Supplier Due Diligence and Vendor Vetting with OSINT

Supplier due diligence answers three questions before the first purchase order: does this supplier exist as described, can it make what it promises, and would buying from it expose you to sanctions, forced-labor or fraud risk? We check each one in open sources, independently of the supplier's own questionnaire.

Email your supplier list Geopolitical risk

New suppliers before onboarding
Fake and front companies
Capacity and certificate claims
Sanctions and forced-labor exposure

Short answer

Supplier due diligence with OSINT verifies a vendor against sources it does not control: company registries, site imagery, trade and procurement records, certification registers, court files, sanctions lists and media. It catches fake suppliers, overstated capacity, hidden owners and forced-labor or sanctions exposure before onboarding. OSINT-S delivers focused supplier checks from 10 business days.

Why a Supplier Questionnaire Is Not Enough

Onboarding forms, certificates and self-assessments are written by the supplier. Due diligence checks them against the outside record.

Most onboarding workflows collect a registration extract, a bank letter, a certificate or two and a signed code of conduct. Every one of those can be accurate, outdated or forged, and a vendor that intends to defraud you fills in the form most carefully. Independent checks matter most for suppliers that are new to you, critical to production, located in high-risk regions or asking for large advance payments.

The work differs from third-party due diligence on sales agents: the main risks are not bribes paid on your behalf but goods that never arrive, goods made with forced labor, money sent to a sanctioned owner and suppliers set up by insiders.

Fake and Front Suppliers: What OSINT Shows

Fake suppliers tend to share a recognizable set of traits: new registration, borrowed addresses, thin web presence and payment details that do not match the company.

Warning sign	How we test it
Registered weeks before the first quote	Registry history, earlier names, dormant periods and changes of officers
Address shared with dozens of companies	Formation-agent and virtual-office indicators, street-level imagery, other firms at the address
New website with stock factory photos	Domain age, archived versions, reverse image search on site photos
Bank account in another country or name	Whether the account holder is a related entity, and how it connects to the supplier
Director linked to someone on your staff	Officers, shareholders and addresses compared with employee details you supply
No customers, trade history or reviews	Trade records, procurement portals, industry directories and buyer references in public

Basic existence checks are covered in more depth by company verification. If an insider may have set up the vendor, the matter becomes a procurement and vendor fraud investigation.

Testing Capacity and Certificate Claims With OSINT

A supplier claiming a 20,000-square-meter plant and 300 staff should be visible as one. We check the site, the workforce and the paperwork independently.

The site. Satellite and street-level imagery for the buildings, loading activity and expansion over time, matched to the address on the certificate. Our geolocation verification team confirms where supplier photos and videos were taken.
The workforce. Job advertisements, professional profiles and filed headcount, compared with the output the supplier promises.
Trade footprint. Export and import records, procurement awards and buyers named in public, which show whether it ships what it sells or resells someone else's goods.
Certificates. Quality, safety and social-audit certificates checked against the issuing body's public register where one exists, including scope, site and expiry.
Subcontracting. Signs that the work goes to another factory: shared addresses, sister companies and product photos traced to a different site.

Sanctions and Forced-Labor Exposure in Your Supply Base

Import bans and sanctions follow ownership and origin, not only names on a list. Due diligence maps both.

United States, UFLPA. Since June 21, 2022, CBP presumes that goods mined, produced or manufactured wholly or in part in Xinjiang, or by an entity on the UFLPA Entity List, are barred from entry. Importers must rebut the presumption by clear and convincing evidence and show supply chain due diligence (CBP).
European Union. From 14 December 2027, under the EU forced labor regulation, no product made with forced labor may be sold in or exported from the EU market; the Commission provides a risk database to identify geographical areas and products at risk (European Commission).
Sanctions ownership. OFAC's 50 Percent Rule treats property of entities owned 50 percent or more in the aggregate, directly or indirectly, by blocked persons as blocked (OFAC FAQ 401). A supplier can be clean by name and blocked by ownership.

