A rumor and a red flag look identical until someone checks

The Vetted Workplace

Real hiring mistakes. Real red flags. Real fixes.

A background check that can't tell you what it's actually confirmed, versus what it's merely heard, isn't giving you intelligence. It's giving you gossip with a letterhead.

The Regulatory Signal

Due diligence is quietly moving from "good practice" to "compliance requirement" in India. In October 2024, SEBI issued a circular mandating that Alternative Investment Funds, their managers, and key management personnel conduct specific due diligence on their investors and investments — explicitly to prevent regulatory circumvention around investor eligibility, stressed-asset rules, and cross-border investment scrutiny. AIFs now have to document and report this diligence to custodians, not just perform it informally.

This is worth paying attention to even if you're nowhere near AIF territory. Regulators tend to formalize a requirement once informal versions of it have already become industry best practice elsewhere — and once one part of the financial system is required to verify rigorously, the expectation tends to spread outward to boards, senior hires, and vendor relationships that once got by on referrals and good interviews.

The Line Between a Red Flag and a Rumor

Millow's founder and CEO, Karan Bhatty, made a point in a recent piece for CIO&Leader that's easy to miss and important to sit with: a genuinely rigorous due diligence report documents not only what's been verified, but also what couldn't be verified — allegations that surfaced during the process but never turned into a confirmed finding, like a claim about someone's management style with no documentary evidence or formal action behind it.

That distinction matters more than it sounds like it should. A report that blurs the line between "confirmed by court records" and "someone mentioned this once" does real damage in both directions. Treat every rumor as a confirmed risk, and you'll reject good candidates and good deals over hearsay. Treat every confirmed risk as just another rumor, and you'll wave through the next hidden conflict of interest because it "was probably nothing." The entire value of verification collapses if a report can't tell you which category something belongs to.

The Fix

The next time you're handed a due diligence report — on a candidate, a board nominee, a vendor, or an investment — the first question worth asking isn't "what did it find." It's "does this report distinguish between what's verified and what's alleged?" If it doesn't make that distinction explicit, you're not actually looking at intelligence. You're looking at a collection of claims with no way to weigh them against each other.

This is the same discipline that shows up whether the check is a standard employment verification or a senior leadership due diligence engagement — the categories change with seniority and risk, but the underlying standard doesn't: document what's confirmed, document what isn't, and never let the second category quietly pass as the first.

Frequently Asked Questions

What's the difference between a verified finding and an unverified allegation in due diligence?

A verified finding is confirmed against an independent, documented source — a court record, a regulatory filing, an employer's payroll system. An unverified allegation is a claim that surfaced during the process — from a reference, a rumor, or an informal source — but couldn't be confirmed against documentary evidence. Good due diligence reports clearly label which category each item falls into.

Is due diligence becoming a legal requirement in India, not just a best practice?

In specific sectors, yes. SEBI's October 2024 circular now legally requires Alternative Investment Funds and their managers to conduct and document specific due diligence on investors and investments. It's a signal of where regulatory expectations are heading more broadly, even for organizations not directly covered by this particular rule.

Why does it matter if a report treats a rumor the same as a confirmed risk?

Because the two require completely different responses. A confirmed risk (documented litigation, a verified conflict of interest) can reasonably factor into a hiring, investment, or appointment decision. An unconfirmed allegation shouldn't carry the same weight — treating it as equivalent risks unfairly penalizing someone over hearsay, while also training decision-makers to eventually distrust the whole report.

Ever received a report — background check, reference, or otherwise — that treated an unconfirmed claim as settled fact? Reply and tell us.

The Vetted Workplace

Every Wednesday. One real case. One real fix.

Written by the team at Millow.io — see what a background check catches before you make your next hire.