KYC, AML, and investor onboarding for private funds

What investor onboarding is trying to establish

Investor onboarding is not a request for a passport followed by a green check. It is the controlled process used to establish who the investor is, whether the person completing the process has authority, who ultimately owns or controls an investing entity, where the money comes from, whether sanctions or other restrictions apply, and whether the investment is consistent with the vehicle's offering rules.

The exact legal obligations depend on the jurisdiction, vehicle, manager, administrator, bank, and other regulated parties. FATF standards provide an international baseline, but local law and risk-based procedures determine the live requirement. A provider's checklist is evidence of its process, not proof that every responsible party has discharged its own obligation.

Keep four decisions separate:

The investor and LP guide explains how this work fits into subscription and admission. This guide focuses on the evidence and operating controls.

KYC and AML are related but not interchangeable

Know Your Customer, or KYC, is commonly used for identity and customer verification. Anti-money laundering, or AML, is broader. It includes risk assessment, customer due diligence, sanctions and politically exposed person screening, understanding the purpose of the relationship, transaction monitoring where applicable, escalation, record retention, and suspicious activity processes for entities subject to those duties.

A document can be authentic and still leave the risk unanswered. A passport identifies a person. It does not establish why a newly formed company is investing, who controls the company, or how the subscription was funded. Likewise, a bank transfer from an account bearing the investor's name can help reconcile cash but may not explain a material source-of-wealth question.

Do not promise investors that one completed check lasts forever. Reuse can be appropriate when the responsible party is allowed to rely on current evidence, but changes in identity documents, address, ownership, control, sanctions exposure, risk, investment size, or transaction pattern may require refresh or escalation.

Identification documents and proof of address

An individual is commonly asked for an unexpired government-issued identity document containing a photograph and identifying data. Whether a national ID, passport, driver's license, certified copy, electronic verification, or translated document is acceptable depends on the reviewing party's policy and law. The name, date of birth, document number, expiry, image quality, and machine-readable data should be internally consistent.

Proof of address often comes from an independent, recent document such as a regulated financial statement, utility bill, government correspondence, or tax document. Mobile-phone screenshots, cropped pages, old statements, and documents without the full name or residential address are frequent rejection points. A mailing address, registered office, or service address may not establish where an individual resides.

Publish acceptance criteria before requesting documents. State the permitted document types, maximum age, required visibility, certification standard, translation rule, and secure submission method. Do not ask investors to email sensitive identity files to a general inbox. Store only what the responsible process requires, restrict access, record the review, and apply a retention and deletion policy.

Source of funds and source of wealth

Source of funds explains the origin of the money used for a particular subscription. Source of wealth explains how the investor accumulated overall wealth. They answer different questions and may require different evidence.

For employment income, source-of-funds evidence might include salary credits and the bank account from which the subscription will be paid. Source-of-wealth evidence might include employment history, compensation, tax records, or long-term account statements. For a business sale, the transaction documents and receipt of proceeds may support both questions. For inheritance, investment gains, property sales, trusts, loans, or gifts, the reviewer needs a coherent chain from the originating event to the subscribing account.

Use proportionality. A modest investment by a long-established professional may require a simpler file than a large transfer through several new entities. A risk-based process does not mean inventing evidence standards during the review. It means defining baseline requirements, identifying risk factors, escalating exceptions, and documenting why the resulting evidence was sufficient.

Ultimate beneficial owners and control

For an entity investor, identify the natural persons who ultimately own or control it under the applicable standard. Ownership thresholds are only one part of the analysis. Control can arise through voting rights, appointment powers, agreements, management authority, or another means even when no person reaches the numerical threshold.

Build an ownership chart from the investing entity to natural persons. For each layer, retain the legal name, jurisdiction, registration number, ownership percentage, control relationship, and evidence date. Reconcile the chart to registers, constitutional documents, reliable registry extracts, and certifications. If no natural person meets an ownership threshold, do not stop. Apply the control analysis required by the responsible party's framework.

Thresholds differ across regimes and can change. FinCEN's CDD rule has used a 25 percent ownership prong plus one control person for covered US financial institutions, subject to exclusions, exceptions, and updated relief. That is not a universal private-fund rule. FATF guidance asks countries and institutions to obtain adequate, accurate, and up-to-date beneficial ownership information using their own implementation.

