---
title: Load customer data
slug: concepts/cards/card-lifecycle/partner-managed-lifecycle/load-customer-data
description: Load customer data to the COS system post-KYC check, with key steps for OFAC screening and webhook updates on status outcomes.
docTags: 
createdAt: 2025-03-20T09:56:10.306Z
---

## OFAC/PEP screening and loading customer data

To add customer data in COS:

1. After a successful KYC (know your customer) check, call the [POST /core/v1/cm/customers](docId\:isgkj7NIS9jHmyu3UPUBk)  endpoint in COS to create the cardholder’s customer account.
2. OFAC uses the customer name, date of birth (DOB), and address. The Customer Identification Program (CIP) requires the customer social security number or government-issued ID (for non-US persons).
3. The webhook event `Core.Customer.Ofac.Changed` is triggered and returns an initial status of **Clear** or **Failed**.
4. If the status is **Clear**, you can approve and create the customer credit card facility on your side.
5. If the status is **Failed**, the Cross River AML team investigates the case. The webhook event is triggered again, sending a status of **Reviewing** or **Pending**, indicating that a person is reviewing the case. This can take up to 48 hours. On occassion, the Cross River team might reach out to you to ask for additional supporting documents. You will need to provide an email address for this. The `Core.Customer.Ofac.Changed` webhook returns any change in status, not just **Reviewing** or **Pending**.
6. After reviewing, the Cross River team moves the status to either **Clear** or **Positive**. The webhook event fires again.
   - If **Clear**, you can continue with approving and creating a credit card facility for your customer.
   - If **Positive**, you must decline the application. This is quite rare.
7. To trigger an OFAC/PEP failure in the Sandbox use these values in your call:
   - For PEP, in the `name` object use the name **Vladimir Putin** to get a hit.
   - For OFAC, in the `name` object use the name **Francisco Javier Arellano Félix**; and in the `profile` object use the birthdate **1969-12-11** (December 11, 1969)
   - For OFAC entity, in the `name` object use the `entityName` value **Blue Star Diamond**
8. Once the customer record is cleared, there is no longer a reason to subscribe to the specific customer webhook.
   - Cross River scans customer records nightly for OFAC/PEP. If a customer hits OFAC during a nightly scan, our AML team will reach out via Zendesk to help clear.
9. You must keep the customer records you create up to date.
   - If a customer changes their name, address, email, or other details, use the Customer Management APIs to update their record.
   - You can make this part of a nightly process.
10. The scans take less than a second. Anything that needs manual review is taken care of within 3 business days.
11. Status Definition Changes (applies to OFAC, PEP, and Internal List). Webhook event responses from this point on mean:
    - **Positive**: Must be rejected (no change)
    - **Clear**: Everything is fine (no change)
    - **Pending**: The case is being reviewed (no change)
    - **Reviewing**: A potential match within a category is being reviewed by CR and is pending a disposition. Previously this was Failed.
    - **Failed**: There isn’t enough information to know the status (for example, RFI not responded to).
12. See the APIs required [onboard a customer](docId\:Nt23Lv6UL3hwB2r5bz4K9) .

As always, if you have any questions, email our [support](mailto\:cos.support@crossriver.com) team.