Vendor Due Diligence With OSINT: A Practical Supplier Checklist

A supplier questionnaire records what a company chooses to tell you. It does not tell you whether the company is still trading, who actually owns it, or whether the email asking you to change a bank account really came from the people you signed the contract with. Open-source research can answer those questions in the time it takes to drink a coffee, provided you run the same checks in the same order every time and write down what you found.

Short version: sort suppliers into risk tiers first, then work through a fixed checklist: registry, owners, domain age, website and email consistency, sanctions screening, and adverse media. Finish every review with a written decision. A mismatch is a question for the supplier, not a verdict.

Why Supplier Questionnaires Are Not Enough

Questionnaires have three weaknesses that no amount of careful drafting fixes. They rely on self-reported answers, they describe a single moment in time, and they take days to chase. A supplier can change owners, move offices or fall behind on its filings the week after it ticks every box.

Open-source checks do not replace the questionnaire; they test it. Each step below either confirms an answer or produces a specific question to send back. That is also why the method works for small teams: you are verifying claims, not building a dossier.

Why Regulators Now Expect Evidence, Not Assurances

Three developments have made “we asked and they said yes” a thin position for organisations with UK exposure.

• Failure to prevent fraud. The new corporate offence under the Economic Crime and Corporate Transparency Act 2023 came into effect on 1 September 2025. Large organisations can be held liable when an employee, agent or other associated person commits fraud intending to benefit them, unless they had reasonable procedures in place. Due diligence on the people who perform services for you is one of the six principles in the government guidance. An organisation counts as large if it meets two of three tests: more than 250 employees, more than £36 million turnover, or more than £18 million in total assets.
• Screening that does not work is still a failure. In October 2024 the FCA fined Starling Bank £28,959,426 after finding that its automated system had, since 2017, screened customers against only a fraction of the sanctions list. For a procurement team the lesson is that having a screening step is not the same as the step working.
• One UK list. From 28 January 2026 the UK Sanctions List became the only source for UK sanctions designations, and the OFSI Consolidated List stopped being updated. The government’s guidance on the change tells businesses to check that any system or spreadsheet still pointing at the old list has been switched over.

None of this applies only to banks. If your business pays overseas suppliers or uses agents to win work, the same logic applies, only the paperwork looks different.

Tier Your Third Parties Before You Research Them

Proportionate means you do not run the same checks on a stationery supplier as on an overseas agent who will handle customer money. Decide the tier before any research, using spend, access and geography. The table below is the rule we would start from; adjust it to your own risk appetite and then apply it consistently.

An auditor is usually more interested in whether you followed your own rule than in whether the rule is perfect, so write it down once.

The Proportionate OSINT Checklist, Step by Step

Here is the order we would run the checks in. Every step ends with a note: matches the questionnaire, does not match, or cannot be determined.

Step 1: Registry status and filing history

Start at the official company register for the supplier’s country. For UK companies that is Companies House. Check whether the company is active, dissolved or in liquidation, when it was incorporated, where its registered office is, what it says it does, whether accounts or the confirmation statement are overdue, and whether it has changed name. If you check more than a handful of companies a week, a free API key from the Companies House developer hub lets you script it:

curl -s -u YOUR_API_KEY: "https://api.company-information.service.gov.uk/search/companies?q=Example%20Packaging%20Ltd"

Save the registry extract with the date you pulled it. Registers change daily, and you want to be able to show what you saw on the day you approved the supplier.

Step 2: Officers, owners and disqualifications

List the directors and the people with significant control. In the UK, the same API exposes /company/{number}/officers and /company/{number}/persons-with-significant-control. Look for owners that are themselves companies, and follow the chain until you reach individuals. Check each name against the register of disqualified directors and note any person who appears at many unrelated companies registered to the same address.

Directors and owners are people, so keep this to their business roles unless something specific justifies more. The section on lawful research below explains why.

