AIMA Fund Administrator Due Diligence: Reviewing AML and KYC Controls

An AIMA administrator DDQ gives your fund a structured starting point for assessing a service provider. To judge AML and KYC controls, ask the administrator to connect its answers to the work it performs: investor verification, screening decisions, overdue reviews and the handling of exceptions. A policy describes a control; a dated file record helps establish whether it operated.

This guide is for fund boards, managers and the people overseeing outsourced investor due diligence. The checklist below focuses on AML/KYC. Administrator selection also requires work on financial strength, fund accounting and NAV, operational resilience, cyber security and other services outside this guide’s scope.

If you are comparing providers before appointment, use our guide to choosing a fund administrator with strong compliance support for RFP questions, service-scope checks and fee comparisons.

By AgentKYZ. Source and edition review: 13 October 2026. We reviewed AIMA’s public administrator-DDQ listing, labelled “AIMA DDQ for Administrators (2017, 2025)”, and the public materials cited below. The restricted questionnaire was not available for review; this article does not claim a question-by-question review of its 2025 edition. We also reviewed the public foreword and contents for AIMA’s September 2022 Customer Due Diligence guide and March 2022 Sanctions Screening guide, not their restricted full texts. Confirm the edition of the questionnaire you use with AIMA and your administrator.

Using the AIMA administrator DDQ

The Alternative Investment Management Association (AIMA) publishes DDQs to help investors assess managers and help managers assess service providers. Its DDQ guidance describes questionnaire responses as an early step in diligence, providing areas for further questions and cross-checks. The administrator DDQ is a separate resource from AIMA’s investment-manager DDQs. Do not apply the manager questionnaire’s edition history to the administrator form.

Ask for a dated response identifying the legal entity, servicing office, systems and services it covers. A group-level answer may omit the team or subcontractor handling your fund. Keep the questionnaire version, respondent and supporting documents together so the next assessment can identify what changed.

Our AIMA DDQ guide explains how questionnaires fit into the wider diligence process. For the records behind AML answers, use the AIMA DDQ AML/KYC evidence guide alongside this administrator assessment.

The checklist and workflow here are AgentKYZ’s original recommendations. They are not AIMA questions, an official interpretation or a substitute for an authorised DDQ. Obtain AIMA materials through its own access channels and follow its copyright and use terms; do not copy restricted questions into public documents or unlicensed platforms.

AIMA has not endorsed this guide or AgentKYZ’s services. Completing a DDQ does not create an “AIMA compliance” status, regulatory approval or certification. AIMA’s CDD foreword cautions that its sound practices are not definitive best practices or a substitute for professional advice. Apply the legal requirements for your fund and servicing arrangement separately.

Initial selection and ongoing assessment

AIMA’s public administrator-guide overview covers selecting a new administrator, assessing an existing relationship and transitioning out of it. Those stages need different evidence.

Before appointment, assess capability and agree how the service will operate. Compare the proposed procedures with your fund’s AML policy, investor profile and jurisdictional requirements. Walk through onboarding and an escalation with the team that will service the fund. Request suitably redacted examples, capacity and training information, and relevant assurance reports. Record the limits of demonstrations: a prospective provider cannot yet show operating evidence from your own fund.

Resolve responsibilities in the administration agreement and service-level arrangements. Specify who requests missing documents, approves higher-risk relationships, decides exceptions, escalates concerns to the money laundering reporting officer (MLRO), and reports to the board. Agree records access, subcontracting controls, incident reporting and transition assistance. Appointment conditions should identify which gaps must close before work begins, who verifies closure and who can authorise the appointment.

During the relationship, assess performance on your fund’s actual investor population. Reconcile reported completion rates to file records, test screening and approvals, and examine overdue items by age and risk. Compare the latest DDQ with the previous response, then investigate changes in staff, systems, servicing locations or subcontractors. Track whether earlier findings recur after the administrator says they are resolved.

