Entity co-location is one of the most overlooked variables in federal contractor due diligence. The Federal Acquisition Regulation requires prime contractors to verify subcontractor responsibility, but the standard SAM.gov lookup only checks one entity at a time. It cannot tell you who else is registered at the same physical address — and that geographic context is exactly where compliance teams find the patterns that single-entity searches miss.
This guide explains what co-location is, how often it occurs, why it matters for due diligence, and how to incorporate geographic screening into a standard contractor responsibility workflow.
What "co-location" actually means
In SAM.gov, every registered entity provides a physical business address. When three or more uniquely named entities register at the same normalized address, they form what we call an address cluster. The threshold is intentionally conservative: two entities at the same address could easily be a small office sharing a suite, but three or more uniquely named entities at the same physical location represents a pattern worth understanding.
Address normalization is essential here. Raw SAM.gov addresses contain countless inconsistencies — "Suite 200" versus "STE 200," "Street" versus "ST," differences in capitalization and punctuation. Without normalization, the same physical building might appear as a dozen separate addresses in the database. Once addresses are normalized and grouped, the true co-location picture emerges.
How common is entity co-location?
Across the 2,684,826 SAM.gov entity registrations in our coverage, we identified 67,594 address clusters where three or more uniquely named entities share a normalized physical address. The average cluster contains roughly 5 entities, with a median of 4. The distribution is right-skewed: most clusters are small, but a long tail of high-density addresses pulls the mean higher.
At the extreme end, 1,126 clusters nationwide contain 20 or more co-located entities. These high-density addresses are often legitimate office buildings, business parks, or co-working spaces — but they include the locations where compliance scrutiny matters most, simply because the volume of entities creates more relationships to verify.
Geographic distribution is uneven. California leads with 9,089 clusters, followed by Texas (5,440), Florida (4,745), New York (3,751), and Virginia (3,677). The top ten states alone account for the majority of all clusters, reflecting where federal contracting activity concentrates around military installations, federal agencies, and metropolitan economic centers.
Why co-location matters for due diligence
The Federal Acquisition Regulation places specific obligations on prime contractors. Under FAR Part 9, prime contractors must verify that subcontractors meet general standards of responsibility, including that they have not been excluded from federal procurement. This is the baseline requirement, and most compliance programs handle it with a simple SAM.gov check at the entity level.
The gap is geographic context. A subcontractor might have a clean SAM record — active registration, no exclusion match, valid UEI — while operating from an address shared with several other entities, one of which is on the federal exclusion list. The single-entity check tells you the subcontractor is fine. The geographic check tells you the subcontractor's registered address has a pattern worth understanding before you award the contract.
Our analysis identified 129 address clusters nationwide that contain at least one entity matching the federal exclusion list. That works out to roughly 1 in 524 clusters, or 0.19 percent of the total. Rare, but not negligible — particularly when you consider that the exclusion list contains 167,681 records and that a single excluded entity at a shared address creates a screening question for every co-located contractor at that location.
Importantly, none of this implies wrongdoing on the part of co-located entities. An excluded entity sharing an address with your subcontractor does not mean your subcontractor is excluded, affiliated, or non-compliant. It means the address warrants standard verification before a contract is awarded. That is the difference between a conclusion and a screening signal.
Legitimate explanations for co-location
The vast majority of address clusters reflect normal business patterns. The most common explanations include:
- Shared office buildings and business parks. Multi-tenant commercial real estate naturally produces high entity counts at a single street address. A 30-story office tower in downtown New York City or a federal contracting park in Northern Virginia can host hundreds of unrelated tenants at the same registered address.
- Virtual offices and registered agent services. Several states — notably Delaware and Wyoming — host concentrated populations of registered agent addresses used for LLC formation. These produce some of the highest entity counts in the database, but they reflect corporate filing services rather than actual operating co-location.
