Shell company red flags: a 9-point checklist for business-account onboarding

When a business customer applies for an account, the registry tells you the company exists. It does not tell you whether the company does anything. That gap — between a legal entity and a trading business — is where shell companies live, and it is where most onboarding fraud and sanctions evasion starts.

A shell is not illegal in itself. Plenty of holding companies, SPVs and dormant entities are perfectly legitimate. The job at onboarding is not to reject every thin-looking company — it is to notice when several thin signals stack up, and to escalate before the account opens rather than after the first suspicious transaction.

Here are the nine signals worth a hard look.

1. Incorporation age measured in weeks

A company incorporated days before it applies for a business account is not disqualifying on its own — new businesses are real. But a fresh incorporation combined with a large expected transaction volume, an overseas owner, or an industry that normally takes months to set up is a classic layering pattern. Note the date; weigh it against the story.

2. Registered address shared with hundreds of others

Mass-registration addresses — formation-agent offices, virtual-office providers — are not inherently bad. But if the registered office is a known agent address and there is no separate trading address and no web presence, you have a company that exists only on paper.

3. Officer count that does not match the activity

A company claiming to run an import/export operation with a single director, no employees and no filed accounts is telling you something. So is the opposite: a tiny dormant entity with a sudden roster of newly appointed directors right before the account application.

4. Nominee or professional directors

A director who sits on dozens of unrelated companies, or whose name traces to a nominee-director service, obscures who actually controls the entity. The control question — who is the beneficial owner — is the one that matters, and a nominee is there specifically to make it harder to answer.

5. No web presence, or a domain younger than the company should be

A real trading company in 2026 leaves a digital footprint: a website, a domain registered around when it started trading, an email domain with valid MX records, a company page on LinkedIn. A company that claims five years of trading but whose domain was registered last month is misrepresenting something.

6. Declared activity that does not match the online footprint

The registry lists an activity code for "management consultancy". The website — if there is one — sells nutritional supplements. The mismatch is the signal. It usually means the entity was bought off the shelf and repurposed.

7. Beneficial owner in a high-risk or sanctioned-adjacent jurisdiction

Ownership that runs through a high-risk jurisdiction is not automatically a problem, but it raises the evidentiary bar. The harder version: a declared beneficial owner whose name is a close match to a sanctions or PEP list. Name proximity is not a hit — but it is a reason to verify identity properly before proceeding.

8. Rapid director churn

Directors appointed and resigned within months, repeatedly, is a pattern of an entity being passed around or prepared for use. The registry's filing history shows this if you read the timeline rather than the current snapshot.

9. Name reuse and recycled entities

Companies that change name shortly before applying, or whose previous name traces to a dissolved entity with adverse history, are trying to outrun their own record. Always check the former-name history, not just the current one.

How to use the checklist

No single signal here should reject an applicant. The discipline is corroboration: one weak signal is noise, three or four stacking up is a pattern that belongs in front of a human reviewer with the evidence attached.

That is exactly what Veritas automates. It pulls the company registry, sanctions and PEP lists, adverse media and per-director identity in parallel, scores the result against a versioned, FATF-aligned methodology, and produces a sourced dossier — every signal traced to the authority that issued it.

The clearest way to see it is the demo case: a synthetic UK company built to fire every signal on this list, including a beneficial owner who matches a real sanctions list. Open the RED demo dossier →