Charity due diligence is often read as a lighter copy of a bank's customer due diligence. The FATF says otherwise: "NPOs are not reporting entities and should not be required to conduct customer due diligence" (interpretive note to Recommendation 8, paragraph 5(e)). A charity's checks protect its own funds and name.
What does NGO due diligence mean for a charity?
The Charity Commission frames it as three "know your" principles: know your donor, know your beneficiaries and know your partner. Each rests on five core elements: identify who you are dealing with, verify identities where reasonable and the risks are high, know what the other party does, know its specific business with your charity, and watch out for unusual or suspicious requests (Charity Commission, compliance toolkit chapter 2).
complead, formerly Sanction Scanner, checks four relationships in its free checklist and in complead for Good, its program for registered charities, NGOs and foundations: partners, suppliers, donors and trustees. Aid beneficiaries stay out of scope. The Commission still expects trustees to know, at least in broad terms, who their beneficiaries are.
Trustees decide how far each element goes, and the Commission's starting point is that "the greater the risks, the more charity trustees need to do to mitigate them." The FATF's October 2023 amendment to Recommendation 8 points the same way: countries should take focused and proportionate measures, based on risk, against terrorist financing abuse of nonprofits.
Picture a small charity (illustrative) funding a school meals program through one local partner. Identifying is a dated registry extract. Verifying is confirming it with the partner's regulator, and knowing the business is its last accounts and a signed agreement. Watching out is asking why the next payment should go to a new account.
Who needs checking: partners, grantees, suppliers, donors or trustees?
The Commission's guidance treats each relationship separately.
- Implementing partners and grantees. They spend the charity's money where it cannot see, so the risks are failed delivery and diversion, including the terror front form of charity fraud. Without due diligence in high risk situations, the Commission warns, trustees cannot tell whether a partner is designated or proscribed in the UK.
- Suppliers and vendors. The risk is paying a sanctioned company or a front for one. OFAC's risk matrix for the charitable sector notes that a prohibited transaction with a person on its SDN List is a violation of US law. The checks follow know your supplier: registration, owners and sanctions screening.
- Donors. The Commission knows of cases where donations or loans to charities were used to launder money, and it treats a gift whose conditions would make the charity a mere conduit to another body as a higher risk (sections 5.4 and 5.5). For a large or unusual gift, ask about its source of funds. Know your donor, the Commission adds, does not mean questioning every donation.
- Trustees and staff with payment authority. The risks are eligibility and conflicts of interest. In one Commission investigation a charity had agreed to hand all its money to a European foundation, and 2 of its 3 trustees were also 2 of the foundation's 3 directors (chapter 2, section 8.2).
What goes on a charity due diligence checklist for each relationship?
Each row sets a floor and the checks to add once a risk factor applies.
| Relationship | Minimum checks | Extra checks when a risk factor applies | Evidence to keep |
|---|---|---|---|
| Partner or grantee | Registry status, governing document, board and signatories, sanctions screening, own bank account | Beneficial owners, adverse media, references, audited accounts, tranches, site visits | Dated registry extract, screening report, signed agreement, approval record |
| Supplier | Registration, sanctions screening of the company and its owners | Ownership chain, adverse media, exposure to high risk countries | Screening report, contract, invoices matched to payments |
| Donor (large or unusual gift) | Identity of the donor, where the gift comes from | Source of funds, sanctions and PEP screening, conditions attached to the gift | Donor record, screening report, decision to accept or refuse |
| Trustee or staff with payment authority | Identity, eligibility, sanctions screening | Adverse media, declaration of interests | Signed declarations, screening log, register of interests |
Table 1. Checks by relationship. Sources: Charity Commission chapter 2; Treasury's 2006 guidelines, section VI; the FATF's 2023 paper on nonprofit abuse, paragraphs 104 to 106; the free checklist's partner list.
For the screening rows, run the organization and each person with control against the UN list and the lists that bind you, such as OFAC's SDN List, the UK Sanctions List or the EU consolidated list. The free sanctions check emails a PDF report for each name, the evidence that row asks for. The free PEP check does the same for politically exposed persons, the extra check on a large donor.
For a corporate partner or supplier, the minimum is knowing who controls it, since a listed owner can hide behind an unlisted company. KYB and UBO verification in complead follows owners up the chain until it reaches natural persons, and each person or company it finds is screened for sanctions, PEP, watchlist and adverse media hits.
The free checklist's partner list adds two financial controls: funds go only to an account in the partner's own name at a regulated bank, and the latest accounts are on file, audited where the grant size or your own policy calls for it.
Which rules apply: the Charity Commission, US Treasury, the EU or FATF?
UK. In England and Wales the duty sits in charity law. For charities working overseas, the Commission's chapter 2 calls checking the relevant country's lists of proscribed organizations and designated persons good practice "as a minimum" (section 10.3). As a guide, trustees should also report unverified or suspicious donations totaling £25,000 or more to the Commission under its serious incident regime (section 5.5).
