Due Diligence with Public Web Sources: A Structured Approach
Using registries, public records, company websites and the open web for due diligence on suppliers, partners and investments — and monitoring after signing.
PageWatcher3 min read
Due diligence is the investigation an organization carries out before entering a relationship — an acquisition, an investment, a supplier contract, a partnership, or onboarding a customer in a regulated sector. Its purpose is to confirm that the counterparty is what it claims to be, and to surface risks before you are committed.
Much of the evidence is public. Company registries, court records, regulatory databases, sanctions lists, news, and the counterparty’s own website all hold relevant information. Using them systematically — with OSINT discipline — makes due diligence faster and more reliable.
Types of due diligence that rely on public sources
- Know-your-supplier / third-party risk: verifying suppliers and partners, their ownership, and their reputation.
- Know-your-customer (KYC): verifying identity and ownership of customers in regulated sectors.
- Investment and M&A: commercial, legal, and reputational background on a target.
- ESG and supply chain: checking environmental, labor, and governance practices, increasingly required by regulation in some jurisdictions.
- Reputational screening: adverse media and litigation history.
Core public sources
| Source | What it can confirm |
|---|---|
| Company registries | Legal existence, registration number, officers, registered address, filings |
| Beneficial ownership registers (where available and accessible) | Who ultimately owns or controls the company |
| Court records | Litigation, insolvency, judgments, depending on jurisdiction |
| Regulatory registers | Licenses, authorizations, and enforcement actions |
| Sanctions lists | Whether entities or individuals are designated, e.g. UN, EU, UK and US lists |
| Procurement records | Public contracts won, and any exclusions |
| News and trade press | Adverse media, disputes, reputation |
| The company’s own website | Claimed services, locations, certifications, leadership, policies |
| Web archives | What the company claimed in the past, and when it changed |
| Domain and technical records | Website age, ownership consistency |
Access and coverage vary widely by country. Some registries are free and detailed, others limited or paid. Note what you could not verify as carefully as what you could.
A structured process
1. Scope
Define the counterparty, the relationship, and the risk level. A low-value supplier needs lighter checks than an acquisition target or a high-risk jurisdiction.
2. Identity and existence
Confirm the legal entity in the official registry: name, number, status, address, officers. Check that this matches what the company says on its website and in contracts.
3. Ownership and control
Identify shareholders and beneficial owners where data allows. Complex or opaque structures are not proof of wrongdoing, but they warrant closer review.
4. Screening
Check entities and key individuals against sanctions lists, regulatory enforcement databases, and adverse media. Record search terms and dates.
5. Claims verification
Compare the company’s claims — certifications, client lists, locations, licenses — with independent sources. A certification claimed on a website can often be checked with the certifying body.
6. History
Use web archives and change histories to see how the company’s claims, leadership, and services have evolved. Abrupt changes or removals can be informative.
7. Document and conclude
Record sources, dates, findings, gaps, and a risk conclusion. Keep copies of what you saw — pages change.
Due diligence doesn’t end at signing
The biggest weakness of traditional due diligence is that it is a snapshot. Risk changes after the contract is signed: ownership changes, a license is withdrawn, adverse news appears, a key certification lapses, or the company quietly changes its terms.
Ongoing monitoring closes that gap:
- Monitor the counterparty’s website, especially leadership, locations, certifications, and legal pages.
- Watch the relevant regulatory register and enforcement pages.
- Track changes to their terms of service or data processing documents if you depend on them.
- Re-screen against sanctions lists on a schedule appropriate to the risk.
Legal and ethical considerations
- Data protection: due diligence often involves personal data about officers and owners. Process only what you need, for a legitimate purpose, and secure it.
- Accuracy: name matches are not identity matches. Confirm with additional identifiers before drawing conclusions.
- Proportionality: depth of research should match the risk.
- No deception: pretexting or misrepresentation to obtain information crosses legal and ethical lines.
For regulated KYC and sanctions compliance, follow your sector’s specific rules and use appropriate specialized screening services. Public web research complements those services. It does not replace them.
Where PageWatcher fits
PageWatcher.app supports the ongoing side of due diligence. It monitors counterparty websites, regulatory registers, and policy documents, detects changes, and uses AI to summarize them, with a dated history of what each page said. For related use cases, see PageWatcher’s guides on tracking terms of service and privacy policy changes and monitoring supplier websites.