The following is a practical guide to open source intelligence (OSINT) tools for AML, risk, and compliance teams, including 15 free tools that can support due diligence, investigations, and sanctions checks, and the licensing and process questions to answer before you use them.
OSINT matters more than ever because the signals regulators now point to are often public. FinCEN’s May 2026 alert on Iranian front companies lists indicators such as a company with little to no web presence, co-located with numerous similar companies, or recently incorporated yet sending large, round-dollar payments. The same alert suggests checking maritime databases for vessels with recent name, flag, or ownership changes. Every one of those checks starts with open source research.
Key takeaways
- OSINT tools collect publicly available information from registries, news, leaks, sanctions lists, maritime data, and the web to support due diligence and investigations.
- The most useful free tools for AML cover five jobs: corporate and ownership records, sanctions and watchlists, news and adverse media, leaks and investigative data, and physical, maritime, and digital footprint checks.
- Free does not always mean free for compliance. OpenSanctions, for example, treats compliance screening as commercial use that requires a license, and OpenCorporates and OCCRP Aleph reserve free access for public-interest users.
- OSINT findings must be verified, sourced, and documented. Presence in a leak or a news story is not proof of wrongdoing.
- Free tools work well for spot checks and investigations, but they do not resolve entities across sources, monitor continuously, or keep an audit trail. That is where a risk intelligence platform takes over.
What are open source intelligence (OSINT) tools?
OSINT tools are used to gather publicly available information from various sources, such as corporate registries, sanctions lists, news articles, leaked document databases, maritime trackers, websites, and social media platforms. These tools help organizations interpret data for due diligence requirements, threat assessment, investigations, and research purposes.
In AML and compliance, OSINT usually answers four questions about a customer or counterparty:
- Does it exist, and is it what it says it is? Registration, address, website, and operating footprint.
- Who owns and controls it? Directors, shareholders, parent companies, and beneficial owners.
- Is it, or anyone connected to it, sanctioned or politically exposed? Watchlists and PEP data.
- What has been reported about it? News, enforcement actions, court records, and leaks.
Why OSINT tools are important for AML
By aggregating publicly available information from many different sources, OSINT tools enable organizations to proactively manage risks and ensure compliance. Access to expanded data sources can help in risk assessments, early detection of money laundering, and uncovering hidden relationships between individuals, other entities, and transactions.
Identifying potential risks with the help of OSINT tools enables organizations to take appropriate measures to prevent money laundering and terrorist financing.
Regulators expect this kind of research. FATF’s risk-based approach treats publicly available information as a core input to customer risk assessment and enhanced due diligence, and the Wolfsberg Group’s FAQs on negative news screening set out how to assess the reliability of public sources and the materiality of what they reveal.
The stakes are concrete. FinCEN found that likely shell companies moved $5 billion in 2024 through Iranian shadow banking networks, using indicators such as recent incorporation with limited or no internet presence and shared addresses with designated companies. Those are exactly the signals OSINT tools are built to surface.
Choosing the right OSINT tools for AML
OSINT tools can be helpful in augmenting data to get a more complete understanding of risk. Depending on your organization’s requirements, you may need one or more of these tools to meet your regulatory requirements.
For those with processes in place, assessing the gaps in data can ensure more complete risk reviews. That being said, time and resources will need to be allocated to manually review the relevant datasets.
Before adding a tool to your workflow, check four things:
- Coverage: does it cover the jurisdictions, languages, and entity types you deal with?
- Licensing: is your intended use, which for a bank or fintech is commercial, permitted under the tool’s terms?
- Reliability: is the data official, curated, crowd-sourced, or leaked, and how current is it?
- Auditability: can you record what you searched, when, and what you found?
Legal and ethical considerations
Public does not mean unrestricted. Before using OSINT in compliance work, keep these principles in mind:
- Respect licenses and terms of service. Several popular datasets are free only for non-commercial or public-interest use.
