Skip to content
AuditFront
WHO.5 EU Sanctions DD

EU Sanctions DD WHO.5: Counterparty Existence Verification

What This Control Requires

Can the counterparty's existence and operations be independently verified?

In Plain Language

Phantom companies and front entities are common tools in sanctions evasion. A company that looks legitimate on paper - with a registered address, tax number, and website - may not actually exist as an operating business.

The EU Sanctions Compliance Helpdesk flags several indicators of phantom entities: no web presence beyond a basic template site, phone numbers with mismatched country codes, management that is never available for direct contact, and registered addresses that turn out to be mail drops or residential flats.

Independent verification means going beyond what the counterparty tells you and checking through official registries, physical verification, and third-party sources.

How to Implement

Verify counterparty existence through multiple independent sources:

1. Official company registries - check that the entity is registered, active, and that registration details match what the counterparty claims.

2. Physical presence - use mapping services (Google Maps, Street View) to verify that the stated address exists and looks like a place of business. For significant relationships, consider a site visit.

3. Online presence - check for a genuine website (not just a template), social media presence, industry directory listings, press coverage, and customer reviews.

4. Communication verification - call the stated phone numbers and verify they work, reach the right entity, and the country code matches the stated location.

5. Management access - try to establish direct contact with senior management. If the CEO is perpetually unavailable and all communication goes through intermediaries, that is a documented red flag.

6. Cross-reference business activity - does the entity appear in trade databases, industry associations, or public procurement records? Can it demonstrate a track record of genuine transactions?

Document all verification steps and their outcomes. Where verification is impossible or produces inconsistent results, escalate before proceeding.

Evidence Your Auditor Will Request

  • Company registry verification records for each counterparty
  • Physical address verification (mapping tools, site visits for significant relationships)
  • Communication verification: phone numbers, email domains, management accessibility
  • Cross-reference checks: trade databases, industry associations, press coverage
  • Documentation of any verification failures and resulting risk mitigation measures

Common Mistakes

  • Accepting counterparty self-description at face value without independent checks
  • Not verifying physical addresses - relying on mail correspondence alone
  • Failing to attempt direct contact with senior management of the counterparty
  • Ignoring warning signs like mismatched phone country codes or template websites
  • Conducting existence verification only at onboarding without periodic re-verification

Related Controls Across Frameworks

Framework Control ID Relationship
EU Sanctions DD EU Sanctions DD WHO.4 (related mapping) Related
EU Sanctions DD EU Sanctions DD WHO.1 (related mapping) Related

Frequently Asked Questions

What if the counterparty is in a jurisdiction where registry information is limited?
Some jurisdictions have limited public registry access. In those cases, rely more heavily on other verification methods: physical address verification, direct management contact, trade record review, bank reference letters, and third-party due diligence reports. If you cannot adequately verify the counterparty's existence through any available channel, that itself is a risk factor that should influence your decision to proceed.
How do we handle counterparties that are newly incorporated?
New entities are not inherently suspicious - legitimate businesses are formed every day. However, a newly incorporated entity warrants extra scrutiny in a sanctions context, especially if the incorporation date is close to sanctions designation dates, the entity is in a circumvention-hub jurisdiction, or the entity has no track record of business activity. Apply enhanced due diligence and verify the business rationale for the new entity.
Is a website sufficient proof of existence?
No. A website is easy and cheap to create. It is one data point among many. A genuine business typically has: a website with substantive content and regular updates, company registry records matching the website details, a physical address that can be verified, working phone numbers, employees who can be contacted, and a track record in trade databases or industry directories. A template website with stock photos and no verifiable contact details is actually a red flag.

Track EU Sanctions DD compliance in one place

AuditFront helps you manage every EU Sanctions DD control, collect evidence, and stay audit-ready.

Start Free Assessment