AIMA CDD guidance: scope and edition
AIMA customer due diligence guidance gives fund managers a sound-practice reference for investor CDD. To put it to work, connect each control to an accountable person, a decision and retrievable evidence. A file marked “complete” is of little use if your MLRO cannot see why a screening alert was cleared.
The Alternative Investment Management Association (AIMA) publishes the Guide to Sound Practices for Customer Due Diligence. Its public September 2022 material describes CDD as part of investor onboarding for funds, investment managers and fund administrators, encompassing anti-money laundering (AML), sanctions checks and beneficial ownership reporting.
Written by AgentKYZ. Source review: 13 October 2026. We reviewed the September 2022 guide’s public landing page, foreword and table of contents, not its full downloadable text. The topic explanations below stay within that public material. The implementation checklist and examples are AgentKYZ’s recommendations, not an AIMA checklist or a statement of requirements from the full guide.
Use AIMA’s official guide access page for the document and applicable access terms. We do not reproduce its templates or restricted content. AIMA has not endorsed or approved this article or AgentKYZ’s services. The reviewed edition is September 2022; the review date does not imply a new 2026 edition or establish that no later guidance exists.
AIMA AML guidance and your legal obligations
AIMA’s public foreword says the practices may be unsuitable for some managers, depending on their size, jurisdiction, regulation, complexity and investment strategy. It expressly cautions against treating them as definitive or “best” practices, or as a substitute for professional advice.
Keep two records when using AIMA AML guidance:
- A legal and regulatory obligations map. Identify the fund, manager and other entities, their activities and the jurisdictions whose rules apply. Record the current authority for each duty and obtain qualified advice where scope is unclear.
- An operational control register. Record how your team carries out each control, what evidence it retains and who reviews exceptions. AIMA’s public topics can help identify areas to examine; the register below is our suggested working method.
An AIMA topic heading does not establish when simplified CDD is permitted, which beneficial ownership test applies, when enhanced checks are mandatory, or how quickly a report must be filed. Determine those points from applicable law and regulatory requirements before building procedures. A sanctions obligation may apply regardless of a customer’s AML risk rating.
For jurisdiction-specific starting points, see our guides to the CIMA AML Rule for Cayman funds, MAS AML requirements, SFC AML requirements and JFSC AML requirements. Those guides link to the relevant authorities. Check the current primary texts for each entity; a Cayman fund and its Singapore manager should not be treated as a single regulatory perimeter.
What AIMA’s public CDD outline covers
The public table of contents identifies these areas. It establishes the guide’s scope, but does not disclose every recommendation within each chapter.
- Risk-based approach: customer risk assessment and documentation of risk analyses.
- Governance: policies, the money laundering reporting officer (MLRO), senior-management escalation and CDD governance.
- CDD throughout the relationship: standard, simplified and enhanced CDD; ultimate beneficial owner (UBO) identification; ongoing CDD; suspicious activity reports; assurance or reliance letters; asset due diligence and crypto assets.
- Digital CDD: digital identity, remote onboarding, electronic signatures and verification.
- Sanctions: screening types, risk assessment, responsibilities, screening frequency, positive identification, testing and training.
- Outsourcing: provider selection, liability and responsibility, contracts and other outsourcing considerations.
AIMA also publishes separate sanctions-screening sound practices. Its public outline names data quality, fuzzy searching, false positives and false negatives. Its foreword describes the guidance as jurisdiction neutral and subject to change. A screening workflow therefore needs its own mapping to applicable sanctions regimes.
For a closer operational review of matching, alert decisions and testing, use our AIMA sanctions-screening guide.
AgentKYZ’s fund-manager implementation checklist
Use these steps to review an existing CDD process or scope a new one. They are original operational recommendations. Adapt them to your entities, investors, approved policy and applicable requirements; completing the list does not establish legal compliance or an “AIMA compliant” status.
-
Define the perimeter before requesting documents. List the entities, investor types, distribution channels and delegated activities in scope. Have compliance or counsel confirm which obligations apply to each. Keep the obligations map, its source dates and the approved policy version with the project record. Avoid treating every fund in a group as identical.
-
Assign decision owners and escalation routes. Name who collects evidence, reviews risk, resolves screening alerts and approves onboarding. Define the MLRO’s role, senior-management escalation and cover for absences. Retain the responsibility matrix and approval limits. An administrator’s “approved” flag should be traceable to the person authorized under the agreed process.
-
Record the customer risk assessment and its reasons. Capture the investor’s business, geography, ownership, investment purpose, delivery channel and other factors relevant to your policy. Retain the inputs and reviewer rationale, including why a material factor was accepted or escalated. Make overrides visible; a risk score alone does not explain a decision.
-
Verify identity and understand ownership and control. Identify the investor, authorized signatories and relevant beneficial owners under the applicable tests. Trace complex structures to the natural persons who ultimately own or control them as required, recording source documents and unresolved links. Ask compliance to resolve uncertain ownership or control tests instead of applying a universal percentage threshold.
