A proper crypto due diligence report should cover the following factors about a project: identity and ownership, legal status, business model, tech, tokenomics, finances, management, security, on-chain activity, reputation, and lawsuits. They are useful for identifying inconsistencies, but a report cannot assure that a project is legitimate and safe.
The scope will depend on what the review is intended for. An investor evaluating a token needs different depth than a business onboarding an exchange as a partner. But a thorough report generally evaluates identity, ownership, management, business model, legal structure, regulatory position, technology, tokenomics, financials, security, reputation, litigation history, and overall risk factors.
Reviewing only a website or whitepaper isn’t sufficient. Marketing materials are written to persuade, not disclose risk. A website can list fabricated team members, and a “regulated” claim can be technically true but misleading. Genuine due diligence cross-references self-published claims against independent sources.
1. Company and Project Identity
Before assessing anything else, a report should establish who is actually behind the project: legal company name, trading name, jurisdiction, incorporation date, registered address, company registration number, related entities, official website, and domain details.
Confirming the legal entity matters because many projects operate through layered or offshore structures with no clear accountable party. That said, a registered company shouldn’t automatically be treated as legitimate — incorporation confirms existence, not conduct.
2. Ownership, Founders, and Management
How do you verify a crypto company?
Check whether people presented as founders and executives can be independently confirmed — their roles, professional history, and beneficial ownership where legally accessible. Claims made on a project’s own team page shouldn’t be taken at face value; verification should rely on independent, lawful sources such as how to verify a crypto company resources rather than social media alone.
3. Business Model and Purpose
What does the project actually do?
Examine its stated purpose, products, target users, revenue model, partnerships, geographic markets, and competitive position — then compare those claims against observable evidence like live products and actual transaction activity, rather than the pitch itself.
4. Legal and Regulatory Information
Depending on the project, examine jurisdiction, corporate structure, licenses, regulatory status, warnings, enforcement actions, litigation, and risk disclosures.
A project shouldn’t be called “regulated” simply because it names a regulator. License numbers can be fabricated or unrelated to the activity offered, so claims should be verified directly with the official authority — checking against published crypto regulatory warnings is a useful starting point.
5. Token and Tokenomics Analysis
What should I look for in tokenomics?
Examine total and circulating supply, distribution, founder/investor allocations, vesting and unlock schedules, utility, holder concentration, liquidity, and major wallet holdings where public.
Heavy concentration in a few wallets or unlock cliffs shortly after launch are relevant risk factors — but no single metric proves a token unsafe; it should be weighed alongside everything else.
6. Blockchain and Technology Review
This may cover the underlying network, smart contracts, contract addresses, open-source repositories, development activity, prior audits, protocol architecture, dependencies, and admin/upgrade controls. Depth depends on the project — a simple token needs far less scrutiny than a novel protocol. A basic documentation review is not the same as a formal security audit.
7. Smart Contract & Security Information
Check whether there is an audit has been done and by whom, when it was done, what it revealed, and if there are any outstanding problems. Admin privileges, upgrade options, multi-signature capabilities, custody information, and any hacks or exploits done in the past are also relevant. It’s important to know that the presence of an audit doesn’t imply safety at all.
8. Financial & Funding Information
If possible, collect data regarding previous rounds of funding, investors, treasuries, revenue details, finances, and token sales’ terms. Private cryptocurrency businesses provide much less information than their public counterparts.
9. Wallets and On-Chain Activity
Blockchain data adds an evidentiary layer that self-reported information can’t. This may include known project wallets, contract activity, holding concentration, exchange transfers, and related addresses. The on-chain analysis provides useful patterns but cannot independently reveal the wallet owner; usually, more detailed investigations use cryptocurrency asset tracing techniques.
10. Reputation and Online Presence
Check the websites, social media, news articles, industry forums, and complaints; however, distinguish an anonymous negative comment from the factual evidence of wrongdoing. Anonymous accusations are not equal to factual evidence.
