Private Equity Due Diligence: AML and Sanctions Checks on Deals
Commercial and financial diligence ask whether a deal is worth doing. Compliance diligence asks whether you are allowed to do it. Here is what the sanctions and AML rules require on the deal side, who to check, a seven-step workflow, red flags and a checklist.
Most AML rules for fund managers are written around customers: the investors whose money you take. A target company, its sellers and your co-investors are usually not customers in that sense, so investor-side KYC procedures do not automatically cover them. But US, UK and EU sanctions prohibit dealing with listed persons and the entities they own or, in the UK, control, and EU freezes also bar making funds available indirectly to listed persons or for their benefit. UK proceeds-of-crime offences apply to anyone who acquires criminal property or enters into an arrangement they suspect facilitates it. And Luxembourg goes further, requiring professionals to analyse the ML/TF risk of each investment in writing.
This guide is for deal teams, general counsel, chief compliance officers and operations leads at private equity, growth and infrastructure managers. It covers the compliance part of private equity due diligence only, not commercial, financial or tax diligence. It cites the texts as read on 12 November 2026 and is general information, not legal advice.
Investor-Side KYC and Deal-Side Due Diligence Are Different Jobs
A manager's onboarding process is designed around investors, as in our LP onboarding checklist. Deal diligence has different parties, different legal drivers and different timing:
| Investor side (LPs) | Deal side (targets, sellers, co-investors) | |
|---|---|---|
| Main legal basis | AML customer due diligence rules for the manager or the fund (for example MAS Notice SFA04-N02, CSSF Regulation 12-02, UK MLR 2017) | Sanctions prohibitions and proceeds-of-crime offences, which apply to everyone; in Luxembourg, also an express duty to analyse the ML/TF risk of investments |
| Who is checked | The investor, its beneficial owners and the people acting for it | The target, its owners and controllers, the sellers, management, co-investors and the parties paid at closing |
| Key question | Who is this investor and where does the money come from? | Are we buying from, investing alongside or paying anyone we must not deal with, and is the business or its value tainted by crime? |
| When | Before acceptance and through the life of the investment | Before signing, again before closing, and through the holding period and the exit |
In the United States, FinCEN's AML rule for registered investment advisers and exempt reporting advisers is now due to take effect on 1 January 2028 (91 FR 36, 2 January 2026). Our guide to the FinCEN investment adviser rule covers its status. Sanctions obligations do not depend on that rule.
What the Rules Say About Deal-Side Checks
The main texts a private equity compliance team works from:
| Regime | What it says | Why it matters on a deal |
|---|---|---|
| US: OFAC 50 Percent Rule (FAQs 398 and 401) | The property and interests in property of entities owned 50 percent or more in the aggregate, directly or indirectly, by one or more blocked persons are considered blocked. The rule speaks to ownership, not control, but OFAC urges caution with entities in which blocked persons hold significant minority stakes or exercise control | A target, seller or co-investor can be blocked without appearing on the SDN List. You have to add up the stakes of blocked owners through every layer |
| US: OFAC compliance framework (May 2019) | OFAC names mergers and acquisitions as an area that appears to have presented numerous sanctions challenges, and says organisations should carry out appropriate due diligence so that sanctions issues are identified, escalated to senior levels, addressed before the transaction concludes and fed into the risk assessment | Sanctions diligence is an expected part of the deal process, not only of onboarding |
| UK: OFSI ownership and control (general guidance, chapter 4) | An entity is owned or controlled by a designated person where that person holds more than 50% of the shares or voting rights, can appoint or remove a majority of the board, or it is reasonable to expect the person could ensure the entity's affairs are conducted in accordance with their wishes. OFSI does not simply aggregate different designated persons' holdings, unless, for example, there is a joint arrangement or one designated person controls another's rights (4.1.4) | The UK test includes control, so a minority owner who can appoint or remove a majority of the board, or otherwise ensure the target's affairs follow their wishes, can bring a target within the asset freeze |
| EU: asset freezes (for example Council Regulation 269/2014, Article 2) | Funds and economic resources belonging to, owned, held or controlled by listed persons are frozen, and none may be made available, directly or indirectly, to them or for their benefit | Paying purchase price, fees or earn-outs to a listed seller, or indirectly for a listed person's benefit (for example through an entity they own or control), can breach Article 2(2) |
