Take a brand, a website, or an invoice and produce a defensible picture of who you are actually dealing with. Four layers — legal entity, people, infrastructure, reputation and risk — worked in that order. Skipping the first ruins everything after it: the trading name on the contract, the brand on the website, and the entity liable in court are routinely three different things, and every later finding attaches to the wrong one if you assume they match.

Write the target, the decision the work supports, the risk areas in scope, the jurisdictions involved, and what is out of bounds. Read ../../ETHICS.md. Corporate research on public filings is broadly lawful and often mandatory, but two limits bite. Stay passive toward the company's own systems — reading DNS and certificate logs is OSINT, authenticating or probing is not. And named individuals inside the company are still data subjects: an officer's directorships are fair game, their family is not.

Done when the scope note names the decision, risk areas, and jurisdictions, and states that no interactive testing is authorised.

You are looking for a registration number in a named registry. Until you have one, you do not have a subject.

Run for the registry mechanics. Record legal name, registration number, jurisdiction, incorporation date, status, registered office, officers, and share capital. Prefer the number over the name downstream — names change, numbers don't. Standard traps: an operating company and a holding company with near-identical names; a dissolved entity still trading under its old brand; a brand held by an IP entity in a different jurisdiction from the trading entity; a website run by a marketing entity that would not be liable for the product.

Done when you can name the entity that would be a party to your contract, with its registry and number, and have stated which other entities share the brand.

Walk up to the ultimate parent and down to the subsidiaries. Sources: filed group accounts and subsidiary lists, listed-company exhibits enumerating subsidiaries, beneficial ownership registers, and the shared-officer and shared-address pivots in . Cross-border chains are the norm, not a red flag. What matters is whether the chain ends in a named natural person or dissolves into a jurisdiction that publishes nothing. Record it as far as it goes and state where it stopped — "traced to a Cayman entity whose register is not public" is a finding, not a failure.

Beneficial ownership breaks down four predictable ways: nominees, legally recorded and economically irrelevant; trusts and foundations, which most registers do not pierce; layering, where no single register sees the whole chain; and thresholds, blind by construction to four people each holding just under the line.

Done when the ownership chain is drawn to its terminus or to a documented opacity point, and named beneficial owners are recorded with their source.

Pull the officer list from the registry, not the website — the website shows who they promote, the registry shows who is legally responsible. For each person who matters to the decision run , and run the officer-name pivot in for their other and prior directorships. A director with a trail of dissolved companies, or one on twenty unrelated boards, is a different risk profile from one with a coherent career.

Employee enumeration — headcount and function mix from professional networks, job postings, and the team page — tests whether the company is operationally what it claims. Platform counts include stale and duplicate profiles, exclude non-users, and skew hard by country and industry: use the shape of the workforce, not the number.

Done when every officer of record is listed with their other directorships checked, and the workforce claim is corroborated or flagged.

Run as the entry point; it covers , , and . What diligence wants from it, as opposed to security testing: registration dates contradicting the claimed founding date, infrastructure shared with unrelated brands under one operator, subdomains revealing unannounced products or partners, and job-posting evidence of the real stack. Check for public repositories and for breach exposure of the email domain.

Done when the domain portfolio is enumerated, registration dates are compared to the corporate timeline, and discrepancies are written down.

Calibrate financial findings to the filing regime first. A listed company files audited statements, segment detail, related-party transactions, and risk factors. A small private company in most jurisdictions files an abridged, often unaudited balance sheet with no profit-and-loss and no turnover figure — so absence of revenue disclosure there is the legal norm, not evasion. What is meaningful: late filings, repeated auditor changes, auditor resignation, qualified opinions, charges registered against assets, and accounts that do not square with the claimed scale of operations. Named sources per risk area: reference/diligence-checklist.md.

Done when litigation, insolvency, and procurement each have a sourced finding or a recorded "searched these databases, nothing found", and financial findings are framed against what this entity type was required to disclose.

Its own step with its own record, because it is the one a regulator or a court will ask you to evidence. Screen the entity, its parents and subsidiaries, and every named individual. Primary publishers: OFAC's sanctions list search, the EU consolidated list, the UK sanctions list, the UN consolidated list. OpenSanctions aggregates sanctions and PEP datasets across jurisdictions and is the practical start for a cross-jurisdiction sweep; OCCRP Aleph is a research index, for investigative rather than compliance screening. PEP status is a risk factor, not wrongdoing, and it extends to close associates and family — exactly where automated screening is weakest.

Adverse media means a structured search of news and regulatory announcements against the entity, its former names, and its principals, in the local language of every jurisdiction in the chain. An English-only search on a company with a foreign parent is close to worthless. Record search terms and date range so the negative is evidentially meaningful.

Done when every entity and person in the chain is screened against sanctions and PEP sources with sources and date recorded, and adverse media is searched in the relevant languages.

Score the profile; do not react to one indicator. Weighted catalogue: reference/shell-company-red-flags.md. Core cluster: an address shared by hundreds or thousands of entities; incorporation shortly before the transaction it is party to; no web presence, or a domain post-dating the pitch; nominee directors recurring across unrelated companies; no employees and no accounts showing activity; a name mimicking an established firm; bank details in a jurisdiction unconnected to the entity, the directors, or the work. Any one is common and innocent. Four together is the answer.

Done when the entity is scored against the catalogue with each indicator sourced, and the conclusion states which indicators drove it.

Hand to . Lead with the entity chart — ultimate parent, intermediate holdings, contracting entity, subsidiaries, key people — then findings by risk area with source, date, and confidence. Gaps get their own section; a diligence report that hides what it could not check is worse than one that found nothing.

Done when the brief has an entity chart, per-risk-area findings, an explicit gaps section, and a stated overall confidence.

Grade ownership claims separately from operational ones. You can be certain who the registered shareholder is and have no idea who benefits.

Vendor "Halberd Logistics" pitching a supply contract; you hold a website and an invoice.

KYB, AML, and sanctions-compliance obligations impose source and record-keeping requirements this workflow does not discharge on its own; for a regulated purpose your record must show what you searched, when, and with what result. Registry data often carries reuse conditions and rate limits — use the published APIs and bulk products rather than scraping. Officer residential addresses and dates of birth are protected in many registers, and deliberately re-identifying a protected address is an offence in some jurisdictions.