How a due diligence check works, UK
Due diligence is the check made before a decision that is hard to reverse: an investment, an appointment, a supplier or partner, or a sensitive transaction. This guide explains what such a check usually covers and where its findings come from.
What the check is for
A due diligence check looks at a person or a company before a decision is made about them. The point is to find out what is on the public record, what has been reported, and whether the picture holds together, while there is still time to act on it.
The question comes first. A check on a prospective director is scoped differently from a check on a supplier, and a check ahead of an investment is scoped differently again. The scope is agreed before any collection starts.
What a check usually covers
Ownership and control. In the UK, companies must file details of their directors and of the people with significant control over them with Companies House. Those filings show who sits behind a company, and where they are kept up to date, they are a starting point rather than the whole answer.
Litigation and insolvency. Court listings and judgments are public in many cases, and the Insolvency Service publishes the individual insolvency register. A check looks for proceedings, bankruptcies and company insolvencies that bear on the decision.
Sanctions and politically exposed persons. A check screens the names involved against the UK sanctions list and against lists of politically exposed persons, where the decision calls for it. A match is a reason to look harder, not a conclusion on its own.
Adverse media. Press coverage is reviewed for what it reports, when, and how reliable its source is. A single article is weighed differently from a pattern across several independent outlets.
Consistency. Where the records disagree, that is itself a finding. Names, dates, addresses and roles are compared across sources, and the differences are reported rather than resolved by guesswork.
How sources are weighed
Each source is named, dated and graded for reliability. An official register is not graded the same way as an anonymous post, and a claim that appears in one place only is reported as one place only.
Where sources conflict, the conflict is reported with both sides. A report that hides a disagreement is a weaker report, however tidy it reads.
What the report should say
A useful report states each finding, the sources behind it, how reliable those sources are, and what the check did not find. An absence of adverse reporting is not proof that nothing exists, and the report should say so plainly.
It should also say what the check could not reach. Some records are not public, some jurisdictions publish less, and some answers simply are not in any source that can be lawfully consulted.
The lawful basis and the limits
Processing personal data for a check needs a lawful basis under UK data protection law. The basis is agreed before the work starts, and the check uses lawful sources only. Information obtained by unlawful access, or from a source whose use is not permitted, is not used.
A check informs a decision. It does not make the decision, and a responsible provider says so.
Questions to ask a provider
Ask which sources the check will use, how each is graded, what the lawful basis is, what is excluded, and what the report will say about what it could not find. A provider that cannot answer these clearly has not thought the work through.