Third-Party Due Diligence with OSINT: A Proportionate Checklist

Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.

TL;DR

• Supplier questionnaires record what a third party chooses to tell you. In vendor due diligence, OSINT lets a small team test those answers in under an hour per supplier.
• Tier your third parties by risk first, then apply a fixed checklist: registry, ownership, domain age against claimed history, website and contact consistency, sanctions screening, adverse media, and a written decision.
• The UK failure to prevent fraud offence (in force since 1 September 2025) and recent FCA and OFSI enforcement make "we asked and they said yes" a weak position.
• UserSearch puts Corporate Intelligence, Domain Intelligence and 100+ third-party sources behind one account, with Cases that keep the search record next to your decision.

Why Are Supplier Questionnaires Not Enough?

Vendor due diligence with OSINT means testing what a supplier tells you against open sources such as company registries, domain records, website archives, sanctions lists and news coverage. Most small compliance and procurement teams run third-party due diligence the same way. A supplier fills in a form, uploads a certificate of incorporation and ticks "no" to every question about sanctions and litigation. Someone files it. Six months later an invoice arrives from a slightly different bank account and nobody can say whether the company was ever what it claimed to be.

The questionnaire is not the problem. The problem is that nothing tests it. A company registry, a domain registration record, an archived copy of a website and a sanctions list are all free or cheap to check, and each one either supports or contradicts what the supplier told you. When they contradict it, you have learned something no form would have told you.

This guide is a proportionate checklist for teams without a dedicated intelligence function: a procurement lead, a two-person compliance team, a finance controller who owns vendor onboarding. It covers how to tier suppliers, the checks to run at each tier, the commands and search strings that make those checks repeatable, and how to record a decision you can defend later.

What Does Third-Party and Vendor Due Diligence Cover?

Third-party due diligence is the set of checks you run on an organisation before, and periodically after, you rely on it: suppliers, resellers, agents, distributors, outsourcers. It asks four questions. Does this entity exist and trade? Who owns and controls it? Is it, or any of its owners and officers, subject to sanctions? Is there credible public information that changes the risk?

The ownership question is the one small teams skip most often, and it matters most for sanctions. In the UK, companies must record their people with significant control (PSCs), meaning individuals who hold more than 25% of shares or votes, can appoint or remove a majority of the board, or otherwise exercise significant influence. The Companies House PSC guidance sets out the tests. Overseas registries vary widely, and some publish no ownership at all, which is itself a data point.

This article is about the wider process. Proving that a single company exists and genuinely trades is one step inside it, and we treat it briefly here as the registry and footprint checks.

Why Regulators Now Expect Evidence, Not Assurances

Three recent developments changed the stakes for UK organisations.

First, the failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It applies to large organisations and makes them liable where an associated person commits a specified fraud offence for their benefit, unless they had reasonable procedures in place. The Home Office's guidance to organisations lists due diligence as one of its principles and names, as examples of good practice, "screening tools, internet searches, checking trading history or professional or regulated status". That is an open-source checklist in all but name.

Second, sanctions screening failures are being punished even where there was no intent. In October 2024 the FCA fined Starling Bank £29m after it emerged that its automated system had, since 2017, been screening customers against only a fraction of the full sanctions list. The lesson for a procurement team is uncomfortable: having a screening step is not the same as the step working.

Third, the UK changed its sanctions list. From 28 January 2026 the UK Sanctions List became the single source for all UK designations, and the old OFSI Consolidated List stopped being updated. Any spreadsheet, supplier portal or script still pointed at the old list is now out of date. OFSI's published enforcement decisions show penalties against non-banks too, such as a £152,750 penalty on Colorcon Limited in September 2025 for making funds available to a designated person without a licence.

If your team sits in a regulated firm, our anti-money laundering page explains how AML teams use UserSearch alongside their core screening tools.

How Do You Tier Third Parties So the Effort Is Proportionate?

Proportionate means you do not run the same checks on a stationery supplier as on an overseas agent who will handle customer money. Before any research, put each third party into a tier. We suggest three, driven by spend, access and geography.

Write the tiering rule down once and apply it consistently. An auditor is more interested in whether you followed your own rule than in whether the rule is perfect.

The Proportionate OSINT Checklist, Step by Step

Here is the manual method, in the order we run it. Each step either confirms the questionnaire or produces a question for the supplier.

