What is open source intelligence (OSINT)?
US law defined the term first; EU due diligence rules now name it:
- 6 January 2006. In section 931 of the National Defense Authorization Act for Fiscal Year 2006, Congress described OSINT as intelligence "produced from publicly available information" and disseminated "for the purpose of addressing a specific intelligence requirement."
- May 2016. The International Consortium of Investigative Journalists (ICIJ) added the Panama Papers data to its public Offshore Leaks Database.
- 30 September 2026. A final report from AMLA, the EU's anti money laundering authority, named "a reliable independent open source" for identifying low risk owners.
The US intelligence community's OSINT Strategy 2024 to 2026 (8 March 2024) adds "commercially available" information, so bought data can count. Information becomes intelligence when it answers a question. A registry page is information; a dated note on who controls a company, written for an onboarding decision, is OSINT. In AML and fraud work you meet it first as adverse media screening.
What does an OSINT check find that a registry extract does not?
Picture a trading company (illustrative) applying for an account at an EU payment firm. Its registry extract shows one local director and no owner at 25 percent or more. Three open sources change the file:
- A court judgment in which a foreign businessman signed a contract for the company.
- An archived copy of its website that names him as founder.
- An Offshore Leaks record that ties him to its shareholder company.
The EU AML Regulation, applying from 10 July 2027, lets a firm verify a beneficial owner through "other reliable sources, including public registers other than the central registers" (Article 22(7)(b)), with the central register consulted as well.
Tracing that chain is KYB and UBO verification. The leak record is only a lead. ICIJ says inclusion in its database "is not intended to suggest or imply" illegal or improper conduct.
For banks, the European Banking Authority's guidelines on ML/TF risk factors list "open source or adverse media searches" among enhanced due diligence measures (guideline 9.13). Outside AML, intelligence agencies, investigative journalists, security teams and human rights investigators use the same method.
Which open sources does an AML or fraud analyst use?
The Berkeley Protocol of the UN human rights office and UC Berkeley calls information open source when any member of the public can observe, purchase or request it (para 14). Common sources of OSINT in an AML or fraud file:
- Registers. Officers and owners; AMLA's report adds residence, tax and property registers (Article 10).
- Courts, gazettes and enforcement notices. Judgments, insolvencies, fines, license withdrawals, disqualified directors.
- News. The EBA names "reports in reputable newspapers" (guideline 1.31).
- Archived websites. What the company claimed before a change.
- Leak databases. The Offshore Leaks Database holds more than 810,000 offshore entities, with links to people and companies in more than 200 countries and territories.
- Social and professional profiles. Whether the career a customer claims leaves any digital trace.
- Maps. Whether an address is an office, a house or a mail drop.
AMLA's Article 8 weighs each source on five points: credibility, official status and independence, how current it is, accuracy or consistency with other sources, and how easily it can be forged.
What is the OSINT Framework?
The OSINT Framework is a directory of mostly free OSINT tools, sorted into categories and open to suggestions from the community, built "with an information security point of view". In security work the point is to see what attackers see: MITRE ATT&CK lists open websites and technical databases among their sources on a target's infrastructure, staff and credentials.
For an AML file the Framework shows where to look; the table below is the method. Choose the source type first, the tool second.
How is an OSINT check done and recorded?
Table 1. Best practices for an OSINT check in an AML file, stage by stage.
| Stage | What is done | What the file keeps | Who decides |
|---|---|---|---|
| 1. Define the objective | Write the question: who owns and controls the company? | The question and the risk reason behind it | Analyst, with the case owner |
| 2. Select the sources | List the source types, name spellings and identifiers to run | The dated search plan | Analyst |
| 3. Capture | Save every page the decision may rest on | URL, date and time, full page capture and HTML source (Berkeley Protocol, para 155) | Analyst |
| 4. Analyze findings | Confirm each fact with a second independent source; a leak record alone never decides | Which source confirmed which fact | Analyst, checked by a reviewer |
| 5. Correlate information for reporting | Write what was found, its source tier and what it changes | The decision, who made it, any suspicious activity report | MLRO or approver |
In complead, formerly Sanction Scanner, adverse media monitoring keeps each story's original text, translation, source tier and capture date together. An AI model classifies it by offense, role and severity with its reasoning shown; your relevance policy decides what counts.
