This website uses cookies

Read our Privacy policy and Terms of use for more information.

SERIESFIN · 003 of 008
DOMAINFinancial intelligence
ACCESSSignal subscribers (PDF)
LAST CHECKED3 November 2026
Independent investigative journalist, OSINT practitioner and digital forensics educator; chapter author in Eyewitness Textures (MQUP, 2024).
Offshore structure investigation maps the corporate vehicles used in secrecy jurisdictions to conceal the source, ownership, or movement of funds: shell companies, nominee-held trusts, foundations, and protected cell companies registered in low-transparency jurisdictions. The primary identifier is a mismatch between the economic substance of the entity and its declared purpose or location. Cross-referencing leaked offshore records with public registries and beneficial ownership declarations resolves entity clusters into named individuals.
The method applies when tracing the ultimate beneficial owner of a secrecy-jurisdiction entity, identifying whether a politically exposed person has undisclosed offshore holdings, cross-referencing declared ownership against leaked service provider records, establishing whether a transaction chain passes through a jurisdiction with no economic substance requirements, or mapping the asset-holding structure behind a confiscation proceeding. A leaked offshore record is Alleged by default. Each entity in isolation is ambiguous. The ownership structure, corroborated from a public registry entry, is not.
FIN-003 sets out the methodology for investigating, mapping, and documenting offshore corporate structures to evidentiary standard.
IN THIS CARD
7
workflow steps
5
tooling sources
6
false-positive checks
6
chain-of-custody requirements
REQUIRED TOOLSFive platforms covering offshore leak datasets, multi-jurisdiction registries, and LEI data.
OPSECLeaked data classification, investigation source logging, database update dates, and no-provider-contact discipline.
WORKFLOWSeven steps from seed entity identification through offshore queries, GLEIF LEI tracing, and evidentiary grading.
FALSE POSITIVESDissolved entities, nominee networks, homonymous entities, trust name reuse, and stale declarations.
CHAIN OF CUSTODYICIJ entity ID, Aleph query string, registry UTC timestamps, hashed filings, and ownership diagram archival.
KEY QUERIESSix operator references across ICIJ, OpenCorporates, OCCRP Aleph, GLEIF, Google dorks, and OpenSanctions.
TOOLS CHECKED · 3 NOVEMBER 2026
ICIJ Offshore LeaksWORKS
Entities, officers and intermediaries across five leak investigations.
No account. "Appleby" returned 89 offshore entities from Panama Papers, Paradise Papers and Bahamas Leaks.
GLEIF LEI searchWORKS
Legal entity identifiers and parent relationships.
No account. "Appleby" returned 613 LEI records.
OpenCorporatesWORKS
Current registry status in many jurisdictions.
No account after a short browser check. "Appleby" returned 1,872 companies.
OCCRP AlephACCOUNT NEEDED
Leaks, court records and corporate filings.
Redirects to an OCCRP sign-in page.
DELIVERABLE

Download the card

A four-page PDF of FIN-003 is below for Signal subscribers.
logo

The rest of this card is for Signal subscribers.

What remains: the step sequence, the tool list, the false-positive checks and the chain-of-custody note.

Join Signal

Signal includes:

  • Full OSINT Reference Card library, 21 domains
  • Methods, every tradecraft tutorial in full
  • AI in OSINT, every tutorial and field report
  • OSINT Hub community access