VSI GLOBAL // ENTERPRISE ARCHITECTURE

OSINT-013-standard-corporate-due-diligence-report-collection

12 min read

[COMPANY/ENTITY] - Collection Map

OSINT-013 Standard Corporate Due Diligence Report - collection workspace. Central topic = the target entity. Branches = data-point categories for corporate DD. Drop each collected value as a child node; expand it with where it was found. Paste raw tool output into the node’s Notes. → feeds deliverable OSINT-013.

00 · Collection Plan - PIRs & EEIs

The questions this collection must answer + the essential elements of information (EEI) for each. Tick as satisfied. → drives §3 Key Judgments, §4 PIRs, §15 Verified Findings, §16 Red Flags, §19 Gaps.

PIR-1 - Identity & Standing: Is the entity real, lawfully constituted, and in good standing?

  • EEI: legal name, registration number/LEI, entity type, jurisdiction, incorporation date
  • EEI: current status (active / dissolved / in administration) and good standing confirmation
  • EEI: registered address vs. operating address corroborated
  • EEI: required licenses/permits/regulatory authorizations identified and current
  • EEI: shell/front indicators assessed (substance, virtual office, recent formation, footprint mismatch)
  • EEI: same-name / lookalike entity candidates identified and excluded
  • EEI: entity-resolution confidence level and matched identifiers recorded

PIR-2 - Ownership & Control: Who ultimately owns and controls it, and is the structure transparent and free of prohibited parties?

  • EEI: UBO(s) identified with equity % and nature of control
  • EEI: corporate structure map (parent / intermediaries / subsidiaries / affiliates) complete
  • EEI: cross-border layering, nominee shareholders/directors, bearer instruments, trusts/foundations identified
  • EEI: control by non-equity means (contracts, financing, dominant counterparty) examined
  • EEI: every UBO/controller screened for PEP, sanctions, or client-conflict status
  • EEI: ownership-transparency rating and confidence recorded (Clear / Partial / Opaque)

PIR-3 - Financial Viability: Is the entity financially sound over the engagement horizon?

  • EEI: revenue and profitability trend (3-year minimum if filings available)
  • EEI: balance-sheet strength, solvency, and going-concern signals
  • EEI: liquidity, leverage, and credit/risk rating
  • EEI: filing currency and auditor issues (changes, qualifications, late filings)
  • EEI: judgments, liens, insolvency events confirmed or excluded
  • EEI: revenue concentration / dependency risk noted
  • EEI: financial-standing verdict (Sound / Adequate / Stressed / Distressed) with basis

PIR-4 - Legal/Regulatory Exposure: What material litigation, regulatory, sanctions, or enforcement exposure exists?

  • EEI: sanctions/watchlist screening complete (entity + group + UBOs + principals) with list versions
  • EEI: export-control / dual-use / debarment registers checked
  • EEI: material litigation (as plaintiff and defendant) identified with status
  • EEI: regulatory actions, fines, license suspensions, enforcement history confirmed or excluded
  • EEI: every hit dispositioned (true / false / inconclusive) with discriminating identifiers

PIR-5 - Integrity & Reputation: Are there integrity, corruption, or reputational concerns bearing on the decision?

  • EEI: adverse-media screen complete (entity + group + principals + brands) across integrity taxonomy
  • EEI: anti-bribery/corruption exposure assessed (government interface, high-corruption geography, intermediary use)
  • EEI: AML posture and financial-crime signals reviewed
  • EEI: ESG / modern-slavery / supply-chain flags checked at baseline
  • EEI: governance quality indicators recorded

Collection gaps / RFIs (running)

  • [open item] → route to [EDD / M&A / Vendor / Reputational / SoW / Asset Tracing]
  • [open item]

01 · Entity Identity & Legal Standing

Confirm the entity exists and is what it claims. Registry-verified legal identity, status, licensing, and substance. → feeds §5 Corporate Identity & Legal Standing.

