Business Background Check Questions

How to vet a U.S. company before signing, lending, partnering, or acquiring, the public-record workflow that a 30-year private investigator would actually run in 2026.

A business background check is not a credit report. It is a multi-source public-records workflow built to answer four questions before money or signatures move: does this company legally exist, who actually owns and controls it, has it been sanctioned or excluded by any government, and is there active litigation, lien, or tax exposure that contradicts what the counterparty is telling you? This guide is the playbook a 30-year private investigator would actually run in 2026, FinCEN BOI, SEC EDGAR, OFAC SDN, UCC Article 9, PACER, and the half-dozen state and federal license rosters that catch what aggregators miss.

In this section The U.S. has more than 36 million small businesses (SBA Office of Advocacy 2025 profile), the OFAC SDN list contains tens of thousands of designations, and the Corporate Transparency Act has reshaped beneficial-ownership disclosure. Skipping a single sanctions or exclusion check now creates strict-liability exposure that a contract indemnity cannot cure.

36.2M U.S. small businesses (firms with fewer than 500 employees, SBA 2025) SBA Office of Advocacy 2025 profile

17,000+ entries on the Treasury OFAC Specially Designated Nationals (SDN) list, mid-2026 U.S. Treasury OFAC public list

$377,700 or twice the transaction value, whichever is greater, max IEEPA civil penalty (2025 inflation-adjusted) 31 CFR §510.701; OFAC penalty schedule

~78,000 individuals and entities currently excluded on the HHS-OIG LEIE list HHS OIG List of Excluded Individuals/Entities

Three forces converged in the past 24 months to make business due diligence both more important and more accessible. First, FinCEN's Beneficial Ownership Information regime under 31 U.S.C. §5336 finally turned U.S. shell-company opacity into a federal reporting question, even as the March 2025 interim rule narrowed the reach. Second, OFAC, OIG, and SAM.gov have aggressively expanded designations, the SDN list grew roughly 14% in 2024 alone after Russia, Iran, Hamas, and fentanyl-supply-chain designations. Third, state Secretary-of-State portals are now free, fully digital, and indexed in ways that did not exist a decade ago, which means a small buyer can produce a credible legal-existence file in 30 minutes for $25.

What has not changed is the underlying truth: corporate counterparties commit fraud, become insolvent, get sanctioned, and abandon licenses, and the public record almost always shows the warning signs before the wire actually leaves. The job is to know where to look, what to read, and how to weigh contradictions.

Common mistake Treating a commercial “business credit report” (Dun & Bradstreet, Experian Business, Equifax Business) as a background check. Those are credit-risk products, not legal-existence or sanctions reports. They are useful inputs, but they will not catch a forfeited entity, an OFAC SDN match, or a state tax forfeiture, and they are not real-time.

One of the most expensive misconceptions in B2B due diligence is the assumption that the Fair Credit Reporting Act (15 U.S.C. §1681) governs business reports. It does not, FCRA covers consumer reports on natural persons. The legal framework around entity vetting is built from a different set of statutes, and each one carries its own permissible-purpose, disclosure, and penalty architecture.

The practical effect is that there is no single “disclosure and consent” statute the way FCRA structures employment screening. Instead, the obligation is layered: you screen sanctions because you are a U.S. person, you read EDGAR because the law makes a public company file there, you document FCPA review because the contract crosses a border, and you respect ECOA because you are extending credit.

Researcher’s note The current OFAC civil penalty schedule (per the Treasury final rule published Jan 15, 2025 in 90 Fed. Reg. 3667) sets the IEEPA maximum at the greater of $377,700 (2025 inflation-adjusted) or twice the value of the underlying transaction, codified at 31 CFR §510.701. Strict liability means the regulator does not have to prove you knew; it only has to prove the dealing occurred. Build the screening into the contract-execution checklist, not into a quarterly compliance review.

Every U.S. business background check starts in the same place: confirm the entity legally exists, in the state it claims, with the people it claims, in the form it claims. Each state's Secretary of State (or equivalent agency) maintains a free entity-search portal indexed by exact name, entity number, registered agent, and (in most states) officer/manager name. The single artifact you want is a Certificate of Good Standing (sometimes called Certificate of Existence or Status Certificate), an official, time-stamped statement that the entity is current on franchise tax, annual reports, and registered-agent requirements.

