October 15, 2026 : A $1.21 Billion Reminder: Due Diligence is not what sits in the file. It is what the file can prove.

A recent enforcement action resulted in more than $1.21 billion in penalties against one of the world’s largest and most established banks for what regulators described as widespread AML and sanctions compliance failures. FinCEN said that BofA failed to timely report more than $5 billion in suspicious transactions and identified deficiencies in its customer due diligence and suspicious activity processes.

The message is timely: if your firm cannot show who reviewed the information, how concerns were resolved, and why the relationship was approved, a folder full of documents will not protect the decision – or the people accountable for the decision.

Hedge funds and institutional asset managers may not operate on the same scale or face the same regulatory obligations as a multinational bank. But the practical lesson carries over to their compliance teams: collecting information, running searches, or relying on administrators and other third parties is not enough.

Passports, corporate documents, and database results establish what information was collected. They do not establish that anyone connected the dots, resolved discrepancies, escalated risks, or documented why the relationship was approved.

When regulators, auditors, investors, or senior management ask what due diligence was performed, “the documents are in the folder” is not a sufficient answer. The firm must be able to show that the information was reviewed, assessed, escalated where necessary, and reflected in a documented approval decision.

BUILDING A DUE DILIGENCE REPORT

A concise customer or counterparty Due Diligence Report brings the evidence together and makes the reasoning behind the decision clear.

It should answer five essential questions:

• Who was reviewed? The customer or counterparty, its owners and controllers, and any other relevant individuals or entities.

• What was checked? Identity, ownership, regulatory status, financials, sanctions, PEPs, litigation, adverse media, and other relevant sources.

• What was found? The material results – not a dump of every search hit.

• How were issues handled? False positives, gaps, inconsistencies, escalations, and judgment calls.

• Why did the firm proceed? The conclusion, any conditions imposed, and the approval supporting the decision.

A useful report does not overwhelm reviewers with every search result. It separates material findings from immaterial noise, identifies the points that require judgment, and gives the right people a clear basis to approve, escalate, or decline the relationship.

EVIDENCE MATTERS. SO DOES THE STORY IT TELLS.

The report should sit alongside the full search outputs, source documents, key correspondence, and written approvals. A simple tracker can record who completed each step, when it was completed, and where the supporting evidence is stored.

Together, those materials show more than process. They show that the information was reviewed, the difficult points were resolved, and the basis for the firm’s decision was documented.

A DEVELOPED SCALABLE PROCESS FOR A FLAT FEE

We help hedge funds and institutional asset managers scope the review, conduct or coordinate the searches, organize the evidence, identify issues for escalation, and prepare a clear, file-ready Due Diligence Report. The firm retains responsibility for the final risk assessment and approval decision.

Koya Law has built a process that does not burn partner hours and scales based on client needs. We utilize AI and an inhouse system customized for tracking our progress and maintaining a detailed history. Trained analysts handle the heavy lifting, with focused partner oversight where judgment matters. The result is thorough, defensible diligence delivered efficiently – for a predictable flat fee.

For legacy files, we reconstruct the record, identify what is missing, and distinguish the diligence that was actually performed from the gaps that need attention. This gives compliance and legal teams a practical remediation plan before an auditor, regulator, investor, or senior stakeholder asks for one.

What would your diligence files prove today?

Martie Evans | mevans@koyalaw.com | (312) 219-8485

Disclaimer: This article is for general informational purposes only and does not constitute legal or other professional advice.