There’s a rule when it comes to enforcing sanctions which surprises people. You can get problems even if you had no knowledge of the party with whom you were doing business. It is not necessary to have had the intention to violate the rules. The fact that you didn’t know is not a defence and in certain instances it sounds more like an admission. Sanctions are simply the most stringent example of a general principle: as soon as you sign, the problems of the other party become your own, regardless of whether you had seen them coming.
It’s not an uncommon situation. Over the past few years most organizations have suffered a serious blow due to a third party, whether it be operational disruption, financial loss, or regulatory scrutiny, and in almost every case those relationships began in the same way—just with a signature and very little checking in between. According to one Ponemon study, nearly half of organizations reported a security incident in a single year which involved a third party. The pattern underlying the headlines is the same: the warning signs were generally there to be spotted in advance, yet no one did look.
That’s the point at which the balance of power changes. Up to that moment you can demand anything, leave at any time, or incorporate the risk into the agreement; after that point you take on the exposure and your leverage is largely lost. Therefore the checks should be carried out before signing, not after a problem has arisen. The good news is that a thorough review prior to the deal doesn’t have to involve a six-week inquiry. It simply consists of a series of focused questions which you can go through in the course of an afternoon. The key is knowing which questions to ask and presenting them in an order that enables an early warning sign to prevent you from having to go any further.
It’s not at all exotic either; it’s the same customer due diligence approach that international standards such as FATF’s Recommendation 10 are based on, just applied on a more practical scale. The following are the seven checks that matter most, in the order in which they should be carried out.
1. Make sure that the entity is genuine and still exists
The first check is one that many people overlook since they think it’s beneath them and it’s precisely this check that slowly causes deals to fall through: is the company actually what it says it is? Make sure you verify the registered legal name, the registration number, the date of incorporation, the jurisdiction, and most importantly the current status. This kind of thing occurs frequently – a contract is entered into with a business that has since been dissolved, has become inactive, or is in fact just a fake imitation of the name on the invoice. Therefore, check two sources rather than just one: the official registry in the relevant country and an aggregator such as OpenCorporates for a more comprehensive view. Be on the lookout for a company that was established last month yet describes itself as having been around for ten years, one that shares its address with hundreds of other shell companies, or small inconsistencies between the trading name, the legal name, and the account into which you are about to send money. And if anything seems amiss, simply request the incorporation documents. A legitimate counterparty will readily provide them; any reluctance to do so is itself an answer.
2. Discover who really has control over it
A company check shows that the company exists, but it gives no information as to who is really in control, and it’s usually in this area that problems occur. The people you should be looking for are the beneficial owners – the actual individuals who own or control the business – not just those who have been listed as directors. As a warning, this has become more difficult in recent times. The public records are incomplete and are continually changing. In the United States, the federal beneficial ownership register was withdrawn in 2026 and now applies only to foreign entities, at the same time as it is removing the data that US companies had previously provided. The UK still maintains its register of people with significant control, while in the EU access to such information has been made more restricted following a court decision in 2022. In short, no one database will give you the full answer; you have to assemble the information from several sources and regard the gaps as questions rather than as confirmation. Keep an eye out for red flags such as nominee directors acting on behalf of somebody else, ownership being channeled through secrecy jurisdictions without a commercial justification, and owners whose identities fail to match the story you’ve been given. All of this is very much a reality. Hidden ownership is exactly how a sanctioned individual is able to carry on trading through an entity that appears completely clean, and it is also how a counterparty can hide a conflict of interest or a record that would have caused the relationship to end. If you can’t determine who is actually benefiting, then that blank space is in itself a finding and should be included in your pricing.
3. The screening of sanctions, watch lists, and PEP status
If you do nothing else on this list, do this, because sanctions liability, as we said up top, doesn’t care what you knew. Screen the entity and everyone who owns it against the major lists: OFAC in the US, plus the EU, UN, and UK. While you’re there, check for politically exposed persons in the ownership and the leadership. Now, the catch that trips people up. Under OFAC’s rules, an entity that’s 50% or more owned by sanctioned parties is itself sanctioned, even if you’ll never find its name on a list, which is exactly why step two had to come first. If you get a hit, the deal stops until you sort it out. A high-risk jurisdiction or a PEP tie won’t end things on its own, but it does raise the bar for everything else. One more thing: this check goes stale fast. Lists change daily, so you want today’s results, not a screenshot from last quarter.
4. Look at any negative media and signals relating to the reputation
This is an uncomfortable truth: almost all the relevant information about a company’s conduct never leads to a definite conclusion, which is why a criminal or registry check just goes right past it. Instead, such information is found in the news. If you want to find out about credible reports on fraud, misconduct, mismanagement, investigations, and disputes involving the company and the people in charge of it, then do so. The aim is not to dismiss someone based on a single negative headline. Rather, you should look for a pattern—just one report is merely noise, but when the same allegation appears in several outlets over a number of years, or when one executive seems to have a bad reputation that follows them from job to job, that’s a sign. You should focus most closely on the individuals, not the company, since people do change and take their behaviour with them in their suitcase. A useful tip is this: when searching, include the names of the founders and senior executives, searching not only by company but also by their previous company names; add those former company names to the search as well. Reputational risk is transferable, and the person who ruined the last business is, more than you might think, the one sitting across the table from you offering the next one.
