Financial OSINT: Tracing Money Through Public Data

Financial OSINT techniques — court records, sanctions databases, property records, and SEC filings that expose financial flows without subpoena power.

Financial OSINT is the hardest subdomain to fake competence in. Court records, UCC filings, sanctions databases, and property records produce hard evidence that survives adversarial review, but they require knowing where to look. This post catalogs the sources that actually pay off. For the full domain guide, see /domains/financial/.

What Public Records Actually Expose

Without a subpoena, you cannot see bank statements, credit reports, or tax returns. What you can see:

  • Filed litigation and exhibits (contracts, bank records, sworn declarations)
  • UCC-1 financing statements (secured lending collateral)
  • Real property deeds, mortgages, and liens
  • Bankruptcy filings (full asset and creditor schedules)
  • SEC filings (Forms D, 10-K, proxy statements, Schedule 13D/G)
  • IRS Form 990 for nonprofits (compensation, grants, related-party transactions)
  • FEC and state campaign-finance filings
  • Sanctions and enforcement lists (OFAC, FinCEN, state regulators)
  • International corporate registries with UBO disclosure (UK PSC, Denmark, Luxembourg partial)

Everything else — direct transaction data for private entities — requires either a leak or legal process. Investigators who claim otherwise are usually overstating.

Court Filings Are the Single Best Source

Civil litigation exposes financial relationships that registries hide. A contract dispute between two LLCs will routinely expose:

  • Full names and signatures of principals
  • Bank account patterns (routing numbers sometimes visible in exhibits)
  • Internal emails describing the business relationship
  • Asset schedules when discovery produces them
  • Sworn declarations about ownership and control

Workflow:

  1. Search PACER for federal cases involving the target entity or its principals.
  2. Search state-court dockets (CourtListener covers federal; state-level systems vary — many states now publish free dockets).
  3. Download the docket sheet and full complaint.
  4. Pull exhibits. Exhibits are where the real material lives.
  5. Check for related bankruptcy filings, which produce the most comprehensive public financial disclosure of any filing type.

A focused dork:

site:courtlistener.com "Meridian Holdings" OR "Meridian Capital"
"Meridian Holdings" filetype:pdf (complaint OR "motion for summary")

UCC Filings

Uniform Commercial Code Article 9 filings record secured loans. When a lender takes collateral from a borrower, a UCC-1 is filed with the state (usually Secretary of State). The filing names:

  • Debtor (with address)
  • Secured party (lender, with address)
  • Collateral description

UCC data is free in most states; commercial aggregators (UCCFilings.com, Lien Solutions) provide nationwide search. A UCC filing against a specific company discloses its lending relationships, its operating state, and sometimes its equipment and inventory.

Example record:

Filing 20260114-7239488 (Delaware)
Debtor: MERIDIAN HOLDINGS LLC, 16192 Coastal Highway, Lewes, DE 19958
Secured Party: FIRST COMMERCIAL BANK, 250 Park Ave, NY 10177
Collateral: All accounts, deposit accounts, and general intangibles.

UCC continuations and amendments track the life of the lending relationship.

Real Property

County recorder offices publish deeds, mortgages, and liens. Many counties now provide searchable online databases. Key records:

  • Deed — grantor, grantee, consideration (purchase price), date.
  • Mortgage / Deed of Trust — borrower, lender, principal amount, maturity.
  • Lien — judgment liens, mechanics' liens, tax liens.

Cross-jurisdictional aggregators (ATTOM, PropertyShark, Regrid) expose multi-state holdings of a named entity or individual.

Pattern: a shell company that owns real estate must record a deed naming grantee and usually provide a tax-notice address. That tax-notice address often routes to the real principal or their agent.

Sanctions and Enforcement Databases

The starting point for any financial-OSINT investigation on a named person or entity:

  • OFAC SDN list (sanctions.treasury.gov)
  • EU consolidated sanctions list
  • UK HMT sanctions list
  • OpenSanctions.org — aggregated, searchable, with JSON API
  • FinCEN advisories and enforcement actions
  • SEC enforcement actions (sec.gov/litigation)
  • DOJ press releases (justice.gov) for criminal financial enforcement

OpenSanctions is the best-maintained free aggregator. A single query surfaces hits across dozens of regimes:

https://www.opensanctions.org/search/?q=Sarah+Lin

Always check sanctions first. A hit changes everything about the investigation, including what you are legally allowed to do with the findings.