  • Legal entity name:
  • Trading / DBA / brand names:
  • Native-script name / transliterations:
  • Former names (with dates):
  • Entity type:
  • Jurisdiction of incorporation:
  • Registration / company number:
  • LEI (Legal Entity Identifier):
  • Incorporation date:
  • Entity age (years):

Status & standing

  • Current status: [Active / Dissolved / In administration / Struck off]
  • Good-standing certificate / confirmation:
  • Source registry:
  • As-of date:

Registered vs. operating address

  • Registered address:
  • Operating / principal address(es):
  • Virtual-office / serviced-address flag: [Yes / No / Unknown]

Licenses & regulatory authorizations

  • [license / permit]
    • Issuing authority:
    • Scope / date:
    • Current / lapsed:
    • Source:

Substance indicators

  • Employee headcount (stated / confirmed):
  • Physical premises evidence:
  • Website / operational presence:
  • Shell / front / nominee flags:

02 · Corporate Structure & Group Mapping

Map the entire corporate family: parent, intermediate holdings, subsidiaries, affiliates. Note cross-border layering, dormant/shell members, and risk concentration. → feeds §6 Corporate Structure & Group Mapping, Appendix C.

Parent / ultimate holding entity

  • [entity name - e.g. HoldCo Ltd]
    • Relationship: [Parent / Ultimate parent]
    • Jurisdiction:
    • Registration number:
    • Status:
    • Ownership % in target:
    • Source registry / source grade:
    • Notes / tool output: ← OpenCorporates, national registries, GLEIF LEI search

Intermediate holding entities

  • [entity name]
    • Relationship: [Intermediate holding]
    • Jurisdiction:
    • Registration number:
    • Purpose / role:
    • Red flag (opacity / dormant / secrecy jxn):
    • Notes / tool output:
  • [entity name 2]

Subsidiaries & affiliates

  • [entity name]
    • Relationship: [Subsidiary / Affiliate / JV]
    • Jurisdiction:
    • Registration number:
    • Status: [Active / Dormant / Dissolved]
    • Materiality:
    • Notes / tool output:
  • [entity name 2]

Structure complexity assessment

  • Cross-border layering count:
  • Secrecy-jurisdiction members:
  • Dormant / shell members:
  • Ownership-concentration risk:
  • Structure-chart reference (Appendix C):

03 · People - Directors, Officers, UBOs & Key Staff

Identify and screen all directors, officers, UBOs, and key controlling individuals. Each person is a recursive block - clone per individual. Deep person-level investigation deferred to POI products; flag as RFI. → feeds §7 Beneficial Ownership & Control, §8 Management & Key Principals.

Director / officer

  • [full name - e.g. Jane A. Smith]
    • Role / title:
    • Appointment date / tenure:
    • Nationality / country of residence:
    • Other current directorships (count + key entities):
    • Disqualifications / bans:
    • PEP status: [Yes / No / Unknown]
    • Sanctions / watchlist hit: [No match / Potential / Confirmed]
    • Adverse history (brief):
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Deep-person RFI raised: [Yes / No]
    • Notes / tool output: ← Companies House / national registry, OpenCorporates, World-Check/ComplyAdvantage
  • [full name 2]

Beneficial owner (UBO)

  • [full name - e.g. Mikhail V. Petrov]
    • Equity % / nature of control:
    • Verification basis: [Registry disclosure / declaration / inferred]
    • Nationality / residency:
    • PEP status / government nexus:
    • Sanctions / watchlist hit: [No match / Potential / Confirmed]
    • Conflict-of-interest flag (client insider / counterparty):
    • Ownership-transparency confidence: [Clear / Partial / Opaque]
    • SoW deep-dive RFI raised: [Yes / No → OSINT-011]
    • Notes / tool output: ← GLEIF, BO registers (PSC/UBO), company filings, Orbis/Dun & Bradstreet
  • [full name 2]

Key controlling individual (non-equity)

  • [full name]
    • Nature of control (contract / financing / dominant counterparty):
    • Basis / evidence:
    • Notes / tool output:

04 · Registrations & Filings

Corporate-registry documents, filing history, and formal disclosures. Identify late or missing filings; extract registered charges / encumbrances. → feeds §5 Corporate Identity & Legal Standing, §9 Financial Standing & Viability.

Registry filings

  • [document - e.g. Annual Return 2023]
    • Filing date / period:
    • Status (current / late / missing):
    • Key content noted:
    • Source / URL:
    • Notes / tool output: ← Companies House, SEC EDGAR, national business registries
  • [document 2]

Registered charges & encumbrances

  • [charge / lien]
    • Holder:
    • Date registered:
    • Amount / nature:
    • Status (satisfied / outstanding):
    • Notes:

Disclosure documents (BO register, PSC, UBO declaration)

  • [disclosure type]
    • Content:
    • Date:
    • Completeness: [Full / Partial / Missing]
    • Notes:

05 · Digital & Infrastructure

Domains, IPs, web presence, social accounts, email patterns, and digital footprint. Assess whether operational reality matches claimed scale. → feeds §10 Operational Profile & Market Position, §14 Integrity Indicators.

