Practice note

Compliance Runs Both Ways

A fund or asset manager does diligence in two directions at once, on the money coming in and on the money going out. Most treat it as one job. It is two, and they need different depths.

Rodolfo Santos20 August 2026PROOF

Ask a fund or asset manager how they run compliance and you will hear about their LP onboarding. Subscription documents, a KYC pack, a screening report from the administrator, a file that closes when the capital lands.

Ask the same manager what diligence they run on a company before wiring it two million dollars and the answer changes register. Now it is about the team, the market, the cap table. Somewhere in there, usually late, someone screens the founders against a sanctions list because a bank asked whether anyone had.

Both of those are compliance. They are not the same job, they do not carry the same risk, and running them at the same depth is a mistake in both directions: too much friction on the way in, too little rigour on the way out.

What actually binds, and why that is the argument for a standard

Start with an uncomfortable fact. In the United States, as at August 2026, most private funds, and the advisers that run them, are not covered financial institutions for anti money laundering purposes.

The FinCEN investment adviser rule, which would have brought many advisers inside the perimeter, is delayed to 1 January 2028 and will be retailored before it lands. Beneficial ownership reporting for domestic entities was permanently eliminated in August 2026, so the corporate registry that funds were starting to lean on for ownership data no longer holds it for US companies. Neither of those changes makes the underlying risk smaller. They just remove the person who was going to tell you what to do about it.

What still binds, and binds absolutely:

OFAC. Sanctions liability is strict. There is no threshold, no de minimis, and no intent requirement. If you take money from a blocked person or send money to one, you are liable whether or not you knew, whether or not a form said otherwise, and whether or not your administrator screened. This is the single obligation that applies identically in both directions.

Form 8300. Any trade or business receiving more than ten thousand dollars in currency or equivalents reports it within fifteen days. It is not a real estate rule and it is not an AML programme rule. It reaches funds.

Everything else a fund or asset manager does is contractual or voluntary. Your bank requires it. Your administrator requires it. Your institutional LPs impose it through operational due diligence and side letters. Your acquirer will test it in five years.

Contractual obligations did not move when the rules did. What moved is that nobody is coming to tell you the shape of them.

That is the case for standardising now rather than waiting. When there is a rule, you comply with the rule. When there is no rule but the risk is real and every counterparty has their own questionnaire, the sensible move is a shared form that everyone can accept, which is what a standard form is for.

Direction one: the money coming in

An LP relationship is the higher-minucia side, and the reason is simple. You are accepting money from someone. If it is dirty, you now hold it, you may have commingled it, and unwinding a subscription two years later is a fund-level event, not a file-level one.

The depth that is actually required:

Find the real people

Not the entity that signs. The people behind it. If one company is owned by a second company, which is owned by a third, you still do not know who actually owns the money. Twenty five percent is the usual threshold, but it is a minimum, not a place to stop. If the chain ends at another entity, you have not found the owner. You have only written down another entity.

Two things get mixed up here and should not be. Ownership and control are different questions. A general partner with no capital in the fund controls it completely and owns none of it. If you write that down as ownership, you get a number above the threshold that is simply wrong. Record who owns and who controls, separately, or you have not described the structure.

Source of funds, and source of wealth

Source of funds is which account the wire came from. Source of wealth is how the person came to have it in the first place. The first is easy and nearly worthless on its own. The second is the one that matters, and for a high risk subscriber it needs corroboration rather than assertion: the sale agreement, the audited accounts, the tax filing, not a sentence in a form.

Cadence, because a relationship is not a closing

This is the part that gets missed. A transaction is assessed once, as at its date. A relationship carries a clock. Re-screening intervals of ninety, one hundred and eighty and three hundred and sixty five days by risk tier, a recorded date of last full review, a next review date, and a written list of events that trigger an immediate review regardless of the schedule. A politically exposed person who was clean at subscription and became a minister last year is a live problem sitting in a closed file.

Direction two: the money going out

Diligence on a portfolio company is not a lighter version of LP diligence. It is a different set of questions, and treating it as a reduced LP pack means you ask for things that do not matter and skip things that do.

Source of funds barely applies, because you are the source of funds. What replaces it:

Identity and integrity of the people

Founders screened against sanctions and, where the risk profile warrants it, adverse media. Not because a rule says so, but because you are about to make them custodians of your LPs' capital and put their name in your annual report.

Where the company can and cannot sell

This is the one most venture diligence skips. A company with a customer in a sanctioned jurisdiction is an OFAC exposure that becomes yours the moment you are on the cap table and, more sharply, the moment you take a board seat. For deep technology, export control classification belongs in diligence rather than in the panic after the first international order.

Who else is on the cap table, and who is behind them

Your co investors are your reputational counterparties. If one of the investors in a round is an entity whose owners are not named, that is the same unresolved chain as above. And where your own fund has foreign investors and the company you are backing works in US critical technology, the makeup of your investor base can bring the investment within CFIUS, the US government review of foreign investment. That is a judgement call rather than a form to file, and it is the clearest example of the two directions colliding: a question about your investors that only comes up when you deploy.

The inversion nobody runs. The startup should be doing diligence on the fund. They are accepting money from an entity whose owners they cannot see, and they almost never ask.

A fund that can hand a founder a completed, certified record of who its investors are, at the moment of the wire, has a differentiator that costs it nothing. It already holds every fact in that record.