Step 1: Registry status and filing history

For UK entities, start at Companies House. Check the status (active, dissolved, in liquidation), incorporation date, registered office, nature of business (SIC codes), whether accounts and the confirmation statement are overdue, and any name changes. If you check more than a handful of companies a week, register for a free API key on the Companies House developer hub and script it:

export CH_KEY="your-api-key"
curl -s -u "$CH_KEY:" \
  https://api.company-information.service.gov.uk/company/01234567 \
  | jq '{name: .company_name, status: .company_status, created: .date_of_creation,
         accounts_overdue: .accounts.overdue, previous_names: .previous_company_names}'

-u "$CH_KEY:" sends the key as the Basic auth username with nothing after the colon, which is how the API expects it; without it you get a 401. jq (install with your package manager) trims the JSON to the fields you need. The API is rate limited, so add a pause if you loop over a list.

For overseas entities, go to the national registry first and use OpenCorporates as a finder. The OpenCorporates API now needs an API token even for basic calls, and default limits are low (the documentation quotes 50 requests a day), so treat it as a pointer to the official source rather than the source itself.

curl -s "https://api.opencorporates.com/v0.4/companies/search?q=example+packaging&jurisdiction_code=ae_du&api_token=$OC_TOKEN" \
  | jq '.results.companies[].company | {name, company_number, jurisdiction_code, incorporation_date, current_status}'

jurisdiction_code narrows the search to one registry (here, a Dubai example). Registry coverage and freshness vary a lot by country; some jurisdictions only show a name and number.

Step 2: Officers, owners and disqualifications

Pull the officers and PSCs, and note appointment dates. A director appointed three weeks before your onboarding call is not a problem in itself, but it is a question.

curl -s -u "$CH_KEY:" https://api.company-information.service.gov.uk/company/01234567/officers \
  | jq '.items[] | {name, officer_role, appointed_on, resigned_on, nationality}'
curl -s -u "$CH_KEY:" https://api.company-information.service.gov.uk/company/01234567/persons-with-significant-control \
  | jq '.items[] | {name, kind, natures_of_control, notified_on}'

A kind value ending in corporate-entity-person-with-significant-control means the owner is another company. Follow it to the next registry until you reach individuals or a registry that publishes nothing. Then check directors' names against the register of disqualified directors. Name matches on a common name prove nothing on their own, so compare the other details Companies House shows for each director, such as nationality and other appointments.

Step 3: Domain age against claimed trading history

If a supplier says it has traded since 2012, its web presence should not start in 2025. Check the domain's registration date through the ICANN Lookup RDAP tool, or from the command line:

whois example.com | grep -iE "creation date|registrar:|registrant country"
curl -s https://rdap.org/domain/example.com | jq '.events[] | select(.eventAction=="registration")'

The first command uses the standard whois client and filters the output for the lines that matter. The second asks RDAP, the structured replacement for WHOIS, and returns the registration event as JSON. Country-code domains such as .uk often show less, and privacy services replace registrant details for most small businesses, so absence of a name is normal.

Then check when the website first appeared, using the Internet Archive's CDX server:

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com&limit=1&fl=timestamp,original"
curl -s "https://web.archive.org/cdx/search/cdx?url=example.com&output=json&fl=timestamp,statuscode&collapse=timestamp:4"

The first call returns the oldest capture, because results are sorted oldest first. The second uses collapse=timestamp:4 to return one capture per year, which gives you a quick timeline. A domain re-registered after it lapsed can carry archive history from a previous owner, so open the old captures and see whose business they show. Our guide to domain OSINT and WHOIS infrastructure goes deeper on registration history.

Step 4: Website and contact consistency

Compare the questionnaire, the registry and the website. Do the company name, number and address match? Does the website's footer show the registered number, as UK companies must on their websites? Does the email domain have working mail records? For premises checks, our guide to verifying premises with Wi-Fi and Bluetooth records can help.

dig +short MX example.com
dig +short TXT example.com | grep -i "v=spf1"

No MX record on the domain the supplier emails you from is a strong mismatch. A contact number that is a UK 07 mobile for a company claiming a large head office is not proof of anything, but it belongs in your notes.

Step 5: Sanctions screening on the entity and its owners

Screen the company, its previous names, its directors and its PSCs. For UK obligations use the UK Sanctions List search; where US rules may apply through dollar payments or a US parent, use OFAC's Sanctions List Search, whose minimum name score slider controls how fuzzy the matching is. Lower scores catch transliteration variants and produce more noise.

If you screen in volume, OpenSanctions publishes yente, an open-source matching API you can run with Docker. It returns scored candidates for an entity rather than a simple yes or no:

curl -s -X POST http://localhost:8000/match/default \
  -H "Content-Type: application/json" \
  -d '{"queries": {"q1": {"schema": "Company",
       "properties": {"name": ["Example Packaging FZE"], "jurisdiction": ["ae"]}}}}' \
  | jq '.responses.q1.results[] | {caption, score, datasets}'

The software is MIT-licensed, but the project notes that using OpenSanctions data in a commercial context may need a data licence. Check that before you build it into procurement.

