The Due Diligence Gap: Why Screening Misses Online Risks

26^th Sep 2026 By Fivecast Insights

From court filings to regulatory notices, enforcement actions and adverse media coverage, risks once left paper trails. Static database screening was built around that reality. Analysts were tasked with checking the lists, reviewing the registers, and monitoring media before documenting the outcome.

That traditional model was effective, until it wasn’t.

Today, the earliest and often the only signal of risk is online behavior. A prospective distributor whose directors are openly promoting a sanctioned entity’s products. A claimant whose public activity contradicts the injury on file. A candidate for a sensitive role whose affiliations are visible to anyone who looks. None of it appears on a sanctions list. None of it appears in a Politically Exposed Person (PEP) register, nor will it be reported as adverse media. It sits in plain sight, in the one place traditional screening was never designed to look.

Sanctions lists, PEP registers, and adverse media only reflect risk after it has been documented, reported, or made public. That delay is the due diligence intelligence gap, and it forces the teams accountable for risk detection to make confident decisions using tools that can’t see online threat signals.

WHERE THE GAP HURTS MOST

The intelligence gap can look different from sector to sector.

• Anti-financial crime. Alert queues are dominated by name-match false positives, so analysts clear noise instead of investigating substance. The actors who present real risk understand exactly how list-based screening works and stay off it, using nominee directors, proxy ownership, and layered structures that only become visible through behavior. When enhanced due diligence is triggered, it means a manual hunt across a dozen disconnected sources with no consistent method and no defensible audit trail at the end of it.
• Insurance. Underwriting and claims decisions rest on self-declared information, and traditional verification confirms only that the paperwork is internally consistent. Organized claim fraud, staged incidents, and undisclosed activity all leave digital residue that sits outside every database an insurer subscribes to. Investigation is treated as a specialist escalation rather than a routine screening layer, so the cases most worth examining are often the ones that never get referred.
• Corporate security. One team carries pre-employment and pre-clearance vetting, insider threat, executive protection, third-party and supplier risk, and M&A counterparty checks. The threats that matter most here are behavioral and pre-criminal by definition: grievance, radicalization, intent to harm, and affiliation with violent extremist groups. A person planning something has no criminal record yet, so traditional screening clears them cleanly and the organization learns the truth after the fact.
• Due diligence providers. Enhanced due diligence reports are still assembled largely by hand, which caps how many can be delivered, how fast, and at what margin, and makes quality a function of which analyst ran the file. Clients now expect digital footprint coverage as standard rather than as a premium add-on, and expect it against tighter turnaround commitments. Adding headcount is the only lever most providers have, and it is the wrong one.
• Designated non-financial businesses and professions (DNFBPs). Lawyers, conveyancers, accountants, real estate professionals, and dealers in precious metals and stones are entering AML/CTF regimes for the first time, with no compliance function to build on, no dedicated analysts, and no budget for an enterprise screening stack. They need customer due diligence that is proportionate, repeatable, and audit-ready from day one, in a form a practice manager can actually operate. The obligation is identical to that of a major bank. The resources are not.

REGULATORY TRENDS PUT PRESSURE ON ANALYSTS.

Meanwhile, regulatory standards across regions are evolving rapidly. Analysts are responsible for delivering the same or better investigatory outcomes despite reduced access to traditional screening data.

UNITED STATES

In August 2026, FinCEN issued a final rule permanently removing the requirement for US companies and US persons to report beneficial ownership information under the Corporate Transparency Act, and announced it will delete previously reported information for newly exempt US persons from the beneficial ownership database.

However, the obligations on financial institutions have not softened. Analysts are still expected to identify who is really behind a customer or counterparty. Conclusions still must be based on defensible evidence.

What has changed is that a data source many programs had begun to design around is narrowing. The outcome requirement stays the same, so the burden shifts to sources analysts can still reach, making online intelligence materially more important to compliant risk detection.

EUROPE

The EU has moved in the opposite direction. The Anti-Money Laundering Authority (AMLA) has been operational in Frankfurt since July 2025, and the single AML Rulebook, Regulation (EU) 2024/1624, applies directly across all 27 member states from 10 July 2027, alongside the Sixth Anti-Money Laundering Directive. The package widens the definition of obliged entities to include crypto-asset service providers, crowdfunding platforms, traders in high-value goods, and professional football clubs and agents, sets a beneficial ownership threshold at 25% or more, and brings the highest-risk cross-border entities under direct AMLA supervision.

AMLA is issuing the technical standards and guidelines that will define what adequate looks like in practice. Firms have one preparation cycle to stand up customer due diligence and ongoing monitoring that can withstand a harmonized, supranational supervisor rather than a familiar national one.

AUSTRALIA

Tranche 2 of Australia’s AML/CTF reforms commenced on 1 July 2026, bringing DNFBPs under AUSTRAC supervision for the first time. Roughly 90,000 new entities now must enroll, assess their money laundering and terrorism financing risk, operate a compliant AML/CTF program, perform customer due diligence, report suspicious matters, and keep defensible records. For most, this is a compliance function being built from nothing, subject to real regulatory scrutiny, on a live clock.

