AML, CTF and KYC: The fund operations mandate

Author:

The Carta Team

|

Read time:

10 minutes

Published date:

20 November 2025

This article explains the core anti-money laundering and counter-terrorist financing regulations, as well as the importance of establishing a robust AML and CTF programme to protect your fund from the consequences of non-compliance.

Contents: Do AML and KYC apply to special purpose vehicles?

• AML, CTF and KYC: The fund operations mandate
• What is money laundering?
• What is terrorist financing?
• Stages of terrorist financing
• What is anti-money laundering (AML)?
• AML vs. KYC in fund operations
• Anti-money laundering and counter-terrorist financing regulations
• Regulators and supervisory bodies
• Sanctions implementers
• Guidance and standard setters
• Key regulations and legislation
• AML and CTF programmes for private funds
• 1. Customer due diligence (CDD)/Know your customer (KYC)
• 2. Risk assessment and screening
• 3. Enhanced due diligence (EDD) for high-risk investors
• 4. Continuous investor monitoring
• The severe consequences of non-compliance
• Criminal and civil penalties
• Reputational damage
• Regulatory action and licence revocation
• Failure to prevent offences
• Streamlining compliance with an integrated fund platform
• Frequently asked questions about AML and KYC
• Who is subject to AML regulations?
• What is an AML programme?
• What are the three stages of money laundering?
• What are the pillars of an AML compliance programme?
• Do AML and KYC apply to special purpose vehicles?

What is money laundering?

Money laundering is the process of disguising the origin of funds (i.e. making illegitimate funds to appear legitimate). It is a criminal offence, as defined under:

• Article 506-1 of the Luxembourg Penal Code, or
• Section 327, 328 or 329 of the UK’s Proceeds of Crime Act 2002

Money laundering involves moving funds through complex transactions to make it appear clean (hence the term “laundering”). The laundered money is then integrated back into the legitimate financial system, appearing as normal business profits or assets. Private funds can be an attractive entry point to this process, due to their potential for high returns and anonymity.

What is terrorist financing?

Terrorist financing is defined in Article 135-5 of the Luxembourg Penal Code and Section 15 of the UK Terrorism Act 2000 as the unlawful act of providing money, assets or goods with the knowledge or intention that they will be used to carry out a terrorist act.

Stages of terrorist financing

1. Raising: funds are acquired from both legitimate sources (e.g. charities or businesses) and illicit sources (e.g. drug trafficking or kidnapping).
2. Moving: funds are stored, concealed and transferred across borders or between individuals and entities.
3. Using: funds are deployed or used to execute the intended terrorist acts.

For more detail on the ways that terrorist organisations exploit the financial sector, read the US government’s 9/11 Commission Report.

What is anti-money laundering (AML)?

Anti-money laundering refers to the set of laws, regulations and internal procedures that require financial institutions to detect, prevent and report suspicious financial activity – such as terrorist financing and other crimes.

AML vs. KYC in fund operations

The distinction between AML and KYC determines the role they play throughout a fund’s lifecycle. While AML is the continuous programme that governs the fund from formation to wind-down, KYC is a specific component of the overall AML framework.

• KYC is foundational: It's the data collection and identity verification process that provides the raw material for an AML risk assessment. Without a robust KYC procedure for every investor, the AML programme has no defensible basis.
• AML is structural: It's the overarching compliance framework that uses KYC data to perform ongoing monitoring, risk management and mandatory reporting to regulatory bodies.

Anti-money laundering and counter-terrorist financing regulations

The AML/CTF landscape in the UK and Europe is informed by several key regulations, government bodies and non-governmental organisations. While you don't need to be a legal expert, understanding the main players provides important context for your compliance programme.

Note that this is not an exhaustive list, and fund managers (or "obligated entities") must implement an AML/CTF programme as advised by their Money Laundering Reporting Officer (MLRO) or Compliance Officer (the “responsible person”).

Regulators and supervisory bodies

• Financial Conduct Authority (FCA): the UK’s main financial regulator, responsible for administering and enforcing AML/CTF legislation, issuing guidance and collecting suspicious activity reports.
• Commission de Surveillance du Secteur Financier (CSSF): drives the AML/CTF regulatory framework in Luxembourg.
• Administration de l'enregistrement, des domaines et de la TVA (AED): Luxembourg’s Registration Duties, Estates, and VAT Authority.
• Jersey Financial Services Commission (JFSC).
• Guernsey Financial Services Commission (GFSC).

Sanctions implementers

• United Nations (UN): establishes international sanction regimes that are implemented and enforced by individual member states.
• Office of Financial Sanctions Implementation (OFSI).
• Office of Foreign Assets Control (OFAC).

