How to Trace Company Ownership Using Public Records

A step-by-step guide to tracing beneficial ownership through state registries, SEC filings, UK Companies House, and cross-border corporate records.

Tracing who actually owns a company is one of OSINT's highest-value outputs. Layered LLC structures exist precisely to make ownership opaque, but in most jurisdictions enough signal leaks through public records to rebuild the chain. This post walks through the method. For the full corporate domain guide, see /domains/corporate/.

Start With What You Know

Ownership tracing begins with a single datapoint: a company name, an address, an officer, a domain, or a phone number. Whatever it is, the planning phase defines the pivots you will try first.

Typical starting points:

  • Company name → search state registry and OpenCorporates
  • Address → search for co-located entities
  • Officer name → search for other directorships
  • Domain → WHOIS for registrant, then reverse-lookup registrant across other domains

Layer 1: State and National Registries

For US entities, the first stop is the state of formation. Delaware, Nevada, and Wyoming are overrepresented because of minimal disclosure requirements — Delaware does not publicly list members of LLCs, for example.

  • Delaware Division of Corporations — entity search by name only; you get entity ID, formation date, registered agent, and status. No officer or member disclosure.
  • California Secretary of State BizFile — discloses officers for corporations and, as of 2024 CTA implementation, more for LLCs.
  • New York Department of State — includes chief executive officer for entities that file annually.
  • OpenCorporates — aggregates global registries, sometimes with data not in the primary source.

A typical registry pull produces:

Entity: MERIDIAN HOLDINGS LLC
Jurisdiction: Delaware
Formation: 2019-08-14
Registered Agent: Harvard Business Services, Inc.
Agent Address: 16192 Coastal Highway, Lewes, DE 19958
Status: Active

The registered agent is almost always a service company, not the real owner. Don't stop there.

Layer 2: SEC EDGAR

If the company has raised capital, filed securities, or been acquired, SEC EDGAR will have something. Full-text search:

https://efts.sec.gov/LATEST/search-index?q=%22Meridian+Holdings%22&forms=D,10-K,13D,13G

Look for:

  • Form D (private placements) — discloses executives and promoters
  • Schedule 13D/13G — beneficial ownership filings for >5% holders
  • Proxy statements (DEF 14A) — director and officer details
  • Exhibits to 10-Ks — subsidiary lists

A Form D filing will often name the "Executive Officers and Directors" of a shell that its state registry obscures. This is the single most useful disclosure regime for US private-entity tracing.

Layer 3: Corporate Transparency Act and UBO Registers

The US Corporate Transparency Act (CTA), litigation-permitting, requires beneficial ownership disclosure to FinCEN. Access is restricted — law enforcement, financial institutions for due diligence with consent — so it is not directly OSINT-accessible. But CTA compliance has created paper trails in consultant communications, engagement letters, and litigation filings that sometimes surface in PACER.

International UBO registers that are directly searchable include:

  • UK Companies House — full director history, filings, and (via the Persons of Significant Control register) disclosed owners with >25% control
  • Luxembourg RBE — UBO register with partial public access
  • Denmark CVR — extensive ownership data publicly searchable
  • Ukraine YouControl and OpenDataBot — deep corporate graphs

UK Companies House is the single best training ground for ownership tracing because the data is free, structured, and deep.

Layer 4: Pivots That Actually Work

Once registries are exhausted, the productive pivots are:

Registered Agent and Address Clustering

Shell companies formed for the same client often cluster on the same registered agent and formation date. Running an agent's full client list (available in bulk through commercial datasets; partially through OpenCorporates) surfaces siblings.

Officer Name Across Jurisdictions

An officer in a Delaware LLC with a distinctive name often appears in other states' records. Google dork:

"John A. Smitherton" ("LLC" OR "Inc" OR "director" OR "officer") -site:linkedin.com

Litigation

Civil litigation is the single most revealing public record about private companies. PACER, state dockets, and services like CourtListener expose contracts, ownership disputes, and sworn declarations that registries never would.

Real Property

Corporate real estate holdings appear in county recorder records. A shell company that owns property must record a deed naming the grantee and usually an address for tax notices. Those tax addresses often route to the true principal.

Layer 5: Domain and Infrastructure

If the company has a web presence:

  • Current WHOIS — often privacy-masked, but registration date is a useful anchor.
  • Historical WHOIS — via DomainTools, WhoisXML, or SecurityTrails (paid; limited free tiers). A pre-privacy snapshot may show the real registrant.
  • Certificate Transparency — crt.sh exposes subdomains and alternate names tied to a certificate, which can link seemingly unrelated entities.
  • Shodan for IP-level co-location. See /tools/shodan/.

Example dork against archived sites:

site:web.archive.org "meridianholdings.example" "Contact"

Putting It Together

A worked example:

  1. Starting point: the company "Meridian Holdings LLC" appears in a local news story.
  2. Delaware filing: registered agent is Harvard Business Services; formation 2019-08-14.
  3. SEC EDGAR: Form D filed 2020-03 by "Meridian Holdings LLC" names executive Sarah Lin.
  4. OpenCorporates: Sarah Lin is listed as officer of three other Delaware LLCs, two of which have NY foreign-qualification filings that disclose her address.
  5. PACER: the NY address matches a litigation defendant, "Lin Capital Partners LLC."
  6. Lin Capital Partners' UK subsidiary appears in Companies House with full PSC disclosure naming Sarah Lin as 75%+ owner.

Chain complete — from a masked Delaware LLC to a named UBO — entirely from public records.

For structured review of the filings produced by a trace like this, many investigators feed the document set through the Subthesis legal document analysis tool to extract officers, addresses, and related entities consistently.

Analysis Discipline

Every node in the chain above is an entity-resolution decision. "Sarah Lin" in Delaware Form D and "Sarah Lin" in NY filings are the same person only if addresses, dates of birth, or corroborating signals align. Document your resolution logic in the analysis phase; otherwise the chain is guesswork.

Limitations

  • Delaware, Nevada, Wyoming, and South Dakota LLCs without federal filings may be genuinely untraceable via OSINT.
  • Offshore structures (BVI, Cayman, Seychelles) rarely yield to public-records methods without a leak.
  • UBO registries are under political pressure; availability changes. Assume current access is not permanent.

Corporate tracing rewards patience. Most investigations that produce real attribution take days, not hours, and the investigator who documents every pivot can pick up where they left off. The one who doesn't will repeat the same searches indefinitely.

See /tools/company-registry/ for the full tutorial on registry searches and /domains/corporate/ for domain-specific patterns across industries.

More from the blog