01
What it is
Corporate OSINT is the structured use of public company registries, leaked records databases, and sanctions lists to trace a company from its registration record to its directors, shareholders, parent entities, and ultimate beneficial owner.
A company name in a contract, a vessel registration, a property deed. That is usually where a corporate investigation starts: a legal entity with a name, an address, and a registered jurisdiction. The goal is to find the natural person behind it. Every legal company must file with government authorities. Those filings leave a trail of directors, shareholders, registered agents, and parent entities that can be followed layer by layer until a real individual appears at the end of the chain. That individual is the ultimate beneficial owner: the person who owns or controls the entity regardless of how many intermediate layers stand between them and the filing.
Corporate structures are layered deliberately. In legitimate business, layering serves tax, liability, and operational purposes. In illicit finance, corruption, and sanctions evasion, it serves concealment. The investigative method is identical in both cases: systematic registry querying, cross-reference of director and officer names across jurisdictions, and pattern recognition in shared addresses, registered agents, and naming conventions. The structure does not tell you which category you are in. The evidence at the end of the chain does. When a corporate investigation intersects with vessel ownership, the maritime OSINT guide covers the additional layers specific to flag state and ship management structures.
When to use this guide
- Identifying the directors, shareholders, and ultimate beneficial owner of an unfamiliar or opaque company
- Mapping ownership structures that span multiple jurisdictions or rely on shell companies, trusts, or nominee arrangements
- Conducting due diligence on a counterparty, vendor, or potential partner where registry-level verification is required
- Investigating a company suspected of sanctions evasion, corrupt contracting, or illicit financial flows
02
How to investigate a company with OSINT
A six-step workflow from initial registration lookup through director cross-referencing, ownership chain mapping, offshore leaks screening, sanctions checking, and adverse media review.
The following tools are used across the steps below. All are free unless noted.
OpenCorporates: The largest open database of company information, aggregating official registry data from over 140 jurisdictions. Search by company name to retrieve registration number, registered address, incorporation date, jurisdiction, status, and officer names, with links to the source national registry. Free for individual searches; API access requires registration.
UK Companies House: The gold standard for corporate transparency. All UK company filings are publicly accessible and free: full accounts, confirmation statements, director appointment and resignation history, and persons with significant control (PSC) records that name beneficial owners with more than 25% ownership or control. Free.
ICIJ Offshore Leaks Database: Maintained by the International Consortium of Investigative Journalists. Searches over 800,000 offshore entities from the Panama Papers, Paradise Papers, Pandora Papers, and other major leaks. Returns companies, officers, shareholders, intermediaries, and the connections between them, with interactive network visualisation. Free.
OpenSanctions: Aggregates international sanctions lists and politically exposed persons (PEP) databases into a single searchable dataset. Covers OFAC, EU, UN, UK, and dozens of other jurisdictions. Search by company name or individual to check for sanctions designation. Free for non-commercial use.
OCCRP Aleph: Investigative document and data search platform maintained by the Organised Crime and Corruption Reporting Project. Indexes millions of leaked documents, public records, court filings, and corporate data from OCCRP investigations. Useful for contextual adverse media and prior investigative coverage of a company or its officers. Free with registration.
Sayari Graph: Commercial platform for cross-jurisdictional beneficial ownership and trade data, particularly useful when OpenCorporates hits a wall on jurisdictions with low public disclosure standards. Paid. Relevant for complex multi-jurisdictional structures where public registry chains terminate without reaching a natural person.
Before you begin
Use official registries as the primary source
Aggregators like OpenCorporates draw from official national registries, but always verify critical details against the linked primary source before relying on them in published investigations or legal proceedings. Registry data can lag by weeks and may not reflect very recent filings. For UK companies, the primary source is Companies House. For US companies, the relevant state Secretary of State registry is the primary source. OpenCorporates links to these registries directly.
Legal considerations
Public company registry data is public record and can be lawfully accessed and published in most jurisdictions. The ICIJ Offshore Leaks database contains data derived from leaked documents; the courts in multiple jurisdictions have held that republication of this data by journalists for public interest purposes is lawful, but context matters. Personal data on individual directors and officers (home addresses, dates of birth) visible in filings should be handled with care. Publishing home addresses of individuals without clear public interest justification may constitute a privacy violation in jurisdictions with GDPR-equivalent legislation.
The method
01
Retrieve the basic registration record
Goal · Confirm the company exists and establish its jurisdiction, status, and registration date
Search the company name on OpenCorporates. Note the jurisdiction of incorporation, registration number, incorporation date, registered address, and current status (active, dissolved, in liquidation). Check whether multiple companies share the same name across different jurisdictions: a common name in a low-disclosure jurisdiction alongside an active trading company in a higher-disclosure jurisdiction is a pattern worth investigating. Follow the link to the primary national registry for the most current filing data.
02
Extract directors and officers, then cross-reference them
Goal · Identify every individual named in the filing record and map their connections to other companies
Record every director, officer, and registered agent named in the current and historical filings. For UK companies, access Companies House directly: it provides full appointment and resignation history, nationality, and date of birth for each officer. Search each officer name on OpenCorporates to identify other companies they appear in, including companies in other jurisdictions. An individual appearing as a director or shareholder on dozens or hundreds of unrelated companies is a nominee signal. A registered agent company appearing across many of the same entities is a service provider link that may reveal a formation network.
03
Map the ownership structure layer by layer
Goal · Follow the shareholder chain upward through each intermediate entity until a natural person is reached
Where a shareholder is itself a company, repeat the registry lookup for that entity. For UK companies, the Persons with Significant Control (PSC) register names individuals with more than 25% ownership or significant control directly in the filing record. For companies in other jurisdictions, trace the shareholder chain using OpenCorporates and primary national registries. When the chain terminates in a low-disclosure jurisdiction (Cayman Islands, BVI, Panama), OpenCorporates will reach a dead end; Sayari Graph covers these jurisdictions with trade and ownership data not available through public registries alone. Map each layer visually: a diagram or simple table prevents errors when ownership traverses four or five intermediate entities. Older filings often reveal more than current ones; early documents are filed before additional layers are added.
