Open Source Intelligence (OSINT)
Information gathered from publicly available sources, such as registries, news and court records, used to build and check customer risk profiles.
What Is Open Source Intelligence (OSINT)?
Open source intelligence, or OSINT, is information collected from publicly available sources and analyzed to answer a specific question. In compliance, the question is usually about risk: who really controls this company, is this person connected to a sanctioned party, does this customer's story hold up, and is there anything in the public record that should change how the firm treats the relationship.
"Open source" here has nothing to do with software licensing. It means the information is lawfully accessible to anyone, whether free or paid: government registers, court records, news, company websites, regulatory announcements, academic papers, trade data and social media. What turns this information into intelligence is the analysis: selecting relevant sources, verifying them, connecting facts and drawing a supported conclusion.
Why OSINT Matters in Compliance
Structured data sources such as sanctions lists, PEP databases and company registers answer standard questions well, but they have limits. Lists cover only designated parties. Registers show what was filed, which may be incomplete or out of date. Many risks become visible only by looking further: a director who appears in a foreign court judgment, a supplier whose address is shared with dozens of other companies, or a vessel whose movements do not match its stated route.
OSINT helps analysts:
- Investigate alerts that cannot be resolved from list data alone
- Establish source of wealth and source of funds for high-risk customers
- Map ownership and control in complex corporate structures
- Identify adverse media and reputational concerns
- Detect indicators of sanctions evasion, front companies and trade-based laundering
- Support enhanced due diligence and suspicious activity investigations
Common OSINT Sources for Compliance
- Corporate registries: incorporation details, officers, shareholders, filings and beneficial ownership registers where available
- Official lists and notices: sanctions lists, regulatory warning lists, enforcement actions and disqualified director registers
- Court and insolvency records: litigation, judgments, bankruptcies and criminal proceedings where published
- News and media: national and local news, trade press and investigative journalism
- Property and asset records: land registries, vessel and aircraft registers, where publicly accessible
- Trade and shipping data: vessel tracking, port calls and customs data
- Websites and domain data: company websites, archived versions and domain registration information
- Social media and professional networks: public profiles and posts, used with care
- Blockchain data: public transaction records for crypto assets
How an OSINT Investigation Works
- Define the question. For example: does this customer's declared wealth fit the public record?
- Plan sources. Decide which registries, jurisdictions and media to check, and in which languages.
- Collect. Gather information and record where and when each item was found.
- Verify. Corroborate important facts with independent sources and assess each source's reliability.
- Analyze. Connect people, entities, addresses and events, and look for contradictions with what the customer said.
- Conclude and record. Write a supported conclusion, separating facts from inferences, with sources cited so another analyst could follow the same path.
Legal and Ethical Considerations
Public does not mean unrestricted. Data protection law, such as the EU General Data Protection Regulation, applies to personal data even when it is publicly available, so firms need a lawful basis, a defined purpose and proportionate retention. Analysts should not use deception to access closed groups or private profiles, and should be careful when relying on social media, where identity confusion is common. Firms should consider documenting what sources may be used and how.
Common Challenges
- Volume and noise: common names produce large numbers of irrelevant results
- Reliability: sources vary widely in accuracy, and some content is deliberately misleading
- Language and script: relevant information may exist only in local languages or non-Latin scripts
- Consistency: different analysts may search differently unless there is a clear method
- Freshness: information changes and investigations need to be repeated when risk changes
How on8.ai Helps
SmartSanction brings together 520+ list and registry sources and about 5 million risk records in one search, covering people, companies, vessels, crypto wallets and addresses. Its adverse media and entity graph features give analysts a structured starting point, and each match comes with the reasoning behind it, so open source research can focus on what the data does not already answer.
Related Terms
Related Articles
Account Takeover (ATO)
A form of identity theft where a fraudster gains access to a user's bank accounts, email, or other services.
Adverse Media
Adverse media is published information linking a person or company to crime or serious misconduct, screened as part of customer due diligence.
Alert Rules
Configured parameters within AML software that automatically trigger an alert when suspicious activities match defined criteria.
Algorithmic Fraud
Automated and programmatic approaches to attempting financial fraud at scale utilizing bots and specialized software.