Counterparty Due Diligence: A Practical Pre-Deal Check

Due diligence is not a search for certainty. It is a disciplined way to decide what must be verified, what remains unknown and whether the unanswered variables are proportionate to the deal.

A registration record is evidence of registration. It is not evidence that every claim made by the business is true.

Fact: official records answer narrow questions

The Australian Securities and Investments Commission recommends checking government registers for a business’s registration, identifiers, status and directors before dealing with it. ASIC also states that appearing on a register does not guarantee that a business is trustworthy. See Check another business is trustworthy.

For technology and data suppliers, the UK National Cyber Security Centre recommends understanding supplier criticality, governance, incident recovery, data protection and contractual reporting. It cautions that its supplier assurance questions are not a box-ticking checklist.

Signal: the story and the records do not align

One discrepancy may have an ordinary explanation. Treat it as a signal to test, not a finding of misconduct.

• The legal name, registration number, payment account and invoicing entity do not match.
• The person negotiating the deal cannot show authority to bind the counterparty.
• A business presented as established was recently formed, renamed or materially reorganised.
• Directors, owners, addresses or trading names change without a clear commercial explanation.
• Required licences, insurance, professional standing or references cannot be independently confirmed.
• A critical service relies on one person, subcontractor, platform or geography that was not disclosed.
• The counterparty gives polished policy documents but little evidence that the controls operate in practice.

Counter-signals may include verified identifiers, consistent filings, independently confirmed references, current licences, evidence-backed answers and transparent explanations for changes.

Action: use five layers and preserve the result

Scale the work to the value, access, duration, reversibility and downside of the relationship.

1. Identity and authority. Confirm the exact contracting entity in the relevant official register. Match its identifiers, address and payment details. Identify who owns or controls it where that is relevant, and verify that the signer is authorised.
2. Capacity. Test whether the counterparty has the people, licences, financial capacity, insurance, facilities and supply chain needed for this commitment. Ask for evidence appropriate to the claim.
3. Integrity and compliance. Check the regulatory, sanctions, anti-bribery, export, privacy or industry requirements that actually apply to the parties and transaction. Use current official sources and specialist advice where required.
4. Delivery and resilience. Identify critical subcontractors, data access, incident notification, backups, recovery arrangements and exit support. For a key supplier, ask what evidence supports its recovery claims.
5. Deal fit. Align scope, price, acceptance, payment, change control, renewal, termination, data return and dispute escalation with the risks revealed above.

Keep a short evidence record rather than a folder of unexplained downloads:

• Verified fact: what the source establishes, with the source and date checked.
• Signal: the inconsistency or dependency that needs attention.
• Counter-signal: evidence that explains or reduces the concern.
• Open variable: what remains unknown, who owns it and the decision deadline.

Recheck time-sensitive facts before signing and during long or critical relationships. A clean check from last year is not evidence of current status.

Limitations: this is not a universal compliance checklist

Registers can be incomplete, delayed or limited in scope. Names can match the wrong person or entity. Private-company finances and ownership may not be public. Different industries and countries impose different verification, sanctions, privacy, procurement and record-keeping duties. A low-risk purchase and a high-access strategic supplier should not receive identical scrutiny.

This is general information, not legal or professional advice. Law and facts vary. Consult qualified advisers for a specific situation.