Arsenly_OSINTby XowiaLabs

Financial OSINT

2026 Expansion
Browse the interactive, filterable tools for this domainOpen tools →

36.1 UBO Tracing Workflow (Ultimate Beneficial Owner) — 12 Steps

Step Action Tool / Source
1 Identify initial entity: legal name, jurisdiction, registration number OpenCorporates · Companies House UK
2 Obtain incorporation document National public registry · OCCRP Aleph
3 Identify active AND historical directors OpenCorporates · SEC EDGAR
4 Identify declared shareholders OpenOwnership Register · GLEIF
5 Detect nominees and trusts ICIJ Offshore Leaks
6 Verify physical-person identities LittleSis · national civil registries
7 Walk the chain to next level (iterate to person or 5 levels max) Maltego · Obsidian
8 Cross-check against sanctions (incl. OFAC 50 Percent Rule) OpenSanctions · OFAC SDN
9 Verify UBO tax-residency transparency FATF High-Risk Jurisdictions
10 Search adverse media and litigation OpenSanctions PEPs · CourtListener
11 Validate with blockchain/crypto if applicable Arkham Intelligence · Etherscan
12 Document final ownership chain (nodes, edges, %, dates, hashes) Maltego + Obsidian + SHA-256 per document

36.2 Verified Financial OSINT Tools

Tool URL Function
OpenCorporates https://opencorporates.com Global corporate registry (140M+ entities)
OpenOwnership Register https://register.openownership.org Public UBO registers
OpenSanctions https://www.opensanctions.org Aggregated sanctions + PEPs
OCCRP Aleph https://aleph.occrp.org Cross-border asset investigation
ICIJ Offshore Leaks https://offshoreleaks.icij.org Pandora / Panama / Paradise Papers
LittleSis https://littlesis.org US people–power connections
FollowTheMoney https://followthemoney.tech OpenSanctions data model
FinCEN https://www.fincen.gov US financial records portal
SEC EDGAR https://www.sec.gov/edgar US corporate filings
GLEIF https://www.gleif.org Legal Entity Identifier registry
OFAC SDN List https://ofac.treasury.gov US Treasury sanctions
EU Sanctions Map https://www.sanctionsmap.eu Interactive EU sanctions map
CourtListener https://www.courtlistener.com US federal court records
OpenSecrets https://www.opensecrets.org US money-in-politics
Sayari https://sayari.com Commercial corporate-network intel
Equasis https://www.equasis.org Global merchant vessel registry
Arkham Intelligence https://www.arkhamintelligence.com On-chain wallet attribution
Dune Analytics https://dune.com SQL across 100+ blockchains (free tier)
Nansen https://nansen.ai Smart-money signals ($49/mo)
Arbiscan https://arbiscan.io Arbitrum L2 explorer
Basescan https://basescan.org Base L2 explorer
Optimistic Etherscan https://optimistic.etherscan.io Optimism L2 explorer

36.3 Common Errors in Financial OSINT

  1. Confusing director with UBO. A director signs minutes; a UBO economically controls. In offshore shells the director is usually a professional nominee with 200+ companies.
  2. Not handling transliterations. Mohammed / Muhammad / Mohamad / Mehmet — exact match fails. Use ISO 9 (Russian) or Hanyu Pinyin (Chinese).
  3. Trusting PSC Register as ground truth. The UK PSC Register is self-reported; real UBOs hide behind nominees. Always cross-check with ICIJ.
  4. Treating sanctions lists as binary. "Not listed" ≠ "clean". Designation takes months–years. Use adverse media + peer designations.
  5. Mixing accusation with conviction. A DOJ forfeiture complaint is a civil allegation, not a conviction. Cite as "the DOJ alleges in its 2016 complaint...".
  6. Forgetting OFAC 50 Percent Rule. An unlisted entity owned 50%+ in aggregate by sanctioned persons is legally blocked.
  7. Treating blockchain analytics as absolute truth. Wallet attributions (Arkham, Chainalysis) are heuristics. Always document source and confidence level.
  8. No chain-of-custody. A screenshot without URL, date, and hash is not admissible. For formal DD: archive.org snapshot + timestamped screenshot + SHA-256.

36.4 Case Study — 1MDB ($4.5B Misappropriated)

1Malaysia Development Berhad (1MDB) was a Malaysian sovereign wealth fund established in 2009. Between 2009 and 2015, approximately USD 4.5 billion was misappropriated according to the US Department of Justice. The DOJ filed civil forfeiture complaints in 2016, 2017 and 2019 seeking to recover more than USD 1.7 billion in assets.

Public money flow reconstructed from open sources:

  1. Origin: Bonds issued by 1MDB (2009-2013) under joint management with Goldman Sachs.
  2. First shell layer: Transfers to Good Star Limited (Seychelles), controlled by Jho Low (Low Taek Jho).
  3. Intermediate layer: Good Star → Wynton Trading (BVI) → Black Rock Asia (HK) → accounts linked to Malaysian PM Najib Razak. Part reached Najib's personal AmBank account (USD 681M in 2013, the "Saudi donation").
  4. Final destination: Real estate in NY / Beverly Hills (USD 100M+), the yacht Equanimus (USD 250M), rights to The Wolf of Wall Street, art works.

Verified public sources:

← Explore the toolkit