Nonprofit and 501(c) Data

ProPublica Nonprofit Explorer exposes Form 990 data for US nonprofits, including:

  • Officer and director compensation
  • Grants paid and received
  • Related-party transactions
  • Highest-compensated employees and contractors

For dark-money research, Form 990 and 990-PF filings are central. Cross-reference grantor nonprofits with grantee nonprofits across multiple years to reveal funding networks.

SEC EDGAR for Financial Disclosure

Beyond the ownership-focused use discussed in /blog/how-to-trace-company-ownership-using-public-records/, EDGAR exposes:

  • Form D (private placements) — amount raised, investor count, executives.
  • 10-K and 10-Q — full financial statements and MD&A for public companies.
  • 8-K — material events, often including undisclosed liabilities and related-party deals.
  • Proxy statements — executive compensation, related-party transactions, director independence.
  • 13F — institutional holdings above $100M AUM.

EDGAR full-text search handles phrase queries well:

https://efts.sec.gov/LATEST/search-index?q=%22related+party%22+%22Meridian%22&forms=10-K

Cryptocurrency

Cryptocurrency tracing deserves its own treatment; a short summary:

  • Bitcoin and Ethereum addresses are public; transactions are traceable on-chain.
  • Commercial tools (Chainalysis Reactor, TRM Labs, Elliptic) do this at scale; paid.
  • Free tools: blockchain.com explorers, Etherscan, OXT (Bitcoin), BreadcrumbsApp (free tier).
  • Exchange KYC-linked addresses are the terminal points investigators chase toward.

The on-chain trail is permanent; the off-chain attribution (which address belongs to whom) is the hard part, and usually requires a leak or law-enforcement subpoena to close.

Putting It Together

A worked example:

  1. Tip: "Meridian Holdings is moving money to political-advocacy nonprofits."
  2. ProPublica Nonprofit Explorer → identify 501(c)(4)s receiving grants from "Meridian"-named donors.
  3. EDGAR Form D → identify Meridian's executives and capital raises.
  4. PACER → civil litigation exposing Meridian's operating agreements, named in exhibits.
  5. UCC filings → lending relationships and operating addresses.
  6. County records → real estate held by Meridian or its principals.
  7. OpenSanctions → negative hit (no enforcement exposure).
  8. OFAC + FEC → no designated-person connections; no PAC contributions from named principals, but spouse donates to aligned PAC.

Output: a financial narrative rooted in public records, every claim citable to a specific filing, every filing archived and hashed — see /blog/preserving-digital-evidence-screenshots-archives-hashing/.

Legal and Ethical Frame

Financial OSINT findings about private individuals carry the same defamation and privacy risk as any OSINT finding — see /blog/legal-boundaries-of-osint/. Findings about public officials, public companies, and sanctioned entities carry less risk, but not none.

Published investigations with extensive public-records foundations — the Epstein Revealed investigation series is one example — demonstrate the legal-document-heavy pattern: claims tied to specific filings, archived sources, explicit confidence levels.

Integration Into Methodology

Financial OSINT fits the standard methodology framework:

  • Planning: define the financial question. "Who funds X" is different from "what does Y own" is different from "is Z solvent."
  • Collection: court records, registries, SEC, sanctions, property, nonprofit filings.
  • Analysis: entity resolution across filings; transaction/relationship mapping.
  • Reporting: citable claims with filing-level precision.

Financial investigations reward discipline more than creativity. The investigators who do this best are the ones who read every filing twice before writing anything.

Where to Start

Begin with a single entity and walk through OpenSanctions → OpenCorporates → EDGAR → PACER → state UCC → county records. Each source answers a different question, and the full sweep takes an afternoon per target. See /tools/company-registry/ and /domains/financial/ for the expanded guides.

More from the blog