What does the Charity Commission say about due diligence for grant-makers?

The Charity Commission says trustees must carry out due diligence checks on donors, beneficiaries and partners, and monitor the end use of funds. The guidance is chapter 2 of its compliance toolkit, "Charities: due diligence, monitoring and verifying the end use of charitable funds", published 3 January 2011.

What is "know your partner" in Charity Commission guidance?

"Know your partner" is Tool 8 in chapter 2 of the compliance toolkit. It lists key issues for trustees to consider about an organisation they fund or work with: its status and governance, key personnel, past relationship, financial controls, monitoring arrangements and operating risks.

What are the Charity Commission's core principles of due diligence?

Tool 16 of the toolkit lists five: identify who you are dealing with; verify identities where reasonable and risks are high; know what their business is; know what their business is with your charity; and watch out for unusual or suspicious activity, conduct or requests.

Does CC8 apply to grant-making charities?

Yes. CC8, "Internal financial controls for charities", says all charities need financial controls regardless of size. Section 6.9, "Expenditure on grants", covers grants a charity makes. It expects a policy on reviewing applications, checking the suitability of applicants, setting grant conditions and confirming that grants were used correctly. The Commission updated CC8 on 27 November 2024.

How much due diligence is enough for a small grant?

The Commission expects due diligence that is proportionate to the risk. Tool 16 says to verify identities "where reasonable, and the risks are high". A small, repeat grant to a known organisation needs lighter checks than a large first award. Record the level you chose and why.

Does the Charity Commission guidance apply in Scotland?

No. Scottish charities are regulated by OSCR, the Scottish Charity Regulator, which publishes its own guidance. Cross-border charities registered with both regulators must satisfy each. This article covers the Charity Commission for England and Wales only.

What should an AI due diligence policy for grant funders include?

Five things: what the AI may do, what it may not do, what data it may receive and where that data is processed, who reviews its output and how, and how each check is recorded. Add the action you take in each risk band, and the name of the person who approved the policy.

Should AI be allowed to score a grant applicant?

We recommend not. A score should come from a fixed formula that gives the same result for the same record every time, so you can explain it to a panel or an auditor. AI is better used to read the record and explain it in plain English for a person to check.

What data should an AI due diligence tool receive?

As little as possible. It needs the applicant’s name and registered numbers to find the public record, and nothing else. Your policy should state where that data is processed and confirm that application data, grant records and personal data stay inside your own system.

Does using AI change your due diligence duties?

No. Your duties come from your policy, your funder agreements and any standards you follow. An AI tool gathers and explains the public record. It does not certify that you have met any duty, and your process still needs to show what you checked and why you decided as you did.

How does the Flexigrant AI Due Diligence Checker fit these parameters?

It is built to them. A fixed formula scores five factors and the AI only writes labelled analysis notes. Only the typed name and numbers are sent, processed in the EU. Access is limited to Manage Grants users by default and can be restricted by role or switched off. Every item links to its source record.

Can you restrict who uses the AI Due Diligence Checker in Flexigrant?

Yes. By default, any user with Manage Grants access can run a check. The GMSAIDueDiligence role narrows that to named users, and a tenant setting switches the checker off for your whole organisation. You request either change by raising a ticket on the support portal.

See the parameters working on your own applicants

Book a demo, and we will run the checker on organisations you name and show you how each of your five parameters holds on screen.

Where is the AI Due Diligence Checker in Flexigrant?

It sits in the Manage Grants menu under AI Due Diligence. Any user with access to Manage Grants can open it by default. If you cannot see it, your administrator may have restricted access or switched the checker off for your organisation.

Do you need a company or charity number to run a check?

No. You can search by organisation name alone. We recommend adding the number because registered names often differ from trading names, and a number takes the checker straight to the right record. A Scottish charity number is required if you want OSCR included.

Why does the check show no OSCR section?

The checker searches OSCR, the Scottish Charity Regulator, only when you enter a Scottish charity number. If you searched by name or by an England and Wales number alone, the OSCR section does not appear. Add the Scottish number and run the check again.

What does the risk score percentage mean?