Step 6: Adverse media

Search news and the open web for the entity and its key people alongside risk terms, then read what comes back. Two search strings cover most cases:

"Example Packaging" (bribery OR sanctions OR insolvency OR liquidation OR lawsuit OR fined)
"Example Packaging" OR "Example Pack FZE" -site:examplepackaging.example.com

Quotation marks force the exact name, OR widens to variants and risk terms, and -site: removes the supplier's own pages so you see what others say. Run the same strings in the local language for overseas suppliers; most relevant coverage of a regional firm will not be in English.

Step 7: Recording the decision

Every check ends in one of three outcomes: approve, approve with conditions, or decline or escalate. Write the reasoning where the next reviewer will find it:

SUPPLIER:     Example Packaging FZE (tier 3)
DATE:         2026-09-24   ANALYST: a.jones
REGISTRY:     Active, inc. 2019, registry extract saved (hash in case log)
OWNERSHIP:    Wholly owned by Example Holdings Ltd (UK) > two individuals, verified
SANCTIONS:    Entity + 4 individuals screened, UK list and OFAC; 1 name hit discounted (DOB/nationality differ)
ADVERSE MEDIA: None relevant in EN/AR searches, 5 years
MISMATCHES:   Website launched 2023, supplier claims trading since 2019 (explained: previous domain)
DECISION:     Approve with conditions: bank details verified by call-back
NEXT REVIEW:  2027-03 or on change of ownership

Two Scenarios From Real Onboarding Patterns

Onboarding an overseas packaging supplier

Context. A UK food brand wants a cheaper packaging supplier and finds Example Packaging FZE, a free zone company in the UAE. Annual spend would be around £400,000, and the supplier will be paid in US dollars. That makes it tier 3.

Actions. The analyst finds the entity through OpenCorporates and confirms it on the free zone authority's own register. The ownership documents supplied show a UK holding company, which Companies House confirms, with two individual PSCs. All six names (the company, a trading name, the holding company, two PSCs and the general manager) are screened against the UK Sanctions List and OFAC. One PSC shares a name with a designated individual. The designated person's listed date of birth is 20 years different and the nationality does not match, so the hit is discounted and the reasons recorded. Domain checks show the website launched in 2023; the supplier explains it moved from an older domain, and the archive confirms the older site carried the same company name and address.

Outcome. Approved with conditions: a call-back to a known number before any change of bank details, and a review in six months. The file shows the name hit and why it was discounted, which is exactly what a reviewer would ask about.

A reseller whose trading history does not add up

Context. A software company receives an application from Example Resellers Ltd to become an authorised partner. The application says the company has "over ten years' experience" and lists three reference customers.

Actions. Companies House shows the company was incorporated in 2024 and filed dormant accounts last year. The domain examplereseller.example.com was registered eight months ago, and the Wayback Machine has no captures before that. The sole director was appointed in 2024 and holds four other directorships, two of them in companies dissolved within 18 months. Adverse media returns nothing. The reference customers' websites exist, but none mentions the reseller.

Outcome. None of this proves wrongdoing. Experience can belong to the people rather than the company, and a new entity is normal for a new venture. But the claims and the record conflict, and a reseller acts in the software company's name. The team asks for evidence of the ten years (previous company numbers, contracts) and direct contact details for the references. The applicant withdraws. The decision note records the mismatches, the questions asked and the withdrawal.

Running the Checklist in UserSearch

The manual method works, and every analyst should understand it. The friction shows up at volume: API keys for Companies House and OpenCorporates, a Docker host for sanctions matching, rate limits, a dozen browser tabs per supplier, and screenshots saved to a desktop folder that nobody else can find.

UserSearch 2.0 brings much of that into one place. One account gives access to 100+ third-party data sources, so your team does not need separate provider accounts. For supplier work the most useful pieces are:

• Corporate Intelligence for company records and officers, and Domain Intelligence for domain ownership, registration history and favicon matching, which helps connect a supplier's site to related sites.
• OneScan to run one input, such as a company name or domain, across several selected sources, with results merged and attributed to their source. The Credit cost is the sum of the sources you pick and is shown before you run it.
• Bulk search to run up to five inputs through one Module in a batch, which suits screening a supplier's directors and PSCs together.
• Cases in Forensic Mode, which keep search history and bookmarks together so the decision note has a record behind it. Teams share Cases and a Credit pool controlled by the team leader.
• Forensic Capture, our free browser extension, to capture a supplier's web pages with SHA-256 fingerprints and independent timestamps, which matters if a claim on the website later changes.