| UK: Proceeds of Crime Act 2002 (sections 327 to 329 and 340) | It is an offence to conceal, disguise, convert, transfer or remove criminal property (s.327), to enter into or become concerned in an arrangement known or suspected to facilitate another person's acquisition, retention, use or control of it (s.328), or to acquire, use or possess it (s.329, subject to a defence where it was acquired for adequate consideration). Property is criminal property if it constitutes or represents a benefit from criminal conduct and the alleged offender knows or suspects that it does (s.340) | If diligence raises a suspicion that the business or the price is linked to crime, completing the deal without dealing with it can expose the buyer and its advisers |
| Luxembourg: CSSF Regulation 12-02 (Article 34(2), as amended by Regulation 20-05) | "In the framework of investment business", professionals must analyse the ML/TF risk posed by the investment and take due diligence measures adapted to the risk assessed and documented. The analyses must be formalised and reviewed annually and when particular events require it | For CSSF-supervised professionals, including investment fund managers, asset-side diligence is a written regulatory requirement, not only good practice |
Two points cause most of the difficulty in practice. First, OFAC aggregates: if two blocked persons each own 25% of a target, the target is blocked, and ownership through intermediate entities that are themselves 50% or more owned by blocked persons counts (FAQ 401). Second, the UK test reaches control as well as ownership, while OFSI will not simply add up separate designated persons' holdings without, for example, a joint arrangement or one controlling another's rights. The same structure can therefore give different answers under US and UK rules, so record both analyses where both regimes apply to you or your fund.
Who to Check on a Private Equity Deal
Diligence that only screens the target's legal name misses most of the risk. Cover each party to the transaction and to the money:
| Party | What to check | Typical sources |
|---|---|---|
| Target company and its subsidiaries | Legal existence, ownership chart to the individuals, directors, sanctions and adverse media, countries of operation, sanctioned-country customers or suppliers | Registry extracts, shareholder registers, the data room, screening results |
| Sellers | Identity and beneficial owners, sanctions and PEP status, adverse media, how they acquired the business, where the proceeds will be paid | Share purchase agreement, funds flow memo, ownership history, source of wealth evidence for individual sellers |
| Management and key shareholders who roll over | Sanctions, PEP status, adverse media, any criminal or regulatory history | Screening, background checks where lawful, CVs and declarations |
| Co-investors and the other side of a club deal | Identity, beneficial owners, sanctions status, and whether together with others they push a blocked person's stake to the relevant threshold | Co-investment agreements, KYC packs exchanged under NDA |
| Lenders, intermediaries and finders | Identity, sanctions status, legitimacy and amount of any fee | Engagement letters, invoices, payee bank details |
| Buyers on exit | Identity, beneficial owners, sanctions status and source of funds of the buyer | Bidder KYC packs, funds flow, bank confirmations |
A Seven-Step Compliance Due Diligence Workflow
Scope the deal risk at screening stage
Before you spend on full diligence, record the basics: countries where the target operates and sells, the sector, the ownership type (founder-owned, family, state-linked, another fund) and how the seller wants to be paid. Each raises or lowers the depth of what follows. CSSF-supervised professionals must formalise this risk analysis (CSSF Regulation 12-02, Article 34(2)); elsewhere it is still the record you will want if a regulator or an LP asks.
Map ownership and control to the individuals
Build the target's and each seller's ownership chart down to natural persons, with percentages at every layer, voting rights, board appointment rights and any shareholder agreement giving vetoes. You need percentages to apply OFAC's aggregation of blocked owners (FAQ 401) and control rights to apply the UK test (OFSI guidance, 4.1). Our guides to UBO discovery in complex structures and UBO calculation worked examples show the arithmetic.
Screen every party and every layer
Screen the target group, sellers, owners, directors, rolling managers, co-investors and payees against the sanctions lists that bind you and your fund, and screen for PEPs and adverse media. Record the lists, dates and how you resolved each potential match. Our guide to sanctions list screening covers list choice and match handling.
Look at the business, not only the names
Ask for customer and supplier lists by country, export controls classifications where relevant, and any past sanctions or AML findings. OFAC's framework lists customers, supply chain, intermediaries and counter-parties, products and services, and geographic locations as areas a sanctions risk assessment may cover. A clean shareholder register does not help if a large part of revenue comes from a sanctioned market.
Test the money at closing
Read the funds flow memo. Every payee should be a party you have screened, every account should be in the payee's name in a country you expect, and any instruction to pay a third party should have a documented reason. Where an individual seller's wealth is concentrated in the business, collect a source of wealth explanation of how they built or acquired it.
