________________________________________________________________________

VISUAL COMPLIANCE RPS EIM Web Service Configuration Details

________________________________________________________________________

November 23, 2011

Version 2.7

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

Notice to Reader

This document contains confidential information which is proprietary to MSR. In consideration of receipt of this document, the recipient agrees to maintain such information in confidence and to not reproduce by any means or otherwise disclose this information to any person outside the recipients organization nor to any person not directly responsible for the evaluation of its contents.

MSR eCustoms. All rights reserved Page # 2 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

Restricted Party Screening (RPS) .NET Web Service

Web Service Location: https://eim.visualcompliance.com/RPS_WS/RPSService.asmx Web Method: WebSearch(sSecno, sPassword, sOptionalID, sName, sCompany, sAddress, sCountry, sModes, sRPSGroupBypass) Parameters (with maximum string lengths): Security Number [sSecNo] [5] An assigned security number which permits access to the RPS database (REQUIRED) [sPassword] [20] An assigned password which permits access to the RPS database (REQUIRED) [sOptionalID] [100] A unique identifier, assigned by the user, used for an Exclusion search through My RPS (REQUIRED for My RPS: 0 or your table-keyed reference number. Submit empty if not subscribing to My RPS) [sName] [100] The persons name to be screened (OPTIONAL if Company is provided*) [sCompany] [100] The company name to be screened (OPTIONAL if Name is provided*) * Either the Name or the Company field must be populated Address [sAddress] [100] The address of the person or company listed above (i.e. street address, city, state*) (OPTIONAL) * We recommended city and state only in the address field, if used, on account of the difficulty of matching the exact format of the government source lists. For best results, these values can be used with special delimiter pairs, detailed later. Country [sCountry] [50] The country where the person or company screened is thought to reside. Can be literal [Mexico] or, for the most reliable results, the ISO abbreviation [MX] (OPTIONAL) [sModes] [25] Types of searches (consist of four elements, recommended settings shown in bold) (OPTIONAL send empty for best performance, populating for override only) 1. Exact (EXT) or Fuzzy Level (F01 F10) or Phonic (PHN) {Exact is default} 2. Stemming ON (ST1) or OFF (ST0) {OFF is default} 3. Thesaurus ON (TH1) or OFF (TH0) {OFF is default} 4. Field Specific ON (FS1) or OFF (FS0) {ON is default} 5. Encryption ON (EC1) or OFF (EC0) {OFF is default}

Password

Optional Identifier

Name

Company

Search Modes

MSR eCustoms. All rights reserved Page # 3 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

For best throughput, we recommend that you send the Search Modes field empty. When empty, the system uses your default user profile settings, with a small performance gain. Fuzzy and phonetic modes are not recommended for automated EIM/API or Batch screening processes. Excessive results are often produced, and the system runs without the human supervision and interventions normal for individual screens operated through the browser. Stemming extends a search to cover grammatical variations on a word. For example, a search for fish would also find fishing. While offered in case of particular user suitabilities, stemming has limited applicability to name and company searching and is usually left OFF. The default setting for Thesaurus warrants some thought, as Thesaurus ON adds significantly to individual record processing times. Thesaurus equates forms and styles for country names (England, U.K., Great Britain), business abbreviations (Ltd., Limited), and given names (Robert, Rob, Bob, Robby, Bobby). If your automated processes use a well-maintained database table including standard official country names (or, even better, two-letter ISO values), Thesaurus is unlikely to improve the accuracy of your search result alerts, and can be left OFF. The profile setting for business abbreviations strip removes common business endings [Co., Company, Corp., Corporation, GmbH, Inc., Incorporated, Limited, Ltd., LLC, plc, Pty.] and is considered mandatory for good results. This filter is engaged through your profile setup. Field Specific OFF means that, where present, the Notes field (which, for instance, sometimes contains additional a.k.a.s or d.b.a.s) is searched in addition to the regular one-to-one field searches for name, company, address, and country. Encryption ON requires the installation of an MSR-supplied COM to decrypt, which method is called in a manner similar to example below in Visual Basic. The encryption key can be supplied by you or created by MSR. This setting is deprecated since the EIM RPS API is HTTPS.
Dim oEncryption As New Encryption.ComEncryption decrypt_string = oEncryption.DecryptFromBase64String(sReturnVal, sKEY)

SSL certificate encryption does not employ the Encryption ON setting. This setting is only for use with the MSR encryption DLL and is only used if your system cannot support an SSL certificate, optionally available and in general the preferred procedure for the Visual Compliance RPS WS if secure socket layer handling is required. Please contact your account representative for more information.

