Private digital intelligence bureau Lawful OSINT — Cyber monitoring — Due diligence
Analysts comparing public registries, directors and corporate control links

Due diligence guide · 13 min

Verify a company and its directors without confusing registration, activity and reputation.

A legal entity can exist without having the capacity, licences or relationships it claims. Verification connects each material assertion to a dated source suited to the jurisdiction.

Published 15 September 2026Reviewed by IIS editorial team

At a glance

Four rules for a useful review.

  • Resolve the exact legal entity.
  • Reconstruct material changes.
  • Separate declared ownership from actual control.
  • Turn discrepancies into questions.

Step-by-step method

A reproducible path from question to conclusion.

  1. 1

    Fix entity and jurisdiction

    Collect legal name, form, official number, registered address, country and used domain. Trading names and translations can refer to multiple companies.

  2. 2

    Return to the competent registry

    Check status, incorporation, registered officers, available filings and dissolution or proceedings notices, recording the consultation date.

  3. 3

    Build the history

    Align name, address, capital, officer, published shareholder and object changes. Gaps become questions to explain, not accusations.

  4. 4

    Map relationships

    Connect subsidiaries, parent entities, lawfully accessible beneficial ownership, appointments and shared addresses. Administrative proximity does not prove operational coordination.

  5. 5

    Test material claims

    Corroborate licences, team, cited clients, locations, assets and references independently. Request documents where public sources are insufficient.

  6. 6

    Write decision conditions

    Classify confirmed, clarification, incompatible and unverifiable points. State validity date and events that should trigger another review.

Resolve legal identity first

A website may use a brand different from the contracting company. Verify which entity invoices, receives funds, employs people or holds the licence.

Namesakes are common. Multiple matching identifiers are needed before attributing an officer, proceeding or address.

Read appointments in context

A former appointment can be legitimate, a registered director may not control activity alone and a shared address may be a normal serviced office. Chronology and jurisdiction change interpretation.

State exactly what the registry establishes, then compare it with current company claims and available original documents.

Make due diligence decision-oriented

A useful output is not a people inventory. It connects findings to partnership risks involving funds, data, reputation, access, compliance or dependency.

Each unconfirmed point should lead to a document request, condition, additional control or scope limit.

Common pitfalls

Four shortcuts that weaken the result.

Searching only the trading name

The brand may hide the entity contracting or receiving funds.

Adding weak signals together

Multiple details from one source do not become independent evidence.

Overreading a shared address

It may be ordinary company formation or serviced-office use.

Forgetting the date

A registry or page describes a given state, not necessarily the present.

Practical questions

Frequently asked questions.

Is an official registry enough?

It is central for recorded facts but does not confirm every claimed activity, relationship or capability.

Can beneficial ownership be checked?

Availability and access conditions vary. Use only lawful routes proportionate to the decision.

How should a discrepancy be handled?

Describe both sources, dates and scope, then request a targeted explanation or document.

Editorial scope

Written and reviewed by Internet Intelligence Service on 15 September 2026. This educational guide describes a lawful, defensive method. It is not legal advice, an emergency service or authority instruction.