Adverse media and OSINT in KYB: online reputation checks

What is OSINT in KYB?

OSINT (open-source intelligence) in KYB is the structured search of public sources, such as news, the company's own website, customer reviews, court and regulator notices, for anything that changes your view of a business customer's risk. Adverse media screening is one part of it; an online reputation check is the whole pass, read, summarised and scored, so an analyst only opens the files that need it.

Most of what OSINT surfaces is noise. Doing it well means clearing the noise fast. Of the online reputation flags our customers' analysts reviewed on Dotfile over the past year, fewer than 1 in 100 ended in a rejection. The value is not in the flags. It is in clearing the 99 and recognising the one.

How is OSINT different from AML screening?

AML screening matches names against curated lists: sanctions, politically exposed persons and adverse media databases compiled by data providers. It answers a closed question, "is this name on a list?", and its legal basis is explicit: from 10 July 2027, the AMLR requires checking targeted financial sanctions and PEP status (Article 20(1)(d) and (g), Regulation (EU) 2024/1624). Our AML screening guide covers it.

OSINT asks an open question: "what does the world say about this company, and does it fit what the company told us?" It catches what no list holds: a website that does not match the declared activity, a wave of complaints about non-delivery, a local press article on a dispute, a regulator's consumer warning, a registered address shared with hundreds of companies.

What do regulators expect from adverse media and open-source checks?

No EU text says "run OSINT on every customer". The expectation comes through risk assessment.

Under today's regime, the EBA Risk Factors Guidelines (EBA/GL/2021/02) list "information from credible and reliable open sources, such as reports in reputable newspapers" among the sources firms should consider (paragraph 1.31). Guideline 2 makes the customer's and the beneficial owner's reputation a risk factor in its own right, and asks: "Are there adverse media reports or other relevant sources of information about the customer?" It adds that firms should judge credibility on "the quality and independence of the source" and "the persistence of reporting", and that "the absence of criminal convictions alone may not be sufficient to dismiss allegations of wrongdoing". For high-risk relationships, "adverse media searches" appear among the enhanced due diligence measures (paragraph 4.64).

Under the AMLR, from 10 July 2027, the hook is Article 20(1)(e): assess "the nature of the customers' business, including, in the case of undertakings, whether they carry out activities". A company with no real activity is the shell your KYB process exists to catch, and the open web is often where that shows. Article 20(2) sets the depth by risk, and AMLA had to issue guidelines on risk factors by 10 July 2026 (Article 20(3)).

How do you run an online reputation check on a company?

Five passes, in this order.

1. Identity of the target. Use the legal name, trading names, registration number, country and website from the case. Most false positives come from searching a bare name.
2. The company's own presence. Is there a website, does it match the declared activity, does it show contact details, legal notices and a registration number? How old is the domain?
3. Public sentiment. Reviews on independent platforms, complaints, social media. Look for patterns, such as non-delivery or withheld refunds, not single angry customers.
4. Legal, regulatory and media signals. Court cases, regulator warnings and enforcement, negative press, links to high-risk jurisdictions, signs of nominee directors or shell structures.
5. Assessment and record. Summarise what was found with sources and dates, rate the risk and record why each signal was kept or discarded.

Scope it to your risk. A merchant acquirer cares about the website and chargeback complaints; a bank onboarding a regulated entity cares about enforcement history and management. Write that scope down: it is your policy, and an automated check should follow it.

Worked example: four findings, one real

A fictional payment institution onboards Hollins Garden Ltd, a UK online retailer of garden furniture. The online reputation check returns four findings.

Three findings cleared in minutes, each with a reason on file. One drove the decision. In a real portfolio the cleared share is far higher, and the record of what you cleared is what a supervisor reads first.

What the data says about online reputation checks

Based on online reputation checks run on Dotfile over the past year; aggregates only.

• Of the flags an analyst reviewed and decided, fewer than 1 in 100 ended in a rejection.
• The share of companies flagged for review depends on the customer's prompt and portfolio: a third at the median workspace, from 6% to 61% between the 10th and 90th percentiles (workspaces with at least 100 checks).

The spread is the lesson. The check reflects the scope you give it.

Frequently asked questions

Is adverse media screening mandatory?

Not as a named obligation in EU law. It follows from the risk assessment: the EBA guidelines list adverse media as a source and a risk factor, and treat it as an enhanced due diligence measure.

What is the difference between adverse media and online reputation?

Adverse media is negative news about a name, usually from a curated database. Online reputation is wider: the company's website, reviews, notices and news, read together against what the company declared.

How do you reduce false positives in adverse media?

Search with identifiers, not a bare name: registration number, country, website, directors. Then require a reason for every discard. Our guide to AML false positives covers the same problem on list screening.

Should OSINT cover beneficial owners too?

For higher-risk files, yes. The EBA guidelines apply the reputation factor to the customer's beneficial owners. See our UBO verification process.

Where Dotfile fits

Dotfile's online reputation check searches public sources using what the case already knows about the company, and returns a summary with a reputational risk profile. Too little information, negative signals or suspicious results send it to review; the rest is approved automatically. The prompt is customisable in your settings, up to 6,000 characters, so the check follows your policy. It runs alongside AML screening within the KYB process; for the person side, see identity verification services.