Regulatory Enforcement Due Diligence: A Guide
There's a difference between hearing that a company was investigated and confirming that it was fined. Adverse media surfaces the former; regulatory enforcement diligence confirms the latter. It's the "regulatory rap sheet" — the official actions, penalties and consent orders a company has actually been hit with — and it's some of the hardest evidence you can put in front of a deal team.
Enforcement outcomes, not allegations
The distinction matters because an enforcement action is an adjudicated or settled fact, recorded by a government body, with a docket or press release you can cite. Fines, disgorgement, consent orders, cease-and-desist orders, debarments, criminal resolutions — these are outcomes. They carry a weight that a news allegation never can, and they often come with a dollar figure and an admission (or a pointed non-denial).
The U.S. alphabet soup
In the United States, enforcement is spread across agencies by domain: the SEC for securities, the CFTC for derivatives, the FTC for consumer protection and antitrust, the CFPB for consumer finance, the DOJ for criminal and major civil matters, the EPA for environmental violations, and OSHA and the Labor Department for workplace and wage issues. Each publishes its actions, and a thorough check means looking across all of them rather than assuming one covers the field.
Don't stop at the U.S. border
A multinational's most significant enforcement exposure is often abroad. The European Commission's competition arm levies some of the largest antitrust and cartel fines in the world; the UK's FCA and CMA, Japan's JFTC and FSA, China's CSRC and market regulator, Australia's ASIC and ACCC, Canada's securities and competition authorities, Korea's fair-trade and financial regulators, and Hong Kong's SFC all maintain their own enforcement records. If a company operates in those markets, its record there is part of the picture.
Always confirm at the source
Enforcement screening, like sanctions screening, is name-based until proven otherwise. The value of a first-pass sweep is that it points you to the right regulator and the right matter — but before you rely on any hit, open the regulator's own register and confirm it's the same party and the action you think it is. The primary record is the only thing worth relying on.
Coverage and caveats
No single tool sees every action in every jurisdiction — coverage is strongest for U.S. federal regulators and the largest international authorities, and thinner at the state and local level and in smaller markets. Treat an automated sweep as a fast way to find the threads worth pulling, then verify each at the regulator's own source. This is general information, not legal advice.