Charity due diligence policy: checks on grantees and partners

The rule: trustees must make the checks

Charity trustees in England and Wales must carry out appropriate due diligence on the people and organisations their charity funds or works with closely, as part of their legal duty to protect the charity's assets. The Charity Commission's Compliance toolkit chapter 2: due diligence, monitoring and verifying the end use of charitable funds puts it this way: “In practice, this means that to meet their legal duty to protect charity assets with the necessary care and properly to assess risk, trustees must carry out appropriate due diligence on those individuals and organisations that the charity receives donations from, gives money to or works with closely.”

The same chapter defines the term: due diligence is “the range of practical steps that need to be taken by trustees in order to be assured of the provenance of charitable funds and confident that they know the people and organisations the charity works with, and able to identify and manage associated risks.” It organises the duty as three ‘know your’ principles – know your donor, know your partner and know your beneficiaries – and adds: “The ‘know your’ principles are already part of the legal duties and responsibilities of trustees in charity law. They are not new obligations for trustees.” The essential trustee (CC3), updated on 16 September 2026, sends trustees to that chapter for “a practical guide to due diligence”.

For grants the Commission is more direct still. Its Making grants to charities and other organisations, published on 3 June 2026, says: “Your charity must carry out appropriate checks before making a grant. This process is sometimes called due diligence.” It also says you must “identify and regularly review any risks of your grant-making processes” and “make appropriate checks on applicant organisations”, and that “You must identify and manage any conflicts of interest.”

The Commission's words carry set meanings. CC3 says “‘must’ means something is a legal or regulatory requirement or duty that trustees must comply with” and “‘should’ means something is good practice that the Commission expects trustees to follow and apply to their charity”. The checks are a must. A written due diligence policy is not required by any law; it is the way a board shows itself, its auditor or examiner and the Commission that the checks are made the same way every time and in proportion to the risk. The toolkit's starting point is that “the greater the risks, the more charity trustees need to do to mitigate them.” The Commission sets no money threshold above which due diligence begins.

This guidance applies in England and Wales. Charities in Scotland are regulated by the Scottish Charity Regulator and in Northern Ireland by the Charity Commission for Northern Ireland. The toolkit chapter itself dates from 2011 (its web version appeared on gov.uk in March 2026): its principles stand, but some of its references to other law and other bodies have moved on, and its sanctions wording is one of them.

Who a charity due diligence policy covers

The duty reaches anyone the charity gives money to or works with closely, so the policy names each group, because the checks differ:

• Grantees that are charities. Registration is reassurance, not a pass. The grant-making guidance says that for each grant you must “carefully consider the level of checks that you will carry out”, and adds: “This includes on organisations that your charity has worked with before”.
• Grantees that are not charities. The guidance says “Your charity can usually make grants to organisations that are not charities”, and names Community Interest Companies (CICs), co-operatives, for-profit companies and public sector bodies among the organisations that are not charities. Check your governing document first: “In rare cases, it may say that you cannot make grants to organisations that are not charities.” And “If you are giving a grant to an organisation that is not a charity or a charity with wider purposes than yours, you must restrict the grant.”
• Delivery partners, sub-contractors and local agents who carry out the charity's work for it, in the UK or overseas. The toolkit is clear about who stays responsible: “Whatever the nature and complexity of the arrangement between a charity and its operational partner, trustees cannot delegate their legal duty of care.”
• Contractors working closely with the charity. The toolkit's scope includes “partners and others that are contracted to work with it”. Routine purchasing is a financial controls matter; the Commission's internal financial controls guidance, covered in charity internal financial controls, deals with payment authorisation.
• Beneficiaries who receive money directly, such as hardship grants to individuals. This is the ‘know your beneficiaries’ principle, and the toolkit says “There are no minimum legal requirements as to what charity trustees should do to comply with the ‘know your beneficiaries’ principle. It will not apply to all charities and a common sense approach is required.”

Donors are the third principle, and the same duty applies to money coming in. The rules for accepting, refusing and returning gifts belong in a separate policy, covered in the charity gift acceptance policy guide; this guide covers the money and the work going out.

The checks, and when to step them up

The toolkit's ‘know your partner’ principle has five core elements, and they make a sound spine for the checklist in any charity due diligence policy (section 8.1):

1. Identify: know who you are dealing with.
2. Verify: where it is reasonable and the risks are high, verify identities.
3. Know what the organisation's or individual's business is, and be assured it is appropriate for the charity to be involved with.
4. Know what their specific business is with your charity, and have confidence they will deliver what you want them to.
5. Watch out for unusual or suspicious activities, conduct or requests.

