When a supplier or commercial partner operates through a corporate group whose parent entity is registered outside the European Union. Standard EU-registry checks cover only the local subsidiary. not the ultimate beneficial owners, the group's consolidated financial exposure. Alternatively, the legal standing of the controlling entity in its home jurisdiction. A supply-risk counterparty report on such a group must therefore combine four distinct layers of verification: the EU-registered operating entity. The foreign parent and any intermediate holding vehicles, publicly available sanctions and enforcement databases. Additionally, trade or credit intelligence sources. Each layer has its own access logic, latency, and blind spots. This page explains the methodology, the realistic scope of what can and cannot be confirmed, and how to structure the engagement.
Why the EU-only check is structurally insufficient
A company registered in, say, Portugal or the Netherlands is subject to the local commercial registry and, if large enough, to statutory audit and filing obligations under EU accounting directives. Those documents are generally accessible and give a reliable picture of the subsidiary's own legal standing – paid-up capital, registered address, current directors, filed accounts.
The problem is ownership. A subsidiary's registry entry will name its immediate shareholder. This is often an intermediate holding company registered in a low-disclosure jurisdiction: the British Virgin Islands. Cayman Islands, Delaware (which has no public beneficial-ownership registry), the UAE free zones, or Singapore. From that intermediate vehicle upward, the chain becomes opaque unless the group is listed on a regulated exchange or subject to a reporting obligation in its home country.
Supply risk specifically compounds this. Financial counterparty risk tolerates more opacity because the exposure is typically capped at the contract value and can be hedged through payment instruments. Supply risk is different: if a critical supplier fails, goes into insolvency in a non-EU jurisdiction, or becomes subject to export-control restrictions in its home country, the operational damage can far exceed the contract value. The question is not only "can they pay?" but "will they still be allowed and able to deliver in six or eighteen months, under any reasonably foreseeable scenario?"
Step 1 – Identifying the full group structure
What to start with. The EU-registered entity's commercial registry filing is the base document. It confirms the immediate parent and gives the registration number and registered address of that parent. From there, the chain must be traced upward through available corporate registries in each intermediate jurisdiction.
Public registries outside the EU vary dramatically in quality. The UK Companies House provides extensive public filings including persons-with-significant-control registers, and for most purposes is as reliable as any EU registry. Companies House records are publicly searchable without authentication. Australia's ASIC, Canada's Corporations Canada (federal layer), and New Zealand's Companies Office operate on comparable principles of public disclosure.
US entities present a specific challenge. Prior to 2024, Delaware, Wyoming. Additionally, several other states maintained no public beneficial-ownership database. the Corporate Transparency Act introduced a federal beneficial-ownership registry administered by FinCEN. However. That registry is not publicly accessible. it is available only to law enforcement and, in limited circumstances, to financial institutions under specific procedures. This means that for a Delaware parent, the public record often shows nothing beyond the registered agent's address.
Offshore holding vehicles (BVI, Cayman, Jersey, Guernsey, Bermuda) have historically provided minimal public disclosure. Post-FATF pressure has led some jurisdictions to establish central registers of beneficial ownership, but public access to those registers remains restricted in most cases. A BVI company's ultimate beneficial owner is known to the registered agent and, upon request, to BVI law enforcement – not to commercial counterparties.
Asian parent companies. A Chinese parent listed on the Shanghai or Shenzhen Stock Exchange will have extensive public filings through the China Securities Regulatory Commission disclosure platform. A Chinese state-owned enterprise will have a registration on the National Enterprise Credit Information Publicity System. Private Chinese companies that are not listed and not state-owned may have minimal public disclosure beyond basic registration data. Indian companies above a certain threshold file with the Ministry of Corporate Affairs and the data is broadly accessible. Japanese listed companies file with the Financial Services Agency; unlisted private companies have more limited public disclosure.
Russian and Belarusian entities require a separate assessment layer given the current sanctions environment (see Step 3 below).
Step 2 – Financial standing of the operating and parent entities
EU operating entity. If the subsidiary is above the size thresholds set by the applicable EU accounting directive (typically: net turnover above €8 million. Balance sheet above €4 million. Alternatively, more than 50 employees on average), it is required to file annual accounts with the local commercial registry. Those accounts – including balance sheet, profit-and-loss statement, and notes – are generally accessible either freely or for a nominal administrative fee through the registry's public portal. Micro-entities file simplified accounts; some member states allow certain small entities to file only the balance sheet, omitting the income statement.
Foreign parent accounts. If the parent is listed, the consolidated group accounts are publicly available through the relevant exchange or securities regulator. If the parent is private and registered in a jurisdiction with mandatory public filing (UK, most EU states, Australia, India for companies above threshold), accounts may be accessible. For private companies in Delaware, offshore jurisdictions, or most Gulf states without mandatory public filing, consolidated financial data is simply not available from public sources – it must be requested directly from the counterparty.
