A quote arrives 30% below the incumbent's price from a company nobody on the team has dealt with. The deposit is due next week. Before it goes out, someone has to establish that the company exists, that the person signing can bind it, that you are allowed to pay it, and that the certificates in the proposal are real.
Most published guidance on this is written for compliance departments with screening software and a budget. This guide is for a buyer with a browser and an hour. It covers four kinds of online source, the one question each of them answers, what each one cannot tell you, and the order that keeps the free checks first. It belongs to phase 2 of the process in our practitioner's guide to strategic sourcing, assessing the supply market, and it precedes the ongoing measurement covered in how to measure supplier reliability.
What can you actually verify about a supplier online?
Four things, from four independent kinds of source. Company registers show whether the entity exists and who represents it. Sanctions and restricted-party lists show whether you may trade with it. Customs records show whether it ships what it says it makes. Certificate databases show whether its quality paperwork is genuine. Each source answers its own question and none of them answers the others.
| Layer | Question it answers | Free or paid | What it cannot tell you |
|---|---|---|---|
| Company registers | Does this legal entity exist, and who can sign for it? | Mostly free | Whether it is any good |
| Sanctions and restricted-party lists | Are we allowed to do business with it, or with its owners? | Free | Anything about capability |
| Customs and trade data | Does it actually ship the products it claims, to whom, how often? | Paid, some free samples | Prices in most jurisdictions; domestic sales |
| Certificate databases | Are the ISO and product certificates real and current? | Free | Whether the certified system is followed |
Most verification failures come from substituting one layer for another. A professional website is taken as proof the company exists. A PDF certificate is taken as proof it was issued. A long trading history is inferred from a confident sales email. Each of those is a claim, and each has a source that either confirms or contradicts it.
Layer 1: Does the company exist, and who can sign?
The register of the jurisdiction where the company is incorporated answers this, and it is the first place to look because everything else depends on the legal name it gives you.
In the United States, companies register with the Secretary of State of their state of incorporation, and most states publish entity name, status, formation date, registered agent and often the officers or managers. Public companies also file with the SEC, searchable through EDGAR. In the United Kingdom, Companies House publishes filings, officers and, since 2016, the register of people with significant control, so beneficial ownership is public. In the EU, every member state runs a national register, but public access to beneficial-ownership data ended with the Court of Justice ruling of November 2022; the sixth Anti-Money Laundering Directive replaces it with access on legitimate interest, and by the July 2025 transposition deadline eleven member states had not fully implemented it (Transparency International, 2025). OpenCorporates indexes many national registers in one search and is a reasonable starting point when you don't know the jurisdiction.
Check four fields. Status: active, dissolved, struck off, or in administration. Formation date, against the "established 1998" on the website. The registered representative or officers, against the name on the quote and the contract. The registered address, against the address on the website and the invoice. A mismatch on any of these is a question to put to the supplier, and the answer is usually mundane, but you want it in writing before you pay.
Layer 2: Are you allowed to do business with them?
Sanctions and restricted-party lists are free, public, and take about five minutes to check. They answer a yes-or-no question that no other source touches.
The lists a buyer in the US or Europe most often needs are the OFAC Specially Designated Nationals list, the Bureau of Industry and Security's Entity List, Unverified List and Denied Persons List, the UFLPA Entity List maintained by the Department of Homeland Security, which blocks imports on forced-labour grounds, and the EU and UK consolidated lists. The UFLPA presumption has applied since 21 June 2022 to goods produced wholly or in part by listed entities or in Xinjiang (DHS). OpenSanctions aggregates these and many others into one free search (OpenSanctions), which is usually enough for a first pass.
Screen the owners and parent companies as well as the trading name. Under OFAC's 50% rule, an entity majority-owned by a sanctioned party is treated as sanctioned even if it is not listed itself, and a clean trading subsidiary with a listed parent is a problem you want to find before the purchase order. Screening the name on the quote alone misses exactly the cases the lists exist for. The step-by-step check is in how to check if a supplier is sanctioned.
Layer 3: Do they actually ship what they claim?
Customs records answer whether a company's exports match its story. In the United States, import manifests are public records, and several commercial services index them: Panjiva, owned by S&P Global, ImportGenius, Volza and others. Panjiva describes its coverage as over two billion transaction records from 22 customs authorities covering around nine million companies (Panjiva); treat those as the vendor's own figures.
What the records show is useful in a specific way. You can see who a supplier has shipped to, how often, in what volumes and under which HS codes. A company that claims to specialise in aluminium castings and whose shipments are all garments is telling you something. A company with no export record at all may be new, may sell only domestically, or may ship through a trading company, and each of those is worth a question.