Step 3: Domain age against claimed trading history

If a supplier says it has traded since 2012, its web presence should not begin in 2025. Look up the domain’s registration date with the ICANN Lookup RDAP tool, or from a terminal:

whois example.com | grep -i -E "creation date|registrar:"
curl -s https://rdap.org/domain/example.com | jq '.events[] | select(.eventAction=="registration")'

Then see when the website first appeared, using the Internet Archive’s CDX endpoint. The first request returns the oldest capture; the second returns one capture per year so you can read the history as a timeline:

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com&limit=1&fl=timestamp,original"
curl -s "https://web.archive.org/cdx/search/cdx?url=example.com&output=json&fl=timestamp,statuscode&collapse=timestamp:4"

A young domain is not wrongdoing; businesses rebrand and move. A domain that was re-registered after it lapsed can also carry archive history from a previous owner, so open the old captures and check whose business they actually show. Country-code domains often reveal less, and privacy services hide registrant names for most small businesses, so a missing name is normal.

Step 4: Website and email consistency

Compare the questionnaire, the registry and the website. Do the company name, number and address match? Does the footer show the registered number? Does the domain you receive email from have working mail records?

dig +short MX example.com
dig +short TXT example.com | grep -i "v=spf1"

No mail records on the domain a supplier emails you from is a strong mismatch. This is also where our own area of expertise helps: the habits described in how to find websites associated with an email address apply to business contacts as well. Check that the supplier’s contact address is published on the supplier’s own website, and be cautious if it only appears on a free webmail domain.

Step 5: Sanctions screening on the company and its owners

Screen the company, its previous names, its directors and its owners. For UK obligations use the UK Sanctions List search. Where US rules may apply, for example through dollar payments or a US parent, add the OFAC Sanctions List Search, whose minimum-score slider controls how fuzzy the name matching is. A lower score catches more spelling variants and produces more noise.

If you screen in volume, OpenSanctions publishes yente, an open-source matching API you can run yourself. It returns scored candidates rather than a plain yes or no. Check the project’s licence terms before building its data into a commercial process.

The next section looks at why one list is never enough.

Step 6: Adverse media

Search news and the open web for the company and its key people alongside risk terms, then read what comes back; do not just count results. Two query shapes cover most cases:

"Example Packaging Ltd" (fraud OR bribery OR sanctions OR investigation OR insolvency)
"Jane Doe" "Example Packaging" (court OR convicted OR fined OR liquidation)

Names are shared by many people, so a hit needs a second detail, such as location, company or date, before it counts. A thin web presence is not a finding either.

Step 7: Record the decision

Every review ends in one of three outcomes: approve, approve with conditions, or decline and escalate. Write the reasoning where the next reviewer will find it. A short template works well:

SUPPLIER:      Example Packaging Ltd (tier 2)
DATE / BY:     2026-11-04, analyst initials
REGISTRY:      Active, incorporated 2019, extract saved
OWNERS:        Two individuals, both verified at registry level
DOMAIN:        Registered 2023; supplier explains previous domain
MAIL RECORDS:  MX present, SPF present
SANCTIONS:     Company and two owners screened, no matches
ADVERSE MEDIA: Nothing relevant in five years
DECISION:      Approve with conditions: bank details confirmed by call-back
NEXT REVIEW:   2027-05, or on change of ownership

The Data Behind Sanctions Screening

It helps to know what you are actually screening against. OpenSanctions publishes a machine-readable index of the lists it aggregates, with a count of “targets” (people, companies and vessels) for each. When we pulled it on 4 November 2026, the consolidated sanctions dataset held 73,807 targets. The individual lists vary widely in size:

Two practical points come out of the numbers. The US SDN list alone is roughly three times the size of the UK list, which is one reason a business with dollar payments should not treat a UK-only search as complete. And the lists differ in scope: the UN list is small because it only covers Security Council designations, while national lists add their own. Whichever you choose, document which lists you used and on what date, because the lists change several times a week.

Video: Eight Steps to Cut Supplier Due Diligence Time

If you want an outside view of how procurement teams structure this work, the webinar below walks through an eight-step supplier due diligence process and where teams typically lose time. It is a vendor webinar, so treat the product pitch as optional, but the process discussion is a useful comparison with the checklist above.

Video: “8 Steps to Save 80 Hours on Supplier Due Diligence [Webinar Recording]” by Kodiak Hub on YouTube, shown for educational purposes.