The five-question intake

1. Exact legal name. “ABC Logistics Inc.” and “ABC Logistics, LLC” are different entities; contracts get voided when the wrong name signs.
2. State of formation. Delaware is the most common because more than 60% of Fortune 500 companies are domiciled there per the Delaware Division of Corporations. But Nevada, Wyoming, and Texas are the ones to look at twice.
3. Entity number. Each state issues a unique file/charter number. Always verify it back from the certificate, never from a salesperson’s deck.
4. Status. Active, in good standing, current, or pending dissolution? Forfeited, revoked, or administratively dissolved entities may still be transacting but their contracts can be voidable and their principals can lose the corporate liability shield.
5. Registered agent and address. A non-physical address in a known mass-incorporator (Northwest Registered Agent, Cogency, CT Corporation generic suite numbers) is normal in Delaware; a residential street address with seven shell entities listed at the same number is a flag worth a phone call.

Cross-state matrix and pricing

Action step If the entity is older than five years, also pull the entity’s annual report history. Patterns of late filings, frequent registered-agent changes, or repeated administrative dissolutions followed by reinstatements often correlate with operational distress that is not yet showing up in financial statements.

For nearly a century, U.S. law allowed a person to form a corporation or LLC without ever disclosing who actually owned or controlled it. The Corporate Transparency Act ended that for most domestic entities effective January 1, 2024, but the regulatory map shifted again in March 2025. Today the right question is not “did the company file a BOI?” but “under the current rule, is this entity even required to file, and if so, can I confirm the filing?”

What the rule actually says (2026 posture)

• The FinCEN Beneficial Ownership Information rule at 31 CFR 1010.380 requires “reporting companies” to identify each beneficial owner, defined as any individual who exercises substantial control or owns at least 25% of the entity, and each “company applicant” who filed the formation paperwork.
• The March 2025 interim final rule (90 FR 13688) narrowed the rule’s reach: the present focus of mandatory reporting is on foreign reporting companies, while most domestic entities are no longer required to file. This is one of the most fluid corners of U.S. regulatory law right now, always read the current FinCEN guidance before relying on the framework.
• The BOI database itself is not a public-search tool. Access is limited to authorized federal, state, local, and tribal officials, and to financial institutions for customer-due-diligence purposes with the reporting company’s consent.

What a private vetter can still do

1. Ask for a copy. Reporting companies retain a FinCEN ID number (FinCEN ID) for the entity and for each beneficial owner. Counterparties signing a material contract should be willing to share the entity FinCEN ID and the BOI confirmation in escrow.
2. Cross-reference open sources. Public DUNS records, SEC filings (if a public parent exists), state business filings naming officers, court filings, and prior press releases will usually surface the ultimate owners even when BOI is unavailable.
3. Treat refusal as a signal. A counterparty insisting on opacity above the BOI regime’s threshold is, by itself, a flag, not because BOI is the only valid disclosure, but because every legitimate reason a buyer has to know the beneficial owners (sanctions screening, FCPA, anti-money-laundering) is independent of the CTA.

Privacy note FinCEN BOI data is not a public ledger and was never intended to be. Even authorized users are bound by 31 U.S.C. §5336(c) confidentiality and federal penalties for unauthorized disclosure. Do not condition a deal on receiving an actual BOI report directly, require a beneficial-ownership representation and warranty from the counterparty instead, then verify through open sources.

If the counterparty is a U.S. public company, a registered investment adviser, a broker-dealer, or has issued securities under Regulation A or Regulation Crowdfunding, the most valuable single resource on the open web is SEC EDGAR. Section 13 of the Securities Exchange Act (15 U.S.C. §78m) makes the periodic filings mandatory; SEC Rule 10b-5 makes lying in them a federal securities violation. The cost is zero and the latency is hours.

