Regulated asset management firms in the UK, EU, and U.S. are required to comply with applicable anti-money laundering (AML) regulations to help prevent financial crime.
On the investment side, this means carrying out know your customer (KYC) checks on deal counterparties both at the outset of the investment and implementing appropriate ongoing KYC throughout the relationship.
While KYC guidelines are nothing new, recent revisions to EU AML regulations and the U.S. FINCEN investment adviser rule have seen audits on AML compliance rise. Increasingly, this is focusing on how customer due diligence (CDD) and KYC programs satisfy the need for periodic refresh KYC, whether ongoing monitoring of transactions and key counterparties is being carried out, and whether records are being maintained for up to five years after the investment ends.
In Carta Law's experience, these requirements are often missed or handled as an afterthought to the initial KYC work. Investment teams change, staff leave, and records can be lost or regular screening deprioritized. There is also often sensitivity at play, balancing the need for regulatory compliance with being a supportive and pragmatic business partner—that is, not bombarding your portfolio companies with constant KYC requests.
Implementing an ongoing monitoring KYC framework
What do you need to do to stay compliant without adding extra workloads to your team?
The first step is to have a documented process—not just for investment KYC at the time of investment, but also for ongoing monitoring and periodic remediation.
Part of this process means establishing whether you manage these workstreams in-house or outsource them to a third-party provider. The regulators' increased focus on AML means getting it right is essential. This requires both in-depth understanding of applicable regulations and guidelines, as well as substantial market experience to understand how the rules are applied in practice. In addition, access to the necessary databases and systems can be expensive, and the screening searches are resource-heavy.
When considering outsourcing, there are typically three options:
Purchase an AML and KYC technology solution. The key challenge here is that results tend to be binary and do not take into account complexities or case-specific nuances. Existing solutions are also generic, usually focused on vendor and supplier management, and not specific to private equity or asset managers' needs. Without an expert to review results before a transaction is approved, nuances between markets, investment types, and specific risk factors can be missed.
Outsource to a large law firm or Big 4. These engagements typically come with a large price tag, given large law's tendency to charge hourly rates. Because of the nature of the work, AML diligence is handled by junior team members who may not have the expertise or market experience to tackle the complexities of an effective investment KYC process. In Carta Law's experience, to mitigate this, these types of firms often use an excessively rigid approach to risk-weighting, which can result in inefficient processes. Depending on the provider, they may also have access only to their in-house databases, limiting the level of detail available.
Engage a specialist KYC provider. This approach typically combines the best of both options: expert KYC specialists who have access to and are enabled by the latest technology, and who have experience working with private markets. It is important to understand who is delivering a KYC report and what experience the team has. Are they senior enough to have experience across different jurisdictions or deal types? What is their approach and how does it align with your risk profile?
While the list above is not exhaustive, several benefits come with outsourcing to the right provider:
You lower your risk level by outsourcing to an independent third party
You gain access to a much greater depth of market experience, ensuring your program fits within your peer group
Compliance teams are increasingly stretched—by outsourcing, you can free up your team for higher-value, more strategic projects
Once you have decided on your chosen approach—in-house or outsourced—it is then a matter of ensuring that your ongoing compliance obligations are met.
Best practices for maintaining ongoing compliance
Once the initial onboarding KYC is completed, busy in-house teams may find it challenging to stay on top of their obligation to carry out ongoing monitoring and refresher checks. With regulatory monitoring on the increase, firms need effective solutions to help ensure compliance without adding to their teams' workloads. If working with a partner, it is important to ask how they approach each of these areas to help support your compliance needs.
Use technology for reminders, alerts, and automatic monitoring. There are a number of technology solutions that can streamline your ongoing compliance efforts. These tools can send reminders for upcoming checks, generate alerts for suspicious activities, and automate the monitoring process.
Conduct regular checks and maintain a detailed audit trail. Consistency is key when it comes to ongoing compliance. Schedule regular checks to ensure that you are meeting regulatory requirements and not exposing yourself to undue risk. It is also important to maintain a detailed audit trail of all compliance activities, documenting each step of the process and any decisions made. This not only helps demonstrate your commitment to compliance but also provides a comprehensive record for regulatory purposes. The frequency of manual refresher checks is typically risk-based, and it is one of the most common questions Carta Law's team is asked when discussing ongoing monitoring with clients.
Create efficiencies and implement automated workflows. Look for opportunities to create efficiencies within your compliance processes. Implement automated workflows wherever possible to reduce manual effort and minimize the risk of human error. By streamlining your workflows, you can improve the accuracy and effectiveness of your ongoing compliance efforts while freeing up valuable time for your team to focus on higher-value tasks.
Recognize the value of a compliance or legal expert. While technology can enhance your compliance efforts, it is essential to recognize the value of having a compliance or legal expert involved in the process, whether by way of an escalation or sign-off mechanism as issues arise. Specialist knowledge of AML and KYC regulations provides continuous expertise and guidance, helping your team interpret the results generated by these tools and—as importantly—recognize when something is not an issue worth spending time on.
By incorporating these best practices into your ongoing compliance strategy, you can strengthen your firm's ability to meet regulatory requirements, mitigate the risk of financial crimes, and manage counterparty reputational risks across the business.
This is the fourth entry in Carta Law's series, Private Markets Compliance: The Operational Framework. Read the next entry here.
DISCLOSURE: This communication is on behalf of eShares, Inc. dba Carta, Inc. ("Carta"). This communication is for informational purposes only, and contains general information only. Carta is not, by means of this communication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services nor should it be used as a basis for any decision or action that may affect your business or interests. Before making any decision or taking any action that may affect your business or interests, you should consult a qualified professional advisor. This communication is not intended as a recommendation, offer or solicitation for the purchase or sale of any security. Carta does not assume any liability for reliance on the information provided herein. ©2026 Carta. All rights reserved. Reproduction prohibited.