The asymmetry, plainly

Depth is set by which way the money moves, not by how much of it there is.
Axis	Toward LPs, money in	Toward companies, money out
Core question	Whose money is this, and how did they come to have it	Who are these people, and where can this business legally operate
Who owns it	The real people, through every layer of entities, ownership and control recorded separately	The founders, and any co investing entity that is not a named institution
Source of funds	Required. Corroborated for high risk, not merely asserted	Not applicable. You are the source
Sanctions screening	Every party and every beneficial owner, before capital is accepted	Founders, the entity, and the markets it sells into
The exposure you inherit	Tainted capital inside the fund, and an unwind that is a fund level event	The company's own counterparties, customers and export footprint
Cadence	Fixed clock. Re-screen at 90, 180 or 365 days by tier, with trigger events	Event driven. Each round, each board cycle, each material change of market
Who signs it	The manager or administrator, on a record the LP's own bank may later rely on	The deal partner, on a record that survives into the data room at exit
Retention	Five years past the end of the relationship, minimum	Life of the holding, plus the tail of any representation you gave at exit

Five practices that hold in both directions

The depth differs. The discipline does not. These five are what separate a compliance file that survives scrutiny from one that merely exists, and each has a test you can apply to a file in under a minute.

01
A risk tier without named factors is not an assessment
Writing "medium risk" on a file records a conclusion and none of the reasoning. The tier has to carry the factors that produced it, because the person relying on your file later cannot review a number.
Test: pick any file marked high risk. Can you say why, from the file alone, without asking anyone?
02
Evidence must precede the decision it supports
An approval dated before the screening it cites is not a documentation defect. It is evidence that the approval was not based on the screening. Timestamps make this mechanical, which is why every record should carry them and every review should compare them.
Test: sort any approved file by date. Does anything the approval relies on come after it?
03
A negative conclusion needs a reason
"Not required" and a blank line look identical in a file six months later, and only one of them means somebody thought about it. Every report you considered and concluded was not required should say why not.
Test: find a filing you decided against. Is the reason written down, or is it in someone's memory?
04
A match cleared without a written reason is not a cleared match
Screening hits are common and most are false. The clearing is the compliance work, not the screening. Record who dispositioned it, when, and their actual reason, which is usually a specific mismatch of date of birth, nationality or middle name.
Test: take your last cleared hit. Does the file name the person who cleared it and say what convinced them?
05
Reliance is named and time limited
A compliance record that anyone may rely on forever is a liability with no edges. Name who may rely on it, cap it at the earlier of the next review and twelve months, and commit to telling them if it stops being true. Then hold the line that sanctions liability is strict and cannot be transferred by certificate, whatever the recipient would prefer.
Test: does your standard KYC pack say who may rely on it and until when? Most do not say either.

Tier the work, then hold the floor

Tiering is where most fund compliance goes wrong in both directions at once: everyone gets the same treatment, so the pension fund is annoyed and the entity with hidden owners is under examined. Three tiers is enough, provided the floor is genuinely a floor.

Tier one

Simplified

Regulated institutions, listed companies, sovereign and supranational investors, US persons investing their own capital in modest size.

Verify identity and regulated status. Screen. Record the basis for the tier.

Re-screen 365 days

Tier two

Standard

Most private subscribers, family offices with a visible structure, ordinary operating companies.

The real people identified all the way down, source of funds stated and plausible, full screening of every named party.

Re-screen 180 days

Tier three

Enhanced

Politically exposed persons and their associates, higher risk jurisdictions, complex or opaque chains, any third party payer, any structure whose purpose you cannot state in a sentence.

Corroborated source of wealth, documented rationale, approval by someone with named compliance authority.

Re-screen 90 days

The floor, which no tier goes below: every named party and every beneficial owner screened against sanctions before money moves, in either direction, with the result recorded and every hit dispositioned in writing. Simplified diligence is a reduction in depth. It is never a reduction to zero, and OFAC has no small subscriber exemption.

What to standardise, and what to leave alone

The instinct when writing a standard is to standardise the judgment. Resist it. What belongs in a standard is the shape of the record: the questions asked, in what order, with what evidence attached, certified by whom, relied on by whom and for how long. What does not belong is whether to accept a given investor. That is the manager's call, on their own responsibility, and a standard that pretends otherwise will be rejected by the first person whose judgment it overrides.

The practical version of this is three documents rather than a policy manual:

One offA single transaction record. One investment, one closing, one payment. Assessed once, as at its date, and then it is done.
OngoingA relationship record. An LP, a managed account, a repeat counterparty. Identical to the first except that it carries the review schedule, which is the whole difference.
AttachedAn ownership chain. One per entity or trust, attached to either of the above, never used alone. This is the part that takes real work, in the same way the cap table is the part of a financing that takes real work.

That is the structure of PROOF, a free public form set for exactly this, and the reason it is two forms rather than eight is that the only structural distinction that changes the work is one off against ongoing. Everything else is an annex.

Where to start on Monday

Week onePull ten LP files at random and run the five tests above. Count how many pass all five. The number will be lower than you expect and it is your actual baseline, not the one in the policy.
Week twoWrite the tier definitions and the floor on one page. If it does not fit on one page, it will not be applied consistently by the person doing it at speed on a Friday.
Week threePut a next review date on every open relationship. Most funds cannot produce this list at all, which means nobody has been re-screening anything.
Week fourBuild the outbound pack: founder screening, market and export footprint, who owns the company. Run it on your last three investments to see what you would have missed.
ThenAdopt one form for each direction and stop redlining it. A standard that gets marked up costs more than the bespoke document it replaced, because now both sides argue about the deviation as well as the substance.

The point of all of it

Compliance in a fund or asset manager is not a defensive function that exists to be shown to a regulator. In this market there frequently is no regulator to show it to, which is precisely why the standard has to come from practice rather than from a rulebook.

It exists so that when an LP's bank asks a question in year four, the answer takes an hour instead of a fortnight. So that a diligence request at exit does not turn into an archaeology project. So that the one file that turns out to matter was done properly on a Tuesday two years ago, by someone following a form, who wrote down why.

Depth should follow the direction the money moves. The discipline should not vary at all.