How verification works
The short version: we confirm you're a real institution. We don't decide whether you deserve access.
Why there's a gate at all #
The methodology behind every method here is published without restriction: read it, adapt it, build your own implementation from it, no verification required. The working reference implementations are verified access only, for one reason: detection logic that's freely downloadable by anyone is detection logic that fraud operators can read and route around. Publishing the method while verifying who receives the running code is standard practice for security tooling.
What verification checks #
Only that your institution is what it says it is.
- Credit unions: your NCUA charter number, checked against NCUA's public registry
- Banks: your FDIC certificate number, checked against FDIC's public database
- Government units: a .gov or .us email domain, or your agency's public listing
- Other lenders: an NMLS ID, state charter, or equivalent
What verification does not check #
Your size, your budget, your technical capacity, or your intended use, beyond the stage you report. There is no minimum institution size and no application review. If you are a genuine institution of the kind these methods are built for, you qualify.
What if I don't fit neatly into these categories? #
Say so on the form. Some state agencies and smaller entities don't map cleanly onto a public database, and we'd rather verify by another route than turn away the institutions this work is meant to reach.
What we never ask for #
Claims data. Credit records. Protected health information. Member or patient identifiers. Any production data of any kind. Verification is about your institution's identity, never about your data.
After verification #
You'll have access to the relevant implementations, and to a private area where you can report issues, log validation results, and receive update notices. Everything you find when testing against your own data, where a feature doesn't compute cleanly, where a peer grouping doesn't fit, where flag volume runs high, feeds back into the published methodology. That's the whole point of verifying institutions individually rather than posting the code for anyone: we can hear from the people actually running it.