Researching a Company Through Public Records

BY DR. LELAND W. SMITH

Most companies leave a paper trail, even small ones. To exist as a legal entity, a business has to register somewhere, file documents on a schedule, name the people responsible for it, and give an address where legal papers can be served. Public companies disclose far more. For an OSINT analyst, those records are often the most reliable sources available, because they are created under legal obligation and can carry penalties when false.

They are also easy to misread. A registry entry tells you what was filed, not whether it is true, and a company can be structured specifically so that its records reveal very little. This guide walks through the main sources, what each one can and cannot tell you, and how to combine them into a picture you can defend.

Start with the exact legal name and jurisdiction

Before you search anything, pin down two facts: the entity's exact legal name and where it is incorporated. Trading names, brand names and website names are often different from the registered name. "Brightline Analytics" on a website might be "BLA Holdings LLC" on paper, incorporated in a different state from the one where it operates.

Good places to find the legal name include website footers, terms of service, privacy policies, invoices, contracts, job postings and payment pages. Many jurisdictions require businesses to display their registered name and number on their website or correspondence, so the footer and legal pages are worth reading closely.

Write down every variant you find. You will search for all of them.

Business registries

US state registries

In the United States, companies are formed under state law, so there is no single national company register. Each state's Secretary of State (or equivalent office) runs a business entity search. Typical information includes:

• Legal name, entity type (corporation, LLC, limited partnership) and entity number
• Formation date and current status (active, dissolved, revoked, not in good standing)
• Registered agent name and address
• Sometimes officers, directors, managers or organisers, depending on the state
• Filing history, including annual reports, name changes and mergers

The amount of detail varies widely. Some states publish officers and principal addresses in annual reports. Delaware, where a large share of US corporations are formed, shows relatively little for free and does not list officers or members in its public search. A company formed in one state and operating in another will usually also register as a "foreign" entity in each state where it does business, which gives you more filings to check.

While you are on a Secretary of State website, look for Uniform Commercial Code (UCC) filings. These record secured lending: a lender files a UCC financing statement to claim an interest in a borrower's assets. They can reveal who a company owes money to and which of its assets are pledged.

UK Companies House

The UK register at find-and-update.company-information.service.gov.uk is one of the most useful free company registers anywhere. For each company it shows the registered office, directors and their appointment history, the filing history with downloadable documents, accounts, charges (secured debt) and the register of persons with significant control (PSCs), meaning people who own or control more than 25 percent or otherwise exert significant control.

Two features are especially valuable. First, you can search officers by name and see every company they have been appointed to, which quickly maps a person's business network. Second, filed documents are images or PDFs of the actual submissions, so you can read signatures, addresses and amendments yourself.

Historically, Companies House did not verify most of the information it received. The Economic Crime and Corporate Transparency Act 2023 gave it new powers to query and remove information and introduced identity verification for directors and PSCs, which began rolling out in late 2025. Treat older entries with the same caution you always should: they record what someone filed.

OpenCorporates

OpenCorporates aggregates company records from registries in many jurisdictions into a single searchable database. It is excellent for a first pass, especially when you do not know where a company is registered or want to find similarly named entities across borders.

Its limits follow from what it is. Data can lag behind the source registry, coverage and depth vary by jurisdiction, and some fields are not collected at all. Always follow the link back to the official register and cite the primary source, not the aggregator.

SEC EDGAR for US public companies

Companies with publicly traded securities in the United States file disclosures with the Securities and Exchange Commission, and those filings are free in EDGAR at sec.gov/edgar/search. Each filer has a Central Index Key (CIK), which is more reliable to search on than the name. EDGAR's full-text search lets you search inside filings for names, addresses or phrases, which is useful when a person or subsidiary is mentioned in passing.

The forms you will use most often:

• 10-K: the annual report. Read the business description, risk factors, legal proceedings and the list of subsidiaries, which is usually filed as Exhibit 21.
• 10-Q: quarterly reports, with less detail than the 10-K but more frequent.
• 8-K: current reports filed when significant events occur, such as executive departures, acquisitions, material agreements, auditor changes and bankruptcy.
• DEF 14A: the proxy statement, covering directors, executive pay, related-party transactions and major shareholders.
• Schedules 13D and 13G: filed by investors who acquire more than 5 percent of a class of voting shares.
• Form 4: changes in holdings by insiders such as officers and directors.
• S-1: registration statements for new offerings, often rich in history and ownership detail.
• Form D: notices of exempt private offerings. These are useful for private companies, because they can name executives and promoters and give the amount raised.
• 20-F: the annual report for many foreign private issuers listed in the US.

Read filings in date order when you are building a timeline. A run of 8-Ks announcing departures, a late filing notice and an auditor change tells a story that no single document does.

LEI and GLEIF

A Legal Entity Identifier (LEI) is a 20-character code defined by the ISO 17442 standard. Entities that take part in financial transactions in many jurisdictions are required to obtain one. The Global Legal Entity Identifier Foundation (GLEIF) publishes the full LEI dataset free at gleif.org, with a search tool at search.gleif.org.

