Counterparty verification checklist for commodity trade

What to cross-check before you wire a deposit — and why the tell is almost never inside any single document.

Three times in the past year a counterparty has approached our desk with a clean website, complete documentation and someone else’s corporate identity. One of them was carrying the address of a real Dutch shipping company. The paperwork was in order. It cleared our first-pass compliance.

We found out because the real company told us, two weeks later.

This page is the checklist we use now. It is not a compliance framework and it does not replace your KYC obligations or your lawyer. It is the practical set of cross-checks that catches the impersonators, written down so that the next person does not have to learn it the way we did.

The principle: read across, not down

Most verification failures happen because people read documents individually. Each document is checked for internal correctness — is the CPA properly formed, does the Q88 have the right fields — and each one passes.

Fraudulent packs are built to survive exactly that. The forger’s job is to make every document look right on its own. What they consistently fail to do is make the documents agree with each other, because that requires maintaining a consistent fiction across six or seven files produced at different times.

The tell is almost never in any single document. It is in what fails to reconcile across the set.

The eight cross-checks

1. Entity continuity

List every legal entity named anywhere in the pack — seller, mandate, shipper, charterer, inspection company, bank, escrow agent. Then ask which of them appear in only one document.

A genuine deal has entities that recur. The charterer on the CPA appears on the Q88. The seller on the SCO appears on the invoice. An entity that surfaces once, in one document, and is never mentioned again is the single most reliable red flag in the set.

2. Registration number against jurisdiction

Company registration numbers have jurisdiction-specific formats. An Australian ACN is nine digits. A UK company number is eight characters. A Dutch KvK number is eight digits. A registration number whose shape does not match the country it claims is either a typo or a fabrication, and it takes thirty seconds to check.

Then take the actual number to the actual registry. Not to a search engine — to the registry. ASIC, Companies House, KvK, whichever applies. Confirm the name on the register matches the name on the letterhead exactly, including the entity suffix.

3. Dates against the vessel

Cross-check every date in the pack against the shipping schedule. An inspection certificate issued before the vessel berthed. A bill of lading dated before the cargo was loaded. A company registration certificate dated after the contract it supposedly supports.

Date impossibilities are common in fabricated packs because the forger assembles documents in the order that is convenient, not in the order events would actually occur.

4. Procedure drift

This is the one that costs the most money. Take the written procedure you agreed at the start — the payment terms, the instrument, the sequence — and compare it line by line against what is being asked for now.

The pattern to watch for: conditions that appear after you have committed something irreversible. A vessel sailing. A deposit lodged. An instrument opened. If new requirements arrive only once you cannot easily walk away, the sequencing itself is the signal, regardless of how reasonable each individual request sounds.

5. Contactability, independently established

Do not use the contact details in the pack. Find the company independently — registry filing, industry directory, port authority listing — and use those details to confirm the person you are dealing with works there and is authorised to bind the company.

Impersonation frauds work by inserting themselves between you and a real, reputable company. The real company usually has no idea. Every detail in the pack routes back to the impersonator; the only way out of that loop is to leave the pack entirely.

6. Inspection certificate provenance

An SGS, Bureau Veritas, Intertek or Cotecna certificate is only worth what its provenance is worth. Certificate numbers can be verified with the issuing office. If the certificate is presented as a scan or a PDF with no verifiable reference, treat it as an unsupported claim rather than as evidence.

7. Banking coherence

Does the beneficiary name on the payment instructions match the contracting entity exactly? Is the bank in a jurisdiction that makes sense for the trade route? Payment instructions to a third-party entity, or to a country unrelated to either counterparty or cargo, need an explanation that holds up.

8. The pressure test

Ask for something that requires the counterparty to be real: a video call with the named signatory, a visit to the shore tank, a call to the registered office number you found independently. Genuine counterparties find this mildly tedious. Fraudulent ones produce reasons.

Which signals actually matter

Signal	Weight	Why
Entity appears once and never again	High	Hardest thing to fake consistently
Conditions added after you are committed	High	Sequencing reveals intent
Registration number fails registry check	High	Objective and verifiable
Refusal of a face-to-face or site visit	High	Real parties tolerate friction
Date impossible against vessel schedule	Medium	Sometimes genuine clerical error
Beneficiary name mismatch	Medium	Occasionally legitimate group structure
Poor English or formatting	Low	Weak signal — this is an international business
Urgency	Low	Real deals are urgent too

The last two are worth stating plainly because they are the ones people over-weight. Bad grammar and time pressure are normal in cross-border trade. Neither is evidence of anything on its own.

If something does not reconcile

1. Do not confront the counterparty first. If they are impersonating someone, telling them what you found simply improves the next version of the pack.
2. Contact the impersonated party directly, through details you established independently. In our case the real shipping company confirmed the misuse within a day.
3. Report it. The ICC International Maritime Bureau (icc-ccs.org) takes counterparty verification requests and maintains records that help the next target.
4. Stop the money before you stop the conversation. Payment instructions are the thing to freeze first.

Doing this faster

Worked properly, this checklist takes an afternoon per counterparty. That is the honest number, and it is why most desks do an abbreviated version and hope.

We built Gideon to do the reading part. You give it the full pack and it reports what does not reconcile across the documents — entities appearing once, registration numbers that do not match their claimed jurisdiction, dates that conflict with the shipping schedule, terms that changed between the agreed procedure and the invoice.

It does not clear anyone and it does not certify anything. Steps 2, 5, 6 and 8 above still require a human doing independent verification, and no software changes that. What it does is compress the cross-document reading from an afternoon to about ninety seconds, and tell you which three things to check yourself.

Nothing on this page is legal, financial or compliance advice. It is an operational checklist based on our own experience, and it does not replace your own due diligence obligations or professional advice.