The filings that actually matter

• Form 10-K, the annual report. Read Item 1A (Risk Factors), Item 3 (Legal Proceedings), Item 7 (MD&A), and the tax footnote.
• Form 10-Q, quarterly update. Focus on changes in legal proceedings and any new debt covenants.
• Form 8-K, current report for material events. Items 1.01 (material agreement), 2.04 (acceleration of obligation), 4.02 (non-reliance on prior financials), and 5.02 (departure of officers) are the four most useful for vetting purposes.
• Schedule DEF 14A, proxy. Discloses related-party transactions, executive compensation, and any “clawback” events under Dodd-Frank.
• Form D, private placement notice; useful when the counterparty is a private fund or a startup that has raised under Reg D.

For investment advisers, the parallel resource is SEC Investment Adviser Public Disclosure (Form ADV Parts 1 and 2). For broker-dealers and registered representatives, use FINRA BrokerCheck, which discloses regulatory actions, customer complaints, criminal history, and employment separations. FINRA Rule 3110 (supervision) and Rule 4530 (reporting) drive what shows up there.

Researcher’s note The single most underread filing is the 8-K Item 4.02, “Non-Reliance on Previously Issued Financial Statements.” A 4.02 means the company has told the market its old numbers were wrong; it is, in effect, a public confession. If a private vendor or partner has filed a 4.02 in the trailing 24 months, that is worth a phone call to the audit committee chair before signing anything material.

The strictest piece of business due diligence in the U.S. is sanctions and exclusion screening. There is no negligence threshold, under the International Emergency Economic Powers Act (50 U.S.C. §1701) and OFAC regulations, transacting with a designated party is a violation whether or not you knew. Four lists carry direct legal force; a fifth and sixth carry contractual force in most federal procurement and healthcare contexts.

The minimum credible workflow is to screen the entity legal name, every d/b/a or assumed name, the registered agent, and every named principal against OFAC SDN + Consolidated and against SAM.gov exclusions. If federal healthcare dollars are involved, OIG-LEIE is mandatory. If export-controlled technology or defense articles are involved, BIS Entity List and DDTC Debarred List are mandatory.

Action step Save and timestamp the screening result (PDF or screenshot) on the day of contract execution. A current OFAC search showing zero hits, captured at the moment of signing, is one of the strongest defenses available if a designation is added shortly after the deal closes.

The court layer answers two operational questions: has anyone sued this company, and has it pledged its assets to anyone else? Federal cases live in PACER ($0.10 per page, capped at $3 per document). State commercial cases live in the trial-court system of each state, coverage varies, with about 65% of state systems offering free name searches per the National Center for State Courts. UCC-1 financing statements live at the Secretary of State of the company’s state of formation, with most states offering free or near-free online lookup under UCC Article 9.

What to actually pull

• PACER federal civil, breach of contract, intellectual-property, trade-secret, antitrust, and False Claims Act qui tam complaints.
• PACER federal bankruptcy, any Chapter 7, 11, or 15 case in any district nationwide.
• PACER federal criminal, SEC parallel prosecutions, FCPA cases, federal fraud.
• State trial courts, commercial disputes, employment, judgments, restraining orders, foreclosure.
• UCC-1 filings, secured liens, factoring arrangements, merchant cash advances (MCAs).
• Tax liens, federal IRS tax liens (filed in county where property sits) and state tax liens (filed in state lien index).

Reading UCC filings

A UCC-1 financing statement names a debtor, a secured party, and a collateral description. The patterns matter more than the individual filings. Two patterns are especially worth attention:

• Multiple recent UCC-1s with MCA lenders (CFG Merchant Solutions, Yellowstone Capital, Kapitus, Mantis Funding) typically indicate that the company has run through bank credit and is paying double-digit effective annualized rates for cash flow. Lenders willing to extend credit junior to a merchant cash advance are rare.
• UCC-1s naming “all assets, accounts receivable, inventory, equipment, and general intangibles” as collateral mean the senior lender has a blanket lien. Any new financing or asset sale almost certainly requires that lender’s consent.

Common mistake Searching only the current legal name in court and UCC indexes. Companies that get sued often change names afterward, pull every prior name from the Secretary-of-State filing history (including d/b/a registrations) and re-run the searches against each one.

There is no public IRS account for a private business, which means buyers cannot simply “pull the company’s tax returns.” What does exist are three indirect proxies that, together, give a reliable view of whether the entity is current on its tax obligations.

