Tracing beneficial ownership with OSINT for financial crime
Learn the 6-step method to unmask the Ultimate Beneficial Owner (UBO) hidden behind shell companies and corporate structures using OpenCorporates & Aleph
1. Introduction and context
1.1. The investigative need (The “why”)
Investigating financial crime, corruption, or tax evasion often requires following assets, which are frequently hidden behind opaque, multi-layered corporate structures, trusts, and shell companies. These entities are deliberately designed to separate legal ownership (the entity on paper) from beneficial ownership (the natural person who ultimately owns or controls the entity).
For journalists, tracing this chain of ownership using Open-Source Intelligence (OSINT) techniques is essential to attribute actions and wealth to the responsible, real-life individuals and expose networks of illicit finance, holding those at the top accountable.
1.2. Learning outcomes
Upon completing this tutorial, you will be able to:
Differentiate between legal ownership, beneficial ownership, and ultimate parent company concepts.
Systematically use global corporate registries like OpenCorporates and official government sources to map an ownership structure.
Apply a six-step framework to trace ownership layers until the ultimate beneficial owner (UBO) is identified.
Visualize complex corporate networks to identify red flags like nominee directors or secrecy jurisdictions.
1.3. Case study hook
A local government council awards a lucrative, no-bid contract to a small, newly registered company with no staff. A search reveals this company is legally owned by a holding company registered in a tax haven.
In using OSINT to track down the holding company’s beneficial owner, you reveal that the UBO is the spouse of a high-ranking council official, providing concrete evidence of a conflict of interest.
💡 2. Foundational theory and ethical-legal framework
2.1.Key terminology
Ultimate Beneficial Owner (UBO): The real person or people who actually own or control a company, or for whom a transaction is carried out. This means a person, not another business.
Shell company: A company that holds money and handles transactions but does not have real assets, many employees, or active business activities. People often use shell companies to hide who really owns something.
Legal owner: The person or company whose name is officially listed in public records as owning shares or holding the legal title to an asset or business.
Secrecy jurisdiction (or Tax Haven): A country or area with very few financial rules and little transparency, making it easy to hide who owns money or assets. Examples include the British Virgin Islands and Cayman Islands.
Nominee director/shareholder: A person or company officially listed as a company officer or owner, but who follows the instructions of the real owner. This makes it harder to see who is truly in control.
⚠️ 2.2. Ethical and legal boundaries
2.2.1. Consent and privacy: The most fundamental ethical barrier is the distinction between publicly available data and private life. Directors and officers company registry data are public, and its use must be explicitly justified by a public-interest rationale, such as investigating corruption, fraud, or political conflicts of interest.
Stop at the login rule: It is very important. Do not try to bypass paywalls for restricted, proprietary, or commercial registry data without an official subscription or a documented exemption (for example, access to public-benefit journalist accounts provided by a registry or database). Investigations must use only data that has been openly licensed, that resides in the public record, and that has been legally obtained.
2.2.2. Legal considerations: Identifying such owners involves the collection and correlation of personal characteristics from different sources of registries: name, birth date, and address.
Data accuracy: Information on companies (registration) available from public-sector entities in less-regulated jurisdictions can be outdated and inaccurate. Journalists need to cross-check the information and include a caveat that registry findings are provisional unless otherwise confirmed.
Disclaimer: Consult your organization’s legal office on any findings regarding illegal or unethical activity through ownership structures, especially when you attribute property (or control) to an individual. Allegations of concealment or fraud pose serious risks.
🛠️ 3. Applied methodology: Step-by-step practical implementation
3.1. Required tools & setup
OpenCorporates Account: Register for a free “Permitted User” account (for journalists, NGOs, and academics) to access the fullest public data set and advanced filtering features.
Investigative Dashboard (OCCRP’s Aleph): A free platform for journalists that aggregates and visualizes data from millions of public records, including many company registries and leaked documents (e.g., Panama/Paradise Papers).
Visualization Tool: Tools like Maltego (or simple mind-mapping software like XMind or draw.io) are essential for mapping the complex network of entities, officers, and addresses.
Jurisdiction-specific registries: Maintain a list of high-value, country-specific public registries (e.g., UK Companies House).
👷♀️ 3.2. Practical execution (The “how”)
The process is iterative: start with the known entity, identify its legal owner, search that owner in turn, and repeat until a natural person (UBO) is reached.
Scenario 1: tracing an unknown owner of a target company
Goal: Identify the UBO of TargetCo, a business registered in New Jersey, USA.
