ChowIndex aggregates every COA, recall, lab dispute, consumer complaint, and state-law change across the U.S. hemp / THCA / intoxicating-hemp market into one live risk score per merchant. As a Risk Controller you monitor the businesses on your book in real time and get paged the moment one slips out of compliance — before chargebacks, regulator notices, recall letters, or claims hit you.
Pin the merchants you back. Their live risk score, COA failures, and state-law exposure roll up to one dashboard.
Score < 60, COA disputed by lab, banned in 3+ states — get paged via email, Slack or webhook the instant they fire.
Every score change is timestamped and exportable. Defensible for examiners, reinsurers, and your board.
Sub-minute event delivery into your fraud system, GRC stack, or core banking platform.
Continuous due-diligence on hemp / cannabis-adjacent depository relationships. FinCEN red flags surfaced before they become SARs. Section 1071 evidence packs.
Pre-boarding risk score for new MID applications. Live monitoring of boarded merchants. Early-warning for COA forgery patterns that historically drive chargebacks.
Product-liability, general-liability and recall exposure for hemp-derived cannabinoid policies. Continuous portfolio monitoring with quarterly evidence packs for reinsurers.
Pre-funding risk lookup and ongoing covenant monitoring. Watch for product bans, ownership changes and lab-refute spikes that signal repayment risk.
We don't gate capabilities behind sales calls. Here is the full list of what your controller account unlocks the moment you verify your email.
Segment merchants by MID, product line, geography, underwriter, or any custom tag.
Paste merchant names or upload a CSV with DBA, EIN, MID — auto-matched to ChowIndex profiles.
Every merchant rendered with a real-time score (0–100), risk band (green/yellow/red), and trend arrow.
Day-by-day score chart for every merchant, with hover-over reason codes for every inflection.
Each score is decomposed into contributing factors — COA failures, state-law exposure, complaints, recalls, ownership.
See how a merchant ranks against the median in its product category (e.g. THCA flower, Delta-8 gummies).
"Notify me when MID X drops below 65" — instant page on crossing.
Page when any accredited lab refutes or flags-forged a COA tied to your merchant.
"Alert when product is banned in N+ states" — directly tracks emerging state laws.
Page on FDA warning letters, state-AG actions, and voluntary recalls touching your merchants.
Boolean rules across any of 40+ signals — combine score, geography, product class, complaint volume.
Route critical alerts 24/7, low-severity to weekday business hours. Per-channel.
HMAC-SHA256 JSON events, sub-minute delivery, retries with exponential backoff + dead-letter queue.
Read every merchant, every score change, every trigger event. OAuth2 client-credentials.
Native channel posts with one-click ack & comment.
Pre-built for ServiceNow GRC, Archer, LogicGate, MetricStream, AuditBoard.
Unit21, Hummingbird, Sardine, Alloy, Sumsub, Persona, ComplyAdvantage.
Nightly bulk extracts to your data lake (Snowflake, BigQuery, Databricks, Redshift).
Every score change, every alert sent, every comment — timestamped, user-attributed, append-only.
One-click PDF + CSV evidence bundle per merchant — drop-in to SAR support, OCC exam, reinsurer review.
Auto-generated board-ready PDF summarizing score distribution, trigger volume, top movers.
Structured fields aligned with CFPB 1071 small-business credit reporting.
Control test artefacts & log retention sufficient for SOC-2 Type II vendor due-diligence reviews.
Configurable per-tenant retention (7 years default, extendable to 10).
Role-based access — admin, analyst, view-only. Per-user audit log.
Okta, Azure AD, Google Workspace, JumpCloud, OneLogin, PingFederate.
Automated user lifecycle from your IdP.
Opt-in (default off) — controls whether regulators can see that your institution backs a given merchant.
Self-serve, cancel anytime, invoiced or card. Annual discount on Enterprise.
Named human contact for portfolio reviews and emerging-threat briefings.
Pick your account type (Bank, Processor, Insurer, Other), submit a work email, and verify.
Starter, Pro or Enterprise — Stripe-billed, cancel anytime from the dashboard.
Paste merchant business names or upload a CSV with DBA / EIN / MID. We auto-match to ChowIndex profiles.
Pick from prebuilt triggers or write a custom rule. Set channels — email, Slack, Teams, webhook.
(Optional) Drop the webhook URL into your fraud platform, GRC tool, or core banking system.
Existing ChowIndex merchants are scored instantly; net-new merchants begin appearing in the index within 24 hours.
All plans include unlimited triggers, full audit trail, and all 50-state coverage.
| Capability | ChowIndex Risk Controller | Generic merchant monitor (G2, LegitScript, etc.) |
BSA/AML platform (Unit21, Alloy, ComplyAdvantage…) |
|---|---|---|---|
| Merchant KYB at onboarding (EIN, business docs, ownership) | ✓ | — | ✓ |
| Sanctions / OFAC / PEP screening | — | — | ✓ |
| Storefront keyword scanning | — | ✓ | — |
| Live COA failure / refute monitoring | ✓ | — | — |
| State-by-state hemp legality tracking | ✓ | — | — |
| Lab-forgery detection | ✓ | — | — |
| Recall & warning-letter ingestion | ✓ | — | — |
| Per-merchant audit-trail evidence pack | ✓ | — | ✓ |
| Reinsurer / OCC examiner-ready PDF | ✓ | — | — |
ChowIndex is complementary to (not a replacement for) your BSA/AML platform. We sit in the cannabis-specific risk layer those tools don't cover.
