Dun & Bradstreet: business identity, credit data and compliance workflows

Dun & Bradstreet connects business identities with ownership, corporate relationships and risk information. For a brokerage, the practical use is understanding corporate applicants, counterparties and service providers across onboarding and ongoing review. Its portfolio spans compliance, credit management, supplier assessment and master data; the relevant subscription depends on which of those decisions the firm needs to support.[1]

Compliance Intelligence covers sanctions, watchlists, politically exposed persons, legal events and adverse media. Configurable rules, entity histories and contextual information support review. A screening hit is an input to the customer’s decision process; the product description does not establish that every similarly named person or company is the relevant subject.[6]

Finance Analytics combines business information with a customer’s credit policies. DecisionMaker supports configurable applications and scorecards; Account Manager can combine receivables data with external signals to prioritise credit review and collections. These are commercial-credit workflows. The published scope does not establish a brokerage trading-margin engine or execution-risk system.[8]

The public Direct+ authentication guide specifies OAuth 2 client credentials. An application exchanges its key and secret for a bearer token at plus.dnb.com/v1/token; the documented token lasts 24 hours, and error 00040 signals expiry. Credentials and tokens are sensitive. Token renewal therefore belongs in the integration design, alongside failure handling, rather than being treated as a one-off setup action.[10]

The Direct+ documentation index separates identity resolution and search, enrichment, monitoring, data files and research. Some detailed linked guides require sign-in. The public material reviewed did not establish one current rate quota, a universal monitoring delay or a complete field entitlement for every customer. Those parameters belong to the selected API product and subscription.[11]

D&B announced customer access to its hosted MCP servers through ChatGPT and Codex in June 2026, including Finance Analytics workflows. That announcement supports the named connection and its intended business use. Actual access, allowed data and actions still depend on the customer’s D&B arrangement and connector configuration; the advertised time savings were not independently tested.[21]

Current enterprise product pages direct prospective customers to consultation or demonstrations. A useful public example is the UK G-Cloud 14 Risk Analytics schedule, dated March 2024 and expressly restricted to public-sector entities. It illustrates packaging, rather than establishing a current brokerage quotation.[13][4]

The accompanying listing labels its GBP 8,152 headline price per licence per year.[12]

The schedule charges by transactions, with no additional per-user charge. It allows multi-year increases of up to 6% annually from year two, provides online training without charge, and prices onsite training at GBP 1,280 per visit.[13]

The August 2026 general terms make the Order decisive for licensed territory, period and permitted use, subject to an applicable separate master agreement. Invoices are normally due within 30 days of the invoice date unless agreed otherwise; taxes are additional.[15]

The D-U-N-S Number is a nine-digit identifier for businesses. D&B offers free issuance and lookup, and lets eligible US non-public companies view and request updates through D-U-N-S Manager. Keeping the identifier aligned with the intended business record matters when a firm has similar trading names or multiple related entities. The number identifies a business; risk assessment requires the associated information and the customer’s review.[3]

Implementation also needs a record of which score version and fields a policy uses. The current-linked lifecycle policy allows data elements to change when sources or law change, while preserving the Order’s purpose. It permits equivalent report layouts and product upgrades with reasonable notice, transition access, support and training. A downstream rule should therefore be tested against a changed data definition, rather than relying only on an unchanged field label.[18]

The public Direct+ index directs service-disruption questions to the Digital Service Center and advertises 24/7 help. This is a support-access statement; the retrieved index does not set a universal restoration target.[11]

The UK G-Cloud listing states a 24-business-hour response and weekday phone/chat coverage from 9 a.m. to 5 p.m. UK time. This covers the listed service.[12]

The March 2024 pricing document gives 8:30 a.m.–5:30 p.m., Monday–Friday. Customers using this procurement route should establish which hours apply to their agreement.[13]

D&B’s security page describes least-privilege access, API authentication, HTTPS, input validation, rate limiting, vulnerability management and continuity planning. It reports annual SOC 2 Type 2 attestation and ISO/IEC 27001:2022 certification at multiple locations. The underlying SOC report is available under NDA; this profile has not independently inspected its coverage or exceptions.[17]

The general terms restrict use to the licensed purpose. Redistribution and derived recommendations to third parties require appropriate permission. On expiry, termination or replacement by a superseding service, licensed information normally must be deleted, with narrow archival, compliance and contact-data exceptions. Export capability therefore does not confer continuing commercial reuse rights.[15]

The Global Privacy Exhibit distinguishes D&B personal data licensed to the customer from customer personal data processed by D&B. The processor role follows documented contractual instructions. Incident notifications go promptly to the registered service-contact address; the reviewed clause does not promise a fixed 72-hour customer notification. At termination or non-renewal, customer personal data is deleted or returned unless law requires storage. These obligations concern different data flows from the customer’s licence to retain and reuse D&B information.[16]

The same exhibit says professional contact information may not carry consent for direct marketing and may not have been screened against all applicable suppression lists. A data subscription therefore needs to be combined with the customer’s own lawful-use and opt-out controls.[16]

D&B traces its origins to 1841 and introduced the D-U-N-S Number in 1963. Its current positioning centres on the Commercial Graph: linked business identities, ownership, relationships and risk context. The group also works with local information providers through its Worldwide Network. Global reach does not imply identical data completeness, refresh timing or contractual rights in each jurisdiction.[21][1]

The UK company’s registered office is The Point, 37 North Wharf Road, London, W2 1AF. That legal entity and its company-registration date should be distinguished from the group’s longer history. The customer agreement identifies the relevant contracting affiliate; the group brand alone is insufficient to identify who provides a particular service.[19][16]

Operator

Dun & Bradstreet Holdings, Inc. group; contracting affiliate specified in the customer agreement

Service scope

Business identity, ownership, commercial credit, third-party risk and master-data services.

Customer types

Financial institutions; Corporate credit teams; Compliance teams; Procurement teams; Public-sector organisations

Delivery

Hosted; API

Pricing publication

Public and quoted pricing

Platforms

D&B Direct+; D&B Connect; D&B Finance Analytics; D&B Risk Analytics

Integrations

REST APIs; Batch and cloud data delivery; Salesforce; MCP connectors

Pricing scope

Enterprise scope is quoted; a dated UK public-sector procurement schedule provides limited published examples.

Implementation

Select licensed datasets and workflow, resolve entity records, configure policies and permissions, then integrate the chosen delivery route.

Support

Service Center and product teams; publicly listed support hours and response commitments are product- and contract-specific.

Permissions and regulatory scope

Data licensing and processing obligations depend on the affiliate, product and use case. A business identifier or screening result does not confer a financial-services permission.

Provider metadata checked 20 Oct 2026Source 1Source 2Source 16Source 23Source 4Source 5Source 13Source 9Source 11Source 15Source 21

For the listed G-Cloud service, data can be exported before the contract ends, and application access then stops. The technical export window and the legal right to keep using the exported information are separate matters.[12]

The lifecycle policy normally provides 12 months’ notice before discontinuing a score or product, with shorter periods allowed for specified regulatory or compliance risks and, for products, by agreement. Score withdrawal includes an alternative; product sunset reduces fees attributable to discontinued services. This gives an integration team a migration framework, while leaving urgent-change exceptions material.[18]