2. Not being the registrant!
When you register a domain name, most registries will require 3 contacts: Registrant, Technical Contact and Admin Contact.
The technical and admin contacts are usually your provider or agency, which is fine. However, some naughty ones are setting themselves as the registrant too.
What this means is that your business actually technically does not own that domain name! If things go south, your provider could hold onto it – or if the provider goes bust, you may not be able to get control over it to make the necessary urgent changes. Both scenarios can result in a painful and very time-consuming process to recover your domain and get it into your name.
Insist at the registration stage that your provider prove that you are the registrant.