Open sources link a supplier to its owners, its sister plants and, often, its own suppliers' regions. Where you need a country- or sector-wide view rather than a single vendor, our geopolitical and supply chain risk intelligence service covers it.

How OSINT Supplier Due Diligence Runs

Four steps, from your supplier details to a decision procurement can act on.

Send the supplier fileName, registration, addresses, bank details, certificates and what you plan to buy, with the value and start date.
Confirm identity and ownersWe match the legal entity, trace owners to people and screen them for sanctions, debarment and litigation.
Test the claimsSite, workforce, trade footprint, certificates and payment details are checked against the outside record.
DecideYou receive approve, approve with conditions or reject, with evidence, open questions and conditions such as audits or staged payments.

What Procurement Receives

A one-page verdict for each supplier with the evidence behind it, from 10 business days for a focused check.

Each supplier gets a verdict sheet: the recommendation, the checks run, what was confirmed, what could not be and what to ask the supplier. Critical suppliers can be taken further into ownership and site work over up to about a month. The fee is fixed after written scoping; urgent onboarding is possible for a 50% surcharge, and the fee goes down if we miss the agreed date.

After onboarding, counterparty monitoring watches for new sanctions, insolvency, litigation and media on suppliers. All checks use lawful sources: no pretext calls, no fake buyer personas and no purchased leaked data, and personal data on owners is handled in line with the GDPR and UK GDPR. Supplier checks are one part of our OSINT due diligence service and of the wider range of OSINT services for procurement teams.

Check the Supplier Before the First Payment

Send the supplier's details, what you plan to buy and when you need to place the order. We reply with the checks we would run, a delivery date and a fixed quote.

Email your supplier list Due diligence overview

Supplier Due Diligence FAQ

We found a new packaging supplier abroad that is 30 percent cheaper than our current one — what would supplier due diligence check before we pay the 40 percent deposit they are asking for?

That the company exists, has traded for more than a few months, owns or rents the site it shows you, and has real customers. We check who owns it, whether the bank account belongs to the same entity, and whether it has litigation, sanctions or fraud complaints. A large deposit to a new supplier is exactly when to check.

Our supplier sent us an ISO certificate and photos of a large factory, but I have a feeling they are a trading company reselling someone else's product — can you tell the difference from open sources?

Often. We check the certificate against the issuing body's register, geolocate the factory photos, compare the site with satellite imagery, and look for job ads and trade records consistent with manufacturing. Trading companies usually show office addresses, few production staff and products traced to other factories.

We import electronics into the US and a component supplier's parent company has a plant in Xinjiang — how would you assess our exposure under the UFLPA?

We map the supplier's ownership, sister plants and, where public, its own inputs, and check names against the UFLPA Entity List and related reporting. That tells you how close the risk sits to your parts. Rebutting the presumption is your legal team's job; our report gives them the facts and sources.

Our accounts payable team noticed a new vendor whose registered address is the same as one of our buyers' homes — should we run supplier due diligence or start a fraud investigation?

Treat it as a possible fraud first. A shared address with an employee is a classic sign of a vendor set up by an insider. A procurement fraud investigation looks at the vendor, the employee and the payments together, and protects evidence for HR or legal action. Supplier vetting alone would answer too narrow a question.

We onboard around 200 new suppliers a year and cannot run a full review on each — which ones would you recommend checking in depth?

Those that are critical to production, sole-source, in high-risk regions for sanctions or forced labor, asking for advance payments, or above a spend threshold you set. The rest can go through automated screening, with an analyst checking only the hits. We can help draw up the criteria.

Can you pose as a potential buyer and call our new supplier to check whether they really have the production capacity they promised us?

No. We do not use pretext calls or fake buyer personas. Capacity can be tested lawfully from imagery, staffing, trade records and certificates, and your own procurement team can ask the supplier directly, or arrange an audit, using questions we draft from the findings.

Sources and Notes

Sources checked 8 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.