For grants, the 2026 guidance says “You should decide what checks your charity will make to assess if the organisation” is a charity or not; does work that will help you to carry out your charity's purposes; is genuine and suitable for your charity to work with; can carry out the funded work; has the right experience or knowledge to deliver; has a structure that you understand; is well managed; and can be monitored. In practice that becomes a short list of documents and searches:

• Status. If the organisation says it is a charity, check it is “listed on the Charity Commission register” (the register of charities) or is a charity that does not need to register, such as one with gross income below £5,000 or an exempt charity, which you can ask “for evidence that HMRC recognises them as a charity for tax purposes”. The guidance says you should not “assume that an organisation with similar purposes or activities to your charity is a charity”. Scottish and Northern Irish charities are checked with OSCR or CCNI, and registration in another country “may give you some assurance about the organisation’s governance and credentials”. Companies, including charitable companies and CICs, are on the Companies House register.
• Accounts and governance. Recent accounts, the governing document and the list of trustees or directors go to whether the organisation “is well managed” and “has a structure that you understand”.
• Public sources, weighed. The toolkit warns: “Care should be taken about how reliable public information is, especially media reporting.” It adds: “Good due diligence in higher risk situations may also involve obtaining references.”
• Safeguarding. The toolkit says “Charities whose partners’ activities involve contact with children or adults at risk should carry out appropriate due diligence on the partner organisation”, and that “any failure by trustees to carry out adequate due diligence of the charity’s partners to ensure they adequately manage risks to vulnerable groups, would be of serious regulatory concern to the Commission.” Ask to see the partner's safeguarding policy and how it is applied; the charity safeguarding policy guide covers what one should contain.
• Sanctions, where the work or the money crosses borders. The toolkit still points to a “consolidated list of asset freeze targets” on the HM Treasury website. That list has closed. The government's UK Sanctions List page says: “The UK Sanctions List is now the only source for all UK sanctions designations. The OFSI Consolidated List of Asset Freeze Targets closed on Wednesday 28 January 2026 and is no longer being updated.” A policy that includes a sanctions check should name the UK Sanctions List.

The grant-making guidance tells charities to “make more checks where the risks are higher. For example, some grants to organisations operating overseas or to organisations that are not charities”. The toolkit's list of situations where “The risk of abuse may be greater” (section 8.3) is a ready-made set of triggers for stepping up, including where:

• “the project proposal is vague or lacks adequate financial or technical details”;
• “the proposals include delegating work to other unknown partners or newly formed organisations”;
• “the project involves unusual payment mechanisms, or requests for cash, or for money to be paid into an account not held in the name of the partner, or in a country in which the partner is not based and not where the project is being carried out”;
• “partners request unnecessary or unusual levels of privacy and secrecy”;
• “the partner cannot demonstrate much previous project delivery and it is difficult to get independent references to vouch for it”.

Before the money moves: written terms and who decides

The grant-making guidance says to set out in writing to the recipient organisation:

• how the grant must be used;
• the time period for the delivery of the funded work;
• how you will monitor the grant, for example the method and timing of any reports you need;
• what will happen if the terms of the grant are not followed;
• what the recipient organisation must do if it can no longer carry out the terms of the grant;
• any terms to protect your charity's intellectual property rights, such as use of its logo;
• any terms that would cause you to terminate the grant;
• any terms you require relating to safeguarding;
• any other terms to protect your charity.

The form can match the risk: “A letter or short agreement may be enough for low-risk grants. For higher-risk grants, you will need extra terms and conditions. For example, if the grant is multi-year or funding overseas work.” For partnerships, the toolkit says “There is no specific legal requirement to enter into a partnership agreement, but it is the main way, particularly where risks are high, that trustees can show they have properly protected the charity’s legal position and have acted in its best interests.” It accepts that “If the amount of funding involved is very small, the arrangement is minor or insignificant and/or with very low risks involved, it may be proportionate not to have a written legal agreement.” A grant to a non-charity or to a charity with wider purposes must also be restricted to your purposes, and the written terms are where the restriction lives.

The policy should say who decides at each level. The grant-making guidance allows trustees to delegate, but “you should not usually delegate high-risk or novel decisions. As trustees, you are still responsible for decisions you delegate.” When delegating, have “written terms of reference for the group or person you have delegated to” and “clear and robust reporting procedures”. Anyone with a link to the applicant declares it before the decision; the conflict of interest policy guide covers how.

