Supply-side due diligence on a jurisdiction is not a single search. it is a layered process in which each successive tier of inquiry adds depth. Cross-checks earlier findings and narrows the residual uncertainty about what can legally be sourced from, transacted in or exported through a given territory. The scope of each tier is determined by the type of data sources consulted, the legal questions those sources can answer and the material limitations that remain once the tier is complete. Understanding what falls inside and outside each tier is the prerequisite for scoping any pre-deal, pre-contract or pre-litigation investigation correctly.
Why a Tiered Approach Exists for Jurisdiction Supply Risk
No single registry, database or public source captures the full legal exposure arising from a jurisdiction's role in a supply chain. Registries were designed for distinct administrative purposes – corporate identification, property title, insolvency status, sanctions lists, export-control classifications – and each answers only the questions it was built to answer. A tiered approach acknowledges this fragmentation and sequences the search so that each layer builds on the verified outputs of the layer before it.
The core problem the tiered model solves is the gap between apparent legitimacy and actual legal risk. A supplier or counterparty may be validly registered, solvent and not individually listed on any sanctions list, yet still present supply risk because of the jurisdiction in which it operates: sector-wide restrictions. Strategic-goods controls, end-use limitations or systemic enforcement deficits that affect the entire territory rather than the individual entity. Only a tiered framework that moves from entity-level to jurisdiction-level to transaction-level inquiry can expose that full picture.
Tier One: Entity-Level Registry Checks
What this tier covers. The first tier establishes whether the counterparty or supplier exists as a valid legal entity, who controls it and whether it is currently in good standing. The primary sources at this tier are the relevant commercial or companies registry of the jurisdiction. typically a national business register maintained by a ministry of economy. Justice or trade. alongside any mandatory beneficial ownership register that exists in that territory.
Information typically available at tier one includes: the entity's registered name and any trading names. its legal form. date of incorporation or registration. the registered address. the identities of directors. Administrators or statutory officers. share capital structure. and. There, the jurisdiction maintains a publicly accessible beneficial ownership register, the ultimate controlling persons or entities above a statutory ownership threshold.
What tier one does not cover. Registry data at this level is almost always self-reported and subject to the administrative verification capacity of the issuing authority. It tells you whether the entity was registered and whether filings are current. it does not tell you whether the reported ownership is the real beneficial ownership, whether the entity is operationally active. Whether the goods or services it supplies are subject to export-control regimes. Alternatively, whether the jurisdiction itself imposes systemic supply-chain constraints that apply regardless of the entity's own compliance posture. Insolvency status may or may not be visible in the commercial registry depending on jurisdiction; in many territories it must be checked separately.
Supply-risk limitation at tier one. Passing a tier-one check means only that the entity has a valid legal existence in its home jurisdiction. It does not constitute clearance for contracting, payment or supply-chain inclusion. Jurisdictions with weak registry maintenance, high rates of shell-entity formation or limited public access to ownership data create elevated residual uncertainty even after a clean tier-one result.
Tier Two: Insolvency, Litigation and Regulatory-Status Searches
What this tier covers. The second tier investigates whether the entity or any of its key principals is subject to insolvency proceedings, judicial reorganisation, receivership or formal regulatory sanction. It also encompasses pending or concluded litigation of a nature that could impair the entity's capacity to perform – particularly in sectors where licensing or regulatory authorisation is required to supply lawfully.
Sources consulted at tier two include the insolvency or bankruptcy register of the relevant jurisdiction, court records where publicly accessible. Regulatory registers maintained by sectoral supervisors (financial services regulators, food safety authorities, export licensing bodies) and, in EU jurisdictions, the Official Journal or equivalent gazette where regulatory decisions are published. For cross-border supply chains, international insolvency registers and the relevant EU insolvency regulation databases become relevant where the counterparty has operations in multiple jurisdictions.
What tier two does not cover. Tier-two searches are still entity-specific. They will not surface jurisdiction-wide restrictions. for instance, a general prohibition on importing goods of a certain classification from a specific country. Alternatively. A financial-channel restriction imposed by international sanctions that affects all transactions with entities in a territory regardless of their individual status. Litigation searches are typically limited to filed or published proceedings; unreported arbitrations or regulatory investigations that have not yet resulted in a published decision will not appear.
