Preparing AML and KYC Evidence for an AIMA DDQ

Start with the evidence behind the answer

An AIMA DDQ AML response should let an investor trace a statement about your controls to the records behind it. If you say higher-risk relationships receive additional review, identify the policy, the review evidence, the authorised decision and any unresolved gap. A policy describes the intended process; dated case records show how your team applied it.

The Alternative Investment Management Association (AIMA) provides due diligence questionnaires that help investors assess managers and help managers assess service providers. An investor uses a manager DDQ to investigate the manager. The manager performs investor KYC to investigate the investor. The two processes meet when the manager needs to explain and evidence its AML controls.

This guide focuses on preparing AML due diligence evidence for a manager’s response. It is an original operating checklist, not a question-by-question mapping or a complete AML programme assessment. You can download the evidence workbook without registering. For help working through gaps, see Singapore managed-KYC services, or choose your jurisdiction below.

For questionnaire selection and the wider response process, start with AIMA DDQ Explained.

Confirm the edition and the scope of the request

Edition reviewed: final 2025 investment-manager DDQ, through AIMA’s public supporting materials only. AgentKYZ prepared this guide using the public sources listed below, reviewed on 13 October 2026. We have not reviewed or reproduced the restricted questionnaire templates or the full restricted sound-practice guides.

AIMA’s 12 March 2025 announcement describes a soft launch and identifies AML among the areas refined. Its transition page distinguishes that release from the final 2025 edition. Do not assume a saved March template is the final version. Confirm the investor’s requested edition, modules, entities and reporting date before reusing an answer.

Use AIMA’s official DDQ access and licensing information to obtain the questionnaire. This workbook contains no AIMA questions, question numbers or scoring criteria. No AIMA affiliation, endorsement or approval is claimed.

“AIMA DDQ compliance” is sometimes used to describe questionnaire preparation. It is not a regulatory status. A completed DDQ does not certify compliance or replace local obligations. AIMA’s September 2022 CDD guide foreword warns that its sound practices are not definitive, universally suitable or a substitute for professional advice. Its sanctions-screening guide is jurisdiction-neutral and subject to change.

An original AIMA DDQ AML evidence checklist

Use the six control areas below to assemble a working evidence index. These are AgentKYZ’s recommendations, informed by the public CDD and sanctions topic outlines, not prescribed AIMA document requirements. Agree the applicable legal standard and your firm’s policy before deciding that evidence is sufficient.

Risk assessments

Collect the business or fund risk assessment, the investor-risk methodology and its approved version, plus dated investor assessments that show the methodology in use. Record relevant geography, investor type, ownership complexity and other factors used by your policy. Keep the reasoning behind the rating, any override, required enhanced due diligence and the authorised approval.

Separate source of funds from source of wealth where those checks are required. A transfer record may establish where a subscription payment came from without establishing how the investor accumulated the wealth. Flag unsupported explanations and inconsistent ratings for review; a risk score alone will not explain the decision.

Beneficial-ownership verification

Keep an ownership and control chart connected to dated source documents. Show how the reviewer traced intermediate entities to the relevant natural persons, what evidence verified their identities and how control was assessed. Include authority to act and the parties relevant to trusts or other arrangements under the applicable rules.

Document the basis for any permitted exemption or simplified treatment. Do not apply one ownership threshold to every jurisdiction and structure. A signed ownership declaration with no documented assessment of its reliability may leave the verification claim unsupported.

For the broader investor-checking workflow, see our AIMA customer due diligence guide.

Screening decisions

Record who was screened, the identifying information used, the search date, relevant lists or data sources and the results. Preserve the reviewer’s rationale for clearing a potential match or escalating it, together with the authorised decision and follow-up. Distinguish sanctions matches, politically exposed person status and adverse information; each calls for its own assessment.

A screenshot saying “no match” cannot show whether a newly identified beneficial owner was included. Keep the screened population aligned with the ownership record. For sanctions, document applicable regimes, rescreening triggers and tool testing; screening alone does not address every sanctions restriction. AIMA’s public sanctions outline identifies information quality, false positives and false negatives, frequency and testing as topics for consideration.

Our AIMA sanctions-screening guide covers the screening workflow and the records supporting escalation and match decisions.

Periodic and trigger-event reviews

Assemble the review schedule, the population due, completed review records and an aged backlog. Show the last substantive review, the policy-based due date and any earlier trigger, such as changed ownership or new adverse information. Record the refreshed evidence, reassessed risk and reviewer’s conclusion.

Avoid presenting a document upload date as a completed review. A review should explain what changed and what still needs a decision. Set frequency under the applicable rules and policy; this guide supplies no universal annual or multi-year cycle. A periodic KYC refresh does not replace ongoing monitoring.