The same AML Regulation lets a firm keep a reference instead of a copy only where the information "cannot be modified or altered" (Article 77(2)). A news page, company website or social post can be edited or deleted the day after the check. So the file keeps the captured page beside the URL.
For internal work a screenshot or PDF may be enough; potential evidence may need a sounder capture (Berkeley Protocol, para 153). The file stays five years after the relationship ends (Article 77(3)), the floor FATF Recommendation 11 also sets.
How is OSINT different from HUMINT, SIGINT, IMINT and MASINT?
The alternatives to OSINT are the other collection disciplines, each named for its source on ODNI's archived What is Intelligence? page:
- HUMINT (human intelligence). Human sources; most of it is collected overtly, for example by debriefers and military attachés.
- SIGINT (signals intelligence). Intercepted communications and electronic signals.
- IMINT (imagery intelligence). Photography, radar and electro optical images.
- MASINT (measurement and signature intelligence). Physical attributes of targets and events, measured to identify them.
- OSINT. Publicly available information, commercial databases included.
An intelligence product rests on a single source type or on all of them (all source). A firm's own KYC file and transactions are not OSINT; banks may also commission a third party intelligence report (EBA guideline 9.13).
Is OSINT legal, and where does it stop?
Public is not the same as free to use. In the EU, the GDPR applies to personal data processed under the AML Regulation (recital 150). An obliged entity can rely on Article 6(1)(c) of the GDPR, processing "necessary for compliance with a legal obligation". Article 14 requires telling people about data obtained elsewhere; Article 14(5)(c) lifts that duty where law expressly lays down the collection. California's CCPA sets its own consumer rights.
Three limits apply to the businessman's file. Collect only what the check needs (Article 5(1)(c)): the post naming him founder goes in, his family photos stay out. Delete it once those five years pass. And keep to platform terms, which scraping or a virtual identity breaches (Berkeley Protocol, para 65).
Names cause the other challenges: ICIJ warns that many people share similar names and asks users to confirm identities by address or other identifiers.
What changed in 2026
AMLA's final report on the customer due diligence standards of 30 September 2026 lets a low risk owner be identified from "a reliable independent open source" and verified through a different listed source (Article 19(1)(d) and (2)). The standards "will be submitted to the European Commission for adoption". The Regulation, Article 77 included, applies to most obliged entities from 10 July 2027.
For one high risk file, before the week is out:
- Write its search plan: question, source types, name spellings.
- Capture every page its decision rests on, with URL, date and time.
- Check that the privacy notice states the lawful basis and the deletion date for open source data.
Related terms
- Enhanced due diligence. Extra checks for higher risk customers; open source searches are among the measures the EBA lists.
- Ongoing monitoring. Reviewing a customer's activity and file for as long as the relationship lasts.
- Synthetic identity fraud. Fraud with an identity assembled from real and invented details.
- Ultimate beneficial owner. The natural person who in the end owns or controls a customer.
- Customer due diligence. The standard checks on who a customer is and what the relationship is for.
- Know your supplier. Due diligence on suppliers and the risks they bring into a firm.
How this entry was checked. Barbaros Sercan, Customer Success Specialist at complead, wrote it. Fact checked by: Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, 28 October 2026. Last reviewed: 28 October 2026. Its OSINT definition follows the words Congress chose in 2006, and every legal line was read on 28 October 2026 in the act or report itself: NDAA 2006 section 931, the IC OSINT Strategy 2024 to 2026, ODNI's What is Intelligence? page, AMLR Articles 22 and 77, AMLA's final report of 30 September 2026, EBA/GL/2021/02, GDPR Articles 5, 6 and 14, FATF Recommendation 11, ICIJ's Offshore Leaks pages, MITRE ATT&CK and the Berkeley Protocol.