Supply-risk limitation at tier two. A clean tier-two result significantly reduces entity-level performance risk but leaves jurisdiction-level and transaction-level risk unexamined. In jurisdictions where courts are overloaded. There, insolvency processes are opaque or where regulatory decisions are not systematically published. The informational value of a tier-two search is inherently constrained by the quality of the underlying record-keeping infrastructure.
Tier Three: Sanctions, Export Controls and Strategic-Goods Classification
What this tier covers. The third tier addresses the question that is most directly relevant to supply risk in a cross-border context: whether the jurisdiction. The entity, the transaction or the goods and services involved are subject to any applicable sanctions regime, export-control classification or strategic-goods restriction. This is the tier at which jurisdiction-level risk becomes fully visible.
Sources consulted at tier three include consolidated sanctions lists maintained by the EU (the Consolidated List of Persons, Groups and Entities Subject to EU Financial Sanctions), the UN Security Council consolidated list. The OFAC Specially Designated Nationals and Blocked Persons list, the UK financial sanctions list maintained by the Office of Financial Sanctions Implementation. Additionally, any bilateral or domestic sanctions regimes relevant to the transaction. For export controls, the applicable sources include national strategic-goods control lists, EU dual-use regulation classifications, and. There. US-origin goods or technology are involved, the Entity List and Denied Persons List maintained under the US Export Administration Regulations.
Jurisdiction-level restrictions at this tier operate independently of whether the individual counterparty is listed. Country-wide arms embargoes, sectoral financial sanctions, prohibitions on supplying specific categories of goods or technology, and geographic restrictions on export licences all attach to the territory rather than the entity. A counterparty that passes a tier-one and tier-two screen may still be a prohibited transaction partner if the jurisdiction-level restriction applies to its sector or to the goods being supplied.
End-use and end-user controls are a specific sub-category within tier three that is frequently underweighted in standard supply-chain checks. Even where neither the jurisdiction nor the entity is listed, the intended end-use of the supplied goods may trigger licence requirements or transactional prohibitions. particularly in sectors involving dual-use items. Telecommunications infrastructure, advanced materials, defence-adjacent technologies or financial instruments capable of being used to evade sanctions. The applicable legal framework for end-use controls varies by exporting jurisdiction and requires separate analysis for each relevant origin country in the supply chain.
What tier three does not cover. Sanctions and export-control lists are dynamic – they are updated without fixed schedule, sometimes with immediate legal effect. A clean tier-three result is valid only as of the date of the search. For ongoing commercial relationships or long-duration supply contracts, periodic re-screening is a legal necessity, not an optional refinement. Additionally, tier three in its standard form does not address underlying contractual, product-liability or regulatory-compliance risk that is specific to the sector or the goods in question – those require a fourth layer of inquiry.
Tier Four: Sector-Specific Regulatory and Compliance Review
What this tier covers. The fourth tier addresses regulatory requirements that are specific to the industry sector, the nature of the goods or services, or the intended end-market. It encompasses product-safety regulations, technical standards, import-licensing requirements in the destination market, mandatory certification schemes, environmental and sustainability disclosure obligations, and sector-specific anti-corruption or integrity requirements applicable to the supply relationship.
Relevant frameworks at tier four include, depending on the sector and destination market: EU product regulation (including CE marking, REACH, RoHS. Additionally, the forthcoming EU Product Liability Directive regime). food and feed safety requirements under EU Regulation 178/2002 and associated delegated regulations. financial product and services authorisations required under MiFID II. PSD2 or the Capital Requirements framework. pharmaceutical good manufacturing practice (GMP) certifications. and, increasingly, supply-chain due diligence obligations under the EU Corporate Sustainability Due Diligence Directive (CS3D) and equivalent national transpositions.