11. Regulatory Warnings, Litigation, and Enforcement
How do I look for regulatory warnings? It is advisable to go through the regulator and relevant legal materials, but the website offered by FintechLegals to look for crypto regulatory warnings could be useful.
12. Domain and Website Investigation
The domain name owner, website details, etc., may give some additional information, but in themselves cannot prove that one controls the website. See how to investigate an anonymous website or domain for further information.
13. Red Flags and Risk Factors
What are some of the important warning signs? Team members who cannot be verified, false representations in relation to regulatory requirements, ownership issues, guaranteed returns with no backing, concentration, poor record keeping, security lapses, and conflicting information.
A single red flag doesn’t prove fraud — it signals a need for further investigation. Multiple unrelated red flags together are more meaningful and may warrant escalation through formal fraud investigations.
What Does a Professional Report Look Like?
A well-organized report typically includes an executive summary, scope and methodology, entity identification, ownership/management findings, business model review, legal/regulatory review, tokenomics, technology/security review, financial information, on-chain analysis, reputation analysis, litigation findings, key risks, sources, and overall findings. A numerical “score” should only appear when clearly labelled as methodology, not fact.
Due Diligence vs. Investigation
Due diligence is forward-looking — assessing risk before or during a relationship. A crypto investigation is typically reactive, focused on a specific incident, fraud, or asset movement that already occurred. The two often overlap.
When Should You Conduct It?
Before investing, entering a partnership, acquiring a digital asset business, relying on a service provider, or when inconsistencies or structural changes appear. Due diligence reduces information gaps — it doesn’t eliminate risk.
Conclusion
A strong crypto due diligence report looks beyond marketing and evaluates identity, ownership, business model, regulatory position, tokenomics, technology, financials, on-chain activity, reputation, and risk. Scope depends on the project and purpose. FintechLegals’ due diligence services support this kind of evidence-led review — without guaranteeing outcomes.
FAQ
What should a crypto due diligence report include? Company identity, ownership, legal/regulatory status, business model, tokenomics, technology, financials, on-chain activity, reputation, and litigation history — scope varies by purpose, and no report guarantees legitimacy.
What is crypto due diligence? The process of verification of information related to the crypto firm/project as part of due diligence before investments and conducting business.
What is due diligence on a crypto project? The verification of the legal entity, independent verification of management, testing of the business model with evidence, verification of regulatory claims with regulators, analysis of tokenomics and blockchain and source documentation.
What must I do before investing? Confirm the legal structure and management, verify regulatory claims by contacting the regulator directly, examine tokenomics for concentration risks, look for security vulnerabilities and regulatory warnings/active litigation.
How can I verify a crypto firm? Verify the legal registration, independent verification of founder(s)/executive(s) backgrounds, verification of regulatory status with the regulator and comparison of claims and facts.
What should a due diligence checklist contain? Legal entities, ownership/management structure, business model, regulation, token economics, technology/audit trail, finances, blockchain transactions, reputation, and regulatory warnings.
Should token economics be part of it? Yes, because token economics such as supply and distribution affect the stability of price and level of insider control regardless of project objective.
Should blockchain transactions be included? Yes, where appropriate. Blockchain transactions either confirm or refute claims, but must be considered together with other evidence, not as the ultimate proof.
How can I check for regulatory warnings? Check directly with regulators in claimed operating jurisdictions, most of which publish public warning lists, plus relevant court records.
Red flags include what? Team members that cannot be verified, unsubstantiated regulatory claims, heavy concentration, undisclosed unlocks, unproven return guarantees, and discrepancies between claims and evidence.
Due diligence versus investigation? Due diligence is the risk assessment that comes before a relationship begins or continues. Investigation comes later and in response to a particular problem.
Can due diligence guarantee safety? No. It reduces information gaps and surfaces risk but can’t eliminate market or technological risk, or account for information that emerges later.
For more updates, follow us on LinkedIn.
Leave a Reply