Guidance and standard setters

• Financial Action Task Force (FATF).
• Wolfsberg Group : produces industry guidance and standards.
• Joint Money Laundering Steering Group (JMLSG).

Key regulations and legislation

AML and CTF programmes for private funds

Anti-money laundering and counter-terrorist financing programmes have several purposes: to prevent private funds from being used for illicit purposes, protect investors and maintain the fund’s integrity within the financial ecosystem.

These ongoing programmes cover everything from investor screening to transaction monitoring and reporting to appropriate authorities. As “obligated entities”, fund managers are required to establish and maintain AML/CTF controls:

1. Customer due diligence (CDD)/Know your customer (KYC)

Customer due diligence is the formal process of collecting, verifying and assessing client information. CDD ensures that funds verify investors’ identities and monitor their business activities for potential red flags before establishing a business relationship.

The documentation collected to identify a prospect is called “know your customer” (KYC). Funds must undertake suitable KYC to verify the identity of their customers – such as investors or transaction counterparties.

Ultimate Beneficial Ownership (UBO)

Under CDD/KYC, the obligated entity is also legally required to identify and verify the UBO and underlying principal of any corporate structure. The UBO is the natural person who ultimately owns or controls the entity (typically holding >25% capital or voting rights), even if legally held by another entity.

2. Risk assessment and screening

The information collected during the CDD step is then used to identify, assess and understand the risks posed by the fund’s relationship with a customer.

• Verify identity: confirm the authenticity of the KYC documentation and information provided.
• Understand the purpose: document the reason for an investment and the nature of the business relationship.
• Screening: check the investor’s name against global watchlists, sanctions lists and lists of Politically Exposed Persons (PEPs) who are in positions of authority and potentially at risk of bribery or corruption.

3. Enhanced due diligence (EDD) for high-risk investors

If the initial CDD process flags a potentially high-risk investor, fund managers must perform enhanced due diligence (EDD). This more comprehensive investigation involves collecting additional documentation, such as evidence of their source of wealth (SOW) and source of funds (SOF).

4. Continuous investor monitoring

Customer due diligence does not end at closing. Continuous monitoring involves periodically screening investors against relevant sanctions lists to keep KYC data up to date, be aware of any changes to an investor's risk profile and compare that risk profile to the firm’s documented risk assessment.

Suspicious Activity Reporting (SAR)

If any suspicion of money laundering or terrorist financing arises, the fund must submit a confidential internal report to the Money Laundering Reporting Officer (MLRO).

The severe consequences of non-compliance

Failure to comply with AML and CTF regulations can result in serious penalties for fund managers and obligated entities – from reputational damage and operational disruptions to asset confiscation and other financial sanctions.

Criminal and civil penalties

Regulators can impose substantial fines on VC and PE firms as well as responsible individuals.

Reputational damage

Non-compliance leads to a loss of trust from the market, damaging relationships with investors, business partners and employees.

Regulatory action and licence revocation

Authorities have the power to suspend or revoke a fund's operating licence or registration.

Failure to prevent offences

Jurisdictions like Jersey have introduced an offence of “failing to prevent money laundering”.

Streamlining compliance with an integrated fund platform

Managing AML and KYC with disconnected tools is a recipe for operational bottlenecks and costly errors. Time spent on manual processes could be better spent on more strategic activities.

Carta helps private funds manage investor risk with an integrated KYC solution that reduces administrative overheads and offers continuous protection against fraudulent activity.

Frequently asked questions about AML and KYC

Who is subject to AML regulations?

UK and European laws require financial institutions, including banks and private investment funds, to comply with AML regulations.

What is an AML programme?

An AML programme is a set of procedures designed to combat money laundering, terrorist financing and threats to the integrity of the European financial system.

What are the three stages of money laundering?

The three recognised stages of money laundering are:

1. Placement: illicit funds are initially introduced into the financial system.
2. Layering: the funds are moved through complex transactions to obscure their origin.
3. Integration: the "cleaned" money is returned to the criminal from what appears to be a legitimate source.

What are the pillars of an AML compliance programme?

A compliant AML programme generally has four pillars:

1. A designated compliance officer.
2. Written internal policies and controls.
3. Ongoing employee training.
4. Independent testing or auditing of the programme to confirm it is effective.

Do AML and KYC apply to special purpose vehicles?

Yes, AML and KYC requirements apply to special purpose vehicles (SPVs), just as they do to traditional fund structures. You must vet each investor in an SPV to confirm the vehicle is not being used for illicit purposes.