An investor due diligence checklist, in fund compliance, is the list of what a fund, its manager or its administrator must establish about an investor before accepting a subscription: the investor's identity, its owners and controllers through every layer, the purpose of the relationship, the results of sanctions, PEP and adverse-media screening, the risk rating, and the approvals and evidence behind each. (Founders preparing for a venture investor's due diligence are asking the opposite question, and this page is not about that.) A checklist passes an examination only if each tick is backed by a document and a named decision, which is where most files fail. Botminds' Investor KYC/AML Onboarding builds every file that way: each fact pinned to its page, each screening hit decided with a reason, and each approval made by a person other than the one who prepared it.
The worked file below is sample data on fictional people and companies from the solution, a Danish family holding company subscribing €40,000,000 to a fictional Quillfield fund. The rules come from the eCFR, UK legislation and EU law.
One defensible investor file: each conclusion, the evidence behind it, and who decided
Nordhavn Holding ApS exists and is who it says
EvidenceDanish CVR registry extract, retrieved 7 October, page 1: name, number, address, start date
Who decidedRead by the Reader agent; confirmed by the analyst
A Luxembourg company owns 100% of it
EvidenceCVR extract page 2 and the Luxembourg RCS extract, read in Danish and French beside English
Who decidedConfirmed by the analyst; re-derived by the Checker on a second model
A beneficiary holds 31% through a Jersey trust
EvidenceTrust deed, Schedule 2, page 31: fixed halves; 62% × 50% = 31%. Missing from the Danish register, present in the Luxembourg one
Who decidedBoth readings agree; analyst confirmed; discrepancy report drafted for the MLRO to approve
The 81% sanctions name match is not the investor’s owner
EvidenceThe list entry against the owner’s passport: different date of birth, nationality and passport number
Who decidedAgent proposed a discount with reason D3; the analyst decided
The same beneficiary is a PEP family member
EvidencePEP record, a 97% match, and her citizen card showing the marriage
Who decidedTrue match confirmed by the analyst; MLRO approval required
The article about her spouse is relevant
EvidenceNewspaper article of 14 March 2026, page 1, in Portuguese beside English: an inquiry, no one charged, in the fund’s sector
Who decidedAgent proposed “relevant — allegation” (M2); the analyst accepted
The family’s wealth has a documented source
EvidenceSource-of-wealth letter, page 2: the sale of a family business in 2019
Who decidedAnalyst confirmed; second reviewer checked
The investor is high risk, rated 78
EvidenceEleven factors on the firm’s risk model, each with its source page; any PEP among the owners sets High
Who decidedRisk agent proposed; reviewer passed 14 of 14 checks; MLRO signed: accept with enhanced due diligence
What is investor due diligence?
It is customer due diligence applied to the people and entities that invest in a fund. The EU AML Regulation's list is a good definition because it is complete: identify the customer and verify its identity; identify the beneficial owners and understand the ownership and control structure; understand the purpose and intended nature of the relationship; check whether the customer or its owners are subject to targeted financial sanctions; understand the nature of its business; and monitor the relationship afterwards (Regulation (EU) 2024/1624, Art. 20(1)).
US and UK rules contain the same parts under other headings. A US mutual fund verifies identity under 31 CFR 1024.220, identifies beneficial owners under 1010.230 and runs ongoing due diligence under 1024.210; a UK firm applies regulation 28, which adds an explicit duty to "take reasonable measures to understand the ownership and control structure" of a legal person or trust (MLR 2017, reg. 28(3A)). Investor KYC by vehicle shows which rule applies to which fund.
What is on an investor due diligence checklist?
Fourteen checks cover a standard and a high-risk investor alike; the high-risk file answers more of them with more evidence. Each check below names the rule that asks for it, so the checklist can be traced to law rather than to habit.
A 14-point investor due diligence checklist, each point tied to its rule
- Investor identified and verified against an official source
Registry extract or certified constitution for an entity; photo ID and address for an individual. 31 CFR 1024.220; UK reg. 28(2)–(3); AMLR Art. 20(1)(a).
- Purpose and intended nature of the relationship
Why this investor, this fund, this amount, and the source of funds for the subscription. UK reg. 28(2)(c); AMLR Art. 20(1)(c); 31 CFR 1024.210(b)(5).
- Every owner at the threshold identified
25% or more in the US and EU, more than 25% in the UK, or the firm’s lower threshold for higher risk.
- Percentages multiplied through every layer
Each path multiplied and the paths added, with the arithmetic shown. AMLR Art. 52(1).