MSR eCustoms. All rights reserved Page # 4 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

Example sModes overrides Exact search with stemming off, thesaurus off, field specific on, and encryption off (typical default format) EXT|ST0|TH0|FS1|EC0 Exact search with stemming off and field specific off, thesaurus off, and encryption off EXT|ST0|TH0|FS0|EC0 Fuzzy level equal to three with stemming, thesaurus off, field specific on, and encryption on F03|ST0|TH0|FS1|EC1 Phonic search with stemming, thesaurus off, field specific on, and encryption off PHN|ST0|TH0|FS1|EC0

Specific RPS Group Search

[sRPSGroupBypass] [6] Search only specific RPS groups, depending on client subscription (OPTIONAL send empty for best performance, populating for override only) 1. 2. 3. 4. 5. 6. Export Sanctions GSA Police PEP International

This field would normally be sent empty, except to override your defaults in special circumstances. Example Format String of numbers corresponding to RPS Groups: 123456 searches all six RPS groups 12 searches only Export & Sanctions * City and State Coding Given a street address will rarely draw an exact match to government list styles and formats, the address field can be dedicated to city and state only, where (using delimiters) both city and state must match the database record to receive an alert where both values are provided for the search. In general, this greatly sharpens the quality of the alerts. Good quality alerts are important, because RPS results have to be selectively escalated (that is, a response of lesser urgency to a yellow alert, and a response of greater urgency to a double or triple red). The City and State method is evoked with the use of pairs of delimiters (dollar signs [$$] and curly brackets [{}] respectively). Any city and region can be treated in this way. The format for this sub-method is $City${State} in the sAddress field. Either or both parameters can be empty (e.g. $${} or $LosAngeles${} or $${California}) with all delimiters provided and the search will be undertaken normally with the supplied arguments. For U.S. states, the name can be spelled in full ($${Ohio}) or abbreviated ($${OH}).

MSR eCustoms. All rights reserved Page # 5 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

Request String Format and Calling the Web Service

HTTP GET Protocol
https://eim.visualcompliance.com/RPS_WS/RPSService.asmx/WebSearch?sSecno=00000&sPassword= pswd&sOptionalID=&sName=Wayne+Smith&sCompany=&sAddress=&sCountry=&sModes=&sRPSGroupBypass =

This example shows a request string with simple/generic search argument components, as it would be formatted by an automated caller in your system processing. The caller, in effect, executes this statement as an HTTP GET action, then waits for a reply. On receipt, the reply string is immediately in the main process flow for evaluation, storage, or reprocessing.

Caller Creation There are many references and coding examples for the use of Web Services available on the Internet. At the Microsoft Developer Network (MSDN) website, for instance (http://msdn.microsoft.com/), there are toolkits and examples for VB, C#, and other .NET languages, as well as Visual Basic. Other online references detail methods for ColdFusion, Java (where the Sun SDK has various base classes for Web Service operations), Javascript, and PHP. To locate these online resources, search Google for "Web Service call object", "consume Web Service", or similar phrases that include the name of your programming language. Both SAP and Oracle have extensive online resources and tutorials for Web Service configuration. In a .NET language, creating a Web Reference automatically creates a proxy class for the Web Service. The class has only to be instantiated as a new instance of the service, variables created for the results obtained from the service method, and the service called. With Visual Basic 6.0, Web Service method calls have to be framed as SOAP requests and receive the results of the method calls as SOAP responses. (See MSDN SOAP Toolkit 2.0 SP2.) Following is a sample SOAP request:
POST /RPS_WS/RPSService.asmx HTTP/1.1 Host: eim.visualcompliance.com Content-Type: text/xml; charset=utf-8 Content-Length: length SOAPAction: "http://tempuri.org/WebSearch" <?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <WebSearch xmlns="http://tempuri.org/"> <sSecno>string</sSecno> <sPassword>string</sPassword> <sOptionalID>string</sOptionalID> <sName>string</sName> <sCompany>string</sCompany> <sAddress>string</sAddress> <sCountry>string</sCountry> <sModes>string</sModes> <sRPSGroupBypass>string</sRPSGroupBypass> </WebSearch> </soap:Body> </soap:Envelope>

MSR eCustoms. All rights reserved Page # 6 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

