A court judgement for financial misconduct and an anonymous forum post can both mention the same applicant. Read at face value, they look like the same category of thing, something negative, attached to a name. They are not remotely the same finding, and treating them as though they were is where reputational risk assessment most often goes wrong.
Reputational risk assessment goes well beyond running an applicant's name through a search engine. It requires a structured approach to finding relevant information, and an equally structured approach to assessing what that information means. A thorough review covers adverse media, fraud and corruption allegations, financial misconduct, criminal investigations, regulatory enforcement, litigation, and business controversies across relevant languages and jurisdictions, not just the applicant's country of residence.
This is where most reputational risk processes stop: at the search. The harder, more valuable part is what comes next.
Reputational research should use a documented source hierarchy, distinguishing verified official records, credible investigative reporting, industry sources, unverified allegations, and content of uncertain provenance. Material findings should be corroborated where possible, assessed in context, and where appropriate put to the applicant or their authorised representative for clarification before a final risk recommendation is made.
Every finding, once located, should be assessed against a consistent set of criteria before it is given any weight at all.
Two variables do most of the work in determining how much a finding actually matters: how credible the source is, and how material the allegation is to financial crime or integrity risk. A historic, resolved litigation matter from a highly credible source carries limited weight. An unresolved, serious allegation from an anonymous or unverifiable source carries a different kind of risk entirely, not because it is necessarily true, but because it cannot yet be dismissed either.
The hardest cell in that grid is not the obvious one. A verified court judgment is straightforward to weigh. A vague, unattributed claim from an anonymous source is easy to dismiss. The genuinely difficult case is a serious claim from a source whose credibility cannot be established either way.
FATF's guidance treats adverse media search as part of enhanced due diligence, grounded in the same recommendations that require establishing source of wealth, source of funds, and beneficial ownership for higher-risk relationships. Reputational research is not a separate, softer check sitting alongside the harder financial verification; it is one of the same family of obligations.
For Citizenship by Investment (CBI) applicants specifically, this matters more than in a typical customer relationship. FATF and the OECD's own review of CBI and RBI programme misuse noted that cases of serious financial crime linked to CBI-issued citizenship have frequently come to light not through screening databases, but through investigative journalism, reporting that a database-only approach to reputational risk would never surface.
This is the reasoning behind treating reputational research as its own stage within the six-stage [due diligence](Internal link: Cedar Rose Due Diligence) framework: Identify, Verify, Screen, Investigate, Assess, Monitor, rather than folding it into screening as an afterthought.
A reputational risk file that lists every hit it found, without weighing credibility or materiality, is not analysis — it is an administrative record. The value of the process comes from what happens after the search: assessing each finding against a consistent set of criteria, distinguishing allegation from fact, and documenting the reasoning behind the conclusion reached. That documented reasoning is what allows a risk committee to explain and defend, the decision it made.
Reputational risk assessment fails less often at the search stage than at the analysis stage. A file that lists every adverse hit it found has completed the easy part. The work that actually protects a due diligence decision is weighing each finding by credibility and materiality, distinguishing allegation from verified fact, and documenting the reasoning — so that when a risk committee asks why an applicant was approved, escalated, or declined, the answer is in the file, not just the outcome.
For a structured framework covering reputational risk assessment, source hierarchy, and how findings should be weighed alongside PEP, sanctions, and Source of Wealth checks, see Cedar Rose's: Citizenship by Investment Due Diligence Guide