Treat every result as a lead. Coverage and freshness depend on the third-party source, and a registry extract from the official site is still the document you file. Our beginner's guide to your first UserSearch research walks through Search types and Cases.

Advanced Patterns for Small Due Diligence Teams

Trigger-based reviews instead of annual rechecks

Rather than rechecking every supplier every year, define triggers: change of ownership or directors, change of bank details, a new country of operation, a sanctions list update in a relevant regime. Companies House lets you follow a company and receive emails about new filings, which covers the first two for UK suppliers at no cost.

Bank detail change requests

Payment diversion usually starts with an email from a domain one character away from your supplier's. When a supplier asks to change bank details, compare the sending domain with the one in your file, check its registration date, and call back on a number you already hold. A domain registered last week is the clearest signal you will get.

Looking one layer down

For tier 3 suppliers, ask who their key sub-suppliers and agents are, particularly where goods or payments pass through third countries. Run the entity and sanctions checks on those names. OFSI's guidance treats ownership and control seriously, and a clean first-tier supplier with a designated owner two layers down is still a problem.

Consistent name variants

Keep a field in your supplier record for every name variant you have seen: previous names, trading names, transliterations, abbreviations. Screen all of them every time. Most missed matches we see come from a name variant nobody wrote down.

Keeping Supplier Research Lawful and Fair

Directors, PSCs and sole traders are people, so UK GDPR applies to what you collect about them. Record a lawful basis (usually legitimate interests, or a legal obligation for regulated firms), keep the research to their business roles unless a specific concern justifies more, and set a retention period that matches your contract records. Tell suppliers in your onboarding terms or privacy notice that you check public sources and sanctions lists.

Use only information that is openly available or that the supplier gives you. Be open about who you are if you contact a supplier's staff or customers. If you find what looks like a true sanctions match, stop the onboarding, do not make any payment, and escalate to your compliance lead or legal adviser, because reporting duties to OFSI may apply. Our domain intelligence knowledge base covers the domain checks in more detail.

A name match is not a finding, and a thin web presence is not wrongdoing. Give suppliers a chance to explain mismatches before you decline them, and record what they said.

Frequently Asked Questions About Vendor Due Diligence with OSINT

What is vendor due diligence with OSINT?

Vendor due diligence with OSINT is the set of open-source checks an organisation runs on a supplier, reseller, agent or outsourcer before relying on it. The checks answer four questions: does the entity exist and trade, who owns and controls it, is it or any of its owners and officers subject to sanctions, and is there credible public information that changes the risk?

What should a third-party due diligence checklist include?

A proportionate third-party due diligence checklist covers registry status and filing history, officers and people with significant control, domain age against claimed trading history, website and contact consistency, sanctions screening on the entity and its owners, adverse media, and a written decision. Lower-risk suppliers need only registry status, entity sanctions screening and a decision note.

How long does supplier due diligence take?

With open sources and a fixed checklist, a small team can test a supplier's questionnaire answers in under an hour per supplier. The time depends on the tier: a low-risk, UK-registered supplier needs only a few checks, while an overseas supplier with complex ownership needs the full ownership chain, sub-supplier questions and senior sign-off.

How do you tier suppliers for vendor due diligence?

Tier suppliers by spend, access and geography before any research. Tier 1 covers low spend with no data or system access; tier 2 covers material spend, access to data or premises, or resellers acting in your name; tier 3 covers overseas suppliers in higher-risk jurisdictions, those handling funds, agents dealing with government bodies, and complex ownership.

Which sanctions list should UK organisations screen suppliers against?

From 28 January 2026 the UK Sanctions List became the single source for all UK designations, and the old OFSI Consolidated List stopped being updated. UK organisations should screen suppliers, previous names, directors and people with significant control against the UK Sanctions List, and use OFAC's Sanctions List Search where US rules may apply.

Why does the failure to prevent fraud offence matter for vendor due diligence?

The failure to prevent fraud offence, in force since 1 September 2025, makes large organisations liable where an associated person commits a specified fraud offence for their benefit, unless reasonable procedures were in place. Home Office guidance lists due diligence as one of its principles, so documented vendor checks are stronger evidence than a supplier's own assurances.

Turning a Checklist Into a Defensible Supplier File

Proportionate due diligence is not about finding everything. It is about running the same sensible checks every time, scaling them to the risk, and writing down what you found and what you decided. A registry, a domain record, an archive, two sanctions lists and a few careful searches will surface most of the problems a questionnaire misses.

UserSearch shortens that work and keeps every step visible. One account, 18 Search types, 100+ sources, OneScan with source attribution, Cases that hold the search record, and SargeBot to draft a PDF report from findings you have verified.

Stop guessing. Start researching with UserSearch. Set up a Case for your next supplier and run the checklist at UserSearch.