Scenario 2: leveraging OpenCorporates’ internal links
OpenCorporates often provides direct links that facilitate traversal.
💾 3.3. Data preservation and Chain of Custody
Handling a large amount of company records can be complicated, so it is essential to maintain a clear, thorough record of all actions.
🧠 4. Verification, analysis, and editorial integration
4.1. Corroboration strategy
Verification is mandatory at every ownership layer to prevent name-matching errors (false positives).
Cross-reference officer details: If you identify a UBO named “John Smith,” search for their full legal name, date of birth, and any associated address. Verify this against an independent source, such as a different country’s corporate registry or public voting records.
Asset/activity consistency check: Look for evidence that the UBO is active in the same jurisdiction or sector as the TargetCo. Does the UBO’s LinkedIn profile mention the sector? Does their address link to the country? Inconsistent data (e.g., a UBO with no ties to the target’s industry or location) can be a red flag for a nominee relationship.
Corroborate UBO status: The most reliable corroboration comes from a Beneficial Ownership Register (like the UK’s PSC register or the EU registers) if one is available and accessible for the target jurisdiction.
4.2. Translating data to narrative
The visualization tool helps translate the complex, often dry, legal structure into a compelling narrative.
🤖 4.3. AI Assistance in analysis and ethical use
LLMs can be deployed to manage and analyze the large volume of structured data pulled from registries.
Summarizing official filings: Copy the text from lengthy official corporate documents (e.g., articles of incorporation, annual reports) into a local or enterprise-secured LLM to request a summary of the Share Structure, Board Appointments, and any unusual financial clauses.
Identifying key entities, dates, and relationships (clustering data): Use an AI to process the names, addresses, and dates of all officers collected from the traversal process. Ask the AI to cluster individuals who share the same address or date of registration across different companies.
Translation of foreign language material: Use AI services to translate key filing documents from non-English jurisdictions (e.g., legal documents from a company register in Latin America or Eastern Europe).
⚠️ AI warning: Hallucination and privacy
Hallucination risk: The AI must not be treated as an authoritative source for a UBO declaration. Every fact and name-match must be verified against the original OpenCorporates or registry document.
Privacy & data security: Do not submit non-public data (e.g., sensitive source material, draft reports, or any PII gathered that is not officially public record) to public LLMs. Focus AI use on the transcription and clustering of the publicly sourced, structured registry data. Use enterprise or paid LLM versions where possible.
🚀 5. Practice and resources
5.1. Practice exercise:
Challenge: Use OpenCorporates to find the directors of Volkswagen AG (German public company). Then, choose one director’s name and use the OpenCorporates Officer search to find any other company they are associated with outside of Germany.
Goal: Use the OpenCorporates filters (jurisdiction, status) to narrow the search and map the person’s cross-border business ties.
5.2. Advanced resources
OCCRP’s Aleph: (Investigative Dashboard) A searchable database of millions of leaked and public records, sypecifically designed for following the money and corporate trails.
Open Ownership Register: A register maintained by the Open Ownership initiative, providing official beneficial ownership data for specific countries (e.g., UK, Ukraine).
FATF (Financial Action Task Force) Guidance: Provides international definitions and red flags on beneficial ownership and money-laundering schemes, helping journalists identify illicit patterns.
UK Companies House: The gold standard for corporate transparency; all filings are free and publicly accessible, providing an excellent reference point for how an open registry should operate.
✅ 6. Key takeaways and investigative principles
Follow the natural person: The investigation is not complete until you identify the Ultimate Beneficial Owner (UBO)—the real, living individual—not just another company.
Map and visualize: Use a mind-map or network visualization tool to track complex, multi-layered ownership structures. This prevents confusion and highlights critical nominee or secrecy links.
Verify the UBO criteria: An individual must meet the defined criteria of ownership or control (typically a $25\%$ threshold or significant influence) to be designated as a UBO.
Beware the nominee: If an officer appears on the records of hundreds of unrelated companies, they are likely a nominee director/shareholder—a major red flag for concealment.
Use OpenCorporates as a funnel: Use aggregated databases like OpenCorporates to quickly traverse the chain, but always verify critical details against the link to the original official registry.
👁️ Coming next week…
Financial tracing and sanctions OSINT
Unravel complex financial trails and asset movements. Learn to use public data for sanctions tracking, procurement fraud detection, and supply chain OSINT.
 | A guest post by
|