The phrase 'due diligence completed' is often more confident than the analysis beneath it. A sanctions screen may have been clear, a company may be active and a director may have verified their identity. Those results can all be accurate while the central commercial claim remains untested.
The central issue is whether the available evidence is sufficient for the decision being contemplated. Routine screening, enhanced review and deeper factual research answer different questions and should not be treated as interchangeable.
Three different questions are often called due diligence
Standard screening checks defined names against defined sources: sanctions, politically exposed persons, watchlists, corporate records, identity data or adverse media. It is repeatable and often mandatory. It is most effective where the question and source universe are stable.
Enhanced due diligence broadens or deepens the review because risk is higher: complex ownership, jurisdictional exposure, unusual transactions, regulatory concerns, source-of-wealth questions or material adverse information. It remains structured, but the scope responds to risk.
Investigative due diligence becomes relevant when a decision depends on a claim, relationship or inconsistency that routine sources cannot resolve. Its value lies in testing the reliability of material facts and making uncertainty explicit, rather than treating a clear database result as a complete risk conclusion.
Better registers reduce one risk, not every risk
Companies House reported nearly four million verified identities and 151,000 addresses removed from the register by June 2026. 1 These reforms make identity and filing data more useful. They do not establish that a company is trading as claimed, that a director has the experience stated in a pitch, or that a connected party is independent.
The FCA makes a similar distinction explicit. Firm Checker can confirm authorisation and permissions, but it cannot guarantee that compensation or ombudsman protection applies, and it does not display every item held by the regulator. It also warns users to verify contact details because clone firms copy genuine registrations. 2
A reliable source should therefore be used for the proposition it supports. Registration supports existence. Permission supports regulatory status for specified activities. Neither independently authenticates the person communicating with you or the truth of a commercial forecast.
The experienced joint-venture partner
A proposed partner presents an established brand, an active company, senior biographies and a list of international projects. Standard screening is clear. The commercial decision, however, depends on the team's claimed delivery history and access to local counterparties.
Investigative due diligence would not repeat the screening at greater volume. It would test selected project claims, reconcile dates and employing entities, examine predecessor businesses, map the local relationships and identify who actually delivered, contracted and was paid. It would also look for plausible reasons why public corroboration may be limited.
The output might support the claims, identify an overstated but remediable presentation, expose a material mismatch or leave a defined uncertainty. Each result can be translated into governance rights, references, conditions, staged funding, warranties or a decision not to proceed.
Red flags need mechanisms, not adjectives
ACFE reported that 84 per cent of perpetrators in its 2026 occupational-fraud study displayed at least one behavioural red flag before detection. It also found that tips were the most common detection route and that control weakness or override appeared in more than half of cases. 3 These findings are useful for organisational risk; they do not create a personality test for dishonesty.
A useful warning indicator should be tied to a mechanism. Pressure to bypass a callback increases payment-diversion risk because it defeats independent authentication. Opaque connected parties increase conflict risk because economic benefit may not align with the disclosed transaction. Unverifiable project claims increase capability risk because the decision relies on experience that has not been established.
Language such as 'concerning', 'suspicious' or 'high risk' is not analysis unless the report explains why the fact matters, what alternative explanations exist and what decision it should affect.
The purpose is calibrated confidence
No due-diligence process proves that a future relationship will succeed or that a person will behave well. Public records can be incomplete, databases can contain false positives and credible businesses can have limited online footprints. The report should make those limitations visible.
Investigative due diligence is justified where the unanswered question is material enough to change the decision and capable of being developed lawfully and proportionately. It should not become a pretext for collecting private information simply because it is available.
The best result is calibrated confidence: a clear explanation of what has been tested, what the evidence supports, what remains unknown and what the client can do with that uncertainty.
Implications for decision-makers
- Use screening, enhanced review and investigative research for different questions.
- Test the representations on which the decision actually depends.
- Tie every warning indicator to a risk mechanism and a practical response.
- State limitations and unknowns prominently enough that they cannot be mistaken for clearance.
Identity verification is not commercial verification
Compulsory identity verification for directors and people with significant control has materially improved the UK corporate-register environment. Companies House began the mandatory regime on 18 November 2025 and now publishes quarterly compliance data. That is a significant change in the reliability of identity data, but it answers a deliberately narrow question: whether the person associated with the filing is who they claim to be. 5
It does not establish that a stated business history is complete, that a person exercises the degree of control implied by a corporate chart, that a counterparty has the operational substance suggested by its filings, or that representations made in a transaction are accurate. Those propositions depend on different evidence. The practical effect is that better registry data raises the quality of the starting point without converting registry checks into a complete assessment of commercial risk.
The same distinction applies to regulated status. A firm may be authorised while a particular product, introducer or connected entity sits outside the expected perimeter; permissions can also be subject to restrictions. The FCA's enforcement against Starling is instructive because the weakness was not absence from a regulator's register but a failure in the implementation of financial-crime controls, including sanctions screening. Status and control effectiveness are different findings. 6
Time and purpose change the answer
Due diligence is often discussed as though it produces a permanent classification. In practice, the same counterparty can present a different risk profile when the transaction, jurisdiction, value, authority structure or passage of time changes. A clean screen six months ago may remain relevant evidence, but it does not answer whether ownership has changed, a new dispute has emerged, a licence has been restricted or the commercial rationale of a new transaction is consistent with the earlier picture.
This is particularly important in long-running professional relationships. Periodic screening is useful for detecting defined events; it is less suited to testing a new representation or explaining a change in behaviour. The decision question should therefore remain explicit. A review supporting a modest supplier appointment, a high-value acquisition, a litigation-funding decision and a private-client mandate may all use some of the same public records while requiring different levels of confidence in different facts.
For experienced buyers of intelligence, proportionality is therefore better understood as evidential relevance rather than simply volume. More data can increase noise if it does not bear on the decision. Conversely, a narrow unresolved fact - authority to contract, an undeclared beneficial interest, the credibility of a claimed project history or the source of funds behind a transaction - can justify deeper examination even when routine screening is otherwise clear.
Real-world context: automated screening can be materially incomplete
In 2024 the FCA fined Starling Bank £28.96 million for financial-crime control failings. The regulator said the bank discovered in 2023 that its automated screening system had, since 2017, been screening customers against only a fraction of the full financial-sanctions list. The case is a strong reminder that a screening result is only as reliable as the data, configuration and process behind it.
Public source: Financial Conduct Authority, Starling Bank financial-crime enforcement, 2 October 2024.
Sources and reading
Sources were accessed and checked for this edition on 23 August 2026. Reported allegations and ongoing proceedings are identified as such in the text.
- 1
Companies House. Progress made in cleaning up the Companies House register. 11 June 2026.
- 2
Financial Conduct Authority. FCA Firm Checker. accessed 17 July 2026.
- 3
Association of Certified Fraud Examiners. Key findings from Occupational Fraud 2026: A Report to the Nations. May 2026.
- 4
HM Government. Fraud Strategy 2026 to 2029. 30 April 2026.
- 5
Companies House. Companies House management information: identity verification April to June 2026. 30 July 2026.
- 6
Financial Conduct Authority. Final Notice: Starling Bank Limited. 2 October 2024.
Scope note
This article provides general information and analysis. It is not legal, insolvency, financial, regulatory, cybersecurity or other professional advice. Public records and reported material can be incomplete, delayed or disputed; an indicator is not proof of misconduct.
About the author
Carratu International
Carratu International provides investigation, intelligence and due diligence support to organisations, professional advisers and private clients. Each instruction is scoped around the decision, the evidence available and the need for proportionate, clearly qualified reporting.
Discuss a related matter