Corporate Registries and Leak Databases

Corporate Registries and Leak Databases
Field	Beneficial-ownership and corporate-structure research
Aggregators	OpenCorporates; OCCRP Aleph; OpenSanctions
Official registries	UK Companies House; US state filing offices; GLEIF (LEI)
Leak data	ICIJ Offshore Leaks Database (810,000+ offshore entities)
Core risk	Name matching, stale data, nominee owners

Corporate registries are government-maintained records of legal entities, and leak databases are searchable collections of documents obtained from offshore service providers and similar sources and published by journalists. Used together they let an examiner move from a company name seen on an invoice, deed or wire to its directors, shareholders, addresses, affiliates and, with luck, ultimate beneficial owners. They are the main OSINT front end of asset tracing and anti-corruption due diligence. This article covers major sources, their limits, and the examination procedures built on them. It is a methods guide: legitimate subjects are entities, public officials in their official capacity, and sanctioned or convicted parties, not private individuals (see OSINT Ethics).

1 Official registries

The primary evidence of a company's existence is its official registry entry. In the United Kingdom, Companies House publishes free online records of incorporated companies, including officers, persons with significant control (PSCs), registered office, accounts and charges (secured borrowing). The Economic Crime and Corporate Transparency Act 2023 expands the registrar's powers and introduces identity verification: from 18 November 2025 verification began to become mandatory for directors and LLP members, with other categories phased in during 2026.^[1] The practical effect for investigators is that post-2025 officer records should be more reliable than historical ones, while pre-reform filings remain unverified self-declarations.

In the United States there is no national company registry; each state's secretary of state maintains formation records, which vary widely in what they disclose. Delaware, Wyoming and others permit minimal public information, often only the registered agent. Federal beneficial-ownership reporting under the Corporate Transparency Act has been sharply curtailed by a FinCEN rule of August 2026 (see Money Laundering), so U.S. investigators generally cannot rely on a national ownership register and instead assemble ownership from state filings, UCC and court records, and bank KYC files obtained in discovery. Many other jurisdictions (EU member states, with the post-2022 court ruling limiting public access to some registers, and offshore centres) have registers with differing public access, and the legal position changes often, so confirm access rules for the jurisdiction at the time of the search.

2 Aggregators: OpenCorporates, Aleph, OpenSanctions

OpenCorporates is a large open database of company records compiled from official registries, searchable across jurisdictions and useful for finding entities that share an officer name or address. Its value is breadth; its limitation is that each record is a copy of a registry entry of variable age, so findings must be re-verified at the source registry.

OCCRP Aleph is a search platform operated by the Organized Crime and Corruption Reporting Project that indexes company registries, leaked and public documents, court records, sanctions lists and journalist-contributed datasets. Access is tiered, with the public interface available to registered users and expanded access aimed at journalists and investigators. Searching it returns cross-referenced entities, which can reveal that a name in a leak also appears in a procurement record.

OpenSanctions aggregates sanctions lists, politically exposed persons (PEP) data and other watchlists into a unified, deduplicated dataset. Its data are released under CC BY-NC 4.0; non-commercial use is free, but any use within a for-profit business, including compliance screening, requires a licence, with exemptions for qualifying journalism and non-profits.^[2] Anyone using it professionally must check the licence terms. A match against a sanctions or PEP list is a screening hit to be adjudicated, not a finding.

3 GLEIF and the Legal Entity Identifier

The Legal Entity Identifier (LEI), standardised as ISO 17442, is a 20-character code assigned to legal entities, mainly those transacting in financial markets. The Global Legal Entity Identifier Foundation (GLEIF) publishes the Global LEI Index free of charge. By the second quarter of 2026 the active LEI population exceeded 3.1 million, and registrants representing 99% of the population reported direct and ultimate parent information (“Level 2” data, answering “who owns whom”).^[3] Reporting exceptions are permitted, for example where disclosure is legally restricted, so an exception code is itself a datum. The LEI is useful because it is a persistent unique identifier that is independent of name spelling and can be matched to registry numbers, and because parent relationships are self-reported but validated by the issuing organisation. It does not reveal individuals; parent chains typically end at a corporate or fund entity.

4 Leak databases

The ICIJ Offshore Leaks Database is the best known leak resource. It consolidates the Offshore Leaks, Panama Papers, Bahamas Leaks, Paradise Papers and Pandora Papers investigations and holds information on more than 810,000 offshore entities, linked to people and companies in over 200 countries and territories.^[4] It publishes structured data on officers, intermediaries, addresses and entities, not the underlying emails and documents, and ICIJ states that appearing in it is not evidence of wrongdoing; offshore structures can be lawful. The Pandora Papers additions (December 2021, April and May 2022) added beneficial-owner data from providers including Alcogal and Fidelity Corporate Services.

