跳到主要内容

who-really-owns-it 标准

登记信息把品牌变成有编号、日期与地址的法律实体。原文:Research companies, directors, shareholders and ultimate beneficial ownership in official corporate registries, filings and offshore datasets — OpenCorporates, UK Companies House and the PSC register, SEC EDGAR, US Secretary of State registries, EU business registers, GLEIF LEI records, OpenOwnership, OpenSanctions and the ICIJ Offshore Leaks database. Use when asked who owns or controls a company, to find a person's other directorships, or to unpick a group structure. Applies to KYB and UBO verification, AML and sanctions screening, nominee and shell-company detection, procurement integrity, and M&A diligence. Reference at useosint.com/skills/who-really-owns-it.

在 GitHub 打开

安装方式

cp -r skills/who-really-owns-it ~/.claude/skills/who-really-owns-it

把该 skill 目录放进客户端 skills 目录。不同客户端的目录可能不同,Claude Code 默认是 ~/.claude/skills/

整仓一次性获取:git clone --depth 1 https://github.com/UseOSINT/Skills.git

依赖与权限

  • 无需 API Key
  • 无需联网
  • 依赖外部命令:go make
  • 以上为按正文与 frontmatter 自动推断的信号,仅供参考;安装前建议先阅读原文。
触发场景
asked who ownscontrols a companyto unpick

SKILL.md 正文

来源 UseOSINT/Skills@06243a5 · 许可 MIT · 内容未修改

Who really owns it

Registries turn a brand into a legal entity with a number, dates, addresses, and

named people. The thing nobody tells you first: **registry structure varies

enormously by jurisdiction, and that variance is the entire game.** One country

publishes full accounts, share registers, and directors' birth dates for free.

Its neighbour publishes a name and a status code and charges for the rest. Your

research strategy is not "look up the company" — it is "work out what this

jurisdiction lets me see, then plan around the gap".

Second thing: search by company number, not name. The number is issued once

and persists through renames, mergers, and dissolution. The name does not.

Triage

What you holdStart hereWhy
A name, unknown jurisdictionOpenCorporates as a cross-jurisdiction indexFinds candidate entities and tells you which registry to go to. Not the source of truth
A name, known jurisdictionThe national registry directlyAlways richer and fresher than any aggregator
A company numberThe issuing registryDurable, unambiguous, no name-matching problem
A US-listed companySEC EDGAR, including its full-text search across filingsFilings dwarf what any company registry holds
A financial-market participantGLEIF's LEI searchLEI records include direct and ultimate parent relationships, which most registries do not
A person, want their companiesOfficer-name search in the registry (see below)The highest-value pivot in this skill
An offshore entityICIJ Offshore Leaks database, plus whatever the jurisdiction publishesOften the only visibility into a closed register
A cross-border groupOpenSanctions and OCCRP Aleph alongside the registriesAggregate indexes catch relationships no single registry sees

Registry-by-registry detail — what each exposes, its access model, and its

identifier format: [reference/registry-catalogue.md](reference/registry-catalogue.md).

Method

  1. Resolve the entity. Search the aggregator to find candidates, then go to

the home registry and pull the canonical record. Record legal name, number,

jurisdiction, entity type, incorporation date, status, and registered office.

Note every former name — you will need them for litigation and media searches.

  1. Pull the filing history, not just the summary page. The summary is a

current-state view. The filing list is the timeline, and the timeline is where

the story is.

  1. Read the officer record. Names, roles, appointment and resignation dates,

nationality and country of residence where published, service address, and in

some registries a birth month and year — which is a genuinely powerful

disambiguation anchor for find-anyone.

  1. Read the ownership record. Share capital, share classes, allotments and

transfers, and the beneficial ownership declaration where the register has one.

  1. Read the charges register. Charges, liens, mortgages, and security

interests name the secured lender, and lenders are counterparties nobody

thinks to look for. A company with no charges and no accounts has no evident

financing.

  1. Run the officer pivot. Take each officer's exact registry-normalised name

and search the officer index for their other appointments. This is where a

single entity becomes a network.

  1. Run the address pivot. Search the registry by registered office. Then

decide what the address actually is before you weight it — see below.