TLS 1.2+ in transit, AES-256 at rest. Customer-managed key wrap available on Enterprise.
Report available on request under NDA. Updated annually.
Standard DPA on file; BAA on Enterprise. SCCs available for EU subprocessors.
Vendor due-diligence questionnaire (SIG-Lite + CAIQ) ready to send.
Annual third-party pentest; summary letter available under NDA.
All controller data stored in AWS us-east-1 by default. Multi-region on Enterprise.
Click Register Now to create your account. Already have one? Sign in.
No setup fee. Plan selection happens after sign-in.
ChowIndex Risk Controller Portal is a compliance and merchant-risk monitoring platform designed for banks, payment processors, acquirers, ISOs, MGAs, and insurance carriers that underwrite or board cannabis, hemp, THCA, Delta-8 and intoxicating-hemp businesses. You add the merchants on your book to a portfolio watchlist, and ChowIndex pages you the moment a COA is disputed, a recall is issued, a product is banned in a new state, or a merchant's public risk score crosses a threshold you define.
Cannabis-friendly banks (community banks, credit unions, FBO sponsors), high-risk payment processors and acquirers, ISOs and PayFacs onboarding hemp merchants, surety carriers, product-liability and general-liability insurers writing cannabis policies, reinsurers requiring portfolio evidence, and BSA/AML compliance teams at any FI with cannabis-adjacent exposure.
Generic merchant monitoring tools scan storefronts for prohibited keywords and broken links. ChowIndex is built specifically for the hemp / THCA / intoxicating-hemp regulatory layer: we ingest every Certificate of Analysis, every lab refute, every state-by-state legality change, every recall, and every consumer complaint, and we normalize them into one live merchant risk score. We give you defensible documentation — not just an alert.
Score-drop thresholds (e.g. score falls below 60), COA refuted by accredited lab, COA flagged as forged, product banned in N+ states, new state-level legal action, consumer-complaint volume spike, ownership change, FinCEN red flags, recall issued, and custom rule expressions. Alerts dispatch via email, Slack, Microsoft Teams, or HMAC-signed webhook.
No. By default, controller activity is private. The watchlist and alerting layer is invisible to the merchant. You may optionally request visible-on-product-page status — useful for some insurance partnerships — but it is opt-in.
Yes. The Controller Pro and Enterprise tiers expose HMAC-signed outbound webhooks, a JSON REST API, NDJSON/CSV exports, and pre-built connectors for ServiceNow GRC, Archer, LogicGate, Hummingbird, Unit21, Sardine, and Alloy. Sub-minute alert latency.
Yes. Every score change, every alert sent, and every COA event is timestamped, immutable, and exportable as a CSV evidence pack — ready to drop into a Section 1071 file, an OCC exam response, a SOC-2 control test, or a reinsurer's quarterly portfolio review.
Starter ($499/mo) is for small books — up to 100 watchlist merchants, email alerts only. Pro ($1,499/mo) adds 500 merchants, outbound webhooks, REST API, Slack/Teams, NDJSON exports, and audit-trail packs. Enterprise ($4,999/mo) gives unlimited merchants, SSO, custom SLA, dedicated risk analyst, regulator-direct escalation, and on-prem evidence-pack delivery.
Account verification is automatic via email. Watchlist setup begins immediately after sign-in — paste a list of merchant business names or upload a CSV. Coverage of merchants already known to ChowIndex is instant; coverage of new merchants begins within 24 hours of being added.
ChowIndex primarily covers the federally legal but state-variable hemp / THCA / intoxicating-hemp market — exactly the segment your bank or processor is most likely boarding. We also surface state-regulated cannabis merchants where they sell to the public via e-commerce, but the risk model is tuned for the interstate hemp side, which carries the most ambiguous and rapidly changing exposure.
Yes. All controller data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We sign DPAs and BAAs on Enterprise. SOC-2 Type II report and FFIEC vendor-due-diligence pack are available on request.
If your institution boards, banks, processes, finances, or insures a single hemp-derived cannabinoid merchant — a Delta-8 brand, a THCA flower distributor, a Delta-9 hemp beverage company, an HHC vape line — you are carrying a layer of risk that no generic merchant-monitoring tool was designed to see. The 2018 Farm Bill federally descheduled hemp containing less than 0.3% Δ9-THC, but the consumer-product market that emerged moves at a speed and operates under a state-by-state legality patchwork that traditional compliance tooling cannot keep pace with. A merchant fully compliant in Florida on Monday can be selling federally legal but state-banned products in Mississippi by Wednesday and facing an AG enforcement action by Friday.
ChowIndex Risk Controller Portal was built specifically for this gap. We aggregate every Certificate of Analysis the merchant publishes, every signed-off or refuted result from accredited labs (ISO/IEC 17025 testing facilities, state-licensed cannabis labs), every state-by-state intoxicating-hemp law change, every FDA warning letter, every state-AG action, every voluntary recall, and every consumer complaint into a single live risk score per merchant. You assign that score a threshold — and we page you the moment it crosses.
If you are evaluating compliance software for your cannabis or hemp merchant book — sign up above. The Starter plan ($499/mo) supports your first 100 merchants and pays for itself the first time we page you about a recall, a forged COA, or a state ban before it becomes a chargeback, claim, or examiner finding.
Catch chargebacks, recalls, and exam findings before they catch you.
Register Now →Already have an account? Sign in