- Apply data protection rules. Personal data collected from public sources is still personal data under laws such as the EU and UK GDPR. Collect only what you need for a defined compliance purpose.
- Do not misrepresent yourself. Avoid fake profiles or pretexting to access information.
- Treat findings as leads, not conclusions. Leaked records and allegations need corroboration. As ICIJ itself notes, there are legitimate uses for offshore companies and trusts, and inclusion in its database does not imply wrongdoing.
- Document your sources. Save links, dates, and screenshots so another analyst or an examiner can retrace your steps.
15 free OSINT tools for risk and compliance
Here are 15 free tools our team has narrowed down for their value in AML processes, grouped by the job they do. While we can share our thoughts, it’s important to select tools that align with your organization’s goals, and to confirm each tool’s terms before using it in a commercial compliance program.
Free OSINT tools at a glance
| Tool | Best for | Free access | Commercial compliance use |
|---|---|---|---|
| GLEIF LEI Search | Legal entity identity and parent ownership | Free, no registration | Open data |
| OpenCorporates | Global company registry records | Free website browsing; free API for public-benefit users | Paid license for commercial API and bulk data |
| UK Companies House | UK companies, officers, and PSCs | Free | Free |
| SEC EDGAR | US public company filings | Free | Free |
| OFAC Sanctions List Search | US sanctions lists | Free | Free |
| EU Sanctions Map | EU restrictive measures by regime | Free | Free |
| OpenSanctions | Consolidated sanctions and PEP data | Free for non-commercial use | Data license required |
| HyperScan | Quick PEP and sanctions checks | Free | Free tool from Sigma360 |
| Google News and Google Alerts | News monitoring | Free | Free, but unstructured |
| ICIJ Offshore Leaks Database | Offshore entities and intermediaries | Free | Open license with attribution |
| OCCRP Aleph | Registries, leaks, and investigative datasets | Free on request for journalists and researchers | Check eligibility with OCCRP |
| Internet Archive Wayback Machine | Historical versions of websites | Free | Free |
| ICANN Lookup (RDAP) | Domain registration data | Free | Free, contact data often redacted |
| Google Maps and Street View | Verifying business locations | Free | Free |
| VesselFinder | Vessel positions and history | Free basic tier | Paid tiers for history and fleet tools |
1. GLEIF LEI Search
The Global Legal Entity Identifier Foundation offers free, registration-free search of every legal entity identifier (LEI), with more than 3 million entities covered. Level 1 data shows who an entity is, and Level 2 data shows who owns whom, including direct and ultimate parents where reported. It is especially useful for financial counterparties, funds, and corporate groups.
2. OpenCorporates
Offers an extensive corporate database with global coverage, drawn from official company registries in well over 100 jurisdictions. Standardized data makes information consistent and accessible. The website is free to browse, and free API and bulk access is available to journalists, NGOs, and academics. Commercial users, including risk and compliance teams, need a paid license.
3. UK Companies House
The UK register is free to search for company details, filing history, officers, and persons with significant control. Since identity verification became mandatory for directors and PSCs on 18 November 2025, its data is becoming more reliable, although verification of existing officers is still being phased in.
4. SEC EDGAR
Free access to filings by US public companies, including annual reports, ownership disclosures, and material events. Useful for confirming corporate structure and identifying significant shareholders of listed entities.
5. OFAC Sanctions List Search
The US Treasury’s free search tool covers the SDN List and other OFAC lists, with fuzzy matching. It is the authoritative source for US designations. Remember that OFAC’s 50 percent rule also blocks entities owned by designated persons even when they are not named on the list.
6. EU Sanctions Map
A free, official visualization of EU restrictive measures by country and regime, with links to the underlying legal acts. Useful for understanding which measures apply to a jurisdiction or sector.
7. OpenSanctions
A consolidated dataset of global sanctions, PEPs, and other high-risk entities. The database includes information on sanctioned parties, PEPs, and vessels from hundreds of sources. Note the licensing: OpenSanctions states that compliance screening is a commercial use that requires a data license, even when it generates no revenue. The bulk data is free only for non-commercial use.