State certificate of tax clearance / good standing

Every state department of revenue (or Franchise Tax Board, Comptroller, etc.) will issue, on request, a Certificate of Tax Clearance, an official statement that the entity is current (or not) on sales tax, withholding tax, unemployment insurance, and franchise tax. Fees range from free to about $50; turnaround is days to weeks depending on the state. In M&A transactions, the Certificate is functionally required before a buyer accepts an assignment of contracts or assumes a payroll. The Federation of Tax Administrators maintains a directory of state revenue agencies.

Federal and state tax liens

The IRS files a Notice of Federal Tax Lien in the county where the taxpayer’s property sits when a tax assessment goes unpaid (IRS guidance). These show up in the county recorder’s index and in commercial lien aggregators. State tax liens follow a parallel process at the state level. Active liens always signal that the company is in unresolved dispute with a taxing authority; chains of liens that get withdrawn and refiled often signal a long-running collection negotiation.

EIN and TIN matching

The Employer Identification Number is the federal tax ID. The IRS does not run a public lookup, but a Form W-9 from the counterparty plus a free TIN-match through the IRS e-Services portal will confirm whether the name and EIN agree with the IRS file. A mismatch is one of the strongest single indicators of either fraud or a recently re-named/sold entity.

Action step For any transaction above $250,000 of contingent exposure, build the state Tax Clearance certificate into the closing conditions. If the seller cannot or will not produce one, write the indemnity escrow to cover at least two years of estimated tax exposure plus penalties.

If the counterparty performs licensed work, finance, healthcare, construction, real estate, professional services, the license itself is part of the background check. Revoked, surrendered, or expired licenses are public records, almost always free to search, and they sit upstream of the operational risk: a contractor without a current license cannot legally collect on a contract in many states.

Federal license rosters

• NMLS Consumer Access, mortgage and consumer-finance company and individual licensure across all 50 states.
• FINRA BrokerCheck, broker-dealers and registered representatives, under FINRA Rule 3110.
• SEC IAPD, SEC- and state-registered investment advisers.
• National Practitioner Data Bank, healthcare malpractice and adverse-action database (limited public access).
• Nursys, multi-state nurse-licensure verification.
• HHS OIG LEIE, Medicare/Medicaid exclusion (already covered in Layer 4).

State license rosters worth knowing

• California Contractors State License Board (CSLB), verifies license, bond, workers’ comp, and disciplinary history.
• New York Department of State Division of Licensing Services, real-estate brokers, security guards, notaries.
• Texas Department of Licensing and Regulation, broad coverage across 39 occupations.
• State medical and dental boards, check the Federation of State Medical Boards (FSMB) for a directory.
• State bar associations, attorney license, public discipline, and good-standing records.

Researcher’s note A “surrendered” license is often more informative than a “revoked” one. Licensees who see discipline coming will sometimes surrender voluntarily to avoid a public revocation; many state boards still publish the surrender and the underlying allegations. Always read the underlying order, not just the disposition.

Foreign counterparties multiply the workload because no single jurisdiction’s public record is comparable to the U.S. system. The framework that anchors the work is the Foreign Corrupt Practices Act anti-bribery and books-and-records provisions at 15 U.S.C. §78dd-1, which makes inadequate vetting of foreign intermediaries actionable for U.S. issuers and U.S. persons. The DOJ FCPA Resource Guide outlines the expected diligence depth as a function of country risk, transaction size, and government touchpoint.

The six-layer foreign workflow

1. Legal existence in the home jurisdiction. UK Companies House (free), Hong Kong Companies Registry (paid), Singapore ACRA Bizfile, Canada Corporations Canada, Mexico SAT.
2. Multi-jurisdictional sanctions screening. OFAC SDN + EU Consolidated List + UK HM Treasury OFSI + UN Security Council Consolidated.
3. Multilateral debarment. World Bank Listing of Ineligible Firms + Asian Development Bank, African Development Bank, Inter-American Development Bank, EBRD sanctions lists.
4. Adverse-media in local language. Native-language news search is non-negotiable; English-only searches miss most local enforcement and reputational issues.
5. Politically exposed person (PEP) screening. Owners, directors, and senior managers screened against PEP databases (Dow Jones Risk & Compliance, World-Check, OpenSanctions.org open-source).
6. Document authentication. Apostille under the 1961 Hague Convention for signature authority, certificate of incorporation, and power of attorney where the counterparty country is a signatory; consular legalization where it is not.