Exceptions and remediation

Maintain an exception log with the missing evidence or control failure, affected population, responsible person, target date and escalation route. Distinguish a request sent to an investor from evidence received and checked. Where a temporary exception is legally and procedurally permitted, record the approving authority, rationale, safeguards and expiry or recheck date.

Close a gap only when the supporting evidence and required approval are recorded. A decision to accept a residual risk does not make missing evidence exist or permit a breach of law. Keep suspected criminal activity and reporting decisions in the restricted AML escalation process, outside an ordinary DDQ remediation tracker.

Oversight of outsourced work

Collect the provider scope, responsibilities, evidence-access terms, reporting and escalation arrangements. Include dated oversight records: file samples inspected, findings, overdue cases, management challenge and follow-up through closure. Test whether you can retrieve the underlying records behind a provider’s “complete” status.

Have compliance or counsel distinguish outsourcing from reliance on another party’s CDD and confirm the applicable conditions. Your regulated entity retains responsibility; the contract must not leave approvals unassigned. Shadow KYC provides independent file testing and evidence-linked findings for oversight and remediation. Those records can also inform a separate programme-wide independent AML audit, with its own scope and independence requirements.

When assessing the administrator itself, use our AIMA fund-administrator due-diligence guide to separate provider selection from ongoing AML and KYC oversight.

Evidence workbook and HTML preview

Download the AML/KYC evidence workbook (CSV). Open it in Excel, Google Sheets or another spreadsheet application. It is a single-sheet working template; no macros, registration or investor data are included.

The workbook follows Control area → evidence needed → responsible person → last review → known gap → remediation status. The HTML preview below contains the same six illustrative rows. Every role, date, document reference and gap is fictional; none describes an AgentKYZ client or an actual finding.

Keep an untouched example copy, then replace all illustrative content in your working copy. Use one row per gap, repeating the control area where necessary. If you have not reviewed an area, record “not yet reviewed”; do not copy an example date. Use “none identified in the stated scope” only after an actual review, and record that scope.

Name one accountable person in each working row. Put the evidence reference and its reporting period in “evidence needed”; keep the last substantive check date in “last review”. In “remediation status”, record the current stage, next action, target date and, on closure, the verifier and supporting reference. The responsible person coordinates the work; approval authority still follows your policy.

Store the working file in an approved restricted location. Use case references instead of passport numbers or unnecessary personal information. Keep the legal-entity scope, DDQ edition and module, evidence cut-off date, policy version, preparer and approver in your cover note. Add internal question references only from the questionnaire you are authorised to use; this worksheet does not supply that mapping.

Assemble a controlled evidence pack

Before drafting the response, agree who owns each claim across the manager, fund, administrator and other providers. A Singapore manager and a Cayman fund can have separate obligations even where they share files. Use the MAS AML/CFT guide and CIMA AML Rule guide to identify the relevant local framework, then check current primary texts with your advisers.

For each answer, record the control as it operates at the cut-off date, who performs it and who approves it. Reference the policy and operating evidence. State the tested population and period, the limitations and any open remediation. A small file sample supports a statement about that sample; it does not justify saying every investor file is complete. Keep planned improvements separate from controls already operating.

Use the workbook as an internal index. Prepare a separate, approved disclosure pack for the investor. Check confidentiality, data protection, contractual restrictions and any consent or disclosure requirements before sharing. Redact or anonymise sample files where appropriate and test that redactions cannot be reversed. Do not put suspicious-activity reports, privileged advice or restricted investigations into an ordinary investor data room; involve the MLRO and legal advisers in disclosure decisions.

Have the response owner and authorised compliance approver check consistency with the evidence and sign off the release. Version the final response and its attachments, record who received them and keep later remediation updates traceable. Give the investor an evidence-backed response and a clear record of outstanding actions for its assessment.

Resolve the gaps under your existing AML arrangements

AgentKYZ scopes onboarding, remediation and periodic-review work against your approved AML policy. The deliverable is a human-reviewed case record with evidence, rationale and any issues requiring your team’s decision. Your MLRO and other authorised decision-makers retain approvals; the regulated entity retains its compliance responsibilities.

For Singapore managers and funds, see Singapore managed-KYC services. A VCC must retain its required eligible financial institution (EFI) appointment; agree the operational support scope and responsibilities alongside that arrangement. If the work concerns another entity, use the relevant service page: Cayman Islands, Hong Kong, Jersey, British Virgin Islands, Guernsey or Luxembourg.

Bring the entity and jurisdiction, case count, known gaps and DDQ deadline to a scoping discussion. Agree secure file access and the decision-makers before transferring investor records.