A fixed formula scores five factors and shows the result as a percentage of the factors it could assess. Factors with no data are left out rather than guessed. The percentage falls into one of three bands: Low (0 to 30%), Medium (31 to 60%) and High (61 to 100%).

Can you rely on the AI analysis notes?

Treat them as a starting point. The notes are labelled as AI-generated commentary and can misread a record. Every item on the results page links to its source, so check each point against the register before you rely on it or repeat it in a paper.

Does the check use data from your Flexigrant applications?

No. The checker sends only the organisation name and registered numbers you type. It does not use application data, grant records or anything else held in your Flexigrant tenant. Processing takes place in the EU.

What should you do if the checker finds no match?

Check the number you entered for a typing error and try again. If you searched by name, find the registered name and number on the register and search with those instead. Some organisations, such as small unincorporated groups, have no registered record to find.

When did the failure to prevent fraud offence come into force?

The offence came into force on 1 September 2025. It applies to fraud committed on or after that date by a person associated with a large organisation. The Home Office confirmed the date in its statutory guidance, first published on 6 November 2024.

Are charities covered by the failure to prevent fraud offence?

Yes, some are. A charity is covered if it is incorporated, such as a charitable company or CIO, and passes the large organisation test. That test requires two of three thresholds in the previous financial year: more than 250 employees, £36 million turnover, or £18 million in total assets.

What is the defence to the failure to prevent fraud offence?

The defence is that the organisation had reasonable fraud prevention procedures in place. The Home Office guidance describes six principles: top level commitment, risk assessment, proportionate procedures, due diligence, communication and training, and monitoring and review. The organisation must prove the defence.

Is a grant recipient an associated person?

Usually not. An associated person performs services for or on behalf of the organisation. A grantee that spends a grant on its own work receives a benefit rather than acting for you. A partner that delivers your programme in your name may be an associated person, and that depends on the facts.

How does a grant-making charity work out if it is a large organisation?

Apply the two of three test to the previous financial year: employees, turnover and total assets. The Charity Commission's regulatory alert of 4 February 2025 frames the turnover test as "£36m of income", so apply it to total income in your accounts. Take professional legal advice if you sit close to the line.

Does the offence apply to public bodies such as councils?

Yes, where they meet the size thresholds. The Home Office guidance names NHS trusts and local authorities as examples of public sector organisations that can be in scope. Government departments and arm's length bodies should also read the Government Functional Standard for grants, GovS 015.

Do register checks on grantees satisfy the reasonable procedures defence?

No single check satisfies the defence. Reasonable procedures are a whole framework, from board commitment to monitoring and review. Register checks can form part of the due diligence principle, and you should document how they fit your wider fraud risk assessment.

Who can use the AI Due Diligence Checker by default?

Any user with access to the Manage Grants menu in Flexigrant can run a check. The checker ships this way in v4.66. If that is wider than you want, the GMSAIDueDiligence role lets you restrict access to named users.

What is the GMSAIDueDiligence role?

It is a dedicated role in Flexigrant that restricts the AI Due Diligence Checker to the users who hold it. Once the role is enabled for your tenant, users without it cannot run checks. You ask for it by raising a ticket on the support portal.

How do you switch off the AI Due Diligence Checker?

Raise a ticket on the support portal and ask for the AI Due Diligence tenant setting to be switched off. Once applied, nobody in your organisation can run a check. To switch it back on later, raise another ticket.

Can you keep the checker on but limit who uses it?

Yes. That is what the GMSAIDueDiligence role is for. The checker stays available to the users who hold the role and unavailable to everyone else. The tenant setting is the stronger option and removes the checker for everyone.

Does the checker send our Flexigrant data anywhere?

No. It sends only the organisation name and registered numbers that the user types into the search. No application data, grant records or personal data from your Flexigrant tenant leaves the system. Processing takes place in the EU.

Where do you raise the ticket?

On the Flexigrant support portal, the same place you raise any other support request. State whether you want the GMSAIDueDiligence role enabled, and for whom, or the tenant setting switched off. Keep the ticket reference for your records.