Vendor Due Diligence Checklist for AML Compliance and Risk

The FCA’s July 2026 review of asset management and alternative firms found that around 40% of firms outsourced customer due diligence or enhanced due diligence. Among firms that outsourced elements of their financial crime compliance function, only 36% reported having full oversight of the third party’s AML onboarding processes.

The finding raises a broader question for financial institutions. How much does a business really know about the third parties supporting its operations?

A vendor may satisfy procurement requirements but, through its ownership structure, directors, jurisdictions, or business relationships, may face sanctions, PEP, bribery, or money-laundering exposure. Thus, vendor due diligence must extend beyond the vendor’s ability to provide the service. It must identify the party to the relationship, the risks it presents, and how those risks will be managed.

What Is Vendor Due Diligence and Why Does It Matter for AML?

In the context of AML, vendor due diligence assesses the financial crime exposure generated by a third-party relationship, as well as the wider legal, regulatory, and operational risks.

AML screening is one part of that assessment. It helps identify sanctions, PEP, adverse media, fraud, bribery and corruption exposure linked to the vendor and relevant individuals behind it.

The distinction matters because vendor due diligence and AML screening are not interchangeable. Vendor due diligence considers the broader risk created by the relationship, while AML screening provides financial crime intelligence that supports the risk assessment.

The term also has another meaning. In mergers and acquisitions, “vendor due diligence” can refer to a report commissioned by a seller for prospective buyers. This guide covers the other meaning, which involves a business assessing its own suppliers, agents and service providers.

The main exposure areas include sanctions, PEP and corruption risks, adverse media, hidden ownership, regulatory enforcement and other financial crime indicators linked to the vendor or its associated individuals. 

A vendor can therefore affect payment flows, customer onboarding, access to sensitive data and the operation of financial crime controls. Outsourcing an activity does not remove the firm’s responsibility for appropriate oversight.

In the UK, the FCA expects firms to retain appropriate oversight of outsourced financial crime activities and remain responsible for meeting applicable regulatory requirements. In the US, financial institutions remain responsible for maintaining appropriate BSA/AML controls when third parties support those controls.

What Does the Vendor Due Diligence Process Include?

The vendor due diligence process runs in five steps. Each step builds the evidence that the following step relies on.

Step 1: Build the vendor profile.

Collect the vendor’s legal name, registration details, jurisdiction, business activity and services provided. Identify directors, beneficial owners and controlling individuals, including ownership held through intermediate entities. Record where the vendor operates and whether it will access customer data, payment flows, regulated activities or sensitive systems.

Step 2: Rate the exposure.

Evaluate the vendor based on location, industry, complexity of ownership, regulatory status, access to payment flows or customer data and the use of subcontractors. Due diligence, approval level, and ongoing due diligence should match the risk rating.

Step 3: Screen independently.

Screen the vendor, relevant beneficial owners, directors and other key individuals against applicable sanctions lists, PEP data, watchlists and adverse media sources. Independent screening provides evidence that can be assessed alongside information supplied by the vendor. Name variants, aliases and transliterated spellings should be considered where relevant to the jurisdiction and individuals involved.

Step 4: Decide and document.

Record the decision, reasoning, evidence supporting the decision, and any conditions to the decision. Higher-risk cases may require EDD, escalation or rejection.

Step 5: Keep monitoring.

A clean result at onboarding does not establish that a vendor will remain low risk throughout the relationship. The risk profile may change as a result of ownership changes, new sanctions designations, regulatory actions and relevant adverse media. Businesses should set up suitable re-screening triggers and conduct more frequent screening on higher-risk vendors..

Vendor Due Diligence Checklist for Financial Crime Risk

A working vendor due diligence checklist gathers evidence rather than simply recording that a questionnaire was completed. Where the risk warrants it, information provided by the vendor should be corroborated against independent corporate, regulatory, sanctions or adverse media sources.