Domains

Clone per domain. → confirms operational presence, flags anomalies (very recent reg, privacy shield, mismatch to claimed scale).

  • [domain - e.g. targetcorp.com]
    • Registrant / WHOIS (privacy shield?):
    • Registration date:
    • Registrar / nameservers:
    • Hosting / IP / ASN:
    • SSL cert (crt.sh - subdomains found):
    • Certificate transparency anomalies:
    • Notes / tool output: ← whois, crt.sh, ViewDNS, Shodan, SecurityTrails
  • [domain 2]

IP ranges & hosting

  • [IP / range]
    • ASN / provider:
    • Geo:
    • Notes:

Social media accounts (corporate)

  • [platform - LinkedIn / X / Facebook / YouTube / other]
    • Handle / URL:
    • Follower count / activity:
    • Claimed founding / history:
    • Consistency with filings:
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Notes:

Email pattern / infrastructure

  • Observed email pattern:
  • MX / mail provider:
  • Exposed employee emails:

06 · Financials

Desktop-standard financial health assessment from filings, credit/risk data, and public financials. → feeds §9 Financial Standing & Viability, Appendix D.

Statutory accounts / filed financials

  • [filing period - e.g. FY 2023]
    • Revenue:
    • Net profit / EBITDA:
    • Total assets / net assets:
    • Filing date (on time?):
    • Auditor:
    • Auditor qualification / going-concern note:
    • Source / URL:
    • Notes / tool output: ← Companies House filings, SEC EDGAR, Orbis, Dun & Bradstreet, Creditreform
  • [filing period 2]

Credit & risk ratings

  • [provider - e.g. Dun & Bradstreet DUNS / Experian / Moody’s]
    • Rating / score:
    • Date:
    • Notes:

Judgments, liens, insolvency events

  • [matter]
    • Type: [CCJ / judgment / lien / winding-up petition / administration]
    • Amount:
    • Date:
    • Status: [Active / Satisfied]
    • Source:

Financial stress indicators (observable)

  • Late filings:
  • Auditor changes:
  • Going-concern language:
  • Revenue concentration flag:
  • Key financial-standing verdict: [Sound / Adequate / Stressed / Distressed]

07 · Commercial Footprint - Locations, Customers, Suppliers, Contracts

What the entity actually does and at what scale. Corroborate claimed scale against operational reality. → feeds §10 Operational Profile & Market Position.

Operating locations / sites

  • [location - e.g. HQ Birmingham / warehouse Rotterdam]
    • Role: [HQ / Branch / Warehouse / Factory]
    • Corroboration:
    • Notes:

Business lines / products / services

  • [product / service line]
    • Description:
    • Revenue split (if available):

Key customers

  • [customer name / type]
    • Concentration risk:
    • Source:

Key suppliers

  • [supplier name]
    • Dependency risk:
    • Source:

Public contracts / tenders

  • [contract - e.g. government tender reference]
    • Contracting authority:
    • Value / period:
    • Source: ← Find a Tender, Tenders Electronic Daily, SAM.gov, public procurement portals

Market position & sector context

  • Stated market position:
  • Sector risk / regulatory context:
  • Headcount (stated / confirmed):

08 · Legal, Regulatory & Sanctions

Sanctions screening, export-control, debarment, and litigation / regulatory / enforcement history. Every hit requires disposition with discriminating identifiers. → feeds §11 Sanctions, Watchlist & Regulatory Standing, §12 Litigation, Regulatory & Enforcement History, Appendix E.

Sanctions & watchlist screening

Clone per subject screened. Record list name and as-of version date for every screen.