  1. Screen. OpenSanctions for the entity and every named person. Report a hit

as a review item, not a finding; transliterated name matching is noisy.

  1. Graph it. Multi-entity results go to graph-the-network; the finished

picture goes to x-ray-a-company.

Filing types and how to read them:

[reference/filing-interpretation.md](reference/filing-interpretation.md).

Beneficial ownership, and where it stops working

Beneficial ownership registers ask a company to declare the natural persons who

ultimately own or control it above a threshold. The trajectory has broadly been

registers opened to the public and then, in several jurisdictions, re-restricted

to those who can show a legitimate interest, after legal challenge on privacy

grounds. Assume access is conditional and check the current model before planning

around it.

Four structural failure modes:

  • Nominees. A nominee director or shareholder is recorded, real, and

economically irrelevant. Legal in many places. The register is accurate and

useless.

  • Trusts and foundations. They interpose a structure most company registers do

not pierce. A company owned by a foundation can have a technically complete

declaration and no identifiable human.

  • Layering. A chain across four jurisdictions where each register sees only

its own link. It is designed that way.

  • Thresholds. A register capturing holders above a percentage is blind by

construction to a group each sitting just below it.

The correct output when you hit one of these is a documented terminus: "control

traced to entity X in jurisdiction Y, whose register is not public; declared

beneficial owner is Z, who also appears as declared owner of 40 unrelated

entities and is assessed as a nominee." That is a finding.

Registered agents and mass addresses

Every jurisdiction requires a registered address, and a formation-agent industry

exists to provide it. A single address hosting thousands of companies is

completely normal. Before weighting it, identify what it is: a law firm or

accountancy practice hosting clients is ordinary; a virtual-office provider is

mildly interesting; a residential address with hundreds of companies is not

ordinary. The useful signal is not the count but the overlap — which specific

other entities at that address share officers, filing agents, or filing dates

with yours. Same-day incorporations at the same address by the same agent is a

batch, and batches are worth looking at.

Offshore jurisdictions and leak-derived data

Several jurisdictions publish essentially nothing: name and status, sometimes not

even that, with officers and owners held only by the registered agent. For these,

the ICIJ Offshore Leaks database is a legitimate and widely used research source.

It aggregates entities, officers, intermediaries, and addresses from several

journalistic investigations into offshore structures, and it is often the only

public visibility into a closed register.

Use it correctly. It is a historical snapshot, not a live register, so absence

means nothing and presence is as-of the leak. It records structures, not

wrongdoing — offshore incorporation is lawful and ubiquitous. Names are as

recorded in the leaked documents, with the transliteration inconsistencies that

implies. Treat a hit as a lead requiring corroboration against a filing, a court

record, or a contemporaneous document, and be careful how you characterise it in

writing. OCCRP Aleph indexes leaks alongside registries and documents and is

worth running the same names through.

The officer pivot

The highest-value move available here. A person's directorship history across

jurisdictions reveals prior ventures, dissolved companies, co-directors who

recur, and business relationships that appear nowhere else.

Make it work: search the registry's normalised officer name form, not your

preferred spelling. Try the surname alone in registries that allow it. Where the

registry publishes a birth month and year, use it — it is the single best

discriminator available for common names. Search former and married names.

Account for transliteration: one person can appear under three romanisations of

the same name across three registries, and no index links them.

Then verify. Two directorships under the same name are not one person. Confirm

with a matching birth month/year, a matching service address, a matching

co-director, or a corroborating source from find-anyone. The officer pivot's

false-positive rate on common names is the main way this technique produces

confidently wrong network diagrams.

Dissolved companies and the historical record

Dissolution removes an entity's legal personality; it does not usually remove its

record. Most registries retain filings for years afterwards, and those filings are

frequently the most informative in an investigation because they document a

failure the principals would rather nobody found. Retention periods vary and some

registries eventually purge, so archive dissolved-company filings when you find

them. A director's trail of dissolved entities is one of the strongest single

signals in corporate diligence.

Filing dates as a timeline

Read the filing history chronologically before you read any individual document.

The pattern carries information the documents do not:

  • Incorporation shortly before a transaction, a tender, or a pitch.
  • A cluster of officer resignations, especially just before or after an accounts

filing or an auditor change.

