The 2026 State of Due Diligence: Data Coverage Across 37 Jurisdictions

Due-diligence data is not a monolith. Some sources are typed APIs with five-minute refresh and four-decade backfills; others are HTML scrapes of municipal registries that change layout every quarter. Treating both as equivalent is the canonical mistake of a junior KYC analyst — and, increasingly, of vendors who collapse everything into a single "match" column.

This report maps the actual landscape across the 128+ data-source connectors DueVestor maintains in production. Each connector is classified by upstream type (typed API, HTML scrape, dataset dump, paid commercial), refresh cadence, and beneficial-ownership disclosure depth. The findings sit alongside two adjacent industry benchmarks: the OpenSanctions coverage stats and the EU Commission AMLA preparatory studies.

Method: what counts as "coverage"

A jurisdiction counts as "covered" only when DueVestor can answer four questions deterministically against a single subject: (1) is the entity registered and active? (2) who are the directors and UBOs of record? (3) is the entity or any UBO on a sanctions list applicable to this jurisdiction? (4) is there enforcement, insolvency, or adverse-media history?

A "thin" jurisdiction is one where two or fewer of those questions are answerable from public sources. A "dark" jurisdiction is where the registry exists only behind in-country paid gateways with no documented API. The 37 figure in the title counts jurisdictions with a dedicated DueVestor connector bundle — the same routed-jurisdiction census the homepage stat strip reports; fewer pass the stricter four-of-four bar.

The four canonical sanctions lists are universal

OFAC SDN (US Treasury), the UN Consolidated list (Security Council), the EU Consolidated Financial Sanctions Framework, and OFSI (UK) are publicly downloadable, freshness-stamped, and parser-stable. Every credible due-diligence vendor ingests them; the question is whether they cross-verify hits across the four (HIGH confidence) or count a single-list hit as a binary "match" (the source of most false positives).

DueVestor downloads all four direct from the canonical publishers with a 24-hour cache and parses them in-process. World Bank Procurement Debarment and Wikidata-derived PEP graphs round out the global tier. Total: 6 global connectors that apply universally, plus jurisdiction-specific layers below.

Jurisdiction coverage by region

United States is the densest. SEC EDGAR (corporate filings), SEC enforcement, DOJ enforcement, CourtListener (federal + state court records), and OpenCorporates (state-of-incorporation data) cover the four questions for every US-domiciled entity. Refresh cadence is daily for enforcement, real-time for court dockets.

United Kingdom is the second-densest. Companies House publishes the full PSC (Persons of Significant Control) register as a free API — the single best UBO disclosure regime in the OECD. FCA enforcement, the Insolvency Service, and BAILII (case law) complete the stack. The PSC dataset alone makes UK entities materially cheaper to vet than equivalent US entities.

European Union is uneven. The Business Registers Interconnection System (BRIS) is the master directory but does not expose UBOs in a uniform schema. Germany (Bundesanzeiger), Netherlands (KVK), Denmark (CVR), Sweden (Bolagsverket), Norway (Brønnøysund), Austria (Firmenbuch), Belgium (KBO), Portugal (RNPC), Romania (ONRC), Czechia (Justice.cz), and Finland (PRH) are individually structured but each requires a separate connector. AMLA will likely consolidate this; until then, EU-wide due diligence is a 12-connector orchestration problem.

Middle East divides sharply. UAE has three free-tier registers (DIFC, ADGM, DFSA enforcement) plus the mainland disclaimer surface — strong coverage for the financial-zone subset, weaker for mainland mainstream LLCs. Israel publishes the Companies Registrar, Nevo case law, GuideStar (NGOs), the Capital Market Authority register, and a Debarred Suppliers list — five connectors, four-of-four pass rate. Saudi Arabia, Kuwait, Qatar: dark for now.

Asia-Pacific is mixed. Singapore ACRA, Hong Kong Companies Registry, Japan gBizINFO, South Korea DART, Taiwan GCIS, New Zealand Companies Register, and India MCA21 + NCLT (insolvency) are well-structured and covered. Indonesia, Thailand, Vietnam, Philippines, Malaysia: thin to dark; structured data exists but is gated behind in-country paid gateways. Australia (ASIC) is structured but DueVestor coverage is currently scaffold-only — slated for 2026 Q3.