Identity and ownership

• Legal entity and registration verified.
• Beneficial owners and controlling individuals identified, including any behind holding companies
• Directors confirmed

Sanctions and watchlists

• Vendor, owners and key people screened against sanctions and watchlists
• Aliases and transliterated name variants included

PEP and corruption

• PEPs identified, with relevant family members or known close associates assessed where required by applicable law and the firm’s risk-based procedures
• Bribery and corruption indicators reviewed

Adverse media and enforcement

• Fraud, money laundering and sanctions violation reporting reviewed
• Corruption-related reporting reviewed

AML controls

• The vendor’s own AML policies and controls documented
• Prior AML or financial crime control deficiencies documented, with evidence of remediation where available

Regulatory and operational controls

• Regulatory licences and registrations verified where applicable
• Regulatory enforcement or disciplinary history reviewed
• Material subcontractors identified
• Business continuity and dependency risks assessed where relevant

Contractual controls

• Audit and information rights documented
• Material changes to ownership or control subject to notification
• Relevant subcontracting requirements documented
• Termination and exit arrangements defined

Relevant reporting may originate from local-language sources or involve associated individuals rather than the vendor itself. Independent checks can therefore identify information that a vendor questionnaire may not capture.

Why Does Financial Vendor Due Diligence Need a Risk-Based Approach?

In the June 2026 insurance review, the FCA highlighted concerns about managing third parties classed as higher risk, reinforcing the importance of risk-based classification and oversight.

On 18 September 2026, the EBA issued its final Guidelines on the management of third-party risk. The guidelines provide a lifecycle approach to due diligence, contracting, subcontracting, monitoring, documentation and exit strategies, including special arrangements for critical functions. The guidelines are final, but not yet in effect, and will be phased in over the course of two years.

Where Does the Vendor Due Diligence Process Break Down?

Vendor due diligence programs commonly weaken in four areas.

• Questionnaire dependence: Self-reported answers are assertions, not findings.
• Name-only screening: Risk often sits with owners, directors or related parties, not the vendor’s legal name.
• Point-in-time checks: A vendor’s risk can change after onboarding. Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party accounted for 48% of all breaches in its dataset, highlighting how vendor relationships can create risks beyond the initial assessment. 
• Split data: When procurement and compliance hold separate records, nobody sees the full picture. A vendor cleared by one team can carry a red flag the other never received.

What Evidence Should Vendor Due Diligence Retain?

A vendor due diligence decision is hard to defend if you can’t retrieve the evidence behind it. The audit trail should allow a reviewer to reconstruct how the vendor was assessed, what information informed the decision and whether the controls applied were proportionate to the vendor’s risk.

The record should also show when the assessment took place, who approved it and when the next review is due. Where a vendor’s risk changes, remediation and follow-up decisions should form part of the same audit trail.

This creates a documented link between the vendor’s risk profile, the controls applied and the decision made.

How Do Vendor Due Diligence Solutions Support AML Risk Management?

Technology can help compliance teams apply financial crime screening consistently across large vendor populations, reduce manual screening work and maintain an accessible audit trail. When evaluating a solution, firms should consider batch screening, risk thresholds, jurisdiction-specific coverage, identifying individuals behind corporate entities, and the ability to retain screening evidence for later review.

AML Watcher supports this financial crime screening layer through sanctions screening across 215+ regimes, PEP screening, adverse media screening and international leaks data. AML Watcher also provides AI-assisted alert analysis through TruRisk, which is designed to help distinguish potential matches from false positives.

How Should Vendor Risk Be Managed After Approval?

The oversight of the vendor should not end after approval, but continue to the next review dates and/or trigger events. Reassessment is necessary if ownership, sanctions status, regulatory status, or service offerings change.

Another aspect of third-party oversight is exit planning, especially when a vendor provides critical services, manages sensitive information, or establishes operational requirements. Firms must understand how the services and dependencies would be handled if the relationship terminates.