CLOSING THE INTELLIGENCE GAP

The answer is not to replace traditional screening. Sanctions lists, PEP registers, and adverse media remain essential, even as regulatory expectations evolve.

The answer is to bring online intelligence into the due diligence process, so screening reflects real-time online behavior and not just static records. One workflow, one subject, one risk picture: the documented record and the digital footprint assessed together, with consistent risk detection applied across both and a full audit trail behind the result.

That approach enables compelling advantages:

• Anti-financial crime: fewer false positives to clear, enhanced due diligence that runs in minutes rather than days, and behavioral evidence to support or dismiss an alert that list-matching alone cannot resolve.
• Insurance: verification of what an applicant or claimant has declared, with digital footprint screening applied as a routine layer at underwriting and at claim rather than as a specialist escalation.
• Corporate security: visibility of pre-criminal and behavioral risk across vetting, insider threat, and supplier due diligence, applied consistently so outcomes do not depend on which analyst ran the check.
• Due diligence providers: enhanced due diligence delivered at a fraction of the manual effort, with consistent quality, faster turnaround, and digital footprint coverage offered as standard.
• DNFBPs: a proportionate, repeatable customer due diligence process with audit-ready reporting, without hiring an analyst team or building a compliance function from scratch.

RISKS NO LONGER SIT SOLELY IN STATIC DATABASES.

They emerge and evolve online far too fast for static registers to keep up.

The teams responsible for compliance, financial crime and fraud, security, hiring, procurement, and due diligence all face the same challenge. Regardless of sector or regulator, they must make confident decisions with an incomplete picture of risk.

Fivecast engineers are building a solution for that challenge. It will the close the gap between traditional screening and online intelligence, rather than trying to supplant the vetting tools that teams already trust. Register for an exclusive look to see how that replaces days of vetting with insight in minutes.

Frequently asked questions

Why is traditional screening not enough for due diligence?
Traditional screening is not enough for due diligence because sanctions lists, PEP registers, and adverse media reflect risk only once it has been documented, reported, or made public. That leaves a gap between the moment risk becomes visible online and the moment it reaches a database. A supplier whose directors openly promote a sanctioned entity’s products may never trigger a screening alert, even though it should influence the decision.

What is digital footprint screening?
Digital footprint screening is the assessment of a subject’s publicly available online activity and presence as part of the due diligence process, alongside traditional record checks. It surfaces behavioral risk indicators that exist in the open but never reach a list, a register, or a news article, including affiliations, stated intent, network associations, and activity that contradicts what a subject has declared.

Does digital footprint screening replace sanctions and PEP screening?
Digital footprint screening does not replace sanctions, PEP, and adverse media screening, which remain regulatory requirements in most jurisdictions. It adds the intelligence layer those sources cannot see, so the two produce a single risk picture together rather than one substituting for the other.

How does the end of FinCEN beneficial ownership reporting affect due diligence?
The end of FinCEN beneficial ownership reporting does not reduce a firm’s obligation to identify who controls a customer or counterparty, but it narrows a data source many programs had begun to design around. In August 2026, FinCEN issued a final rule permanently removing beneficial ownership reporting for US companies and US persons under the Corporate Transparency Act, and will delete previously reported information for newly exempt US persons. Foreign reporting companies must still report beneficial ownership for foreign individuals.

When does the EU single AML Rulebook take effect?
The EU single AML Rulebook, Regulation (EU) 2024/1624, applies directly across all 27 member states from 10 July 2027, alongside the Sixth Anti-Money Laundering Directive. The Anti-Money Laundering Authority (AMLA) has been operational in Frankfurt since July 2025 and is issuing the technical standards that will define adequate customer due diligence in practice. The package widens obliged entities to include crypto-asset service providers, crowdfunding platforms, and traders in high-value goods.

What do Tranche 2 businesses need for customer due diligence in Australia?
Tranche 2 businesses in Australia need customer due diligence that is proportionate to their risk, repeatable across every client, and documented well enough to evidence to AUSTRAC on request. Tranche 2 of Australia’s AML/CTF reforms commenced on 1 July 2026, bringing lawyers, conveyancers, accountants, real estate professionals, and dealers in precious metals and stones under supervision for the first time, with roughly 90,000 entities newly in scope.

About Fivecast

Fivecast delivers open-source intelligence solutions built for clarity, powered by AI, and trusted to surface what matters. Engineered to solve complex intelligence challenges, our platform cuts through digital noise across the surface, deep web, and dark web to help those protecting nations, borders, businesses, and communities uncover critical insights before risk becomes reality.

Trusted by agencies and enterprises across national security, law enforcement, defense, corporate security, and financial crime, Fivecast was born from collaboration between government and research institutions. Headquartered in Australia with a global footprint, we support the world’s most critical missions.

Fivecast. Engineered for Intelligence.