Privacy note The General Data Protection Regulation (Regulation (EU) 2016/679) restricts how U.S. buyers can collect and process personal data on European individuals in the diligence file. Build the data-minimization principle into your due-diligence template: collect what is necessary for the FCPA / sanctions screening, retain it only as long as the contract is live plus the limitations period, and document a lawful basis (legitimate interests under Article 6(1)(f) is the typical basis for compliance-driven diligence).

The last layer is the one that does not have a clean URL: open-source intelligence, the adverse-media review, and the pattern-recognition that separates a competent vetter from a checklist-runner. The goal is not to catalog every negative mention, it is to identify the small number of signals that have historically correlated with counterparty failure.

The ten persistent red flags

1. Entity is forfeited, revoked, or administratively dissolved in its state of formation.
2. Principal or beneficial owner appears on OFAC SDN, OIG-LEIE, or SAM.gov exclusions.
3. Three or more UCC-1 financing statements with merchant-cash-advance lenders in the trailing 18 months.
4. Federal criminal indictment, SEC enforcement action, or DOJ False Claims Act intervention against any current officer or director.
5. Chain of name changes, entity renamed three or more times in 36 months, or a series of formed-and-dissolved sibling LLCs at the same registered-agent address.
6. Registered agent is a generic mass-incorporator and the entity has no verifiable street address, phone, or web presence.
7. State tax liens or franchise-tax forfeiture within the last 24 months.
8. Principals’ professional licenses revoked, suspended, or surrendered, especially in finance, healthcare, or law.
9. Bankruptcy filing (Chapter 7, 11, or 15) by the entity or a controlled affiliate within 24 months.
10. Sustained adverse-media in the home jurisdiction, especially anything tied to fraud, embezzlement, or self-dealing.

Adverse-media workflow

A defensible adverse-media check covers three search rings: (1) the entity legal name and every prior name; (2) each current officer, director, and beneficial owner by full name plus city of residence; (3) the registered-agent street address. Use both Google and Bing because they index different sources, and use the country’s native-language press for foreign counterparties. OpenCorporates is useful as a global cross-jurisdictional index of entities; OpenSanctions consolidates global sanctions and PEP lists with an open-data license.

Common mistake Treating a single red flag as disqualifying or a clean Google search as exculpatory. Almost every large company has at least one lawsuit, regulatory inquiry, or critical news article in its history. The signal lives in clusters and patterns, one UCC-1 with an MCA lender is normal; six is a story. One officer with a bar complaint is normal; three officers with overlapping disciplinary records is a story.

The closing question is always the same: given a deal of size X with country risk Y and sector risk Z, what depth of background check is proportionate? A useful framework is the four-tier escalation model that mirrors how most compliance functions size their diligence.

The 12-step self-service workflow

1. Confirm exact legal name, state of formation, entity number, and current status (Secretary of State).
2. Pull a Certificate of Good Standing.
3. Screen entity + every d/b/a + every principal against OFAC SDN and Consolidated, OIG-LEIE, SAM.gov exclusions, DDTC Debarred, BIS Entity List.
4. Pull SEC EDGAR (if public) or FINRA BrokerCheck / IAPD (if regulated).
5. Pull UCC filings in state of formation and state of headquarters.
6. Pull PACER federal civil, criminal, and bankruptcy across all districts.
7. Pull state trial-court records in HQ state and every state of major operations.
8. Verify professional licenses across all relevant rosters.
9. Pull state Certificate of Tax Clearance.
10. Pull Dun & Bradstreet or Experian Business credit report.
11. Run adverse-media in English (and local language for foreign counterparties).
12. Document the file, timestamp the screenshots, and store with the contract.

Action step The single highest-leverage discipline is to re-run the OFAC, SAM.gov, and Good Standing checks the day of contract execution, not the day diligence opened. Designations and forfeitures move on a daily cadence; a check from 30 days ago is not a check, and the timestamp on the day-of-signing PDF is what makes the file defensible.