Table of Contents
To verify a foreign company before shipping, confirm four things: that the company exists in its home registry under the exact name on your order, that its address is a working site rather than a mailbox, that no party in the transaction appears on a restricted party list, and that the bank account you are asked to pay into or invoice belongs to that same company.
Most of that can be done in an afternoon, from a desk, at no cost. The expensive checks (site visits, paid investigation reports, third party audits) only make sense once the cheap ones have come back clean.
Verification is a sequence, and the order matters. Run the free registry and screening checks before you quote. Do the bank and reference work before you issue the proforma. Leave nothing until after the container is booked, because by then you have nothing left to hold back.
What “verified” has to mean before you ship
Plenty of exporters treat verification as a fraud check. That is half of it. There are two exposures, and they fail differently.
The commercial exposure is that you ship and never get paid. You lose the cargo and the freight. Painful, sometimes recoverable.
The regulatory exposure is that you ship to a party you were not allowed to deal with, or to an end use you were not allowed to supply. That one does not go away when the money arrives. Penalties for dealing with a denied party attach whether or not the deal was profitable.
So build one file that answers both. Same documents, two readers.
Step one: confirm the company exists in its home registry
Ask the buyer for the registered legal name, the company number, the country of registration, and the registered address. Ask in that exact form. A buyer who sends back a trading name and a mobile number has already told you something.
Then go to the registry yourself. Most countries publish a searchable company register. China has a national enterprise credit information system. Singapore, the UK, Hong Kong, India, Malaysia, Vietnam, Mexico and most of the EU run official online registers, some free and some pay per search. Search the number first. Name searches alone find lookalikes.
What the registry record must match
- The legal name, character for character, against the name on the purchase order.
- The registration number and the issuing jurisdiction.
- Status: active, in good standing, not dissolved, struck off or in liquidation.
- Incorporation date. A company formed six weeks ago placing a large first order is a different risk to one formed in 1998.
- Registered address, checked against the address on the order and the address on the bank details.
- Directors and, where published, shareholders.
- Stated business activity. A company registered for textiles ordering machine tools deserves a question.
Save the registry page as a dated PDF. A screenshot showing the URL and date is the minimum. That file is your evidence that you checked, and when.
When the register is not public
Some jurisdictions publish nothing useful, or publish only in the local language behind a national ID login. Fallbacks, in rough order of strength: a register extract supplied by the buyer and then confirmed with the issuing body, a certificate from the local chamber of commerce, a bank reference from a regulated bank in that country, or a credit report from an established commercial information provider.
Never accept a scanned certificate as proof on its own. Certificates are the easiest document in the world to forge, and a convincing one costs almost nothing.
Step two: test the address and the digital footprint
The address
Put the registered address and the delivery address into a satellite map and a street level view. You want a site that matches the claimed business. A machinery importer working out of a fourth floor flat is worth a conversation. So is a warehouse address that turns out to be an empty plot.
Search the address as a text string too. If dozens of unrelated companies share it, you are looking at a formation agent or a virtual office. That is legal and common, and also the standard setup for a shell. Either way the address proves nothing, so get the operating site separately.
Domain age, email and phone
Check when the company’s domain was registered. A domain created a few weeks before a large first order is one of the cheapest red flags to find and one of the most reliable. Check whether the domain registration country matches the company’s claimed country.
Look closely at the email domain. Free mail addresses on a corporate order are a warning. The sharper risk is a lookalike domain with an extra letter, a hyphen, or a .co in place of .com. That is how payment redirection fraud usually starts. Compare the domain on the latest email against the original enquiry, character by character.
Call the landline published on the company’s own website, not the number in the email signature. Ask for your contact by name. A fake front office fails that check often.
Step three: screen every name in the transaction
Most supplier vetting guides skip this step, and it is the one with legal consequences. Registry checks tell you a company is real. They do not tell you whether you are permitted to trade with it.
Screen the buyer’s legal name and trading names, the directors, the known owners, the consignee, the notify party, the forwarder, the end user, and the delivery address and country. You can run a denied party screening check on all of them in one pass before sending the quotation.
Screening throws up name matches that are not real matches. A partial hit on a common surname is normal. What matters is that you resolve each one and record the reasoning, which is covered in resolving a false positive in denied party screening. An unresolved hit in someone’s inbox is worse than no screening, because it proves you were on notice.
Ownership matters too. An entity that is not listed itself can still be off limits if listed parties own enough of it, so the ownership data from the registry feeds straight into the screening decision.
Step four: verify the bank details and the payment route
The account name must match the legal entity name on the contract. Not similar. The same. If the buyer explains that the account is in the name of a group company, a director, or a trading arm in a third country, treat that as a stop and escalate it.
Third party payments are a recognised sanctions evasion and laundering indicator, and they also strip your recourse if the deal sours. The same applies to payment from a country unconnected to the buyer or the goods. Those patterns and others sit in the red flags of sanctions evasion.
Confirm any change of bank details by phoning a number you held before the change request arrived. Never the number in the email asking for the change. That one rule prevents most invoice redirection losses.
Where verification is thin but the trade is worth doing, shift the risk into the payment terms. A confirmed letter of credit puts a bank’s promise between you and the buyer, at a cost, as set out in how a letter of credit works. Cash in advance on the first order is the blunter version, and normal for a new overseas customer.
