Risk intelligence is the program that decides. Everything else establishes facts: who this person is, what this company is. It takes those facts, adds what the world knows about them, and turns it into an answer.
Two things make that hard, and neither is data. The first is matching, because names are not identifiers. The second is knowing when to look again, because a clean result tells you about the day you checked and nothing about the day it changed.
Sanctions, politically exposed persons and adverse media, screened once or monitored continuously. Also its own product page.
Validated, corrected and matched to a person.
Fraud risk, SIM swap, porting and breach exposure from a number.
Open-source research, including where people go when they would rather not be found.
Account ownership, income and behaviour, over PSD2 rails.
Convictions, enforcement and insolvency, locally and globally.