- Trust and foundation roles named
Settlor, trustees, protector, beneficiaries or their class, and anyone with control. UK reg. 6; the trustee under 31 CFR 1010.230(d)(3).
- A control person, always
One individual with significant responsibility to control, manage or direct the entity, even when no one reaches 25%. 31 CFR 1010.230(d)(2).
- Registers compared with source documents
Any substantive discrepancy described and resolved, never silently chosen. 31 CFR 1024.220(a)(3)(i)(D); UK reg. 28(9).
- Identity documents valid, addresses current
Unexpired IDs; proof of address within the firm’s window, three months in the sample firm.
- Every party screened, with the list date
Investor, owners, controllers and signatories against sanctions lists, PEP data and adverse media; the version of each list recorded.
- Every hit decided with a reason and a decider
True match, false positive or relevant, with the identifiers compared and the person who decided.
- PEP status recorded and approved
Senior management approval, source of wealth and source of funds established, enhanced monitoring. UK reg. 35(5); AMLR Art. 42.
- Risk rating with each factor cited
The model and version, each factor’s points and source, and the enhanced measures the band requires.
- Approved by someone other than the preparer
Analyst, second reviewer and approver are different people; the acceptance decision is recorded with its reason.
- Next review date and retention set
Within one year for higher risk and five for others under the EU Regulation; records kept five years after the relationship ends.
What makes an investor KYC file defensible?
Traceability, in both directions. Starting from any conclusion, a reviewer must reach the document and the person who decided; starting from any document, the reviewer must see what it was used for. A file that says "beneficial owners verified" with a folder of PDFs behind it is complete and indefensible: no one can tell which page proved which owner or who looked.
The US identification rule already demands this shape. Its minimum file is the identifying information, a description of each document relied on with its type, number, place and dates of issue, a description of the methods and results of any non-documentary checks, and a description of how each substantive discrepancy found during verification was resolved (31 CFR 1024.220(a)(3)). The beneficial-ownership rule asks for the same four items for each owner (1010.230(i)). Those are not filing instructions; they are a definition of a traceable file.
One owner, two independent readings, and the evidence for each
How far up an ownership chain must you go?
To the natural persons, through every layer, with no stopping point written into the rules. The US definition covers anyone who owns 25% directly or indirectly, by any contract, arrangement, understanding or relationship (31 CFR 1010.230(d)(1)). The EU Regulation is more explicit about method: indirect ownership is calculated by multiplying the holdings at each level and adding the paths, and every level of ownership counts (Art. 52(1)). The same chain names the controlling persons on the entity's CRS self-certification, and the CRS entity form beside the W-8BEN-E shows what happens when the two files disagree.
The sample file shows why stopping early fails. Nordhavn's register declares two owners, at 38% and 62%, the second "through" a trust. Only the trust deed shows that the 62% is split in fixed halves between two people, each at 31%, one of them a PEP's spouse whom the register does not name. A checklist that stops at the register ticks "owners identified" and misses the one owner that changes the risk. How to calculate beneficial ownership through layers works through the arithmetic, including loops and split paths.
UK rules add a duty for the cases where the chain does not resolve. If a firm has exhausted all possible means and still cannot identify the beneficial owner of a body corporate, it may treat the senior person responsible for managing it as the owner, but it must keep written records of every action it took and every difficulty it met (reg. 28(6)–(8)). An unresolved chain is acceptable only with that trail behind it.
“An additional challenge is the use of nominee arrangements, in which an intermediary … agrees to be identified as the nominal investor and essentially acts as a ‘shield’ for individuals who want to make investments without disclosing their identities or source of funds.”
US Department of the Treasury, 2024 Investment Adviser Risk Assessment
What evidence proves a sanctions screen was done?
The screen's inputs and its outcome, for every party, at a stated date. That means the names and identifiers screened, which lists in which version, each potential match with its score, the identifiers compared and the decision, and who made it. A tick saying "screened: clear" proves only that someone typed it.
Ownership belongs in the screen as well as the names. The EU Regulation asks firms to verify whether persons subject to targeted financial sanctions control a legal entity customer or hold more than 50% of its proprietary rights, individually or together (Art. 20(1)(d)), and OFAC's GVA Capital penalty shows what it costs to rely on the owner on paper: OFAC found a legal opinion that the investing vehicle was not blocked had reached the wrong conclusion, and imposed $215,988,868 (OFAC, June 12, 2025). The OFAC 50 rule and control explains why the arithmetic alone was not the test.