5. Look at the history of legal cases and regulatory developments
The way a counterparty behaves when a deal falls through is one of the best indications you’ll have, since a great deal of this information is already available to the public. Check out the litigation history, the regulatory actions, and any enforcement penalties. If a company is a frequent defendant, one that has been fined by the regulator in your industry, or one that leaves unpaid judgments behind it, this shows you in advance how it will treat you when the relationship becomes strained. It’s not true that every lawsuit is a bad sign; some litigation is just normal for business. Therefore, you should look for patterns and assess the severity rather than simply counting the number of cases. A single contract dispute is nothing out of the ordinary. Having had ten over the course of a decade, on the other hand, is a sign of a deliberate strategy. And you should place more trust in regulatory findings than in lawsuits, since a regulator has already carried out an investigation and reached a conclusion, which always outweighs an unproven allegation in a complaint.
6. Evaluate the company’s financial condition and its capacity to carry out operations.
An honest counterparty that can’t pay or deliver is still a failed deal. Before you sign, assess solvency: recent financial statements where available, credit signals, and any insolvency filings, liens, or bankruptcies. The question is blunt. Can this company actually do what the contract commits it to, for the full life of the contract? Warning signs include recent insolvency-related filings, deteriorating credit indicators, and opacity where you’d expect disclosure, such as a company that should file public accounts but somehow never has. Where you can, line the numbers up against the commitment on the table. A supplier asked to hold months of inventory, or a partner promising heavy upfront invYou’re not merely entering into an agreement with a company—you’re also agreeing to accept the liability of all the parties on which it relies. The key suppliers, subcontractors, and partners of that company then become parties with whom you are exposed, and if the other side has any access to your systems or data, then its own security situation becomes your responsibility as well. You don’t have to follow every single link, but when it comes to high-value or high-access situations, you should be aware of the level of concentration and the dependencies involved. If a counterparty quietly outsources the main part of the work, depends on a single supplier in a vulnerable jurisdiction, or is situated downstream of a sanctioned party within its own supply chain, then the risk in such cases reaches you directly. This point is also the one that deteriorates most quickly, since supply chains can change without being noticed. A supplier that was satisfactory at the time of signing can be acquired, placed on a sanctions list, or breached a year later without your knowledge, which is another reason why the most important relationships require ongoing monitoring rather than just a single clearance.h is one more reason the biggestThere is one habit that is worth forming when dealing with the seven, even though it doesn’t count as a check by itself—namely, to record what you have found. In the case of any deal that is not merely trivial, make a dated note listing the sources you consulted, what they revealed, and the reasons why you considered the risk to be acceptable. This only takes a few minutes and serves two purposes. Should the relationship eventually turn out badly, you will be able to demonstrate that you had taken reasonable care rather than having to depend on memory. Moreover, if a regulator, an auditor, or your own board inquire into how the decision was reached, the file that is linked to the sources will provide an answer in a way that a verbal assurance never can. The checks guard you against the counterparty; the record protects you from the consequences.ill. The checks protect you from the counterparty. The record protects you from the fallout.
Two rules for using the checklist well
The way to proceed is to base the degree of scrutiny on the nature of the deal; in the case of a large, long-standing relationship involving a high level of access, all seven of the checks should be carried out, but when it comes to a small, one-off purchase only the first three are required. The principle is to match the level of inspection to the extent of the exposure, not to be thorough out of habit.
The second rule is to treat each finding as a snapshot taken on the day it is carried out. In the case of your most important counterparts, the work should not cease when you have signed the agreement since sanctions lists do change, ownership can move and the bad news often comes to light after the document has been signed. You therefore need to keep an eye on the relationships that present the greatest risk right throughout their entire duration and not just check them once and then file them away.
The information was never the hard part
If you go through the seven items you will see a pattern: almost all of them are public. The entity record, the ownership history, the sanctions lists, the news reports, the court documents, and the accounts. Contracts are not entered into with bad counterparties since the information has been concealed. Instead, they are entered into because it is truly difficult to gather the information from so many dispersed sources within the time available before a deal is finalized by hand.
Beady is designed to deal with that aspect as well. It looks at a company and the individuals involved by checking over more than 100,000 public sources, bringing together negative media, sanctions and exposure as a result of being a PEP, litigation, and regulatory signals all in one place, with each finding linked back to its original source so that you can verify it and show it to a colleague, a committee, or a regulator. Instead of taking an analyst a number of days to go through various tabs, you can now act on a single, source-linked picture before you sign.
If you want to see the results for a counterparty that you are currently considering, arrange a demo and we’ll carry out the exercise with you.