  • [subject - e.g. TARGET CORP LTD]
    • Lists screened (with version dates): [OFAC SDN / OFSI / EU Consolidated / UN / BIS Entity List / SAM.gov / World Bank Debarment]
    • Result: [No match / Potential match / Confirmed match]
    • If hit - discriminating identifiers confirming or excluding:
    • Disposition: [True positive / False positive / Inconclusive]
    • 50%-rule ownership-by-sanctioned-party analysis done: [Yes / No]
    • Grade:
    • Notes / tool output: ← OFAC SDN search, OFSI list, EU Sanctions Map, UN Consolidated, ComplyAdvantage
  • [subject 2 - UBO / director]

Export-control & dual-use

  • Entity List / Denied Persons / Unverified List (BIS):
  • Debarment (SAM.gov / World Bank / IADB):
  • Notes:

Litigation (entity as defendant)

  • [matter]
    • Forum / case number:
    • Plaintiff:
    • Claim type (fraud / breach / regulatory / other):
    • Status / disposition:
    • Materiality:
    • Source:
  • [matter 2]

Litigation (entity as plaintiff)

  • [matter]
    • Defendant:
    • Status:
    • Notes:

Regulatory / enforcement actions

  • [action]
    • Regulator / agency:
    • Nature: [Fine / License suspension / Enforcement notice / Criminal referral]
    • Date / status:
    • Materiality:
    • Source:

09 · Reputation & Adverse Media

Structured adverse-media screen across integrity taxonomy. Baseline screen - not the deep reputational/human-source investigation of OSINT-017. Grade reliability; separate substantiated reporting from allegation. → feeds §13 Adverse Media & Reputational Baseline, §14 Integrity, Compliance & Conduct Indicators.

Adverse media - by integrity theme

One node per identified item. Clone as needed.

  • [item - e.g. “Entity fined for data breach - FT 2022-09”]
    • Theme: [Fraud / Corruption / Sanctions evasion / Labor / Human rights / Environmental / Safety / OC ties / Product failure / Governance]
    • Outlet / date:
    • Substantiation: [Substantiated / Reported / Allegation / Rumour]
    • Subject (entity / group member / principal):
    • Source grade (A–F / 1–6):
    • Notes:
  • [item 2]

Anti-bribery & corruption (ABC) exposure baseline

  • Government interface / contracting exposure:
  • High-corruption geography presence:
  • Intermediary / agent use:
  • ABC program evidence (policies / certifications):
  • Severity:
  • Escalate to EDD: [Yes / No]

AML / financial-crime posture

  • Cash-intensive sector flag:
  • High-risk geography exposure:
  • Suspicious-transaction reporting history (public):
  • Notes:

ESG / modern-slavery / supply-chain flags

  • [indicator]
    • Basis:
    • Escalate to vendor / EDD: [Yes / No]

Governance quality

  • Board composition / independence:
  • Audit committee / external auditor standing:
  • Public governance failings:

10 · Network & Affiliations

Related entities sharing infrastructure, personnel, addresses, or ownership. Interlocking directorships; pattern of associated failed/struck-off entities; third-party relationships bearing on risk. → feeds §6 Corporate Structure & Group Mapping, §8 Management & Key Principals, §14 Integrity Indicators.

Related / associated entities (non-group)

  • [entity name - e.g. shared director / address / phone]
    • Relationship type: [Shared director / Shared address / Shared phone / Common ownership / Former name]
    • Jurisdiction:
    • Status: [Active / Dissolved / Struck off]
    • Risk relevance:
    • Notes / tool output: ← OpenCorporates, national registries, LittleSis, OffshoreLeaks
  • [entity name 2]

Shared infrastructure (digital / physical)

  • [indicator - e.g. shared IP, shared registered agent, co-located address]
    • Type:
    • Linked to:
    • Risk implication:

Interlocking directorships pattern

  • [individual - director appearing across multiple entities]
    • Entities linked:
    • Pattern significance:

Third-party risk relationships

  • [counterparty / key supplier / dominant customer]
    • Nature of dependency:
    • Risk:

99 · Collection Admin

Working register - not a deliverable section, but the audit trail and source record behind it. → populates §21 Annex A, Appendix E, Appendix F.

Source register

Every material datum traceable to a graded source. Admiralty two-axis: reliability A–F, credibility 1–6.

  • [S-1 - source name / URL]
    • Type: [Primary registry / Licensed database / Open web / Adverse media / Corporate filing]
    • Reliability (A–F):
    • Credibility (1–6):
    • Date accessed:
    • Notes:
  • [S-2]

Evidence archive

  • [screenshot / capture ref + SHA-256 hash + URL + timestamp]:

Screening log

  • [list screened - name + provider + version/as-of date]:
  • Date of screen:
  • Operator:

Open gaps / verification pending

  • [gap item - what is missing, impact on PIR, recommended collection, escalation target]

RFIs raised

Graph View