How far to take verification, by order value and risk
Verification effort should scale. Adjust the tiers below to your own order sizes, and move a customer up a tier for any single high risk factor, whatever the order value.
| Tier | When it applies | Checks to complete before shipping | Payment terms |
|---|---|---|---|
| Basic | Small first order, low risk country, uncontrolled goods | Registry search, address and domain check, restricted party screening of buyer and consignee, bank name match | Payment in advance |
| Standard | Repeat or mid value orders, mainstream markets | All basic checks plus register extract, director and shareholder screening, two trade references, VAT or tax number check | Part advance, balance against documents |
| Enhanced | High value, higher risk country, dual use or controlled goods, new intermediary in the chain | All standard checks plus beneficial ownership trace, end user statement, adverse media search, credit report, licence check | Confirmed letter of credit or advance |
| Escalated | Unresolved screening hit, opaque ownership, suspected diversion | All enhanced checks plus third party verification or site visit, written compliance sign off, legal review where needed | Hold. Do not ship without sign off |
Trade references, end use and the onward destination
Making references worth taking
References supplied by the buyer are chosen by the buyer. Take them anyway, then make them work. Ask for two suppliers in your sector, contact them through details you find independently, and ask specific questions. How long have you supplied them. What was the largest single order. Did they pay on terms.
A bank reference is worth more, because a regulated bank has already run its own customer checks before opening the account. Ask for one on the enhanced tier.
Where the goods actually end up
Verifying the buyer does not verify the end use. A well run trading company can still be a route to a destination you are not allowed to supply. Ask what the goods are for, who the end user is, and where they will be installed. For controlled items, put the answer on an end user statement.
Watch for a delivery country that does not match the buyer’s country, a buyer with no obvious use for the product, odd routing through a transhipment hub, and a customer who declines to name the end user. Those signals matter most where the goods are dual use.
Red flags, and what to do about each
- Company number missing from the registry, or mapping to a different name. Stop and verify the extract with the issuing body.
- Registered address shared with dozens of unrelated companies. Request separate evidence of the operating site, such as a lease.
- Domain registered weeks before the order. Move to the enhanced tier and require advance payment.
- Email domain differs by one character from earlier correspondence. Treat as attempted fraud. Call a known number before responding.
- Bank account name does not match the company name. Do not proceed until it does, or until the mismatch is documented and approved.
- Buyer volunteers full payment above asking price with unusual urgency. Slow down and complete the enhanced tier.
- Buyer refuses to name the end user or the installation site for controlled goods. Do not ship. Escalate for licence assessment.
- Order profile makes no commercial sense for the buyer’s stated business. Ask directly and record the answer in the file.
One flag is a question. Two or more together is a pattern, and a pattern is a reason to decline rather than investigate further.
When verification comes back thin
Often nothing is wrong and nothing is provable. The registry is closed, the references are lukewarm, the company is genuinely young. You then have three honest options.
- Decline, and say why in the file. Cheapest option and sometimes the right one.
- Proceed with the risk transferred: payment in advance, or a confirmed letter of credit, with a small first order to build a record.
- Buy the missing information. A commercial credit report or a local verification agent costs a fraction of a lost container.
What you should not do is proceed and leave the file empty. Write down what you checked, what you could not establish, and who approved the shipment on what basis. That record is the difference between a documented commercial judgement and an unexplained gap. Screening evidence should be retained too, as set out in record keeping for denied party screening.
Re-verify on triggers, not only at onboarding. A change of consignee, a new delivery country, a sudden jump in order size, a change of bank details, or a gap of more than a year since the last check should all send the customer back through the sequence.
Key takeaways
- Verify the registration number in the official registry first, then the name. Name searches alone find lookalike companies.
- Save every check as a dated PDF or screenshot showing the source and the date you ran it.
- A registered address shared by many companies is a formation agent’s address and proves nothing about operations.
- Restricted party screening covers the buyer, consignee, notify party, forwarder, directors, owners and end user, not the buyer alone.
- The bank account name must match the contracting entity. Third party payment is a recognised evasion indicator.
- Confirm any bank detail change by phone, using a number you held before the change request arrived.
- Verifying the buyer does not verify the end use, so ask who uses the goods and where they will be installed.
Frequently asked questions
How do I check if a foreign company is legitimate?
Search the official company registry in its country of registration using the registration number, and confirm the legal name, status, incorporation date, address and directors match the order. Then check the address on a satellite map, check the domain registration date, screen the names against restricted party lists, and confirm the bank account name matches the company name.
What documents should I ask a new overseas buyer for?
A certificate of incorporation or a current register extract, the tax or VAT registration number, evidence of the operating address such as a lease or utility bill, identity documents for the person signing, bank details on company letterhead, and two trade references. For controlled goods, add an end user statement naming the end user and the intended use.
Do I need to screen my buyer against sanctions lists?
Yes, and not only the buyer. Restricted party obligations apply to exporters of every size, and they extend to the consignee, the end user, intermediaries and the forwarder. Screening is quick and free to run. The obligation exists regardless of order value, and a clean registry result is no substitute for a list check.
What if the buyer’s bank is in a different country?
It can be legitimate, particularly for groups with regional treasury arrangements. Ask for the explanation in writing and check it against the ownership structure. Refuse any account held in a name other than the contracting entity. A payment routed through a country with no connection to the buyer or the goods should be escalated before you ship.
How often should I re-verify an existing customer?
Screen every transaction, because lists change constantly. Refresh the wider verification file on a risk based cycle, typically annually for standard customers and more often for higher risk ones. Re-verify immediately on a trigger: new consignee, new destination, change of ownership, change of bank details, or a large jump in order size.
Putting the sequence into practice
Build the checks into your order process so nobody has to remember them. Registry and screening before the quote, bank and references before the proforma, end use confirmed before booking. Globalior’s free screening tool handles the list checks, and the free denied party screening tool keeps a dated record of each search for your file. If you want help setting the tiers or reviewing your current process, contact the Globalior team.