Lead Sourcing & Enrichment Waterfall

Who does what

• Requester owns the lead need, the budget and the final acceptance.
• List Builder a GTM engineer or RevOps operator, builds the list.
• Privacy Lead a DPO, counsel or delegate, owns the channel flags and retention.
• Reviewer a sales or SDR lead, checks samples and edge cases.
• CRM Admin owns the field mapping, duplicate rules, owners and the import.

What you need

• A versioned ICP brief with personas and a destination.
• Your markets, the planned channels and any consent sources.
• The tools and API access you have.
• A budget, suppression lists and a retention rule.

Some answers are yours to set before the first run:

• The sample precision and defect thresholds.
• The contact cap per account.
• The order of email providers, the credit cap and the rule for catch-all addresses.
• How old data may be at handoff, and how long unused rows are kept.

1Check the brief

• Lead need confirmed
• Ready to source?
• Run stopped before sourcing

The run starts only on a dated count that shows a gap. Stale counts are recounted first, and existing CRM records you can reactivate join the list and pass every check like new ones.

The first decision asks whether the brief is ready to source. Two operators should classify a known positive and a known negative example the same way. Before any personal data is collected, each channel gets a flag per market:

• Eligible.
• Consent required.
• Not eligible.
• Needs legal review.

The Privacy Lead confirms the flags and documents the interest assessment and the plan for the Art. 14 notice, and only the data the eligible channels need is collected. When the brief is unclear or no channel is eligible, the run stops here, before any data exists. The brief goes back to ICP & TAM Mapping, or the channels and markets change.

2Plan and build

• Plan sources and test a sample
• Build and normalize the list

The List Builder chooses a route per segment:

• AI Ark company or lookalike search.
• Clay Find Companies or Find People.
• Apollo People Search.
• Sales Navigator by hand only, with no export and no scrapers, because LinkedIn's terms ban them.

Each route is tested on about ten rows, and the Reviewer rates every row with a reason. When precision falls short of the threshold, you refine the filters and sample again. Filters are never broadened silently.

The approved volume is then pulled into Clay with its provenance: route, record ID, query and retrieval time on every row. Caps cut pulls without a warning, and a count that lands on a cap gets split by region, size or title:

• Clay imports stop at 50,000 rows.
• AI Ark returns 10,000 results per search.
• Apollo People Search returns 50,000.

Domains and LinkedIn URLs become stable keys, and rows with a missing key go to review.

3Screen and enrich

• Dedupe and suppression screen
• Enrich companies and score ICP fit
• Find people and verify current employment

Before any credit is spent, the list is screened:

• Duplicates are resolved by rule.
• Rows in an active campaign or on a suppression list leave the run.
• Customers, open deals and existing CRM records follow your policy.
• An objection to direct marketing is final: its minimal suppression key stays, and do not contact lists stay in sync.

Enrichment fills only the fields that change a decision, and only for accounts that pass the basic qualifiers. Run conditions in Clay keep columns from firing on rows without a key or with a filled field. Hard disqualifiers come first, then the fit score and a tier from 1 to 3. Buying signals stay separate from fit.

For each qualified account, people are found by title keywords and mapped as decision makers, champions and influencers, up to your contact cap. Database records can lag behind LinkedIn, so every person's current employment is confirmed before the email search, and only people confirmed as current continue.

4Find verified emails

• Email allowed for this contact?
• Work-email waterfall and verification

The second decision is made per contact: is a work email allowed? The answer comes from the market flags, the contact's country and subscriber type, and any consent record. In the UK, sole traders and some partnerships count as individual subscribers. Contacts without email eligibility skip the email search, which saves credits and data, and keep their other channels.

For eligible contacts, a waterfall in Clay asks providers in order and stops at the first result that passes your validation strategy, charging only that provider. ZeroBounce verifies the result. Statuses differ between tools, so they are normalized:

• Valid is allowed.
• Invalid, disposable, spamtrap, abuse and role addresses are blocked.
• Catch-all follows your team's rule.
• Unknown results are checked again after a delay.

Phone numbers are added only where the phone channel is eligible.

5Approve and hand off

• Qualify rows and approve a sample
• Import to CRM
• Reconcile the run and hand off
• Campaign-ready list delivered

A row is released only when every check passes, and anything that needs review is held. The Reviewer samples each segment by status, route, tier and market, excluded rows included. For Austria, addresses are checked against the RTR's ECG list before release. The Requester then approves one exact list version, and approval never carries over to the next one.

The CRM Admin imports lookup first:

• Contacts are upserted by email.
• Companies are looked up before they are created, because HubSpot does not deduplicate companies created through its API.
• In Salesforce the import uses an external ID, with Clay's create action switched off.

Every row ends with one CRM reference or the reason it failed. The List Builder then reconciles the run, with rows per step from pulled to imported, credits and cost per step, and a retry list for the failed rows only. The handoff carries:

• The view, the channels, and email status and date.
• The Art. 14 notice deadline, due within one month of obtaining the data or at first contact.
• The refresh and retention dates.

The run closes when the need is met or the remaining gap is accepted, and the receiver confirms the handoff.

Compliance checks

The playbook carries checks for the EU, Germany, Austria, Switzerland, the UK and the US. Three examples:

• Under the EDPB's guidance, legitimate interest cannot cover collecting data for sending that is not permitted, so channel flags come before any data.
• In Germany, cold email needs prior express consent.
• In the US, CAN-SPAM asks for accurate headers, a postal address and an opt out honoured within ten business days.

They are checks for your Privacy Lead and no legal advice.

Run it in Vanthis

In Vanthis the playbook becomes your own Motion on the Canvas. You adapt it to your tools, providers and CRM, and your agent, Claude or ChatGPT, works through it step by step with each step's instructions. To run it somewhere else, download it as Markdown or as an agent skill.