Credit intelligence sources. Commercial credit bureaus and trade intelligence platforms aggregate payment behaviour, court judgment data, and in some jurisdictions, bank reference data. These sources are particularly useful for the EU operating entity, where local court registries, gazette publications, and insolvency registers feed into commercial databases. For the foreign parent, coverage quality drops sharply for jurisdictions outside the OECD core.
What to ask for directly. For supply relationships of material value, a well-structured counterparty report will include a request for the group's most recent audited consolidated accounts. A group structure chart certified by the counterparty's management. Additionally, (where applicable) a copy of any group-level credit facility agreements to the extent they contain representations about the group's financial condition. Counterparties are not legally obliged to provide these, but the refusal itself is informative.
Step 3 – Sanctions, export controls, and enforcement checks
This layer applies regardless of where the parent is registered. A non-EU group supplying goods or services to an EU buyer is subject to EU sanctions law to the extent that the transaction involves EU-based parties. EU-currency clearing, or EU-origin goods. The buyer – not only the seller – can face liability for engaging with a designated entity.
EU consolidated sanctions list. Maintained and published by the European Commission, this list consolidates all restrictive measures adopted under the Common Foreign and Security Policy. It covers designated individuals, entities, and vessels. Checking the registered name of the counterparty is necessary but not sufficient: the list includes aliases, former names. Additionally. Associated entities. Additionally, the ultimate beneficial owner may be designated even if the operating subsidiary is not.
US OFAC SDN and sector lists. Relevant for any transaction that touches the US financial system, uses US-dollar clearing, or involves goods with US-origin content above the de minimis threshold under Export Administration Regulations. The SDN List is publicly searchable. OFAC also maintains sector-specific lists (SSI, CAPTA) that do not involve full blocking but restrict certain types of transactions.
UK OFSI list. Post-Brexit, the UK maintains its own financial sanctions list administered by the Office of Financial Sanctions Implementation. For groups with UK operations or UK-currency transactions, this list must be checked separately from the EU list – the two are substantially overlapping but not identical.
UN consolidated list. The UN Security Council sanctions list underlies most national regimes but may cover entities not yet incorporated into EU or UK domestic law. It is publicly available through the UN website.
Export control classifications. If the supply relationship involves goods, software. Alternatively, technology with potential dual-use applications. The counterparty's jurisdiction of registration and ultimate beneficial ownership affects the applicable export licensing requirements under EU Dual-Use Regulation (2021/821) and member-state implementing rules. A parent registered in a country subject to a trade embargo or heightened-scrutiny designation triggers additional licensing obligations even if the EU subsidiary itself appears clean.
Debarment and procurement exclusion lists. For counterparties that supply to public-sector buyers, checking the European Debarment Register and national equivalents (e.g.. The UK government's list of suppliers suspended from public procurement) is a further element of the enforcement layer.
Step 4 – Operational and reputational intelligence
Adverse media screening. Structured searches of news databases covering regulatory actions, criminal investigations, corruption allegations, environmental violations, and labour disputes relating to any entity in the group. This layer is particularly important for jurisdictions where formal enforcement records are not publicly accessible but where investigative journalism has documented material issues.
Litigation and arbitration records. Where accessible, commercial court registries in the parent's home jurisdiction and in major arbitration centres (ICC, LCIA, SIAC, HKIAC) may reveal pending or concluded disputes of material scale. Arbitration proceedings are generally confidential unless the award is published or enforcement proceedings are filed in a national court.
Regulatory filings and correspondence. In some jurisdictions, regulatory correspondence (e.g., SEC comment letters in the US. FCA supervisory notices in the UK) is publicly available and can surface concerns that have not yet resulted in formal enforcement action.
ESG and supply-chain compliance flags. Under the EU Corporate Sustainability Due Diligence Directive (CS3D) and the Supply Chain Act in Germany. EU-based companies above applicable thresholds are required to conduct due diligence on their supply chains. A counterparty report in this context should flag any known issues with the group's own supply chain, labour practices, or environmental record that could create derivative liability for the EU buyer.
What cannot be verified through public sources
It is important to state this clearly, because a report that overstates its own coverage is less useful than one that maps its blind spots accurately.
Beneficial ownership of private offshore vehicles is, in most cases, not verifiable through public sources. The registered agent knows; the regulator may know upon request; the commercial counterparty does not, unless the group voluntarily discloses.
Internal group cash flows and intercompany lending. Consolidated accounts, where available, show the group as a whole. They do not show how cash moves between entities within the group, which matters for supply-risk purposes: a subsidiary may appear solvent while the parent is systematically extracting cash through transfer pricing or management fees.
Undisclosed pledges and encumbrances. A parent company's assets – including its shares in the EU operating subsidiary – may be pledged as collateral to a lender without any public registration obligation in the parent's jurisdiction. If that lending relationship deteriorates, the lender may acquire control of the subsidiary through enforcement without any prior public signal.
Political and regulatory risk in the parent's home jurisdiction. Whether a government might restrict the export of goods or technology, impose currency controls, or nationalise a sector is a qualitative assessment, not a registry output. It belongs in the report as a scenario description, not as a verified fact.