Set the review cycle from applicable requirements and the risk assessment. An incident, material service change or repeated failure may justify an earlier review. At renewal, record the reasons for continuing, imposing conditions or considering another provider. At exit, confirm the receiving party can retrieve usable KYC records, screening histories, open exceptions and approval trails without losing responsibility for live cases.

Fund administrator due diligence checklist

Use these AML/KYC review areas alongside your authorised AIMA administrator DDQ. For each area, record the applicable policy or legal requirement, evidence requested, period covered, reviewer and result. The suggested checks are not universal legal requirements; adapt them to your fund with qualified compliance and legal input.

1. Service scope and accountability. Request the administration agreement, responsibility matrix, service levels and list of delegates. Trace a higher-risk onboarding case through preparation, review, approval and escalation. Check that the fund, administrator and appointed AML officers have compatible accounts of who decides and who reports.
2. Investor risk assessment. Request the methodology, country-risk inputs, risk-rating history and override approvals. Check whether ownership, geography and other relevant risk factors affected the rating and the evidence collected. Investigate a low-risk classification that conflicts with facts in the file.
3. Identity and beneficial ownership. Request verification records, ownership charts and the evidence supporting them. Trace a layered investor structure to the relevant natural persons under the applicable rules. Check unresolved ownership questions and reliance arrangements rather than treating a completed subscription form as sufficient verification.
4. Enhanced due diligence. Request the higher-risk and politically exposed person (PEP) procedures, source-of-funds or source-of-wealth evidence where required, and approval records. Test whether the file supports the administrator’s stated risk decision and whether the required reviewer approved it at the appropriate time.
5. Sanctions and other screening. Request screening scope, list-update arrangements, dated results, alert rationales and escalation logs. Check relevant parties, rescreening triggers and the treatment of potential matches. Inspect why an alert was cleared. AIMA’s public sanctions-guide contents identify information quality, false positives and negatives, screening frequency and testing as review topics; applicable sanctions obligations still depend on the relevant regimes.
6. Ongoing CDD and event-driven reviews. Request review schedules, trigger rules and a dated backlog by fund, risk and age. Reconcile a reported “complete” review to updated evidence and its approval. Check whether a change of ownership, new adverse information or another relevant event led to reassessment.
7. Subscriptions, redemptions and payments. Request procedures and records for incomplete KYC, third-party payments and bank-detail changes. Follow a case from receipt to release or rejection, checking the approvals required by the fund’s policy and applicable law. Establish who can impose a restriction and who can authorise its removal.
8. Records and access. Request retention rules, access controls and arrangements for secure transfer or exit. Retrieve a file with its historical screening results and approval trail. Record missing attachments, inaccessible systems or data-location restrictions that could prevent the fund or an authorised reviewer from obtaining evidence.
9. Quality control and remediation. Request quality-review results, relevant independent assurance reports, training records and the open-issues log. Check a report’s scope, period, exclusions and relevance to your fund before relying on it. Retest a previously closed finding and compare recurring failures with staffing, workflow or system changes.

For more detail on investor verification and ongoing reviews, read our AIMA customer due diligence guide. Our AIMA sanctions screening guide examines screening evidence and the handling of alerts.

Keep evidence requests proportionate and secure. Use agreed access rights, restricted repositories and redaction where appropriate. Do not put investor identity documents or confidential suspicious-activity reports into an ordinary DDQ response. Route sensitive disclosures through the MLRO and authorised channels, observing applicable confidentiality and tipping-off restrictions.

Request evidence you can test

Define the review population and period before selecting files. Reconcile the administrator’s investor list to the fund’s records, and document omissions or differences. A list that excludes incomplete onboarding cases can make a backlog disappear without resolving any files.

For each request, specify the fund and legal entity, control being tested, expected record, relevant date range and delivery owner. Ask for underlying records where they are necessary to test a claim. A dashboard total is useful for oversight, but it does not establish why an investor was approved or a screening alert was dismissed.