A Worked Example: The Reseller Whose Dates Do Not Add Up

This is an illustrative scenario with invented names, not a real company. A distributor wants to add a reseller, Northgate Trading, which says it has been in business since 2014 and will quote to customers in the distributor’s name. That puts it in tier 2.

1. Registry. The company is active but was incorporated in 2022, not 2014.
2. Owners. Two individuals, one of whom also appears at an unrelated company that was dissolved after complaints about non-delivery.
3. Domain. The website domain was registered in 2022, and the archive shows nothing before that date.
4. Email. The contact address is on the company’s own domain, with working mail records.
5. Sanctions. No matches on the company or its owners.
6. Adverse media. Two customer complaints about the earlier company, both a few years old.

The single most useful result is the first one. The questionnaire’s “since 2014” does not match the registry, and the other evidence is consistent with a newer company. That is a question to put to the reseller: was there a predecessor business, and who ran it? If the answer is a plausible trade-name history, the review can approve with conditions, such as a probationary period and payment on delivery. If the reseller will not explain, the review ends there. Either way the file shows what was found and why the decision was taken.

Bank Detail Changes and Other Trigger Events

An annual recheck catches problems late. A better pattern is to repeat the relevant checks when something happens:

• A request to change bank details. Verify it by calling a number you already hold, not one in the request. Compare the sending domain with the supplier’s established domain.
• A change of ownership or directors. Registry filings will show it. Re-run owners and sanctions.
• A sudden jump in order size or new payment terms. Re-run the registry and adverse media steps.
• A new sanctions designation affecting your supplier’s country or sector. Re-screen, using the current list rather than a saved copy.

Email-based requests deserve particular care because they are the cheapest route for a fraudster. See our guide to digital footprint investigation for how public signals fit together, and how we protect search privacy if you are deciding whether to check addresses with an online tool.

Keeping Supplier Research Lawful and Fair

Directors, owners and sole traders are people, so data protection law applies to what you collect about them. In the UK, record a lawful basis (usually legitimate interests, or a legal obligation for regulated firms), keep the research to their business roles unless a specific concern justifies more, and set a retention period that matches your contract records. Tell suppliers in your onboarding terms or privacy notice that you check public sources and sanctions lists.

Use only information that is openly available or that the supplier gives you, and be open about who you are if you contact a supplier’s staff or customers. If you find what looks like a true sanctions match, stop the onboarding, make no payment, and escalate to your compliance lead or legal adviser, because reporting duties may apply. A name match is not a finding. Give suppliers a chance to explain mismatches before you decline them, and record what they said.

Frequently Asked Questions

What is vendor due diligence with OSINT?

It is the practice of checking a supplier’s claims against publicly available sources such as company registers, domain records, sanctions lists and news, instead of relying only on what the supplier tells you.

How long should a supplier check take?

For a tier 1 supplier, a few minutes at the registry and sanctions list. For tier 2, expect closer to an hour once you have a routine. Tier 3 reviews take longer because of overseas registries and ownership chains.

Which sanctions list should I screen suppliers against?

Screen against the lists that apply to your legal obligations and your payment routes. UK organisations use the UK Sanctions List. Businesses with US dollar payments or a US parent usually add the OFAC lists, and EU operations add the EU list. Record the lists and the date.

Is a young domain a red flag?

Not by itself. It becomes a question when it conflicts with a claim, such as “trading since 2012”, and the supplier cannot explain it with a previous domain or a rebrand.

Can I use these checks on individual contractors?

Yes, but with more care, because a sole trader’s business details are also personal data. Keep to business roles and what the contractor has provided, and follow your data protection obligations.

Sources and Further Reading

• GOV.UK: failure to prevent fraud offence guidance
• FCA: Starling Bank fine, October 2024
• GOV.UK: moving to a single list for UK sanctions designations
• Companies House developer hub
• ICANN Lookup (RDAP)
• OFAC Sanctions List Search
• OpenSanctions datasets and yente
• UserSearch: a proportionate OSINT checklist for third-party due diligence, which informed the structure of this guide