Home › Guides › SEC filings & entity identity
SEC filings, enforcement and the LEI: identity, numbers and risk
Three public systems answer three different questions about a company: EDGAR tells you the numbers, SEC enforcement releases tell you the trouble, and the LEI system tells you who the entity actually is and who owns it. All three are free, machine-readable, and underused outside finance.
EDGAR: the primary source everyone else resells
Every US-listed company files its mandatory disclosures into EDGAR: annual and quarterly reports, current reports on material events, insider transactions, registration statements. It is complete, timestamped and public the moment it is filed.
Most financial data products are, at bottom, EDGAR repackaged with a nicer interface. Going to the source has two advantages: you see filings the moment they land rather than after a vendor's processing lag, and you get the full document rather than the fields someone else decided to extract.
The identifier is the CIK — the SEC's central index key. Like every good identifier it is stable through name changes, which company names are not.
Enforcement: risk that arrives in public first
The SEC publishes litigation releases, administrative proceedings and accounting-and-auditing enforcement releases as they happen. Monitored systematically, these are a genuine early-warning layer:
- Counterparty risk — enforcement against a customer or supplier is material, and it is public before it reaches most commercial risk databases.
- Portfolio monitoring — for investors, an action against a holding is immediately relevant.
- Sector patterns — clusters of enforcement in one practice area signal where regulatory attention is moving, which matters if you operate there.
The LEI: the closest thing to a global company ID
The Legal Entity Identifier is a 20-character code for a legal entity participating in financial transactions, maintained by GLEIF and published openly across millions of entities worldwide.
Two properties make it uniquely useful:
- It is global. National company numbers work inside one jurisdiction; the LEI crosses them. A German subsidiary and its US parent both have LEIs from the same system.
- It records parents. GLEIF captures direct and ultimate parent relationships, which is the piece almost every national register omits — and exactly what you need to answer "who ultimately owns this counterparty".
GLEIF LEI identity & ownership →
Why name matching fails, and identifiers do not
Anyone who has tried to join two company datasets on name knows the failure modes: legal-form suffixes that appear inconsistently, transliteration differences, brand names that differ from registered names, and subsidiaries that share a parent's brand while being separate entities.
We measured this problem in a different context and the result was stark: cross-source name matching was wrong roughly 40% of the time. Identifiers solve it — and when a shared identifier is unavailable, a verified domain is a far better key than a name string.
| Scope | Identifier |
|---|---|
| Global financial entity | LEI |
| US public company | CIK |
| US federal contractor | UEI |
| Research organisation | ROR ID |
| Everything else | Verified web domain |
A worked risk-and-identity workflow
- Resolve the entity. Start from the name you have, find the LEI, and read the parent chain. You now know which legal entity you are actually dealing with.
- Pull the numbers. If it is US-listed, EDGAR has the filings. If not, the national register may carry accounts — see Nordic, Eastern European or Asia-Pacific registries.
- Check for trouble. Scan SEC enforcement for the entity and its parent.
- Confirm it trades. A national register confirms active status — the LEI tells you the entity exists, not that it is operating.
An LEI can lapse, and a lapsed LEI tells you something
One property of the LEI system is regularly missed and it is commercially useful: an LEI must be renewed. Registration is not permanent. Each record carries a registration status and a next-renewal date, and entities that stop renewing move to a lapsed state while remaining in the published data.
That gives you a signal no static identifier provides. An entity that let its LEI lapse has stopped doing the thing that required it — no longer transacting in regulated markets, or no longer operating at all. It is not proof of either, but as a flag on a counterparty list it earns its place, and it costs nothing because the status field is published alongside the identifier.
The same logic applies in reverse. A newly issued LEI on an entity you are assessing means it has just started transacting in markets that require one, which is a meaningful change of state for a company that previously did not.
Filing cadence as a signal in its own right
Most people read EDGAR for content — what a filing says. There is a second, cheaper layer: when filings arrive.
- Regular quarterly and annual filings, on time — the baseline. Unremarkable, and that is the point.
- A cluster of current reports on material events — something is happening. These are filed when a specific triggering event occurs, so a burst is a burst of events.
- A late filing notification — the company is telling the market it cannot file on schedule. That is rarely good news and it is public immediately.
- A registration statement — the company is raising capital or listing securities.
None of this requires reading a document. The metadata — form type and filing date, per CIK — is enough to build a monitoring layer, and it is the layer most teams skip because they assume the value is inside the PDF.
Frequently asked questions
What is EDGAR?
The SEC's filing system holding every mandatory US public-company disclosure. Public, machine-readable, and the source most data vendors resell.
What is an LEI?
A 20-character global identifier for legal entities in financial transactions, published openly by GLEIF — and it records parent relationships.
Where do I find SEC enforcement actions?
The SEC publishes litigation releases, administrative proceedings and AAER releases as they occur; tracked systematically they are an early risk signal.
How do I match companies across countries?
By identifier — LEI globally, national numbers within a jurisdiction, verified domain as the fallback. Name matching across borders fails often.