What Corporate Due Diligence Covers

A corporate due diligence check answers one question before a decision is taken: is the counterparty what it has been presented to be? The answer is assembled from records that exist independently of the person making the claim, and the work has a shape that changes little from one deal to the next. What changes is the depth, which follows the size of the decision and the risk attached to it.

Start from the decision, not from the records

The first step is to establish what the check is for. A company buying a business needs to understand ownership, contracts, liabilities, litigation, tax and staff. A bank lending to it needs the borrower, the guarantors and the security. A firm taking on a new customer needs to know who it is dealing with and whether the relationship makes sense. Writing down the decision first prevents two common failures: checking everything and concluding nothing, or checking so little that the report cannot support the choice it was meant to inform.

The company itself, from the register outward

Public company registers are the starting point because they are cheap, fast and authoritative on the facts they record. They show when a company was incorporated, where it is registered, who its directors and officers are, what it has filed, and whether it has changed its name or address. Court registers show litigation, judgments and insolvency proceedings. Security registers show charges over assets. Together these records establish the legal skeleton of the business and reveal the first discrepancies, such as a registered address that is also the address of hundreds of other companies, or a director who resigned the day before a filing that would have required their signature.

Registers differ widely in what they publish. A listed company in a jurisdiction with full disclosure can be checked in detail from a desk. A private company in a country without public filings may yield little more than its incorporation. Knowing the difference matters, because a report that treats a thin record as a clean one is misleading. The glossary of investigation terms sets out the vocabulary used here, including what a beneficial owner is and why the phrase matters.

Ownership and control, which are not the same thing

Legal ownership is who holds the shares. Beneficial ownership is who ultimately owns or controls the company, and the two are frequently separated by layers of companies, trusts and nominee arrangements. Each layer obscures the person at the top. Beneficial ownership registers were created because that obscurity was used to hide the proceeds of crime, to evade sanctions and to avoid tax. Where a register is open, it is the fastest route to the answer. Where it is closed or absent, ownership has to be reconstructed from corporate filings, from the documents produced in the transaction itself, and sometimes from enquiries on the ground.

Control can exist without ownership. A person who is not a shareholder may still direct a company through a management contract, a shareholders agreement or a power of attorney. A check that stops at the share register can miss the person who actually decides.

Litigation, regulation and the public record

The litigation history of a company and of the people behind it is a strong signal. It shows not only whether claims have been brought but how they were resolved, whether they form a pattern, and whether the same counterparties recur. Regulatory notices, licence decisions, professional sanctions and insolvency filings are read the same way. None of these is conclusive on its own. A single claim may be ordinary commercial life; a series of claims with the same counterparty, or a licence withdrawn and quietly restored, deserves an explanation.

Media and other public sources extend the record beyond the register, but they carry their own risk of error. A negative article is a question to resolve, not a finding. The guide to the reputation audit explains how the public record is read, and why an allegation and a court finding are never treated as the same thing.

The counterparty in its market

A company can be clean on paper and still be an implausible partner. The market check asks whether the business makes sense: whether it has the staff and premises its turnover implies, whether its customers can be verified, whether its address is a real operating site or a mail drop, whether its sector has a known pattern of abuse. This is the part of the work that public records cannot complete, and it is where an experienced reader earns their fee.

Money, and where it comes from

Where a transaction involves a payment, the origin of the money becomes part of the check. This overlaps with anti-money-laundering obligations, which apply directly to regulated firms such as banks, and it is why due diligence and compliance are often run together. The guide to KYC and AML covers the identity, ownership, source of funds and monitoring duties that a regulated firm owes, and where those duties end and a commercial check begins.

Red flags, and the discipline of resolving them

A red flag is a fact that does not fit. Common examples include an owner who cannot be identified, a payment routed through an unrelated country, a director shared with a sanctioned company, accounts that change auditor every year, or a sudden change of ownership shortly before a deal. The value of a check lies in what is done with the flags. Each is recorded with its source, tested against other records, and either resolved or left open with its consequence stated plainly. A list of unresolved flags is not a judgement, and a client cannot make a decision on one.

What the finished report contains

A finished report is short enough for the decision maker to read. It states the question, the sources and their dates, the findings, the open questions and the risk that remains after the work. It separates what is known from what is inferred. It names its limits, because a check on a private company in a country without a public register will always know less than one on a listed company. The purpose is not to remove risk, which no check can do, but to make it visible before it is taken. Where a suspicion already exists and a decision is not the object, the work is no longer due diligence but an investigation, and it follows different rules.

Where to check a company register

OpenCorporates is a widely used starting point that aggregates company registers from many jurisdictions, and it is a practical first stop when the country of registration is not known. It is a secondary source, so the underlying national register remains authoritative. The address is opencorporates.com.