Key-person dependencies. The operational risk that a critical supplier's capabilities depend on individuals who are not identified in public corporate records cannot be verified through registry checks.
How the report is structured in practice
Scope definition. Before work begins, the exact perimeter of the group is agreed: which entities are in scope. This jurisdictions require coverage. Additionally. What the primary risk question is (e.g., "is this group in a position to perform a five-year exclusive supply contract for a component with no substitute supplier?").
Registry phase. Commercial registry searches in each relevant jurisdiction, collecting constitutional documents, current directorships, filed accounts where available, and any registered charges or encumbrances. This phase has defined latency: EU registries typically respond within one to five business days; some non-EU registries require formal written requests and take longer.
Sanctions and enforcement phase. Systematic screening against EU, US, UK, and UN lists for all identified legal entities and, where names are known, key individuals. Export control classification check for goods categories involved in the supply relationship.
Financial analysis phase. Review of all available filed accounts, preparation of a financial-condition summary, and identification of data gaps. Where filed accounts are more than eighteen months old or unavailable, the gap is flagged explicitly.
Intelligence phase. Adverse media review, litigation searches, regulatory filings review. This phase is qualitative and is bounded by the agreed scope and timeframe.
Report delivery. A structured document covering: group structure diagram, entity-by-entity registry findings, financial condition summary with data-gap mapping. Sanctions and enforcement findings, qualitative intelligence summary, identified risk factors. Additionally, a clear statement of what could not be verified and why. The report does not express a binary "approved/not approved" verdict – it presents findings and gaps that allow the client's own risk function to make an informed decision.
Service tiers
The scope of a counterparty report scales with the complexity of the group structure and the depth of verification required. Three standard tiers are available:
| Tier | Scope | Fee (EUR) | Not included |
|---|---|---|---|
| Signal | EU operating entity only – registry, filed accounts, sanctions screening, adverse media (1 jurisdiction) | €590 | Foreign parent registry checks; financial analysis of parent; export control classification |
| Standard | EU entity + immediate parent (up to 2 jurisdictions) – full registry chain, financial analysis of available accounts, sanctions and export-control screening, adverse media across group | €1,150 | More than 2 non-EU jurisdictions; offshore vehicle beneficial-ownership investigation; primary-source interviews |
| Extended | Full group perimeter (up to 5 jurisdictions) – complete registry chain, consolidated financial analysis, full sanctions/export-control/debarment screening, ESG and supply-chain compliance review, scenario risk assessment | €2,500 | Physical on-site verification; local-counsel opinions in non-EU jurisdictions (quoted separately if required) |
When to commission this report
Before signing a long-term or exclusive supply agreement. Once the contract is signed, the leverage to request disclosure diminishes. The pre-signature phase is the moment at which a counterparty has the strongest incentive to cooperate with due-diligence requests, and the client has the strongest ability to walk away or renegotiate terms based on findings.
When the group structure has changed. An acquisition, a restructuring, or a change of ultimate ownership in the supplier group – even if the EU subsidiary appears unchanged – can alter the risk profile materially. A change-of-control clause in the supply agreement is only useful if the buyer is aware that control has changed.
In response to a sanctions event in the parent's jurisdiction. If the country where the parent is registered becomes subject to new EU or US sanctions. The existing relationship must be reviewed urgently, because dealing with the subsidiary may become a sanctions violation even if the subsidiary itself is not designated.
As part of a periodic review programme. For critical suppliers, an annual refresh of the report – focused on changes since the last version – is a proportionate risk-management measure. The cost of an annual refresh is significantly lower than an initial full-scope report, because the baseline is established.
How to engage
To initiate a counterparty report, send the full registered name and, where known, the registration number of the EU entity to info@ferrazwhitmore.com. Include a brief description of the supply relationship – goods or services involved, approximate contract value, and jurisdiction of delivery. This allows the scope to be confirmed and the correct tier to be recommended before work begins.
If the group structure is already partially known, include any available information on the parent entity or entities – even incomplete information accelerates the registry phase and reduces the risk of scope gaps. For groups with complex structures spanning more than five jurisdictions, an initial scoping call through the contacts page is recommended before formal engagement.
Turnaround for Signal tier is typically three to five business days from confirmed scope. Standard tier runs five to eight business days. Extended tier is eight to fourteen business days, depending on the responsiveness of non-EU registries and the volume of financial documents requiring analysis.
Disclaimer: This page describes the general methodology applied by Ferraz & Whitmore when preparing counterparty reports for groups registered outside the European Union. It does not constitute legal advice. The scope, findings, and limitations of any specific report depend on the characteristics of the subject group, the jurisdictions involved, and the information available at the time of preparation. Registry data, sanctions lists, and financial filings change; a report reflects the state of available information at the date of delivery and should not be relied upon as current after that date. Where local-counsel opinions or on-site verification are required, these are quoted and engaged separately. Ferraz & Whitmore is registered with the Ordem dos Advogados (Portuguese Bar Association) and operates in accordance with applicable professional conduct rules.