Source	Type	Best for	Main limit
Official registry	Primary	Legal existence, officers, filings	Self-declared; few show real owners
OpenCorporates	Aggregator	Cross-jurisdiction name and address search	Lag; copies of registry data
OCCRP Aleph	Aggregator / archive	Linking entities across records and leaks	Access tiers; coverage uneven
OpenSanctions	Watchlist aggregator	Sanctions and PEP screening	Licence; false positives
GLEIF	Identifier registry	Entity disambiguation, parent chains	Self-reported parents; financial-sector bias
ICIJ Offshore Leaks	Leak data	Offshore officers, intermediaries	Snapshots through about 2020; not proof of wrongdoing

Leaked data raise their own legal and ethical issues: provenance is uncertain, material may include private data, and use in litigation requires authentication. Stay within the public, journalist-curated tables, and do not seek out or republish raw leaked personal data.

5 Forensic examination techniques

Technique 1: Ownership-chain reconstruction. Start from the target entity and record, per level: legal name, registry number, jurisdiction, status, formation date, officers, shareholders, registered agent and address. Proceed upward until you reach (a) a natural person, (b) a listed company or state body, (c) a nominee, trust or bearer structure, or (d) a registry that discloses nothing. Then compute effective ownership by multiplying percentages. Worked example: Target Ltd is 60% owned by Holdco A, which is 50% owned by Trust B and 50% by Holdco C; Holdco C is 80% owned by an individual. The individual's effective stake in Target is 0.60 × 0.50 × 0.80 = 24%, below a 25% PSC threshold, so a naive PSC screen could miss them. The examiner also tests control separate from ownership (voting agreements, board appointment rights). Output: an ownership diagram with every edge sourced to a registry extract, and each break in the chain stated explicitly.

Technique 2: Address and agent concentration analysis. Export all entities matching a registered address or agent from an aggregator. Compute the count and the share that were formed within 12 months, are dissolved, or have no filed accounts. Example: 212 entities at one suite address, of which 160 (75%) formed within two years and 140 show no officers: that address is a formation-agent location and is no evidence of common ownership; but if 6 of the 212 share an officer, those six are the lead. Over-reading shared addresses is the commonest error.

Technique 3: Officer-network pivot with disambiguation. For each officer, collect date of birth (month/year where published), nationality, service address and prior roles, then assess whether two records are the same person using at least two identifiers beyond the name. Record a confidence level (confirmed, probable, possible). Output: a person-to-company table that distinguishes confirmed links from name-only matches.

Technique 4: Timeline and lifecycle tests. Plot formation, name change, officer change, accounts, charge registration and dissolution dates against transaction dates. Shells commonly show formation shortly before first payment, officers resigning immediately after a payment or audit, and dissolution after receipt of funds. Example: an entity formed 4 January, invoicing from 20 January, three invoices totalling $480,000 paid by 28 February, officer resignation 3 March: a 48-day active life with no filed accounts.

Technique 5: Charges and filings as financial evidence. UK charge registers and US UCC filings show who lent to the company; accounts filed at Companies House show turnover bands, employee numbers and director loans. A company claiming $20 million of sales but filing micro-entity accounts with two employees is internally inconsistent and warrants a reasonableness test.

Technique 6: Screening protocol. Run entities and officers against sanctions and PEP datasets with documented fuzzy-matching thresholds. Adjudicate each hit using date of birth, nationality and role: a name hit with a mismatched birth year is closed as false positive with the reason recorded; unresolved hits are escalated. Keep the query log and dataset version/date. Example: 400 officers screened, 23 hits, 19 closed on mismatched identifiers, 3 confirmed PEP associations, 1 unresolved: the report states these numbers and the method rather than only the confirmed hits.

Technique 7: Leak cross-match. Search each target name, address and intermediary in the Offshore Leaks Database. A match establishes an appearance in a source dataset; to establish relevance, confirm identity through independent identifiers and ask whether the structure was disclosed to the relevant tax and regulatory authorities. Output: a documented match with source node ID and a statement of what the match does and does not show. Findings then feed tracing and net-worth work.

6 Limits and verification

• Nominees. Nominee directors and shareholders sit on the register in place of real owners; look for professional nominees who hold hundreds of directorships.
• Stale and self-declared data. Most registries accept filings without verifying them; note the filing date of every datum.
• Transliteration and name matching. Names rendered from Cyrillic, Arabic or Chinese scripts vary; search variants and use identifiers instead of names.
• Coverage bias. Leak and sanctions datasets reflect what was leaked or listed, not the universe of wrongdoing; absence of a name is not exoneration.
• Licensing. Check terms for each dataset before using it commercially or republishing it.
• Fairness. Present links as links; do not infer guilt from an offshore appearance or a PEP relationship.

See also: Asset Tracing, Anti-Corruption OSINT, Public Records and Court Dockets, OSINT Tools, AML Law.

References

1. DWF Group. "Economic Crime and Corporate Transparency Act" (August 2025), on mandatory identity verification from 18 November 2025. dwfgroup.com
2. OpenSanctions. "Free and non-commercial use." opensanctions.org
3. GLEIF. "The LEI in Numbers: Q2 2026." gleif.org
4. ICIJ. "Offshore Leaks Database: About." offshoreleaks.icij.org