If there was one point of consensus at SuperReturn anti-money laundering (AML) and know your customer (KYC) panel hosted by Carta Law, it was this: AML compliance in private markets has become too procedural, laborious, and inefficient. Too often, KYC becomes a mechanical exercise—more about completing forms than understanding risk. Instead of taking a thoughtful, purpose-driven approach, many compliance teams default to checklists that miss the bigger picture.
As Adam Porter, general counsel at Alchemy Partners, put it, "We're trying to establish who we're transacting with and who owns and controls them, so we don't wake up and discover they're owned by someone we should never have transacted with."
The goal is simple: Make sure you're not doing business with someone you shouldn't be doing business with. But in the delicate balancing of regulators' expectations, administrators' checklists, and a thoughtful approach to risk, the industry has lost sight of that clarity.
The problem with “ticking the box.” Or just “Computer says no”
Many firms have drifted into a culture of box-ticking—chasing formal completeness over substantive compliance.
A blanket request for documentation that doesn't take into account actual regulatory requirements or the nuances between different types of entities, jurisdictions, asset classes, and investment structures may appear thorough, but may ultimately raise unnecessary roadblocks without necessarily addressing the risk factors relevant to the specific case. As the panel agreed, these over-engineered processes still miss the bad actors, while frustrating legitimate investors and delaying closes.
It's not always the regulation slowing deals—it's often the misapplication of it.
Getting comfortable with risk
The best compliance teams are those that understand risk can't be eliminated and get comfortable with that. That's not to say it should be ignored, rather that it needs to be managed in line with the firm's commercial risk profile and relevant regulations.
That means documenting the rationale for decisions—who made the call, on what basis, and how it aligns with the firm's policy. In practice, this looks like risk notes differentiating AML concerns from reputational judgment calls.
It's not a softer approach; it's a smarter one. In a fast-moving industry, aiming for total risk exclusion slows down deals and can impact business relationships.
For the panel, this directly links to how expertise and technology should work together. Understanding risk is the bridge between proportionate human judgment and scalable automation.
Expertise before automation
Historically, AML regulations have been designed around banks and broker-dealers–but that is changing. FinCEN's 2024 rule, though delayed, looks to bring investment advisers under the Bank Secrecy Act for the first time, and the EU/UK frameworks already apply to asset managers. Now, model asset managers must build toward a thorough compliance infrastructure.
Technology is often heralded as the solution for understanding the jurisdictional nuances of this framework, but for the panel, this only kicks the can down the road. Good compliance depends on judgment: knowing which risks are worth escalating, what evidence is proportionate, and when to document a reasoned decision rather than chase another certificate. Software can't yet exercise that degree of judgment. It still needs to be operated—presumably by the same KYC professionals who are finding it challenging to adapt their processes to asset management.
As the panel summed up: "Before artificial intelligence, you need actual intelligence." Technology and automation can play a critical role in scaling well-designed compliance processes—helping teams screen, track evidence, and ensure consistency—but they work best when guided by people who understand fund structures, risk, and regulatory expectations.
The goal isn't to replace human judgment; it's to empower it, ensuring that automation serves experience rather than substituting it.
The investor experience
For limited partners (LP), onboarding is often their first operational touchpoint after commitment. A clunky KYC process—multiple requests, unclear asks, contradictory comments from administrators—by association, sends a message long before any capital is called: This firm is either disorganized or inflexible. That early impression matters.
The fix, discussed by the panel, isn't radical. It's about setting expectations early, explaining regional nuances (particularly EU vs. U.S.), providing standard structure letters that answer 80–90% of questions, and naming a senior escalation owner who can make the call when an edge case arises. LPs don't hate KYC—they hate purposeless hurdles.
The direction of travel
Private markets are maturing quickly. LPs expect professionalism that matches institutional finance, but also the pragmatism to move deals at pace. The firms that will stand out are those that can demonstrate disciplined, proportionate compliance frameworks that comply with the purpose of AML/KYC rules without strangling the commercial realities of investing.
This growing sophistication reflects a broader move across the industry toward smarter, risk-based compliance. Asset managers want to move fast, but they also want to get compliance right—and that means moving beyond box-ticking to build genuinely intelligent processes.
That balance between caution and conviction, judgment and automation is where operational excellence now lives.
This is the second entry in Carta Law's series, Private Markets Compliance: The Operational Framework. Read the next entry here.
DISCLOSURE: This publication contains general information only and neither eShares, Inc. dba Carta, Inc. (“Carta”) nor Carta Law is, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication does not give rise to any lawyer-client relationship, is not a substitute for such professional advice or services and nor should it be used as a basis for any decision or action that may affect your business or interests. Before making any decision or taking any action that may affect your business or interests, you should consult a qualified professional advisor. Carta does not assume any liability for reliance on the information provided herein. © 2026 eShares, Inc. dba Carta, Inc. All rights reserved. Reproduction prohibited.