Escalate, decide and record before signing
Unresolved sanctions hits, a suspicion that the business or price is linked to crime, or ownership you cannot see through should go to the compliance officer and, where needed, to senior management before the deal is signed. The OFAC framework expects sanctions issues to be escalated to the relevant senior levels and addressed before the transaction concludes; deciding before signing is our recommendation, because it keeps your options open. Record the decision and the conditions, such as a seller exit, a restructuring, a specific indemnity or a walk-away. Where a suspicion arises, take advice on reporting and consent routes, for example the authorised disclosure defence in sections 327 to 329 of the UK Proceeds of Crime Act.
Carry it into the holding period and the exit
Add the portfolio company and its owners to ongoing screening, refresh the asset risk analysis when ownership, markets or management change (Luxembourg requires at least an annual review), and repeat the checks on buyers at exit.
Red Flags in Private Equity Transactions
These are our practical indicators, drawn from the ownership and payment issues above. None is proof of wrongdoing on its own; each needs an explanation you can record:
- A seller or co-investor whose ownership chart stops at a trust, foundation or nominee and who will not go further.
- Recent restructuring that brings a sanctioned or politically exposed owner just under a threshold, or that moves shares to relatives or associates shortly before the sale.
- Requests to pay the price, fees or earn-outs to a third party, to an account in another country, or in several parts to several accounts.
- Revenue from sanctioned or high-risk countries that management cannot explain, or that runs through distributors with unclear ownership.
- Finder or consultancy fees that are large for the work, paid to an offshore company, or linked to public officials.
- A valuation that only makes sense if unusual cash receipts are real, or cash-intensive revenue that the accounts do not explain.
- Adverse media on owners or managers covering fraud, bribery, sanctions evasion or organised crime, even without a conviction.
Many of the same indicators apply to the investor side; see our list of AML red flags in fund subscriptions and redemptions and sanctions evasion red flags.
Worked Example: A Mid-Market Buyout With a Club Co-Investor
An illustration, not a real case. A UK-based manager is buying 70% of an industrial services group headquartered in Germany, with subsidiaries in Türkiye and the UAE, from its founder. A co-investor will take 20% and the founder will roll over 10%.
- Ownership: the founder holds the group through a Cyprus holding company. The data room shows that 30% of that holding company was moved to the founder's brother-in-law eight months ago.
- Screening: the founder, the brother-in-law and the target group are clear. The co-investor's fund is managed by a firm whose largest LP is an entity 40% owned by a person on the UK sanctions list.
- Analysis: under the OFSI guidance, the designated person's 40% stake in the fund's largest LP does not by itself make the LP, let alone the co-investor, owned or controlled by the designated person, but the team asks whether the designated person has board or veto rights in the LP or the co-investor, or other means to direct the investment. If the same person were also blocked by OFAC, a 40% stake held by one blocked person would not block the LP under the 50 Percent Rule, but OFAC urges caution with significant minority stakes (FAQ 398). The team also asks why the holding company shares were moved before the sale and screens the brother-in-law's connections.
- Business exposure: UAE subsidiary invoices show sales to a distributor that resells into a sanctioned market. Management says the contract ended last year; the team asks for the termination and for the last 24 months of shipments.
- Decision: the investment committee approves subject to written confirmation that the designated person has no control rights over the co-investment, a specific sanctions indemnity and warranty, evidence that the distributor contract has ended, and a re-screen before closing. The analysis, sources and conditions are kept in the deal file.
After Closing: Holding Period and Exit
Diligence is a snapshot. OFAC says that after an M&A transaction the audit and testing function will be critical to identifying any additional sanctions-related issues, and Luxembourg requires the investment risk analysis to be reviewed annually and when particular events require it (CSSF Regulation 12-02, Article 34(2)). Practical steps:
- add the portfolio company, its directors and its significant owners to ongoing sanctions and adverse media screening;
- build a sanctions and AML item into the 100-day plan, such as a screening process for the company's own customers and suppliers where its exposure warrants it;
- refresh the risk analysis when ownership, markets or management change;
- apply the same checks to buyers at exit, including the funds they will use to pay.
Private Equity Compliance Due Diligence Checklist
- Deal risk scoping note on file (countries, sector, ownership type, payment route).