Result Strings
There are two reply string formats, text (pipe-delimited) and XML. The default return string format is text-delimited (^ indicating a new record, and | indicating fields within records) in XML parenthesis. Parse the results by looping over the output string for records, nesting a loop in the first for fields. The setting for a true XML return string is configured in your user profile by Visual Compliance administration. The reply string can be empty, or consist of search results (with or without a risk country notice), a risk country notice alone, or error message. A risk country notice occurs when the country submitted for search is found to be under U.S. embargoes, sanction programs, state supporters of terrorism, or other U.S. federal prohibitions or cautionary status. Not all of these messages will be pertinent to your business transactions, and must be dealt with selectively based on the nature of your goods and services. For instance, China is currently under a U.S. Arms Embargo, and so will return a risk country alert, but is also a major trading partner for the United States. Risk country alerts apply only to the country submitted, with no relevance whatsoever to any name or company submitted. A current list of countries affected can be found at Visual Compliance online in the RPS pages. In summary, whether pipe-delimited or XML format, there are five main reply string scenarios: 1) 2) 3) 4) 5) No matching records, no Risk Country notice No matching records, Risk Country notice Matching records, no Risk Country notice Matching records, Risk Country notice Error message

For no matching records, no risk country notice, the text-delimited result string is in this form.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/" />

In XML, for no matching records, no risk country notice, the following string is returned.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/"><rps></rps></string>

For no matching records with a risk country notice, the text-delimited result string is in this form.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/" /> RISK_COUNTRY</string>

In XML, for no matching records with a risk country notice, the following string is returned:
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/"><rps>RISK_COUNTRY</rps></string>

MSR eCustoms. All rights reserved Page # 7 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

Text-delimited result string with matching records found A text-delimited result string with matching records found (in these examples searching for Wayne Smith), with no risk country report, will be in a form similar to the following.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/"> DBP000063|Arms Export Control Act Debarred Parties [ITAR]|||Smith, Wayne P.|2333 Big Woods, Edgerly Road||Vinton|LA, 70668|United States|US|[Status current to Department of State consolidated list, November 2006. Contact DDTC for further clarification.]|63 FR 29773-74<BR>June 1, 1998|6/1/1998||frserve\63FR29773-74.pdf||_Y|</string>

A text-delimited result string including a risk country report will be similar to the following. Note the annotation appended to field 16 (RISK_COUNTRY). This notice does not pertain to the name or company searched, instead only the search value provided for country.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">^DBP000063|Arms Export Control Act Debarred Parties [ITAR]|||Smith, Wayne P.|2333 Big Woods, Edgerly Road||Vinton|LA, 70668|United States|US|[Status current to Department of State consolidated list, November 2006. Contact DDTC for further clarification.]|63 FR 29773-74<BR>June 1, 1998|6/1/1998||frserve\63FR2977374.pdf RISK_COUNTRY||_Y|</string>

Text-delimited Field Summary In text-delimited, new record commencements are marked with a single circumflex/carat (^), fields within records with a pipe (|). Return string fields with maximum lengths as applicable or populated are: MSR ID [9], Program [100], Type [50], Category [30], Name [2500], Street 1 [255], Street 2 [255], City [50], State [50], Country [50], Country Code [3], Notes [5000], FR References [500], Start Date, End Date, PDF Filename/Risk Country Alert [50], Client Reference Number [100], Alert [2]. These native fields are appended into eighteen pipe delimited fields: ^1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18| True names ^dp_id|dp_list|dp_type|dp_categry|dp_name|dp_street1|dp_street2|dp_city|dp_state|dp_country| dp_ctry_co|dp_notes|dp_frc|dp_start|dp_end|dp_frserve|optional_ID|alert_type| Descriptive names ^ MSR Reference Number | RPS Source List | Type [i.e. SDN sanction program] | Category [i.e. SDN type] | Name | Street 1 (if any) | Street 2 (if any) | City (if any) | State (if any) | Country (if any) | Country Code (if applicable) | Notes (if any) | F.R. Reference (if any) | Start Date (if applicable) | End Date (if any) | PDF file reference (if any) and Risk Country notice (if any) | Client-supplied ID (if given in search argument) | Alert level returned for this item in this search |

XML result string with matching records found When creating your caller/receiver, please ensure that it is not configured to request the WSDL with every webservice query, or is not inadvertently requesting the WSDL in tandem requests.

