Supplier Due Diligence: What Importers Must Check Before Paying

Supplier due diligence is not a single check. It is four checks that answer four distinct questions, each tied to a specific failure mode that costs importers money.

The four questions

1. Identity — Is this a real legal entity at the address on the invoice? 2. Capacity — Does the entity have the operational ability to deliver? 3. Payment — Is the bank account in the same legal name as the invoicing entity? 4. Sanctions — Is anyone in the ownership chain on a sanctions, PEP, or adverse-media list?

Skipping any one of these is not "lighter due diligence." It is leaving a specific door open.

Identity verification

The minimum is a current registry extract from the country's official company register, dated within 90 days. The extract must confirm:

• Legal name and registration number
• Registered address
• Legal representative or directors
• Status (active vs struck off, in liquidation, or dormant)

A copy of a "business license" supplied by the seller is not sufficient on its own — it must be cross-referenced with the live registry record.

Capacity verification

Identity is necessary but not sufficient. A real company can still be incapable of delivering. Capacity signals:

Payment verification

The single highest-frequency fraud pattern in cross-border supplier payments is the beneficiary name mismatch: the invoice is from Company A, the wire instructions name Company B or an individual. Always confirm:

• Bank account name matches the invoicing legal entity exactly.
• A bank account confirmation letter from the supplier's bank, on bank letterhead, naming the beneficiary.
• If a payment instruction changes mid-transaction, re-verify from scratch — never proceed on email instruction alone.

Sanctions and adverse media

Run the legal entity, the legal representatives, and the ultimate beneficial owners (≥25% stake) against:

• OFAC SDN list
• EU consolidated sanctions list
• UK OFSI consolidated list
• UN sanctions list
• Local PEP databases
• Adverse media for the last 36 months

A name-only match should be treated as a hit pending disambiguation, not dismissed.

What a real verification report looks like

Every KeyBS Trust report covers all four checks, with a named analyst sign-off and source links for every claim. See the sample report for the exact format.