Latin America: Brazil has the most coverage (Portal da Transparência, Serasa, Justiça Federal court records, CADE competition enforcement). Mexico, Argentina, Chile, Colombia: scaffold-only. The pattern matches FATF effectiveness scores — countries with strong AML supervision tend to ship structured registries.

Other notable jurisdictions: Switzerland (ZEFIX corporate + FINMA enforcement), Canada (federal corporate registry + SEDAR+ securities filings), Ireland (CRO), Germany at depth (GLEIF current-state + OffeneRegister historical officers), and Russia (SPARK-Interfax — paid commercial). Africa outside Egypt and Morocco is almost entirely dark; West Africa specifically has near-zero structured corporate data despite being a high-risk operating region.

The beneficial-ownership coverage gap

The single most important due-diligence question — "who actually owns this?" — is answerable from public data in only 11 of the 37 jurisdictions DueVestor reaches. The UK PSC register is the gold standard. The EU 5th AML Directive required member states to publish UBO data, but the 2022 Luxembourg court decision (WM, Sovim SA v. LBR) restricted public access pending the AMLA consolidation, leaving a fragmented compliance surface.

For the remaining jurisdictions, UBO data is either (a) restricted to "legitimate-interest" applicants — typically banks and regulators, (b) commercial-tier only via providers like Sayari, BvD Orbis, or Dun & Bradstreet, or (c) absent entirely. DueVestor handles this by spawning a Type B child report on any UBO that registry data DOES surface — if the cascade extractor finds no UBOs, the report says so explicitly rather than silently shipping a partial view.

PEP coverage: Wikidata is good enough, until it isn't

For Tier-1 PEPs — heads of state, central-bank governors, supreme court justices — the Wikidata graph is comprehensive and freshness-stamped. For Tier-2 PEPs (subnational officials, state-owned enterprise directors, immediate family members) coverage drops sharply outside OECD members. Vendors who claim "5 million PEP records globally" are typically counting historic + relatives + close associates; the operationally useful count for FATF Recommendation 12 compliance is closer to 250,000–400,000 individuals.

Adverse-media: GDELT is the unsung benchmark

GDELT v2 indexes news in 100+ languages with 15-minute refresh — the largest open adverse-media corpus available. The challenge is signal-to-noise: a name match on GDELT alone is LOW confidence; the same name corroborated by a court filing, an enforcement action, or a registry change is HIGH confidence. False-positive rates on naive name matching can exceed 70% in common-name jurisdictions (India, China, common Hispanic surnames).

2027 predictions

• EU AMLA goes operational in July 2026; expect a uniform UBO disclosure schema across all 27 member states by Q2 2027.
• OpenSanctions and OFAC will consolidate around a common identifier — likely a derivative of the GLEIF LEI for entities and a structured wikidata-style identifier for natural persons.
• UK PSC register will tighten verification after the Economic Crime and Corporate Transparency Act 2023 implementation, likely cutting "obviously false" PSC declarations by 40–60%.
• Adverse-media screening will shift from keyword search to LLM-classified passage scoring; vendors who can't show their classifier's precision/recall on a benchmark set will lose enterprise accounts.
• At least three Latin American jurisdictions will ship structured UBO registries — Brazil, Chile, and likely Colombia — driven by FATF Mutual Evaluation pressure.

What this means for compliance teams

Three operational implications. First: stop paying for "more lists" — the four canonical sanctions lists are FREE and cover the deterministic compliance obligation. Second: treat single-source hits as MEDIUM confidence until corroborated; the difference between a $40 false positive and a $4M enforcement action is the second source. Third: build escalation paths for "no UBO found" — silence is a finding, not a clean.

“In Mutual Evaluation reports, FATF consistently flags beneficial-ownership transparency as the single weakest pillar across both high-income and developing economies.”