- Ownership and control chart for the target and each seller, to natural persons, with voting and board rights.
- Sanctions, PEP and adverse media screening of target group, sellers, owners, directors, rolling managers, co-investors, lenders and payees, with dates and match decisions.
- Aggregation test for blocked owners (OFAC) and control test (OFSI) documented where any owner is listed or is close to a listed person.
- Business exposure review: customers, suppliers and distributors by country; prior sanctions or AML findings.
- Source of wealth note for individual sellers whose wealth is concentrated in the business.
- Funds flow checked: every payee screened, accounts in the payee's name, third-party payments explained.
- Escalation decision recorded before signing, with any conditions; re-screen before closing.
- Portfolio company and owners added to ongoing screening; asset risk analysis review date set.
- Exit: buyer KYC, beneficial owners, sanctions status and source of funds checked.
How One Constellation Supports Deal-Side Checks
One Constellation is a SaaS AML/KYC compliance platform headquartered in Singapore, part of the Ascent Group, a subsidiary of KFin Technologies. Fund managers can use it for KYB and UBO checks on targets, sellers and co-investors; sanctions, PEP and adverse-media screening of every party and layer; and case management that records each match decision and escalation. The same platform runs investor onboarding on the LP side. The legal analysis and the investment decision remain yours.
Frequently Asked Questions
What is AML due diligence in private equity?
It is the compliance part of deal diligence: identifying who owns and controls the target and the sellers, screening every party for sanctions, PEP status and adverse media, checking the business's exposure to sanctioned countries and the payees at closing, and recording the decision. It sits alongside commercial, financial and legal diligence.
Is a portfolio company a "customer" for KYC purposes?
Usually not. Most AML customer due diligence rules for fund managers are built around investors. Deal-side checks are driven mainly by sanctions prohibitions and proceeds-of-crime laws, which apply to every buyer within their reach, not only to regulated firms. Luxembourg is an exception in practice: CSSF Regulation 12-02, Article 34(2), requires professionals to analyse and document the ML/TF risk of investments and apply adapted due diligence.
How does the OFAC 50 Percent Rule apply to an acquisition?
Entities owned 50 percent or more in the aggregate, directly or indirectly, by one or more blocked persons are themselves considered blocked. You add up the stakes held by blocked persons through every layer (OFAC FAQ 401). The rule covers ownership, not control, but OFAC urges caution with significant minority stakes and control by blocked persons (FAQ 398).
How is the UK ownership and control test different?
OFSI treats an entity as owned or controlled by a designated person if that person holds more than 50% of the shares or voting rights, can appoint or remove a majority of the board, or could reasonably be expected to ensure the entity's affairs are conducted in accordance with their wishes. OFSI does not simply aggregate separate designated persons' holdings unless, for example, there is a joint arrangement or one designated person controls another's rights.
Who should be screened on a private equity deal?
The target group, its owners down to the individuals, its directors, the sellers, managers who roll over, co-investors, lenders, intermediaries and every payee in the funds flow. On exit, screen the buyer and its beneficial owners.
What happens if diligence finds a sanctioned owner?
Stop and escalate before signing. Depending on the regime and the stake, the target or the seller may be subject to an asset freeze, so the deal may need restructuring, a licence, a seller exit or a walk-away. Take legal advice and record the analysis and the decision.
Sources
- OFAC FAQ 401: indirect ownership and the 50 Percent Rule
- OFAC FAQ 398: control and the 50 Percent Rule
- OFAC: A Framework for OFAC Compliance Commitments (May 2019, PDF)
- OFSI: UK financial sanctions general guidance (updated 12 May 2026), chapter 4
- Council Regulation (EU) No 269/2014, Article 2 (EUR-Lex)
- Proceeds of Crime Act 2002, section 327 (legislation.gov.uk)
- Proceeds of Crime Act 2002, section 328 (legislation.gov.uk)
- Proceeds of Crime Act 2002, section 329 (legislation.gov.uk)
- Proceeds of Crime Act 2002, section 340 (legislation.gov.uk)
- CSSF Regulation No 12-02, as amended by CSSF Regulation No 20-05 (PDF), Article 34
- FinCEN: delay of the investment adviser AML rule effective date, 91 FR 36 (2 January 2026, govinfo PDF)
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
Check Every Party to the Deal, and Keep the Record
See how One Constellation supports KYB and UBO checks, sanctions, PEP and adverse-media screening, and case management that records each decision.