  • A share transfer coinciding with a change of registered office.
  • An abrupt shift from timely to late filing.
  • A dormant company that suddenly starts filing activity.
  • Filings backdated or submitted in a batch on one day, which usually means an

agent catching up on a compliance failure.

Where this goes wrong

  • Filed is not verified. Most registrars check completeness, not truth.

A registry record proves a statement was made under a filing obligation.

  • Staleness is built in. Annual filing cycles mean the published picture can

be a year or more behind reality, and status fields update slowly after

dissolution or restoration.

  • Aggregators lag and normalise. A cross-jurisdiction index has partial

coverage that varies by country, refreshes on its own schedule, and normalises

names and roles in ways that lose detail. Confirm anything material at source.

  • Name matching fails in both directions. Legal-form suffixes, punctuation,

accents, transliteration, and post-merger renames create false negatives;

common names create false positives.

  • Wrong-registry errors. Federal versus state versus municipal registers,

separate registers for branches of foreign companies, and entirely separate

regimes for partnerships, cooperatives, trusts, and charities. Not finding an

entity often means you searched the wrong register.

  • Redaction regimes. Residential addresses and full dates of birth are

suppressed in many registries, and some allow individual officers to apply for

protection. A suppressed address is not a hidden one.

  • Paid tiers hide the important documents. Several registries give a free

summary and charge for the filings that actually matter. Budget for it or say

in the report that you did not read them.

Confidence grading

  • Confirmed — stated in a document filed at the primary registry or

regulator, retrieved and dated, with the entity identified by number.

  • Probable — from a reputable aggregator or an LEI record, consistent with

the primary record, uncontradicted.

  • Unconfirmed — inferred from a shared address, a shared name, or a leak

dataset without corroboration.

  • Assessed — your judgement, labelled as such, e.g. that a director is a

nominee. State the basis and keep it separate from fact.

Grade identity attribution separately from the record itself. A filing can be

genuine and still not be your person.

Worked example

Question: does the director of a UK supplier control other entities?

  1. Registry record gives the company number, one director, and a birth month and

year. Anchor established.

  1. Officer index on the exact name form returns eleven appointments. Six share the

birth month and year — same person. Five do not, and are set aside.

  1. Of the six, two were dissolved after compulsory strike-off. Filing history on

both shows accounts overdue before strike-off. Sourced and recorded.

  1. Address pivot on the registered office returns roughly 300 entities, but it

resolves to a chartered accountancy practice. Weighted low. Dead end.

  1. Better signal: two of the six share a second director, who appears in the

ICIJ database as an officer of an offshore entity. Recorded as a lead, graded

unconfirmed, and taken to find-anyone for corroboration rather than written

up as a link.

  1. Output: six confirmed directorships, two adverse histories, one unconfirmed

offshore association clearly labelled as such.

Pivots

Selector producedFeed into
Officer or shareholder namefind-anyone
Parent, subsidiary, or related entityx-ray-a-company
Registered office or service addressdig-through-data-brokers
Company website from the filing or recordrecon-a-domain-passively, who-owns-this-domain
Multi-entity ownership and officer webgraph-the-network
Historical registry page or removed filingread-deleted-pages
Filed contact emailwhat-an-email-reveals
Finished entity chartwrite-the-intel-brief

Legal and ToS notes

Most registry data is published for reuse, but conditions differ: several

national registries impose licensing terms, attribution requirements, or rate

limits, and several offer an official API or bulk product specifically so you do

not scrape the web interface. Use them. Officer personal data is personal data —

residential addresses and full dates of birth are protected in many registers,

and deliberately circumventing a protected-address regime is an offence in some

jurisdictions. Beneficial-ownership access may require you to assert a legitimate

interest; assert one you actually have, in writing. Leak-derived datasets are

lawful to research and are published by journalistic organisations for that

purpose, but characterising a named person as wrongdoing on the basis of a leak

entry alone is both an evidential and a defamation problem. Corroborate, and

write carefully.

质量与来源

所属仓库
UseOSINT/Skills
仓库星标
49
最近更新
2 个月前
采集时间
今天
commit
06243a5620b0
内容指纹
sha256:98468eb4e9734a1
文件路径
skills/who-really-owns-it/SKILL.md