For the screening of the people in the chain, the decision record is the evidence. In the sample file, an 81% sanctions match on the name "HALVORSEN, Mats" against an owner named Mads Halvorsen was proposed for discount because the date of birth, nationality and passport differ; the reason code, the identifiers and the analyst who agreed are all on the file. Investor screening by agents that ask sets out where such decisions must stay with a person.
How long must investor due diligence records be kept?
Five years in each of the three regimes, counted from different moments. The difference matters for a fund that keeps one archive across jurisdictions: the longest clock for each kind of record should win.
How long investor due diligence records are kept, and from when the clock starts
| Record | US (31 CFR) | UK (MLR 2017, reg. 40) | EU (AMLR, Art. 77) |
|---|---|---|---|
| Identifying information | Five years after the account is closed (1024.220(a)(3)(ii)) | Five years from when the firm knows or has reasonable grounds to believe the relationship has ended | Five years from the end of the business relationship |
| Documents relied on, verification methods, discrepancy resolution | Five years after the record is made | As above, for due diligence taken in connection with the relationship | As above |
| Beneficial-owner identification | Five years after the account is closed (1010.230(i)(2)) | As above | As above |
| Suspicious activity report and supporting documents | Five years from filing (1024.320(c)) | Not covered by reg. 40 | Five years, for the record of the assessment and any report |
| A refused investor | Not addressed by these sections; keep the decision under your program | Not addressed by reg. 40 | Five years from the date of refusal |
| After the period | No deletion rule in these sections | Delete personal data unless another law, consent or legal proceedings require keeping it | Delete personal data; a supervisor may require up to five more years |
The refused investor is the row most files miss. Under the EU Regulation the clock also starts "on the date of refusal to enter into a business relationship," so a declined subscription needs its file kept as carefully as an accepted one. In the sample firm, every file is kept five years after the relationship ends, in the region where the investor is, with legal hold.
Where investor due diligence files fail examination
Rarely on the documents, and usually on the joins between them. Four failures recur in the rules' own language: an owner identified on a register but not on the source document; a screening hit closed with no recorded reason; a high-risk investor approved by someone who also prepared the file; and reliance on an intermediary's assurance with nothing behind it. Treasury's assessment names the last one directly: in many offshore funds, it found, relying on the assurances of intermediaries who represent investors is routine (Treasury, 2024).
The checklist above guards against each. The register comparison catches the first; the reason-and-decider rule the second; the separation of preparer, reviewer and approver the third; and a requirement to hold each introduced investor's identifying data and owners, not just a letter, the fourth. AML outsourcing to a fund administrator covers what that requirement looks like in a contract.
Asking why a file is rated high, and getting every factor with its source
Where Investor KYC/AML Onboarding fits the checklist
Investor KYC/AML Onboarding turns the checklist into the file. The Collector agent asks for the documents the firm's rules require for that investor type; the Reader pins each field to its page; the Ownership agent multiplies through each layer, names trust roles and the control person, and compares the result with the register; the Checker re-derives every owner on a different model; the Screening agent proposes a decision on each hit with its identifiers; the Risk agent cites each factor. The analyst confirms, a second reviewer passes or returns each of 14 checks, and the MLRO signs.
The file it leaves is the one in the frame at the top of this page: every conclusion with its evidence and decider, sealed on an audit trail and kept for the retention period. It will not tick a check on an agent's say-so; every check is passed by a person. To see a sample file, start from Investor KYC/AML Onboarding.
Questions people ask
What is the difference between investor due diligence and KYC?
In fund compliance they are close to the same thing: KYC is usually used for identification and verification, and investor due diligence for the whole file, including owners, purpose, screening, risk rating and approvals. Enhanced due diligence is the deeper version for higher-risk investors, with source of wealth and senior approval.
How do you verify an investor's source of wealth?
With documents that show how the wealth was built, such as sale agreements, audited accounts, tax returns or probate records, matched to the investor's story and to the size of the subscription. Source of wealth vs source of funds separates the two questions and the evidence each needs.
Do you have to screen every owner, or only the investor?
Every party who matters to the risk: the investor, each beneficial owner, each controller and the people who sign. The EU Regulation asks firms to check whether sanctioned persons control the customer or hold more than 50% of it, which cannot be answered by screening the investor's name alone.
What if a beneficial owner cannot be identified?
Under UK rules, after exhausting all possible means, a firm may treat the senior person managing the company as its beneficial owner, but must record every step it took and every difficulty. Under US rules the control person is always required, and the file should describe why no 25% owner was found.
Should a declined investor's file be kept?
Yes. The EU Regulation keeps the five-year clock running from the date of refusal, and in every regime a refusal may be relevant to a later suspicious activity report. Keep the reason for the decline and who made it.