What the records don't show matters as much. Prices are absent in most jurisdictions. Domestic sales are invisible. Anything routed through a trader appears under the trader's name. Trade data confirms or contradicts a claim about activity; it does not tell you about quality, capacity or financial health, and it is the one layer that usually costs money, which is why it sits later in the route.
Layer 4: Are the certificates real?
A certificate is a claim by a certification body, and you verify it with the body and its accreditor, not with the supplier. The institutional picture changed in 2026: the International Accreditation Forum ceased operations on 1 January 2026 and merged into Global Accreditation Cooperation Incorporated, which now oversees the IAF CertSearch database of accredited certificates, around 400,000 of them across more than 150 economies (IAF). The database remains a useful third check; the two below don't depend on it.
The first is the issuing certification body's own register. Every legitimate body publishes a way to look up the certificates it has issued, by number or by client name, and the lookup should return the company name, the standard, the scope and the validity dates. The second is the accreditation body that oversees the certifier: ANAB in the United States, UKAS in the United Kingdom, CNAS in China, and their equivalents elsewhere. If the certification body is not accredited by the relevant national body, the certificate is a private opinion rather than an accredited one.
The signals that a certificate should not be relied on are consistent. The certification body is unknown or its website is a template. The certificate has no scope statement, or a scope that doesn't match what the supplier sells you. There is no certificate number, or the number returns nothing at the issuer. The expiry date has passed. The document is a scan with no verification link. The company name on it differs from the name on the register. Any one of these is enough to ask for the original and check it yourself; the lookup sequence is in how to verify an ISO 9001 certificate.
What do paid databases add?
Credit and ownership data that public registers don't hold. Dun & Bradstreet, Creditsafe and Moody's Orbis carry credit scores, payment-behaviour indicators, financial statements where filed, and corporate family trees. Sayari and Kharon specialise in ownership networks and risk screening, including links to sanctioned or restricted parties several layers up the chain.
They pay for themselves in three situations. The first is a large prepayment to a private company that files no accounts, where a payment-behaviour score is the only forward-looking signal available. The second is a single-source part, where you are buying a relationship for years and want to know who owns the other side. The third is a regulated end market, defence, medical, aerospace, where the ownership chain is itself a compliance requirement. For a routine competitive RFQ on a stocked item, the free layers are usually enough, and the paid report can wait until the supplier wins.
What does OSINT add that databases miss?
Open-source checks confirm or contradict the register; they don't replace it. Their value is in catching the gap between what a company says about itself and what the public record shows.
Domain registration date, from any WHOIS service, against the founding date claimed on the site. A company "serving customers since 1998" with a domain registered eighteen months ago has some explaining to do. The registered address on satellite imagery and street-level photography, which distinguishes an industrial unit from a residential street or a serviced-office tower. Headcount on LinkedIn against the "500 employees" in the brochure. Court records, which in the United States means PACER for federal cases and state court portals for the rest, for litigation with customers or suppliers. Adverse media in the local language as well as English.
The rule for this layer is discipline about what it proves. A young domain is a question, not a verdict. A small LinkedIn footprint is common for manufacturers in some countries and meaningless there. OSINT is where a buyer most often over-reads, so write down what each finding does and doesn't establish before acting on it.
In what order, and how long?
Free and disqualifying checks first, paid and confirmatory checks last. The order below fits in an hour for a straightforward supplier and stops early when a disqualifying result appears.
| Step | Source | Minutes | Stop if |
|---|---|---|---|
| 1. Register | State, national or Companies House register; OpenCorporates | 10 | Entity not found, dissolved, or representative doesn't match the signatory |
| 2. Sanctions | OpenSanctions, then the specific list for any hit | 5 | Hit on the entity or a majority owner |
| 3. Certificates | Issuer's register, then its accreditation body | 10 | Certificate not found, expired, or in another name |
| 4. Domain and address | WHOIS; satellite and street imagery | 10 | Address is residential or virtual with no explanation |
| 5. Trade data | Panjiva, ImportGenius or similar, if you have access | 15 | Shipments contradict the claimed product line |
| 6. References | Two customers, by phone | Outside the hour | References decline or can't be reached |
Steps one to four cost nothing and cover most of the risk. Step five depends on whether you or a colleague already has a subscription. Step six is the one people skip and shouldn't, because a reference call is still the fastest way to learn whether a supplier delivers.
Which red flags end the check?
