Trust, but verify: what our sector can borrow from banking

In July 2025, Britain's financial regulator fined Barclays, one of the country's biggest banks, £42 million. Part of the reason was a mistake that a few minutes of checking would have prevented. An investment firm asked Barclays to open an account to hold its customers' money. Barclays opened it without checking whether the firm was allowed to hold other people's money. It was not, and the regulator's public list of approved firms would have shown that.¹ Customers went on to put £34 million into the account.²

I spent five years at EY in New York helping banks avoid this kind of mistake. The work came down to one question: who are we really dealing with? Banks ask it before they open an account, and they keep asking for as long as the account stays open.

In the social sector, we usually choose partners on reputation, a trusted introduction and a few good meetings. That instinct is not wrong, but it is not enough. Trust holds best when it rests on something you have checked. So I would turn the old saying around: verify, so that you can trust.

Good intentions are not a check

Many of us think of due diligence as something banks do to us. In fact, charity regulators have long asked charities to do the same. The UK's Charity Commission expects trustees to know who their donors and partners are.³ Its checklist for taking on a new partner includes checking government sanctions lists and searching local news for links the partner has not mentioned.⁴ Sanctions lists name people and organisations that it is illegal to fund or do business with.

The American University of Beirut learned this the hard way. Between 2007 and 2009, the university, which received grants from USAID, the US government's aid agency, ran journalism training that included staff from two media organisations on the US sanctions list. It also included a third sanctioned organisation in a list of NGOs it shared with students. In 2017, the university paid USD 700,000 to settle a case brought by the US government. It accepted the facts and agreed to put proper checks in place.⁵ One search of a public list would have prevented it. All three organisations were on that list for anyone to see.

The checking already happens the other way round: banks and corporate funders routinely check the NGOs they work with.⁶⁷ What is often missing is our own check on the partners we choose. A registration number only tells you that an organisation exists. It does not tell you who runs it, what has been reported about them, or whether the people associated with it carry any risk.

A matching name is not proof

Checking badly is its own risk. Most screening works by matching names, and names are unreliable. A name written in Hindi or Arabic can be spelt several ways in English, and many people share the same name. A 2024 research study found that more than 90 per cent of sanctions screening alerts were false alarms of exactly this kind.⁸ I saw the same pattern at EY, and more recently when advising a large global payments company on its screening rules: far too many alerts, very few real problems, and investigators spending most of their time clearing false alarms instead of looking at genuine risks.

In a bank, a false alarm mostly wastes time. In our sector, it can damage a reputation. If a funder hears that a grantee’s director “appears on a watchlist”, and nobody checks whether it is actually the same person, a good organisation can lose support because of someone else’s record. A wrong red flag can do as much harm as a missed one.

The opposite mistake is just as easy: assuming that an organisation with little information about it must be hiding something. Many small, honest organisations leave very little trace in public records. At TransUnion CIBIL, the Indian credit bureau, I spent years building ways to judge small and mid-size businesses that had little or no borrowing history. The lesson applies here too: missing information is a question to ask, not an answer. Every possible match, and every gap, needs someone to ask two questions. Is this really the same person or organisation? And is this just an accusation, or has it been proven?

Checking protects both sides

An NGO has as much right to know who it takes money from as a funder has to know who it gives money to.

Due diligence is often seen as something the more powerful side does to the weaker one. In practice, it protects everyone who is about to make a commitment: the funder that wants its money to reach the work, the NGO that wants to know whose money it is taking and what that could mean for its reputation, and the company that needs its partner to deliver what was promised.

Even people who champion trust agree. The Trust-Based Philanthropy Project, a movement that encourages funders to give long-term grants with no strings on how the money is spent, lists "do the homework" as one of its six core practices.⁹ It asks funders to do their own research on the organisations they plan to fund, rather than making those organisations prove themselves through lengthy paperwork.¹⁰ And the right to check runs both ways. An NGO has as much right to know who it takes money from as a funder has to know who it gives money to.

How much checking is enough?

You do not need to work at a bank's scale. Banks must check every customer and watch every transaction. An NGO or funder only needs to check the partners it is about to commit to, but for those few, the check should be just as careful. The depth can also vary: a small local partner you have worked with for years needs a different level of checking from a large first donation from someone you do not know.

What matters most is timing. Check before you commit, not after. A concern raised before any money moves is a conversation. Found afterwards, it is a crisis.

Whatever the size of the relationship, four habits do most of the work:

1. Check the people, not just the organisation: the board, the owners and the main partners.
2. When a name comes up, confirm it is really the same person, and keep accusations separate from proven facts.
3. Write down what you checked and what you could not check.
4. Check again when something important changes.

A concern raised before any money moves is a conversation. Found afterwards, it is a crisis.

Trust without holding your breath

Trust is what our sector runs on. When it breaks, it breaks in public, and usually at the worst possible moment. Checking is not the opposite of trust. It is what lets you trust someone without holding your breath. Banks learned that the hard way, through fines and headlines. We don't have to.