MSR eCustoms. All rights reserved Page # 8 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

The full WSDL for the Visual Compliance RPS Web Service can be obtained at: https://eim.visualcompliance.com/RPS_WS/RPSService.asmx?WSDL An XML result string, with no risk country report, will be similar to the following.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/"> <rps><rpsresult id="DBP000063"><list>Arms Export Control Act Debarred Parties [ITAR]</list><type></type> <category></category><name>Smith, Wayne P.</name><street1>2333 Big Woods, Edgerly Road</street1><street2></street2><city>Vinton</city><state>LA, 70668</state><country>United States</country><ctrycode>US</ctrycode> <notes>[Status current to Department of State consolidated list, November 2006. Contact DDTC for further clarification.]</notes><frc>63 FR 2977374&lt;BR&gt;June 1, 1998</frc><startdate>6/1/1998</startdate> <enddate></enddate><frserve>frserve\63FR29773-74.pdf</frserve> <optionalid></optionalid><alerttype>_Y</alerttype></rpsresult></rps></string>

An XML result string, including a risk country report, will be similar to the following. Note the annotation appended to field 16 (RISK_COUNTRY). This notice does not pertain to the name or company searched, instead only the search value provided for country. A current list of countries affected can be found at Visual Compliance online in the RPS pages.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ "><rps><rpsresult id="DBP000063"> <list>Arms Export Control Act Debarred Parties [ITAR]</list> <type></type><category></category><name>Smith, Wayne P.</name><street1>2333 Big Woods, Edgerly Road</street1> <street2></street2><city>Vinton</city><state>LA, 70668</state> <country>United States</country><ctrycode>US</ctrycode> <notes>[Status current to Department of State consolidated list, November 2006. Contact DDTC for further clarification.]</notes><frc>63 FR 29773-74&lt;BR&gt;June 1, 1998</frc><startdate>6/1/1998</startdate> <enddate></enddate><frserve>frserve\63FR29773-74.pdf RISK_COUNTRY</frserve> <optionalid></optionalid><alerttype>_Y</alerttype></rpsresult></rps></string>

XML Field Summary The XML field nodes are as follows, populated here with typical sample data marks. Fieldby-field, the descriptive names correspond to the text-delimited descriptions.
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/"> <rps> <rpsresult id="xxx"> <list>xxx</list> <type /> <category /> <name>xxx</name> <street1>xxx</street1> <street2 /> <city>xxx</city> <state>xxx</state> <country>xx</country> <ctrycode>xx</ctrycode> <notes>xxxxxxx xxxxxx xxxxxx</notes> <frc>xxxxxxx</frc> <startdate>xx/xx/xxxx</startdate> <enddate /> <frserve /> <optionalid /> <alerttype>xx</alerttype> </rpsresult> </rps> </string>

MSR eCustoms. All rights reserved Page # 9 of 10

6/7/2011

VISUAL COMPLIANCE EIM RPS Web Service Configuration Details (Confidential)

V 2.6

Alert levels Alerts for RPS official government list matches are: TR (Triple Red - Name, Company, Address, and Country found), DR (Double Red - Name or Company and Address and Country found), _R (Red - Name or Company and Country found), _Y (Yellow Name or Company found). These alerts are rigorously generated field-to-field, and iterated down through partial combinations of the supplied arguments to least-found or no match. [Alerts for My RPS inclusion tables are: 3R (Triple Red - Name, Company, Address, and Country found), 2R (Double Red - Name or Company and Address and Country found), _R (Red - Name or Company and Country found), _Y (Yellow Name or Company found). For My RPS subscribers, any alert found in your exclusion table will be converted to a conditional green EG for literal text match on name or company, or FG for a match on unique ID reference.] To reduce or avoid transmission errors, the return string is limited to 200 records a number already in excess of what generally is useful and pertinent in Restricted Party Screening. Error Messages (returned in results XML string) No Security Number
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">ERROR: Security Number is required.</string>

No Password
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">ERROR: Password is required.</string>

No Search Request
<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">ERROR: Search Request is required.</string>

Security Number or Password incorrect

<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">ERROR: The User Profile for '00000' does not exist.</string>

Search Modes not formatted properly

<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">ERROR: Search Modes not formatted properly.</string>

RPS Group Search contains a number other than 1,2,3,4,5,6

<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">ERROR: RPSGroupBypass is out of range.</string>

Not subscribed to any RPS Group

<?xml version="1.0" encoding="utf-8" ?> <string xmlns="http://tempuri.org/ ">ERROR: Access to RPS Groups Denied.</string>

MSR eCustoms. All rights reserved Page # 10 of 10

6/7/2011