<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-financial-records
description: >-
  Trace financial flows through public corporate filings, property records,
  court documents, and beneficial ownership registries. Identify shell companies,
  money laundering patterns, and illicit financial networks.
domain: cybersecurity
subdomain: investigation-attribution
tags:
  - financial-investigation
  - money-laundering
  - corporate-filings
  - beneficial-ownership
  - osint
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1583"]
---

# Analyzing Financial Records

## Overview

Financial record analysis traces money flows through public records to identify
beneficial ownership, shell company networks, and illicit financial activity.
Uses company registries, court filings, property records, and leaked financial
databases as primary sources.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling |
| requests | `pip install requests` |
| OpenCorporates API key | Optional, for higher rate limits |

## Key Concepts

### Public Financial Data Sources

| Source | Data Type |
|---|---|
| **OpenCorporates** | Company registrations, officers, filings |
| **SEC EDGAR** | US public company filings (10-K, 10-Q, 8-K) |
| **Companies House** | UK company data and accounts |
| **ICIJ Offshore Leaks** | Panama Papers, Paradise Papers datasets |
| **Court records** | PACER (US), BAILII (UK) litigation records |
| **Property records** | County assessor databases, land registries |

### Red Flags for Financial Investigation

```
- Circular ownership structures (Company A owns B owns C owns A)
- Nominee directors appearing across multiple entities
- Registered agent addresses shared by hundreds of companies
- Frequent name changes or jurisdiction changes
- Dormant companies suddenly activated for large transactions
- Mismatched revenue/employee ratios
```

## Quick Reference

```bash
# Look up company
node agent.js company-lookup --name "Acme Holdings" --jurisdiction gb

# Search SEC filings
node agent.js sec-search --company "Acme Corp" --filing-type 10-K

# Map corporate network
node agent.js corporate-network --company-id oc-123456 --depth 2

# Check ICIJ Offshore Leaks
node agent.js offshore-check --name "John Smith"
```

## Workflow

```
1. IDENTIFY   — Target entity or individual
2. ENUMERATE  — Discover all associated companies and directorships
3. MAP        — Build corporate ownership graph
4. TRACE      — Follow financial flows through entity chain
5. FLAG       — Identify red flags and anomalous patterns
6. CORROBORATE — Cross-reference with independent sources
7. DOCUMENT   — Produce financial analysis report
```

## Detection

```yaml
title: Financial Records Detection
id: 218f7804-622d-42a6-953e-d56f5b170708
status: experimental
description: Detects suspicious activity related to analyzing financial records techniques in investigation attribution context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1583
  - attack.command_and_control
falsepositives:
  - Threat intelligence enrichment services querying external APIs
```

## Verification

```bash
python3 -c "import requests; print('requests OK')"
node agent.js --self-test
```

## References

- [OpenCorporates API](https://api.opencorporates.com/)
- [SEC EDGAR Full-Text Search](https://efts.sec.gov/LATEST/search-index?q=)
- [ICIJ Offshore Leaks Database](https://offshoreleaks.icij.org/)
- [Companies House API](https://developer.company-information.service.gov.uk/)