Payments overseas carry a tax test as well as a charity law one. Under section 547 of the Income Tax Act 2007 (charitable trusts) and section 500 of the Corporation Tax Act 2010 (charitable companies), a payment to a body situated outside the United Kingdom is non-charitable expenditure if the charity has not taken “such steps as the Commissioners for Her Majesty's Revenue and Customs consider are reasonable in the circumstances to ensure that the payment will be applied for charitable purposes.” The due diligence and monitoring record is how a charity shows HMRC what steps it took.

Monitoring, and what to do when a partner goes wrong

Due diligence does not end when the money is paid. The toolkit says trustees “must keep proper and adequate financial records for both the receipt and use of funds and audit trails of decisions” as “an absolute minimum”, that “the nature and the extent of the monitoring should be proportionate to the level of risk the charity is exposed to”, and that trustees “remain responsible and accountable for ensuring proper monitoring takes place and their legal duties are met.” The grant-making guidance adds: “You must be able to show that: the grant has been used to help you to carry out your charity’s purposes; you have managed your charity’s resources responsibly and reasonably”. For a small, low-risk grant an end-of-grant report may be enough; for a large or overseas grant, milestone reports with evidence before the next payment.

When monitoring shows a problem, the guidance says: “You must take immediate action if your monitoring shows that the grant is not being used as required. One option may be to suspend any ongoing funding while you review the situation.” Before a project starts, the toolkit says “If trustees suspect that a partner may be bogus or they are suspicious about them or their work they should seriously consider not taking forward the proposed project with the partner.”

The policy should also say what staff must not do. The toolkit is plain: “A charity’s responsibility is not to investigate or determine criminality.” Suspected crime is reported. The Commission's How to report a serious incident in your charity says “you should report allegations or incidents of fraud and cyber-crime to Report Fraud via its online reporting tool, ensuring you obtain a crime reference number and making clear that you’re representing a charity”, and that if you report to Report Fraud or the National Crime Agency “you should also make a serious incident report to the Commission”. Report Fraud covers England, Wales and Northern Ireland; its site says “If you live in Scotland, please report via 101.” It replaced Action Fraud on 4 December 2025, as the government's announcement of Report Fraud records, so a policy written before then needs the name changed.

A partner's problem can be the charity's serious incident. The Commission's Reporting a serious incident in your charity when it involves a partner says “Trustees should make a serious incident report when an incident has occurred involving one of the charity’s partners in the UK or internationally, which materially affects the charity, its staff, operations, finances and/or reputation, such that it is serious enough to be reported.” One of its triggers is an incident that “raises or is likely to raise material issues around due diligence in terms of whether the partner involved remains capable of delivering the charity’s work or continues to be a suitable partner for the charity to work with”. The serious incident reporting guide covers the report itself.

Large charitable companies and CIOs have one more reason to check partners. Since 1 September 2025, a large organisation commits the offence of failure to prevent fraud under section 199 of the Economic Crime and Corporate Transparency Act 2023 if a person associated with it “commits a fraud offence intending to benefit (whether directly or indirectly)” the organisation, or a person to whom the associate provides services on its behalf. Associated persons include an “employee, agent or subsidiary undertaking” and anyone who “otherwise performs services for or on behalf of the body”, which can take in delivery partners and agents. The offence reaches only a “relevant body”, defined in section 199(13) as “a body corporate or a partnership (wherever incorporated or formed)”: a charitable company or a CIO can be one, an unincorporated trust or association cannot. Under section 201, a relevant body is large only if it met two or more of these in the financial year before the year of the fraud: turnover more than £36 million, balance sheet total more than £18 million, more than 250 employees; a parent is judged on its group under section 202. It is a defence that the body “had in place such prevention procedures as it was reasonable in all the circumstances to expect the body to have in place”. How turnover is measured for a body that is not a company is explained in the Home Office's guidance on the offence of failure to prevent fraud. The charity fraud policy guide covers fraud response more widely.

The record of each decision

The toolkit says “Trustees should keep a written record of due diligence processes and the results which informed their decision making. This should include the checks carried out and the results and conclusions of the assessment on a partner.” It goes on: “The trustees should document the risks identified from the assessment together with the actions they consider necessary to properly manage the risks arising from entering into a partnership arrangement.” That is a should, not a must; the must is the financial records and “audit trails of decisions” in section 2.2. For a grant to an organisation that is not a charity, the grant-making guidance adds that you “keep a record of decisions you make” and “should be able to explain and justify funding decisions”.

So the grant or partner file holds, for each relationship: who was checked and against what, what the checks found, any doubts and how they were resolved, the risks and the controls chosen, who decided and when, the written terms, the monitoring reports, and any action taken. If making grants is a significant part of what your charity does, the grant-making guidance says “you may be required to explain your grant-making policy in your trustees’ annual report”, which is another reason to keep the policy and the file in step.