Some findings are questions, and a shorter list ends the conversation until the supplier has explained them in writing.
| Signal | Why it matters | Action |
|---|---|---|
| Legal name on the register differs from the name on the invoice or bank account | You may be paying an unrelated party | Stop; require payment details in the registered entity's name |
| Signatory is not the registered representative and has no written authority | The contract may not bind the company | Request a power of attorney or the representative's signature |
| Certificate not found at the issuing body | The certificate is not what it appears to be | Treat as uncertified; ask why |
| Domain registered years after the claimed founding date | The history is not as described | Ask for evidence of trading history |
| Registered address is a virtual office or residential | Capacity claims are unverified | Ask where production happens and verify that address |
| Sanctions hit on the entity, an owner or a parent | Trading may be prohibited | Stop; escalate to whoever owns compliance |
Everything else, a small headcount, a new domain with a plausible story, a certificate from a less-known but accredited body, is a question to ask rather than a reason to walk away.
What can't be verified online?
Capacity, quality, and the financial health of a private company that files no accounts. The public record establishes that a company exists, who runs it, whether you may trade with it and whether its paperwork is real. It does not establish that the plant can hold your volume, that the parts will pass inspection, or that the business will still be there in two years.
Those need other methods: a sample order or a small first order, a third-party inspection at the plant, reference calls, and for a large first commitment, payment terms that share the risk. The supplier's side of this exchange is worth remembering too. Suppliers triage the buyers who approach them on clarity, volume and relationship (Production Machining), and a buyer's agent now checks suppliers on readability and reachability before sending a request, as described in how to be found by AI buying agents, so the checking runs in both directions.
Software, including ours, does not do this work for you. A sourcing agent such as Buyer24's finds candidate suppliers, removes duplicates against your existing list and locates a contact address; it does not run the checks in this guide, and "vetted" on a referral network means a buyer chose to work with the supplier, not that the supplier has been cleared against registers and lists.
The list of what cannot be checked remotely is longer in some jurisdictions than others. Where the supplier is in mainland China, the registry works differently, certificates have their own database, and the law on what a foreign buyer may investigate changed in March 2026. That case has its own guide, verifying a Chinese supplier in 2026. For the logistics side of buying abroad, see managing overseas suppliers, and for what leaves your control when you send a drawing, when to transform and when to redact an RFQ.
FAQ
How do you check if a supplier company is legitimate?
Look the legal name up in the register of its jurisdiction of incorporation: a Secretary of State database in the US, Companies House in the UK, the national register in an EU state, or OpenCorporates as an index. Confirm status, formation date, representative and address against what the supplier told you. A website or a brochure is a claim; the register is the record.
How do you verify an ISO 9001 certificate?
Look the certificate up in the issuing certification body's own register by number or company name, then confirm that body is accredited by the national accreditation body, such as ANAB, UKAS or CNAS. The result should show the company, the standard, the scope and the validity dates. The International Accreditation Forum merged into Global Accreditation Cooperation on 1 January 2026, which now runs the CertSearch database as a third check.
How do you check whether a supplier is sanctioned?
Search the entity and its owners on OpenSanctions, which aggregates the OFAC, BIS, UFLPA, EU and UK lists, then confirm any hit on the list's own site. Screen parent companies and majority owners as well, since under the OFAC 50% rule an entity majority-owned by a sanctioned party is treated as sanctioned even if it isn't listed.
What do paid business databases add over free sources?
Credit scores, payment-behaviour indicators, financial statements where filed, and multi-layer ownership graphs. They are worth the cost before a large prepayment to a private company, for a single-source part, or in regulated end markets. For a routine competitive quote on a stocked item, the free registers, sanctions lists and certificate checks usually answer enough.
What can't you verify about a supplier online?
Production capacity, product quality and the financial health of a private company without public accounts. Those need a sample or trial order, a third-party inspection, reference calls, and risk-sharing payment terms for a first large commitment. Online sources establish existence, authority, permission and paperwork; they don't establish performance.
Key takeaways
- Online verification is four independent checks: registers for existence and authority, sanctions lists for permission, customs data for activity, certificate databases for paperwork. None substitutes for another.
- Read the register for status, formation date, representative and address, and compare each against the quote, the contract and the website.
- Screen owners and parents on sanctions lists, not only the trading name; OFAC's 50% rule treats majority-owned entities as sanctioned.
- Verify certificates with the issuing body and its accreditor, then the global CertSearch database, now run by Global Accreditation Cooperation after the International Accreditation Forum merged into it on 1 January 2026.
- Run the free checks first: register, sanctions, certificates, domain and address fit in about 35 minutes. Trade data and paid reports come after, when the supplier is a serious candidate.
- Capacity, quality and private-company finances can't be verified online. Use samples, inspections, references and payment terms for those.
- A sourcing agent finds and dedupes suppliers; it does not run due diligence, so the verification step stays with the buyer.