SAM.gov, fully explained.

The System for Award Management (SAM.gov) is the federal government's central source of truth for entity registration. It answers a single question: is this vendor legally permitted to receive federal money right now?

SAM is not a vetting system. It does not vouch for capability, financial health, or past performance. It certifies three narrow things: that the entity exists as it claims, that it has filed the required representations and certifications for the current fiscal year, and that it does not appear on any active federal exclusion list. Registration is free and is processed by GSA on behalf of the federal acquisition community (sam.gov/content/entity-registration).

The most common diligence failure here is treating an active SAM registration as a clean bill of health. An active SAM is necessary; it is the lowest possible bar. Labor enforcement, sanctions list hits, supply chain risk, and Section 889 hardware exposure all live outside SAM and have to be checked separately.

In April 2022, the federal government retired the DUNS Number, the proprietary Dun & Bradstreet identifier that had served as the unique entity ID since 1998. It was replaced with the Unique Entity Identifier (UEI), which SAM.gov now generates itself at registration. The UEI is public, free, and not tied to a third-party data broker.

UEI

Unique Entity Identifier. 12-character alphanumeric. Assigned by SAM.gov at registration. Public, free, replaces DUNS as of April 2022.

CAGE

Commercial and Government Entity code. 5-character. Assigned by the Defense Logistics Agency. Identifies a specific physical location, not the legal entity. One company can have multiple CAGE codes (one per location) but only one UEI.

EIN

Employer Identification Number. 9-digit federal tax ID issued by the IRS. Maps to the legal taxpaying entity. Free to obtain online (www.irs.gov/businesses/small-businesses-self-employed/employer-identification-number).

TIN

Taxpayer Identification Number. Broader category covering EINs, SSNs, and ITINs. For most businesses, the EIN is the TIN.

DUNS

Retired April 2022. Some legacy federal systems still reference DUNS; FPDS award records before the cutover are indexed by DUNS. Modern lookups should use UEI.

Resolving a vendor to its canonical UEI is the first step of every DiligenceDesk audit. A loose name match against SAM is the most common way analysts pull labor enforcement, performance, or sanctions context for the wrong company. The UEI eliminates that ambiguity.

SAM.gov reports a small set of entity statuses. Each one carries a different procurement consequence. The categorical names below match what you will see in SAM's entity record; the consequences are how DiligenceDesk and most procurement workflows treat them.

Active

Eligible. Registration current, no exclusions on file. Eligible for federal award.

Active w/ excl

Disqualifying. Registration current but the entity also appears on an active exclusion list (debarment, suspension, ineligibility). Disqualifying for new awards.

Pending

Renewal in progress. Not yet validated. Surface as a watch item; do not treat as fully active.

Inactive

Blocks new awards and pauses payment on existing contracts within a few business days.

Not registered

Entity has never registered with SAM. Disqualifying for any federal work, but expected for non-vendors.

SAM.gov consolidates federal exclusion data that used to live in the now-retired Excluded Parties List System (EPLS). An exclusion can come from any agency with debarment authority: GSA, DoD, OFAC, SBA, IRS, OIG, and many more. The cause varies (fraud conviction, false certification, performance default, sanctions designation, criminal indictment), but the consequence is uniform: the entity is barred from receiving new federal awards for the duration of the exclusion.

Exclusions appear on the SAM record itself, which is what makes a SAM check the right gate. The full exclusion catalog is searchable directly at sam.gov/content/exclusions.

SAM registrations are valid for 365 days from the date of activation (sam.gov/content/entity-registration). The renewal window opens 60 days before expiration. A lapsed registration immediately blocks new awards and pauses payment on existing contracts within a few business days.

1. T − 60 days

   Renewal window opens

   SAM emails the registered point of contact. The vendor can begin renewal but is not yet required to.
2. T − 30 days

   Reminder cadence increases

   Weekly reminders from SAM. DiligenceDesk surfaces an "expiring soon" warning on the entity card automatically.
3. T − 0

   Expiration

   Registration goes inactive. New awards blocked. Payments on active contracts pause within a small number of business days.
4. T + 90 days

   Re-registration required

   Beyond 90 days lapsed, the vendor typically has to re-register from scratch, including re-verification of every representation and certification.

Initial registrations and renewals can take up to 10 business days to validate (sam.gov/content/entity-registration). Vendors who treat SAM as a last-minute task before submission routinely miss award deadlines.

Patterns that show up repeatedly in pre-award diligence reviews:

• Searching by trade name instead of legal entity name. "ACME Federal" on a capability statement may be a DBA. The SAM record is filed under the legal entity, which could be "ACME Holdings, LLC" or similar. A name-only search misses the actual record.
• Treating a CAGE match as an entity match. CAGE codes identify locations, not entities. A vendor with five offices has five CAGE codes but one UEI. Always anchor diligence to the UEI.
• Missing the affiliate / subsidiary distinction. A clean SAM record on a subsidiary does not clear the parent or the wider corporate family. Section 889 specifically applies to affiliates of named manufacturers, not just the named entity.
• Skipping the FAR 52.204-26 representation. Offerors must certify they have checked SAM for entities barred from receiving Section 889-related awards (www.acquisition.gov/far/52.204-26). False certification is a contract-termination event.
• Trusting an old SAM snapshot through a long procurement cycle. Exclusions are added daily; an audit from 60 days ago is not a current state.
• Confusing "not registered" with "non-existent". Many real companies are simply not federal vendors. Absence from SAM is expected for non-vendors and is not by itself a red flag.

DiligenceDesk uses the SAM record as the canonical identity anchor for every audit. The orchestrator first resolves the user's query (legal name, UEI, or CAGE) against the SAM API, picks the best match, then uses the resolved legal name for every downstream lookup (DOL, OSHA, ITA Consolidated Screening List, USAspending, SEC EDGAR, GLEIF, NIST NVD, and the Section 889 hardware registry).

SAM exclusions and expired registrations are surfaced in the verdict ladder directly. An active SAM exclusion produces a FAIL verdict regardless of what the other sources show. An expired registration produces a WARNING. A "not registered" result returns NEUTRAL rather than FAIL, because most companies in the world are simply not federal vendors and absence from SAM is not by itself disqualifying.

The full methodology page documents how SAM evidence interacts with the other intelligence pillars in the unified verdict.