Choose full-population testing or a documented sample based on the review’s purpose, risk and data availability. If sampling, cover higher-risk cases, complex ownership, overdue reviews and exceptions as well as ordinary cases. Explain the selection method and limitations. The proportion of exceptions in a targeted high-risk sample is not automatically the failure rate for the whole fund.

Distinguish control design, implementation and operation over time. A policy may be well designed but absent from the servicing workflow. A walkthrough may demonstrate that a control exists without proving it operated throughout the review period. Record which conclusion the evidence supports, including where historical records are unavailable.

Investigate gaps before drawing conclusions

When a DDQ answer and a file disagree, preserve both records and ask the administrator to explain the difference. Missing evidence is a finding about what you could substantiate; it does not by itself prove the underlying check never happened. Conversely, a verbal assurance does not close an evidence gap.

1. Identify the exact requirement, answer and conflicting or missing record. Check whether the evidence came from the correct fund, system and period.
2. Request the underlying decision, approval or audit trail. Establish whether the problem is retrieval, incomplete documentation, control execution or a mismatch between the fund’s policy and the administrator’s procedure.
3. Assess the affected population. Expand testing where the same workflow, migration or servicing team could have produced the same gap elsewhere.
4. Agree interim controls and a remediation owner and date. Escalate material or urgent risks promptly to the responsible AML officers and governing body under the applicable procedures; do not wait for the next DDQ cycle.
5. Verify the correction with fresh evidence and retesting. Preserve the original finding, the administrator’s response and the reason for closure. A new policy or a promise to obtain documents is not evidence that existing files were corrected.

Illustrative example, not a client finding: an administrator reports that all high-risk reviews are current, but one file’s due date has passed and no approval is visible. First check whether the due date changed with documented authority or the approval sits in another system. If neither explains it, assess other cases using that workflow, agree action with the responsible officer and record the overdue review separately from any failure in management reporting. Close each finding only when its own evidence supports closure.

Record findings and the oversight decision

Keep a findings register that another reviewer can follow without repeating the investigation. A useful record contains:

• the fund, review period, DDQ version, control area and applicable requirement;
• the evidence reference and date, protected file identifier, population or sample covered, and test performed;
• the observed fact, administrator’s explanation, unresolved uncertainty and reviewer’s conclusion;
• the risk or severity with reasons, affected population and any immediate action;
• the accountable owner, remediation deadline, current status and escalation history;
• the closure evidence, retest result, reviewer and closure date.

Use explicit results such as “supported by evidence”, “exception identified”, “not tested” or “not applicable, with reasons”. Do not count an untested control as a pass. Distinguish remediation reported complete by the administrator from closure verified by the reviewer.

Give the board a summary of material findings, repeat issues, overdue actions and limits on assurance. Record its decision on appointment or continued use of the administrator, any conditions and the next review date. Where residual risk can lawfully be accepted, document the authorised decision and rationale; risk acceptance cannot waive a legal obligation.

Independent file testing and Shadow KYC

Shadow KYC provides an independent review of the investor files your administrator keeps against your fund’s AML policy. AgentKYZ reports exceptions by category and age, linked to file evidence, so your team can investigate discrepancies and track remediation. Your board uses those findings to inform its oversight and provider decisions.

For the wider fund document pack, use our managed fund regulatory documents checklist. It separates offering documents, filings and ongoing reports from the investor KYC records tested in this review.

For Cayman funds, read our CIMA AML Rule guide alongside this checklist. It explains the separate regulatory requirements for outsourcing oversight and the independent AML audit, with links to CIMA’s primary texts. Apply CIMA’s requirements alongside AIMA’s industry guidance when setting the review scope.

Shadow KYC produces fund-specific file-testing evidence that can inform the separate programme-wide independent AML audit. The fund retains compliance responsibility, and the client’s appointed officers retain the approvals and decisions allocated to them. To scope a review, bring your fund’s AML policy, administrator service scope, investor-population summary and outstanding issues. See the Shadow KYC review process.