Where ComplyChat fits, and where it does not

Start with what it is not. ComplyChat is not a due diligence service: it does not check registers, screen anyone against the UK Sanctions List, score risk or decide whether a grant goes ahead, and it does not replace the grant file or the board's minute of the decision.

What it can help with is the part of the record that tends to go missing. Few grant decisions are reached only in a panel meeting. A grants officer messages the chief executive after a visit: the partner wants the second payment sent to a different account. The chief executive forwards it to the treasurer, a trustee asks for the bank letter, and over two evenings they agree to hold the payment until it arrives. That exchange is the written record of “the checks carried out and the results and conclusions” the toolkit describes, and if it sits on three personal phones, the charity can produce the minute but not the reasoning.

ComplyChat is designed to keep those internal conversations on the charity's own record. Staff, trustees and volunteers talk in channels the charity holds; a mobile number verified by SMS is an identity, so a trustee or volunteer with no work account can take part; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans, once the charity's Microsoft 365 tenant is connected, conversations are kept within the charity's own Microsoft 365 subscription under the retention schedules it already runs. Free personal messaging has three calendar months of recent history and no Microsoft 365 archive, so it cannot be the lasting record.

A question for the next trustees' meeting: for the last partner or grantee your charity had doubts about, could you show the Commission what was checked, what worried you and who decided to go ahead?

Questions people ask

Is due diligence a legal requirement for charities?

Yes: the Charity Commission says trustees must carry out appropriate due diligence on those the charity receives donations from, gives money to or works with closely, as part of their legal duty to protect the charity's assets (Compliance toolkit chapter 2, section 2.1). No law requires a document called a due diligence policy, but the Commission's 2026 grant-making guidance says “Your charity must carry out appropriate checks before making a grant.”

What are five core parts of due diligence?

The Charity Commission's ‘know your partner’ principle has five core elements: identify who you are dealing with; verify identities where it is reasonable and the risks are high; know what the organisation's business is; know what its specific business is with your charity; and watch out for unusual or suspicious activities, conduct or requests (Compliance toolkit chapter 2, section 8.1).

What checks should a charity do before making a grant?

The Commission's Making grants to charities and other organisations (3 June 2026) says to decide what checks will show whether the organisation is a charity, does work that furthers your purposes, is genuine and suitable, can carry out the work, has the right experience, has a structure you understand, is well managed and can be monitored. You must make more checks where the risks are higher, for example some grants overseas or to organisations that are not charities.

Can a charity give a grant to a CIC or a company?

Usually yes: the Commission says “Your charity can usually make grants to organisations that are not charities”, unless, in rare cases, your governing document says you cannot. The grant must be restricted so that it helps you to carry out your charity's purposes, and the Commission expects extra care and checks before you make it.

Does a charity need a written agreement with a partner?

There is no specific legal requirement, but the Commission says a partnership agreement is the main way, particularly where risks are high, that trustees can show they have protected the charity's legal position. For grants, it says to set out in writing how the grant must be used, how it will be monitored and what happens if the terms are not followed; a letter or short agreement may be enough for a low-risk grant.

What records should a charity keep of due diligence?

The Commission says trustees should keep a written record of their due diligence and the results that informed their decision – the checks, the conclusions, the risks found and the actions to manage them (toolkit section 8.2) – and that as a minimum they must keep proper financial records and audit trails of decisions (section 2.2). For grants, you must be able to show the grant was used to help carry out your charity's purposes.

Official guidance and your next step

The Charity Commission's guidance is in Compliance toolkit chapter 2 (2011, published on gov.uk as a web page in March 2026), Making grants to charities and other organisations (3 June 2026), The essential trustee (CC3), How to report a serious incident in your charity and Reporting a serious incident in your charity when it involves a partner. The statutes are section 547 of the Income Tax Act 2007, section 500 of the Corporation Tax Act 2010 and sections 199 to 202 of the Economic Crime and Corporate Transparency Act 2023. Sanctions designations are on the UK Sanctions List, which replaced the OFSI Consolidated List on 28 January 2026. In Scotland and Northern Ireland, read the OSCR and CCNI guidance instead. Quotations are from the pages named as published on 2 and 3 November 2026.

This guide covers charities in England and Wales and is not legal advice. The donor side of due diligence is in the charity gift acceptance policy guide, and the wider set of documents a board keeps in what policies a charity needs.

Then do one thing: pull the file for the last grant or partnership your charity agreed and check it holds four things – what was checked, what the checks found, the written terms, and who decided. If one is missing, that is the first line of your due diligence policy.