Each LEI record includes the legal name, registered and headquarters addresses, the registration authority and local registration number, and its status. The most useful part for investigators is the relationship data: where reported, an LEI record names the entity's direct parent and ultimate parent, based on accounting consolidation. That can link a small subsidiary to a group you might not otherwise connect it with.

Check the registration status. An LEI that has lapsed means the entity has not renewed its record, so the data may be out of date. Relationship data is also only as complete as what the entity reported, and some entities report exceptions instead of parents.

Beneficial ownership: what you can and cannot see

Beneficial ownership means the real people who ultimately own or control a company, as opposed to nominee shareholders or holding companies. It is often the question clients care about most, and it is often the hardest to answer from public records.

• The UK PSC register is public, though it relies on what companies file and does not reach people who stay below the thresholds.
• In the European Union, public access to beneficial ownership registers was curtailed after a 2022 Court of Justice ruling, and access now generally depends on showing a legitimate interest.
• In the United States, the Corporate Transparency Act's beneficial ownership reports go to FinCEN and are not public. In 2025, FinCEN also narrowed the reporting requirement so that it no longer applies to companies created in the United States.

In practice you will often build a partial ownership picture from indirect sources: SEC filings, LEI parent data, UK PSC entries, charges and UCC filings, court records, press releases and procurement records. Say clearly in your report what you established and what remains unknown. "Ultimate beneficial owner not identified from public records" is a legitimate and useful finding.

Registered agents, and why an address proves little

Every US company must have a registered agent with an address in its state of formation, where legal documents can be served. Many companies use commercial registered agent services. As a result, a single office building may be the registered address of a very large number of unrelated companies.

The same applies elsewhere: formation agents, accountants and virtual office providers lend their addresses to many clients. So:

• Two companies sharing a registered address is, by itself, almost meaningless.
• Two companies sharing an unusual address, such as a small residential property or a specific suite number, is a lead worth following.
• A shared address plus a shared officer, phone number, email domain or filing agent is stronger. Look for several independent links, not one.

Before drawing conclusions from an address, search it in the registry to see how many entities use it. If the answer is hundreds, note it and move on.

A worked example

Suppose a client is considering a supply agreement with "Northgate Components" and asks you for a basic background check.

1. The website footer gives the legal name as "Northgate Components Ltd" with a UK company number. You open the Companies House record using the number, not the name, to avoid confusion with similarly named companies.
2. The record shows the company was incorporated three years ago, has filed micro-entity accounts on time, and has two directors. One director resigned eight months ago. The PSC entry names a UK holding company rather than a person.
3. You open the holding company's record. Its PSC is an individual who is also a director of five other companies. Two of those were dissolved after being struck off for failing to file. You note the facts without drawing a conclusion yet.
4. Northgate's registered office is a formation agent's address shared by many companies. You record that it is not evidence of a link to anyone else at that address.
5. A GLEIF search finds an LEI for the holding company with a lapsed status. You record the last-reported details and the lapse date.
6. You search EDGAR full-text search for the company and director names and find nothing, which is expected for a small private UK company. You note the negative search, with the date.

Your report states the verified facts (incorporation, filing record, officers, ownership chain as filed), the gaps (no verified natural-person owner behind the holding company beyond the PSC entry, lapsed LEI) and your assessment, clearly labelled: the filing record is consistent with a small, active trading company, and the director's history of struck-off companies is worth discussing with the client, but it is not evidence of wrongdoing on its own.

Limits and common mistakes

• Confusing similar names. Always identify an entity by registry number and jurisdiction, not just its name.
• Treating registry data as verified. Most registries record what was filed. Errors, stale entries and deliberate falsehoods all occur.
• Reading too much into status. "Dissolved" or "not in good standing" can mean a missed fee, a planned wind-down or something more serious. Check the filing history.
• Matching people by name alone. Common names produce false matches. Use partial dates of birth where registries show them, addresses, appointment history and co-directors to confirm identity.
• Relying on aggregators. Cite the official registry, and check the date you retrieved it.
• Ignoring negative results. Record what you searched and found nothing in. It shows coverage and protects you when someone asks whether you checked.

Ethics and legality

Company registers are public so that people can check who they are dealing with, and using them for due diligence is lawful and proportionate. Registers also contain personal data about directors and owners, so collect only what the task needs and handle it according to the data protection rules that apply to you. Some registries have terms restricting bulk downloading or automated scraping; read them and use official bulk data products or APIs where those exist. Never misrepresent yourself to a registry, a registered agent or a company to obtain records, and do not use pretexting to get information that is not public.

Checklist

• Identify the exact legal name, all known variants and the jurisdiction of incorporation.
• Pull the official registry record by entity number and save a dated copy.
• Review officers, filing history, status, charges or UCC filings, and foreign registrations.
• Use OpenCorporates to find related entities, then confirm each one in the source registry.
• For US public companies, review the latest 10-K, recent 8-Ks, the proxy and ownership filings in EDGAR.
• Search GLEIF for an LEI and check parent relationships and registration status.
• Map beneficial ownership as far as public records allow, and state the gaps.
• Check how many entities share a registered address before treating it as a link.
• Require several independent connections before linking people or companies.
• Log every search, including negative results, with the date and source.