04
Screen against the ICIJ Offshore Leaks database
Goal · Identify whether the company, its officers, or its shareholders appear in leaked offshore records
Search the company name and every director and shareholder name against the ICIJ Offshore Leaks database. The database covers over 800,000 entities from major investigative leaks including the Panama Papers and Pandora Papers. A positive hit does not confirm wrongdoing; many offshore structures are used for legitimate tax and estate planning. A hit does, however, confirm the company or individual had offshore connections not visible in the national registry record, and provides the specific leaked documents as a secondary source for further investigation. Use the interactive network visualisation to explore connections between entities in the database.
05
Check all entities and individuals against sanctions lists
Goal · Identify any entity or individual in the ownership chain designated under international sanctions
Search every company name and individual name identified across steps 1 to 4 against OpenSanctions. The platform aggregates OFAC, EU, UN, UK, and dozens of other national sanctions lists into a single search. A sanctions designation against a company or individual in the ownership chain above the target entity is significant context even if the target entity itself is not designated. Record the specific list, the designation date, and the grounds for designation where available. Cross-check any positive results against the primary sanctions list source (OFAC, EU Official Journal) before publication.
06
Search for adverse media and prior investigative coverage
Goal · Identify whether the company or its principals have previously been the subject of investigative reporting, litigation, or regulatory action
Search the company name and each director and UBO candidate in OCCRP Aleph, which indexes millions of public records, court documents, and investigative journalism outputs. Supplement with Google News searches combining the company name with terms including fraud, corruption, money laundering, sanctions, and lawsuit. For the company's country of registration, search the relevant national court record system where publicly accessible. Prior investigative coverage is context, not conclusion; verify independently before incorporating prior reporting as a factual basis. If the investigation surfaces a named individual as a director or UBO candidate, the HUM-001 card covers how to verify individual identity claims to evidentiary standard.
03
What can go wrong in corporate OSINT investigations
Attribution errors, structural traps, and evidentiary pitfalls specific to corporate investigations.
Registered owner versus ultimate beneficial owner: The name on a company registry record is the legal registrant, not necessarily the person who controls or benefits from the company. A single-purpose holding company, a trust, or a law firm acting as a registered agent can stand between the registry record and the UBO through multiple layers. Verifying check: The investigation is not complete until a natural person is identified at the end of the chain. If the chain terminates at a jurisdiction that does not disclose beneficial ownership (Cayman Islands, BVI, Panama), flag the gap explicitly and document the last known verified entity. Do not attribute the company to the registered agent or nominee director.
Nominee directors: A director appearing on the filing records of hundreds of unrelated companies across multiple jurisdictions is almost certainly a nominee: a professional signatory placed on filings to satisfy legal director requirements, with no actual control over the company. Verifying check: Search the director name on OpenCorporates. If they appear on more than approximately 20 to 30 unrelated companies, treat them as a nominee and identify the service provider behind the structure rather than attributing control to the individual.
Common company names creating false attribution: OpenCorporates returns results across 140+ jurisdictions. A search for a company name will frequently return dozens of entities with identical or near-identical names in different jurisdictions. Without the registration number and jurisdiction, a finding cannot be attributed to a specific legal entity. Verifying check: Always confirm the specific registration number, jurisdiction, and registration date before attributing any finding to a named company. Never rely on name alone.
ICIJ data as proof of wrongdoing: Appearing in the ICIJ Offshore Leaks database means a company or individual appeared in leaked documents relating to offshore structures. It does not confirm illegal conduct. Legitimate tax planning, estate management, and international business structures all make routine use of offshore entities. Verifying check: Treat ICIJ hits as opening a new investigative line, not closing one. Document what the hit shows (the specific dataset, the entity relationship, the jurisdiction) and what remains unconfirmed (the purpose of the structure, the identity of the UBO, any legal violation).
Chain of custody: Company registry data is updated continuously. Evidence that exists today may be changed in tomorrow's filing.
Screenshot OpenCorporates and primary registry results at the time of access with the URL, registration number, and timestamp visible.
Download the full filing history from Companies House or the relevant primary registry as a PDF and record the download date.
Screenshot ICIJ Offshore Leaks results and export the network data where available, noting the specific dataset (Panama Papers, Pandora Papers) and the entity relationships visible.
Screenshot OpenSanctions results with the list name, designation date, and the query used.
Log every tool used, the exact query, and the timestamp of each result in a dedicated case file separate from the investigative output document.
04
Go deeper
Reference cards and structured tutorials for practitioners extending this workflow.
Each reference card used in this guide is available individually in the archive. Every card covers the full workflow, key queries, OPSEC controls, false positives, and chain of custody requirements for the technique.
COR-001
Company registry research across jurisdictions.
Companies House, OpenCorporates, and Orbis. Officer networks, group structures, and nominee checks across 140-plus jurisdictions.
FIN-001
Financial record tracing across jurisdictions.
EDGAR, ICIJ Offshore Leaks, and Sayari Graph. Payment flows, asset transfers, and corporate funding structures across jurisdictions.
HUM-001
Human intelligence sourcing to evidentiary standard.
LinkedIn, Hunter.io, and Maltego. Map proximity, verify identity, and make initial contact without compromising the source.
DIG-001
WHOIS investigation: domain name to attribution chain.
ViewDNS, SecurityTrails, and crt.sh. Registrant email pivots that surface corporate registration addresses and hosting networks.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.