What tier four does not cover. A sector-specific regulatory review at this tier is necessarily jurisdiction-specific for the destination market and may not capture all obligations in intermediate jurisdictions through which goods or services transit. It also does not substitute for contractual due diligence. the legal terms governing the supply relationship. This includes liability allocation, force majeure provisions. Termination triggers and dispute resolution mechanisms. which constitute a distinct fifth dimension of supply-risk analysis requiring direct legal review of the proposed agreement.
What Every Tier Shares: Structural Limitations of Public Record Sources
Data currency. Every public registry and list operates on an update cycle that introduces a gap between the moment a legally relevant event occurs and the moment it is reflected in the searchable record. For corporate registries, this lag can range from days to months depending on the jurisdiction's administrative capacity. For sanctions lists, additions may take effect immediately in law while the searchable database is updated with a short operational delay. Any analysis based on public records must specify the date of the search and acknowledge that subsequent changes are not captured.
Jurisdictional access asymmetry. Not all jurisdictions provide equivalent public access to registry data. Some territories maintain comprehensive, machine-readable, open-access registers; others require in-country registered users, notarised requests or physical attendance to obtain the same category of information. In practice, this means that the informational depth achievable at each tier varies significantly across the jurisdictions that may feature in a given supply chain. Where direct registry access is limited, secondary verification through certified local correspondents or official document requests becomes necessary, with corresponding implications for the time required to complete each tier.
Self-reported data and verification gaps. Commercial registries in most jurisdictions accept filings on the basis of declarant responsibility rather than active verification of accuracy. Beneficial ownership registers are particularly susceptible to this limitation: the registered information reflects what the entity's administrators have filed, not necessarily what an independent investigation would uncover. Reliance on registry data without cross-referencing against independent open-source intelligence, financial disclosures or correspondent verification leaves a residual gap that grows in proportion to the opacity of the jurisdiction.
Practical Implications: Matching Tier Depth to Transaction Risk
Not all supply relationships require all four tiers. The appropriate scope of pre-transactional due diligence is proportionate to the risk profile of the relationship: the nature of the goods or services. The jurisdictions involved, the volume and duration of the supply commitment. Additionally, the regulatory obligations applicable to the procuring entity. A low-value, one-time purchase of non-strategic goods from a well-regulated jurisdiction may require only tier-one and tier-three verification. A long-term supply agreement for dual-use components sourced through an intermediate jurisdiction with known compliance deficits warrants all four tiers plus ongoing monitoring.
Documentation of the process matters independently of the result. Across EU anti-money-laundering, export-control. Additionally. Supply-chain due diligence frameworks, the adequacy of the compliance programme is assessed not only by its outcome but by the documented methodology applied. Organisations that cannot demonstrate a structured, tiered approach to jurisdiction screening. including the sources consulted, the scope of each tier. The date of the search and the conclusions drawn. face heightened regulatory exposure even where the underlying counterparty ultimately proves clean.
Legal counsel and jurisdictional expertise. The interpretation of what a registry search result means in a specific legal context. whether a clean insolvency register in a given territory provides genuine assurance. Whether a sector-level sanction applies to a particular transaction, whether a regulatory authorisation obtained in one jurisdiction is recognised in another. requires legal analysis that goes beyond the raw search output. The factual outputs of each tier serve as inputs to a legal assessment; they do not constitute that assessment themselves.
If your organisation is scoping supply-chain due diligence across multiple jurisdictions or needs legal interpretation of registry and sanctions search results. Contact Ferraz &. Whitmore at info@ferrazwhitmore.com or visit our contacts page to arrange a consultation. Our team advises on cross-border regulatory compliance, trade sanctions and supply-chain legal risk across Western Europe and beyond.
For related analytical content, see our Analytics section, which covers jurisdiction risk, regulatory developments and cross-border legal frameworks.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice. The information reflects publicly available sources and general legal principles as of the publication date indicated. It does not account for changes in law or regulation occurring after that date, nor does it address the specific circumstances of any particular transaction, entity or jurisdiction. Readers should seek independent legal advice before acting on any information contained in this article. Ferraz & Whitmore accepts no liability for reliance on the contents of this page without prior professional consultation.