-
Choose the CDD depth and justify it. Record the basis for standard, simplified or enhanced measures. Confirm that simplified measures are legally available for the case; a familiar intermediary is insufficient justification on its own. For enhanced checks, record the additional evidence required, including source-of-funds or source-of-wealth work where applicable, its assessment and the required approvals.
-
Keep screening decisions reproducible. Define the people and entities screened, applicable lists, data fields, screening triggers and review responsibilities. Retain dated results, relevant identifiers, match analysis and the reason for clearing or escalating each alert. Test data quality and missed-match risks. Treat possible sanctions matches through the approved escalation process, with compliance determining applicable restrictions, freezing and reporting actions; a low AML risk score does not clear a sanctions concern.
-
Test digital onboarding and evidence retrieval. Establish which identity checks and electronic signatures your policy and applicable rules accept. Review how the provider handles failed verification, suspected impersonation and manual exceptions. Keep enough evidence of the verification method and outcome to support review, with access, retention and deletion controls appropriate to the data. An uploaded identity document does not by itself explain how identity was verified.
-
Manage ongoing reviews and trigger events. Set review dates under your risk-based policy and any mandatory timetable. Define triggers such as ownership changes, new adverse information or changes in sanctions exposure. Track overdue work, reassess risk and retain closure evidence. Consider asset due diligence and crypto-asset exposure where relevant to the fund’s strategy, with specialist input for obligations outside the investor-onboarding process.
-
Separate missing documents from suspicion. Define how staff refer unusual activity to the MLRO or designated reporting officer. Keep sensitive assessments and reporting decisions in access-controlled records, observing applicable confidentiality and tipping-off restrictions. A general remediation tracker can reference a restricted case without disclosing its contents. Never delay a required report simply to complete a checklist.
-
Examine outsourcing and reliance separately. Document the provider’s capability, agreed scope, escalation timelines, record access and oversight arrangements. If using third-party reliance, confirm separately that it is permitted and its conditions are satisfied. Test whether underlying records can actually be obtained. A service agreement, reliance letter or provider assurance report is not evidence that every investor file is complete, and delegation does not remove the regulated entity’s compliance responsibility.
-
Test files and close the gaps. Ask a reviewer to trace selected decisions from source evidence to approval, including higher-risk and exception cases. Choose and document the testing coverage for your risk and oversight needs. Give each finding an owner, due date and closure criterion; verify the correction before marking it closed. Provide the appropriate governing body with findings, overdue items and decisions. Where an independent AML audit is required, agree its separate scope and independence requirements with the auditor and make the file-testing records available as supporting evidence.
Build a CDD evidence and remediation register
For each control, use these fields: control area → evidence needed → responsible person → last review → known gap → remediation status. Add the applicable policy or legal reference, due date, approval record and a secure link to the evidence. Keep confidential investor material out of broadly circulated management reports.
Illustrative example, not a client finding: an ownership chart names two intermediate holding companies, but one ownership link has no supporting evidence. The register records the investor-file reference, the missing link, the operations owner, the date reviewed and the remediation deadline. The MLRO or authorized approver determines how the unresolved gap affects onboarding under the policy and applicable rules. Closure requires the missing evidence and a documented reassessment, not just a “document received” status.
Use that register to answer practical oversight questions: which files remain unresolved, how old are the gaps, who can approve the next action and where is the evidence behind the decision? For administrator-maintained files, Shadow KYC provides a separate review against your fund’s AML policy and evidence for following up exceptions.
When assessing the provider itself, our AIMA fund administrator due diligence guide connects administrator selection and ongoing oversight to the evidence you request.
How CDD evidence supports an AIMA DDQ
AIMA’s official DDQ page describes questionnaires for investors assessing managers and for managers assessing service providers. Keep the direction of due diligence clear: an investor uses a manager DDQ to investigate the manager; investor CDD examines the customer investing in the fund.
Start with our AIMA DDQ guide for the questionnaire’s role in manager due diligence. Use the AIMA DDQ AML/KYC evidence checklist to organize the records supporting your description of AML controls.
When describing your AML controls to a prospective investor, use evidence from the checklist to support the answer: the approved risk methodology, a redacted approval record, testing coverage and a remediation report. Explain the period and entities covered, and disclose material limitations. A policy proves what you intended to do; file-level evidence helps show what happened in practice.
Share examples only with appropriate permission and redaction. Keep suspicious-activity material restricted. Obtain AIMA questionnaires through official, authorized access and observe their licensing terms. This article neither reproduces DDQ questions nor claims to cover a particular manager-DDQ edition.
Put the checklist to work with AgentKYZ
If your team needs capacity to complete investor files, AgentKYZ supports onboarding, remediation and periodic reviews under your AML policy. We return risk assessments, screening rationale, ownership evidence, indexed documents and an audit trail. Your MLRO keeps final approval; your regulated entity keeps compliance responsibility.
Scope delivery for your structure through our managed KYC services for the Cayman Islands, Singapore, Hong Kong or Jersey. If the administrator already does the work and you need evidence of oversight, review Shadow KYC and, for Cayman funds, the CIMA oversight and audit requirements.
Bring your policy, investor population, open exceptions and current division of responsibilities to a scoping call. Start with those process details; agree a secure transfer method before sharing investor documents.