8. HyperScan
HyperScan is our free AI-powered PEP and sanctions screening tool. It gives compliance teams a quick way to check individuals and entities against global sanctions and PEP data before moving to a full investigation.
9. Google News and Google Alerts
Google News provides access to a wide range of articles to research an organization or key stakeholders, and Google Alerts can notify you when new content matches a name or keyword. Use them to stay updated on local and global regulatory or enforcement actions. Results are personalized and unstructured, so treat them as a starting point rather than a complete adverse media screening process.
10. ICIJ Offshore Leaks Database
The International Consortium of Investigative Journalists’ Offshore Leaks Database contains information on more than 810,000 offshore entities from the Pandora Papers, Paradise Papers, Bahamas Leaks, Panama Papers, and Offshore Leaks investigations. This data can expose hidden offshore structures, the intermediaries behind them, and links to beneficial owners. The records run up to 2020, so treat them as historical context, and remember that ICIJ stresses inclusion does not imply wrongdoing.
11. OCCRP Aleph
The Organized Crime and Corruption Reporting Project hosts Aleph, a data platform that brings together company records, leaks, gazettes, and other investigative datasets. Access is free for journalists, researchers, and civil society members, who request it through OCCRP. Aleph grew out of OCCRP’s earlier Investigative Dashboard, and OCCRP is rebuilding it as Aleph Pro, which will remain free for nonprofit journalists. Commercial compliance teams should confirm eligibility before relying on it.
12. Internet Archive Wayback Machine
Shows how a website looked in the past. Useful for checking whether a company’s stated history matches its online history, spotting recently created websites, or recovering content that has since been removed.
13. ICANN Lookup (RDAP)
Domain registration data shows when a website was created and which registrar holds it, which can flag freshly registered domains used by front companies or spoofed websites. Since 28 January 2025, RDAP has replaced WHOIS as the standard for generic top-level domains, and registrant contact details for individuals are usually redacted.
14. Google Maps and Street View
Google Maps provides geolocation services, allowing organizations to map and visualize data related to potential risks. Site assessments with Street View are possible without a physical visit, and can help assess the legitimacy of business locations provided by clients or counterparties, such as an operating company that turns out to be a mailbox or a residential address.
15. VesselFinder
This tool provides vessel tracking and maritime data to help risk professionals assess trade-related risks. Compliance teams can check vessel movements, names, and flags to assess potential illicit trade, smuggling, or sanctions violations. FinCEN’s 2026 alert specifically flags vessels with recent or multiple name, flag, or ownership changes as a red flag for Iranian oil sanctions evasion. Historical data and fleet features generally require a paid plan.
For teams that want more, the OSINT Framework is a free directory that links to hundreds of further tools organized by data type.
How to use OSINT tools in an AML investigation
Tools are only as good as the process around them. This workflow shows how free OSINT tools fit into a typical review of a business customer or counterparty, for example a newly onboarded trading company that is sending large payments.
- Confirm the entity. Look up the company in its national registry, OpenCorporates, and GLEIF. Note the incorporation date, status, registered address, and any parent company.
- Map ownership and control. Record directors, shareholders, and persons with significant control, and follow each layer until you reach a natural person. Check the names against the ICIJ Offshore Leaks Database and, if you are eligible, OCCRP Aleph.
- Screen every party. Run the entity, its owners, directors, and key counterparties against OFAC, EU, and UK sanctions lists, PEP data, and sanctions and watchlist screening tools. Consider ownership by sanctioned persons, not just direct matches.
- Check the footprint. Use Google Maps and Street View to view the address, the Wayback Machine to check website history, and an RDAP lookup to see when the domain was registered. A recently registered domain, a shared address with dozens of companies, or no visible premises are all worth noting.
- Search the news. Search the entity and its people in local languages as well as English, looking for fraud, corruption, sanctions, or enforcement coverage.