- Franchise and subsidiary structures. Many federal contractors operate multiple subsidiaries or affiliated entities from a parent company address. This is normal corporate structure and should not be confused with anomalous co-location.
- Incubators and small business development centers. Federal SBA-supported incubators commonly host dozens of small businesses at a single address as a deliberate program feature.
The point of co-location screening is not to flag every shared address as suspicious. The point is to ensure that when you make a contracting decision, you have the same geographic context that an experienced compliance officer would assemble manually — just delivered in seconds rather than hours.
What the data actually shows
Looking across all 67,594 clusters, three patterns appear consistently and are worth understanding before adopting any geographic screening workflow.
Concentration follows federal spending
States with the densest contractor populations are exactly where you would expect them: California, Texas, Florida, New York, and Virginia anchor the top of every density metric. This is not a surprise, but the magnitude often is. Virginia alone contains 134 high-density clusters with 20 or more entities, the most of any state. California follows with 111. The District of Columbia, despite its small footprint, packs 68 high-density clusters into a single city. For compliance teams working in these jurisdictions, the geographic dimension is not optional — it is the dominant variable.
Exclusion matches are rare but geographically clustered
Of 67,594 sellable clusters, only 129 contain a confirmed exclusion match. That is 0.19 percent — rare by any measure. But the distribution is not random. Virginia and California tie at 19 exclusion-matched clusters each, followed by Texas at 12, then Maryland and Florida at 10 each. These five states alone account for over half of all confirmed matches nationwide. The takeaway: in the highest-volume contracting markets, exclusion proximity is something compliance teams encounter often enough that having pre-cross-referenced data matters.
Most clusters are small
The median cluster contains 4 entities. The average is roughly 5. The distribution is heavily right-skewed, meaning a small number of very high-density addresses pull the average up while the typical cluster sits near the 3-entity minimum. For most compliance lookups, you are not looking at a 50-entity address — you are looking at a normal small office with a handful of co-located registrants. The screening question is the same regardless of cluster size: are any of these entities on the exclusion list, and is the pattern of registration anything unusual?
How to screen for co-location in your supply chain
Adding geographic screening to a standard subcontractor due diligence workflow takes four steps. The first three can be done manually with public databases. The fourth is where automated geographic intelligence saves significant time.
Step 1: Identify your subcontractor's registered address
Pull the registered physical address from SAM.gov. This is the address you will use as the search key. Do not rely on a corporate address from a website — use the SAM.gov record because that is the address that matters for federal procurement.
Step 2: Search for all entities registered at that address
This is where manual screening becomes difficult. SAM.gov's public search interface does not support efficient address-based queries for the general public. You can search by name, UEI, or NAICS code — but not easily by address across the full database. This is the gap that geographic intelligence reports fill.
Step 3: Cross-reference each co-located entity against the exclusion list
Once you have a list of co-located entities, check each against the SAM Exclusion List. Look for both UEI matches and firm name matches. Note any matches with the excluding agency and action date for further review.
Step 4: Review SAM registration status and patterns
For each co-located entity, note whether the SAM registration is active or expired, whether multiple entities share coordinated expiration dates, and whether any are concentrated in the same NAICS codes. None of these patterns prove wrongdoing on their own, but they collectively inform a richer responsibility determination than the single-entity check alone provides.
For compliance teams managing many subcontractors, doing this manually for every new vendor is impractical. State-level intelligence reports automate the geographic dimension by pre-clustering every address in a jurisdiction and pre-cross-referencing every cluster against the full exclusion list. The result is a CSV you can search by address in Excel — the entire workflow above collapses into a 60-second lookup. See a sample report to understand the format.
Where to start
If your compliance footprint is concentrated in a single state, start with that state's report. Virginia, California, and Texas are the largest contracting markets and most common starting points. If you operate across a region, the regional bundles offer 25 percent savings versus individual state pricing. Either way, the goal is the same: turn the geographic dimension of contractor due diligence into a routine workflow rather than a manual research project.