A foundation is not a bank: it is not subject to the AML-CFT (anti-money laundering / countering the financing of terrorism) obligations set out in France's Monetary and Financial Code (Code monétaire et financier) the way financial institutions are. Does that mean it can disburse funds without looking? Certainly not — and those who assumed so found out the hard way that the nonprofit sector has been flagged by the FATF (Financial Action Task Force) for twenty years as vulnerable to misuse for terrorist financing. Between the fantasy of bank-style controls and the naivety of the blind-trust check, there is a middle path: proportionate, risk-based due diligence.
AML-CFT and Foundations: What "Due Diligence" Really Means When Funding Nonprofits
Reading time: ~6 min
Table of Contents
- What AML-CFT Does (and Does Not) Require of Foundations
- FATF Recommendation 8 and the Sector's Specific Risk
- Mapping the Risk in Your Funding Portfolio
- Proportionate Due Diligence Measures
- The Role of Beneficiary Traceability
- Mini FAQ
1. What AML-CFT Does (and Does Not) Require of Foundations
The formal anti-money laundering and counter-terrorist financing obligations (customer identification, suspicious activity reports to Tracfin — France's financial intelligence unit, asset freezes) fall on the regulated entities listed in the Monetary and Financial Code: banks, insurers, notaries, and so on. Foundations and endowment funds (fonds de dotation) are not listed as such. That said:
The sanctions and asset-freeze regime applies to everyone. Transferring funds to a person or entity listed on a freeze list (the French Treasury's national register, EU lists, UN lists) is prohibited for anyone — foundations included. Ignorance is no defense. Ordinary criminal law applies: knowingly (or through culpable carelessness) funding an entity involved in illicit activities can expose you to serious criminal charges. Public funders and banks pass their own obligations downstream: your bank applies its own due diligence to YOUR flows; outgoing transfers to high-risk areas without documented justification can freeze your operations.
2. FATF Recommendation 8 and the Sector's Specific Risk
FATF Recommendation 8 asks states to apply proportionate, risk-based measures to nonprofit organizations against abuse for terrorist financing purposes. It calls for neither screening every donor nor blanket suspicion — the FATF itself corrected, in 2016, the overzealous interpretations that were choking humanitarian action. What it asks funders to do in practice: know your beneficiaries, understand where the money goes, and be able to demonstrate it.
3. Mapping the Risk in Your Funding Portfolio
| Axis | Low Risk | Elevated Risk |
|---|---|---|
| Geography | Activity in France / the EU | Conflict zones, countries under sectoral sanctions, FATF "grey list" jurisdictions |
| Beneficiary | Established organization, published accounts, statutory auditor (CAC) | Recently created organization, accounts unavailable, opaque governance |
| Flows | Transfer to a French account, modest amounts | Cascading re-granting (your beneficiary re-transfers to local partners), cash, large amounts |
The third axis is the one most often overlooked: when your beneficiary itself funds implementing partners, your risk shifts to actors you cannot see.
4. Proportionate Due Diligence Measures, by Risk Level
Baseline (all funding): verification of legal existence, checking the Treasury's freeze register and EU/UN lists for the beneficiary and its officers, a written agreement with a traceability clause, and record-keeping.
Enhanced due diligence (sensitive areas or arrangements): screening extended to second-tier partners, requiring the beneficiary to have its own screening process in place, interim financial reporting, and an audit clause.
Red flags (in all cases): refusal to document how funds were used, unexplained changes to banking details, and discrepancies between the narrative report and the financial statements.
The key point: every measure must leave a trace. Due diligence that is exercised but not documented does not exist — not for your statutory auditor, not for a judge, and not for the press.
5. The Role of Beneficiary Traceability
Your due diligence stops where your beneficiary's opacity begins. That's why the most advanced foundations reframe the question: instead of multiplying their own after-the-fact checks, they favor beneficiaries whose management is traceable by design.
An NGO running on Abvius automatically screens its own third parties (suppliers, local partners) against sanctions lists — including those second-tier partners you never see — blocking payments on any unresolved alert and attaching a certificate to each project's audit file. For you, as a funder, that changes the equation: the full chain — "your grant → the project → screened third parties → justified expenses" — exists in one place, demonstrable at any time. Your AML-CFT due diligence becomes a selection criterion rather than a compliance burden. And as a bonus, that same transparency gives you the material for credible reporting: instead of saying "we trust them," you can show exactly how the money worked.
6. Mini FAQ
Do we need to screen our donors?
For a grantmaking foundation, the main risk lies downstream (with beneficiaries), not upstream. A gift-acceptance policy with graduated scrutiny for large or unusual donations is sufficient in most cases.
Does a donation to a French nonprofit operating abroad expose us to risk?
Your exposure depends on the nonprofit's own controls: if it screens its local partners and suppliers and can prove it, your risk is controlled and documented. If not, it's your name that ends up at the far end of the chain — which is exactly why it's worth making this a criterion in your review process.
Is there a legal requirement for a foundation to screen its beneficiaries?
There is no general screening requirement — but the absolute prohibition on making funds available to a frozen person or entity does apply. Screening is the reasonable way to comply with that prohibition. Our screening guide details the lists and the method.
Summary
Foundations are not regulated AML-CFT entities, but they operate under the same sanctions regime as everyone else, and under FATF scrutiny as an at-risk sector. The answer is neither paranoia nor blind trust: it is proportionate, documented due diligence built on the real traceability of your beneficiaries. To go further: the republican commitment contract, how to track fund use, and AML-CFT compliance for NGOs. To see how Abvius equips nonprofits with built-in screening and an audit trail, contact our team via abvius.org.