the named risk owner, then pilot and production validationWeeks 5–6
Nothing else is requiredDeployment, documentation and Agent Care handover are ours.
Delivery timeline
Four phases across six weeks
This is a schedule and not an illustration, and that is why two phases genuinely share week five.
PhaseW1W2W3W4W5W6
DiscoveryW1
BuildW2 – W3
EvaluateW4 – W5
Pilot & LaunchW5 – W6
Week focusW1Monitoring discovery, cadence rules and the automation boundaryW2Source integration and the supplier-base baselineW3Sweep workflow, detection logic and escalation controlsW4Evaluation suite, designation cases and failure-mode testingW5Purchasing-system integration, pilot sweeps and targeted correctionsW6One monitoring quarter run under the risk owner, then Agent Care handover
Reading the bandEach bar runs over the weeks its own work is named for, and the fifth is shared by design.
At the end of W6When the sweep record validates, Agent Care assumes the agent.
DurationSix-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.
Next step · Procurement AI agent
Build a supplier risk monitoring agent around the sweep your base has not had since onboarding.
Show us your supplier base and the day each name was last re-checked. The duty attached the hour that supplier was designated, not the day you found out. Nothing is filed for having looked: blocked property is reported annually, a rejected transaction within ten business days.