US. Treasury's anti terrorist financing guidelines for US charities (September 2006) are voluntary. Before funds go out, they suggest collecting nine items of grantee information, checking the grantee against the SDN List and asking it to certify that it complies with OFAC sanctions (section VI). OFAC's risk matrix grades grantees from low to high risk on factors such as a written grant agreement, a track record and payment in small increments.
EU. Here the duty sits mostly with banks and sanctions law. UN Security Council Resolution 2664 of 9 December 2022 carved humanitarian work out of UN asset freezes, and Council Regulation (EU) 2023/331 wrote that exemption into six EU sanctions regulations. Recital 5 records the resolution's request that providers relying on it keep benefits to listed persons to a minimum, including by strengthening "risk management and due diligence strategies and processes". OFAC implemented the same resolution through general licenses on 20 December 2022 (FAQ 1105).
FATF. The FATF Recommendations bind countries, not charities. The FATF's 2023 paper on protecting nonprofits from abuse suggests nonprofits verify those they receive money from, give money to or work closely with. High risk nonprofits could also screen their partners' beneficial owners against domestic and UN lists, in a targeted and proportionate way (paragraphs 104 to 106).
How long should a charity keep its due diligence evidence?
Keep proof that each check was done, when and by whom, for longer than the relationship lasts.
- The record of checks and the decision. The Commission says trustees "should keep a written record of due diligence processes and the results which informed their decision making" (section 8.2). Note the risk level, mitigations, approver and date.
- Screening reports. A dated report naming the lists searched shows what was known on payment day.
- Accounting records. Trustees in England and Wales must preserve them for at least six years from the end of the financial year in which they were made (Charities Act 2011, section 131).
- OFAC records. A US charity keeps a full record of each transaction subject to OFAC's regulations, licensed or not, available for examination for at least 10 years (31 CFR 501.601).
- The agreement and the reports. OFAC's matrix rates a grantee that documents its spending with receipts, photographs, video and testimonies as low risk; file them with the signed agreement.
What does partner due diligence look like on a grant to a grey listed country?
Picture a UK charity (illustrative) planning a £120,000 grant to a new partner with an annual income of £150,000, delivering cash assistance in a country on the FATF's list of jurisdictions under increased monitoring, the grey list. The free NGO due diligence checklist asks about six risk factors, and four apply.
- High risk area: yes. The AML Country Risk Index rates the country from 0 to 100 on its FATF listing, its Basel AML Index result and how many sanctions programs name it.
- New relationship: yes. No track record with the charity.
- Large grant for the partner: yes. £120,000 is 80 percent of its £150,000 income.
- Cash based delivery: yes.
- Unclear control or links to PEPs: no, once the ownership check is done.
- Funds passed on to other organizations: no.
Under the checklist's rule, two or more factors make the relationship high risk, so the extra checks in Table 1 apply: beneficial owners, adverse media, references, audited accounts and payment in four tranches of £30,000, each released against a financial and a narrative report. OFAC's matrix rates small increments like these as low risk. A long standing partner with none of these factors would stay at the minimum checks. If the risks cannot be adequately managed, the Commission says the appropriate decision may be to stop working in that region (section 10.3).
Why do banks ask charities about due diligence, and what should you prepare?
Picture a bank (illustrative) asking a small charity for its trustees, accounts, countries and partner checks. A charity that answers within a day hands the analyst what a case by case decision needs, which is what standard setters ask banks for.
The FATF says "Financial institutions should not view all NPOs as high risk" (paragraph 123). Its Box 11 lists exiting whole groups of customers among practices out of line with a risk based approach, because a refusal or an exit should be decided case by case. The EBA's annex on nonprofit customers of 31 March 2023 asks EU firms to understand a nonprofit's governance, funding, activities, locations and beneficiaries. It counts clearly documented roles, a legal duty to publish accounts and external audits as lowering the risk.
Prepare the pack before the bank asks. It holds the governing document, trustee list, latest accounts, programs, countries, due diligence policy and recent screening reports. Where a sanctions regime applies, add evidence that a humanitarian exemption covers the work, which the EBA annex tells firms to obtain (paragraph 4). The free charity and NGO KYC form, a template for the UK Money Laundering Regulations 2017, asks for the charity's registration, trustees, main funders and where its programs run.
Three things to settle before the next grant is paid:
- List every partner, supplier, major donor and trustee with payment authority, with the risk factors that apply to each.
- Screen each name and file the report with its date and the lists searched.
- Record the risk level of each relationship and who approved it.
How this page was checked. The author, Burçak Aydın, is complead's Finance Manager. The charities, grant and bank are illustrative. Each rule and figure was read in its own text on 1 November 2026: Charity Commission chapter 2, FATF Recommendation 8 and the FATF's 2023 nonprofit paper (archive copies of 22 October 2026), Treasury's 2006 guidelines, OFAC's matrix and FAQ 1105, Regulation (EU) 2023/331, the EBA annex, the Charities Act 2011 and 31 CFR 501.601.