- Check trade and maritime links. If the business involves shipping, review the vessels involved for name, flag, or ownership changes and unusual routes.
- Corroborate and document. Separate verified facts from allegations, record each source with a link and date, and summarize the risk for your enhanced due diligence file or suspicious activity report.
These checks map directly to the red flags in recent guidance. FinCEN’s 2026 front company alert and OFAC’s March 2026 advisory on sham transactions both describe shell companies, layered structures, and transfers to relatives or offshore companies around the time of a designation.
Features of OSINT tools
The specific functionalities of OSINT tools can vary widely. Here are some to look out for when assessing if a tool is right for your needs:
- Data aggregation: a streamlined process of collecting information from multiple channels
- Search and filter: users can enter keywords, queries, or specific criteria to retrieve relevant information
- Data visualization: graphs, charts, or network diagrams can facilitate the analysis of complex datasets and reveal patterns or trends
- Link analysis: lets users explore connections between entities
- Monitoring and alerts: users can set up alerts or notifications based on specific keywords or criteria to stay updated on changes in risk
- Social media analysis: monitoring and analyzing social platforms, including mentions, hashtags, or activities, to detect emerging trends
- Geolocation: maps data based on geographical information to identify hotspots or assess risks based on location-specific factors
- Workflows: can facilitate team collaboration with features to annotate data, assign tasks, and generate reports
- Customization: the ability to tailor the tool to your needs and preferences, including integration with other tools, APIs, or external data sources
- Export and audit trail: the ability to save searches, results, and timestamps so your work can be reviewed
Why data alone isn’t enough
It’s important to know your OSINT tools and understand what data can be used to mitigate financial crimes, but it’s equally important to have the right technology in place to make sense of that data. While OSINT tools are fantastic aggregators of public data, they don’t always have the ability to optimize that data and transform it into multi-dimensional risk intelligence.
Free tools also have practical limits for regulated institutions:
- Manual effort: every search, comparison, and screenshot is done by hand, one entity at a time.
- No entity resolution: each tool has its own spelling, identifiers, and formats, so confirming that records refer to the same person or company is left to the analyst.
- No continuous monitoring: most free tools are point-in-time searches, so changes after onboarding go unnoticed.
- Licensing constraints: some of the best datasets are not licensed for commercial compliance use.
- Weak audit trail: results are scattered across browser tabs rather than logged in one case record.
- Coverage gaps: registries, languages, and news sources vary widely by country.
Free OSINT tools vs a risk intelligence platform
| Free OSINT tools | Risk intelligence platform | |
|---|---|---|
| Best for | Spot checks, investigations, verifying a specific fact | Screening and monitoring at scale |
| Data | Separate sources, each with its own format | Unified, standardized data across sources |
| Entity matching | Manual | Automated entity resolution |
| Monitoring | Point in time | Continuous, with alerts |
| Adverse media | Unstructured search results | Filtered and scored for relevance and materiality |
| Audit trail | Manual notes and screenshots | Logged decisions linked to sources |
| Licensing | Varies by tool, often non-commercial | Licensed for compliance use |
How technology platforms increase efficiency
As organizations are inundated with more and more data and increasingly complex threats, technology platforms provide efficiency gains that make workflows more manageable and effective.
Not only do technology platforms consolidate data from disparate tools into a single dashboard, they also make sense of multiple streams of data in a single, standardized format. For example, a technology platform enables you to review PEPs, sanctions, adverse media, UBOs, and more, from a single place. Plus, they can apply advanced entity resolution to make sense of multi-source data in a way that standalone OSINT tools cannot.
While technology platforms require some level of investment, they can be cost-effective for high-risk or highly regulated companies because they help teams execute efficient workflows by automating cumbersome tasks, consolidating open source and licensed data, and surfacing risk flags that might otherwise be missed by organizations working across multiple OSINT tools. Activity history and reporting are typically built in to reduce manual tracking efforts. Our AML automation guide explains where automation delivers the fastest return.