Entities, trusts, and multi-layered structures

An entity onboarding file normally includes formation and constitutional documents, current registers, registered address, business activity, tax classification, authorized signatories, board or member authority, and ownership information. Confirm that the subscribing entity exists, is permitted to make the investment, and is acting for its own account unless another capacity is disclosed.

For a trust, identify the relevant settlor, trustees, protectors, beneficiaries or classes, and any person exercising effective control under the applicable rules. Obtain the trust instrument or an acceptable extract, evidence of trustee authority, and an explanation of the trust's purpose and funding. Trust vocabulary varies across jurisdictions, so map functional roles rather than relying only on labels.

For layered structures, request the complete chain once. Repeatedly asking for one entity at a time creates delay and hides gaps. Use a dated chart, mark regulated or listed entities, identify any permissible reliance or simplified treatment, and keep the rationale. When another person submits information, verify authority and preserve who made each representation.

Politically exposed persons and higher-risk cases

A politically exposed person, or PEP, is not automatically prohibited. The status can require enhanced review because a prominent public function can create corruption exposure. Definitions commonly extend to family members and close associates, and local rules determine scope and treatment.

Enhanced due diligence may include senior approval, more detailed source-of-wealth and source-of-funds evidence, adverse-media review, closer understanding of the relationship, and increased monitoring. Apply the same evidence discipline to sanctions matches, high-risk jurisdictions, unexplained intermediaries, unusual payment routes, and structures without a clear commercial purpose.

Screening tools produce candidates, not conclusions. Record the data used, match logic, review outcome, reviewer, date, and escalation. A false positive dismissed without a reason is not a durable control. Neither is a cleared screen whose underlying identity data was incomplete.

Per-deal refresh and reliance

Whether an investor must repeat a full process for every deal depends on which entity is admitting the investor, who owns the obligation, whether prior data may be relied on, and whether anything material has changed. A syndicate that forms a new issuer for each deal may require a fresh admission decision even when a provider reuses current identity evidence.

Use a change declaration before each subscription. Ask whether name, address, tax residence, investing entity, beneficial ownership, control, PEP or sanctions status, source of money, or authorized signatory has changed. Confirm the age of documents and risk review. Refresh only what is stale or changed, unless the governing requirement calls for a full review.

Never let reuse blur responsibility. Record which party performed the original check, the legal or contractual basis for reliance, the evidence received, and which party accepted the investor for the current vehicle.

A defensible onboarding file

The final file should allow a qualified reviewer to reconstruct the decision without opening a discontinued platform. Retain the submitted evidence, data extracted from it, screening results, ownership chart, risk rating, exceptions, approvals, subscription representations, tax forms, change declarations, and admission decision. Keep access logs and retention dates appropriate to the governing rules.

Use a status model that distinguishes invited, documents received, review in progress, information requested, escalated, approved, rejected, subscription accepted, and cash reconciled. “Onboarded” is too vague when legal admission, identity approval, and payment are separate events.

Before close, reconcile the approved legal investor, named bank-account holder, signed subscriber, accepted commitment, and received cash. Any mismatch needs a documented resolution. Then connect the approved record to the payment and capital-call controls rather than copying sensitive documents into multiple systems.

Operating checklist

• Define the responsible party and applicable framework before collecting evidence.
• Publish secure, specific document standards and a support route.
• Separate identity, authority, ownership, eligibility, tax, and payment decisions.
• Trace entities and trusts to natural-person ownership and control.
• Explain source of funds separately from source of wealth.
• Escalate PEP, sanctions, adverse-media, geographic, and payment anomalies.
• Record the basis for any reliance, reuse, simplified review, or exception.
• Reconcile the admitted investor, signer, sending account, and ledger.
• Export a complete decision file with access and retention controls.
• Refresh on a defined schedule and when material facts change.

How to use this guide

Treat this as an operating map, not a structure recommendation. The correct answer depends on the asset, investors, jurisdictions, offering method, tax position, and people performing regulated or fiduciary roles. Rules and provider services change. Confirm the live facts with qualified counsel, tax advisers, and the parties named in your actual documents.

Published by Run a Fund, an independent Superscout Inc. publication. Research and drafting may use AI-assisted tools; sources and material claims are reviewed before release. We do not accept payment for a favorable conclusion. Last substantive review: September 5, 2026.