Role: methodology for following money, ownership, and economic relationships.
When the skill activates
- Investigating ownership behind a company or transaction
- Mapping a network of related entities (companies, beneficial owners)
- Sanctions checking
- Shell-company / offshore-structure analysis
- Following payments, contracts, or political donations
Core principles
1. Follow the structure, not just the name
Companies are nested. Always look one level up (parent), one level sideways (sister companies), one level down (subsidiaries) to find the real picture.
2. Beneficial ownership > legal ownership
Legal owner can be a nominee/trustee. Always ask: who is the ultimate beneficial owner (UBO)? Most jurisdictions now require UBO registers.
3. Sanctions are a fact-check, not a verdict
Match against multiple sanctions lists. False positives are common (similar names). Confirm with date of birth or other identifiers.
4. Time-stamp every relation
Companies merge, split, dissolve. A 5-year-old structure may be irrelevant.
5. Document the trail
Every claim has a source. Screenshots of registry pages with date/URL.
Methodological frameworks
Ownership chain mapping
For target company X:
- Direct shareholders (>5% typical disclosure threshold)
- Parent company (if any) — recurse upward
- Subsidiaries (X's children)
- Sister companies (other children of the same parent)
- Board members and executives — look for crossovers
- UBO (where registered)
Beneficial owner identification
Ladder:
- Legal owner (per registry)
- Nominee / trustee analysis (if legal owner is a corporate entity, recurse)
- UBO register (where mandated by law)
- Press / leaks (Panama Papers, Pandora Papers, OCCRP)
- Inference (only if multiple converging signals)
Sanctions check
Always check against:
- OFAC SDN List (US)
- EU consolidated sanctions list
- UK OFSI list
- UN Security Council list
- Country-specific lists where relevant
Tools:
- OpenSanctions.org (consolidated, searchable)
- Each list's own search
- Aleph (OCCRP) for cross-referencing
Politically Exposed Persons (PEP) check
Identify if a person/owner is a PEP. Sources:
- World-Check (paid)
- Open PEP databases (Wikidata, Aleph)
- Government lists where published
Network analysis (financial)
Map relationships:
- Shared addresses (red flag for shell-company nests)
- Shared directors / nominees
- Shared funding sources
- Common consultants / law firms
- Transaction patterns (where data available)
Use the osint-network skill for the structural analysis.
Standard data sources
International
- OpenCorporates — global company registry data
- OCCRP Aleph — leaked documents + structured data
- OpenSanctions.org — consolidated sanctions
- GLEIF — Legal Entity Identifiers
- Wikidata — structured entity data with links to news
National (configure per project)
Most jurisdictions have:
- Public company registry (e.g. Companies House UK, SEC EDGAR US)
- Beneficial owner register (per AMLD5/UBO directives)
- Court records
- Government procurement databases
- Property registries
Investigative journalism
- OCCRP — Eastern European focus, global cases
- ICIJ — Panama/Pandora Papers, FinCEN Files
- Domestic investigative outlets
Workflow
Phase 1: scope
- What's the question? (ownership / sanctions / network / specific transaction)
- Sensitivity? (regulated due diligence vs. journalism vs. research)
- Public information only? (always yes for public OSINT)
Phase 2: target identification
- Exact entity name + jurisdiction
- Tax/registration ID where available
- Disambiguation (multiple companies with similar names)
Phase 3: structural mapping
Per the framework above. Document each step with source.
Phase 4: sanctions / PEP check
Cross-reference against multiple lists. Document hits and false positives.
Phase 5: network analysis
If relevant: extend to related entities and persons. Use the osint-network skill.
Phase 6: synthesis
Produce report:
- Ownership structure (with mermaid diagram if useful)
- Beneficial owner conclusion (with confidence)
- Sanctions / PEP findings
- Network observations
- Sources and dates
- Gaps and caveats
Output template
# Financial OSINT: [Entity]
## Scope
- Target: [Entity name + ID]
- Question: [What we're investigating]
- Sensitivity: [Public OSINT / regulated DD / journalism]
## Ownership structure
[Mermaid diagram]
### Direct shareholders
| Owner | Stake | Type | Source |
|-------|-------|------|--------|
### Parent company / UBO
[Per the framework]
## Sanctions / PEP
- OFAC: [hit/no hit + match details]
- EU: ...
- PEP: ...
## Network observations
[Key findings from network analysis]
## Sources
[Numbered, with URLs and dates]
## Gaps and caveats
- [What couldn't be confirmed]
Ethical limits
- Public information only. Avoid leaked data unless ethically published (OCCRP, ICIJ).
- Distinguish facts from inference. Mark speculative chains.
- Be careful of accusations. Sanctions / fraud claims need solid evidence.
- Time-stamp everything. Networks change.
- Right of reply for serious allegations being published.
Integration with other skills
- person-osint for the persons behind companies
- osint-network for structural relationship mapping
- intelligence-{signal,structure,context,synthesis} for the analytical pipeline
🎯 COMPLETED: [SKILL:financial-osint] [financial OSINT on X] 🗣️ CUSTOM COMPLETED: [SKILL:financial-osint] [Financial OSINT done]