How Sigma360 unifies risk data
We give compliance teams instant access to a vetted, ready-to-use risk data library covering sanctions, PEPs, adverse media, corporate registries, and ownership data. Our risk intelligence platform draws on more than 100 billion data points, 150+ corporate registries, and more than 730,000 global news sources in 120+ languages, and can ingest structured and unstructured risk-related data, including your internal customer data, so you can access a unified view of risk on any person, company, or entity in a single dashboard.
On top of that data, we add the capabilities free tools leave to the analyst:
- Entity resolution to confirm when records from different sources describe the same person or company
- Derived intelligence such as shared addresses, shared directors, and nominee relationships that point to ultimate beneficial ownership
- Adverse media screening scored for severity and materiality, with our AI News Agent removing 95% of irrelevant news events
- Continuous monitoring through perpetual KYC, so changes surface as alerts after onboarding
- AI-assisted review through AI360, where Entity Summary compiles a standardized risk profile in seconds
- An audit trail that logs every decision with links back to its sources
In short, OSINT tools help you find information. We help you turn it into a defensible risk decision, at scale.
Conclusion
Free OSINT tools give compliance teams access to a remarkable range of public information, from corporate registries and sanctions lists to offshore leaks and vessel movements. Used well, they help confirm who a customer really is, who stands behind it, and what has been reported about it.
But free tools come with limits: manual effort, licensing restrictions, no entity resolution, and no continuous monitoring. For high-risk or high-volume programs, the most effective approach combines targeted OSINT research with a platform that unifies the data, monitors it continuously, and documents every decision.
Discover why global companies choose Sigma360 to simplify risk management for onboarding, periodic reviews, and ongoing monitoring. Request a demo, or start with HyperScan for free.
Frequently asked questions
What are OSINT tools?
OSINT (open source intelligence) tools collect and analyze publicly available information from sources such as corporate registries, sanctions lists, news, leaked document databases, maritime trackers, and websites. In AML, they support customer due diligence, enhanced due diligence, investigations, and sanctions checks.
What are the best free OSINT tools for AML?
Useful free tools for AML include GLEIF LEI Search and national registries such as UK Companies House for corporate data, OFAC Sanctions List Search and the EU Sanctions Map for sanctions, the ICIJ Offshore Leaks Database for offshore structures, Google News and Google Alerts for news, the Wayback Machine and ICANN Lookup for digital footprint, Google Maps for location checks, and VesselFinder for maritime data. HyperScan offers free PEP and sanctions checks.
Can banks and fintechs use free OSINT tools for compliance?
Yes, but check each tool’s terms. Official government sources such as registries and sanctions lists are generally free for any use. Some aggregated datasets are not: OpenSanctions treats compliance screening as commercial use that requires a license, and OpenCorporates and OCCRP Aleph reserve free access for public-interest users.
Is OSINT legal for AML investigations?
Using publicly available information is generally lawful, but data protection laws such as the GDPR still apply to personal data, and tools’ terms of service must be respected. Collect only what you need for a defined compliance purpose, avoid pretexting or fake accounts, and document your sources.
How do you verify OSINT findings?
Corroborate each finding with at least one independent and, ideally, official source. Confirm identity using identifiers such as dates of birth, registration numbers, or addresses, since many people and companies share names. Treat leaked records and allegations as leads, and record the source, date, and link for every finding.
What is the difference between OSINT tools and AML screening software?
OSINT tools are usually single-purpose searches that an analyst runs manually. AML screening software unifies data from many sources, resolves entities, screens automatically against sanctions, PEP, and adverse media data, monitors continuously, and keeps an audit trail of every decision.
Is WHOIS still available for domain checks?
For generic top-level domains, RDAP replaced WHOIS as the standard on 28 January 2025. You can still look up registration dates and registrars through tools such as ICANN Lookup, but registrant contact details for individuals are usually redacted for privacy.
