How to conduct a due diligence review on a new business partner

Selecting a new business partner can strengthen a financial-services business, but it can also create third-party, financial-crime, privacy and operational risks. A due diligence review should turn those risks into documented evidence and a clear decision, rather than relying on reputation, a polished pitch deck or the partner’s largest clients.

For Australian organisations, the depth of review should reflect the product, customer type, transaction, data access and regulatory reliance. This means checking whether a prospective counterparty is appropriately registered, capable and honest, then setting proportionate conditions before onboarding. The same discipline is needed when a relationship is expanded, outsourced or moved to another jurisdiction.

Define the scope and decision rights

Start with the proposed relationship: the service, payment flow, customer journey, systems touched, subcontractors and countries involved. These details determine what could fail and which evidence is relevant.

Assign a decision owner, identify the business sponsor and record who can approve, impose conditions or decline the relationship. Higher-risk engagements involving customer funds, sensitive data, complex entities or overseas operations warrant enhanced due diligence and independent review.

In Australian offices, “run it past the risk team” may sound informal, but the resulting record still needs evidence, an owner and a deadline. Clear governance prevents a partnership from being approved informally before its risks have been assessed.

Verify identity ownership and authority

For an Australian entity, confirm its Australian Business Number and check corporate details against the relevant ASIC and business registers. Request incorporation documents, constitutional records and director or member lists, since the names and legal structure shown in a contract may not reflect the actual decision-makers.

Identify and verify every beneficial owner, controlling party and authorised representative. Establish who can sign, instruct or receive confidential information, and look for nominee arrangements, conflicting interests, undisclosed agents or links to adverse media. Independent ownership evidence is more reliable than statements repeated by the prospective partner.

International partners require equivalent checks in their home jurisdictions, supported by current registry extracts, certified documents and verified bank details. Confirm that the proposed signatory has authority and that subcontractors or related parties are disclosed before the agreement is signed.

Assess regulatory and financial-crime exposure

Determine whether the partner is regulated and whether its activities create obligations under Australia’s anti-money laundering and counter-terrorism financing framework. AUSTRAC requirements depend on the partner’s role, so outsourcing must not be assumed to transfer a reporting entity’s duties. Regulatory status, licences, enforcement history and compliance ownership all belong in the review.

If personal information will be handled, assess compliance with the Privacy Act 1988 and the Australian Privacy Principles. Record what data is collected, why it is needed, where it is stored and which overseas entities can access it. Contractual privacy safeguards should match the actual data flow rather than a generic information-security statement.

Financial-crime screening should cover sanctions, politically exposed persons, adverse media, fraud, bribery and organised-crime indicators. Apply enhanced checks where ownership, geography or activity increases exposure, while recording the source and date of every result. Where specialist competence is needed, Summit Finuas Network’s approved training providers directory can support trainer or course selection, subject to procurement and accreditation checks.

Test capability controls and resilience

Request evidence rather than assurances: policies, risk frameworks, control testing, audit reports, business-continuity plans, incident records and service-level performance. Test whether the partner has resources and oversight suited to the importance and complexity of the work, including access controls, reconciliation, complaints handling and regulatory reporting.

People and processes matter as much as technical controls. Confirm that relevant roles have appropriate competence, mandatory training and clear escalation paths, and investigate unusually high turnover or unexplained gaps in segregation of duties. Any remediation plan should be role-based and measurable, using the skills development guidance available through Summit Finuas Network.

Operational resilience can be affected by cross-border dependencies. A service provider in Sydney may rely on development or processing teams elsewhere, while a Melbourne-based organisation may depend on overseas cloud infrastructure. Examine concentration risk, disaster recovery, backup arrangements, recovery-time objectives and the partner’s ability to support Australian customers during local disruptions.

Set contractual safeguards and monitoring

The agreement should define scope, responsibilities, service levels, reporting obligations, confidentiality, data protection, audit rights and change-control procedures. Include protections for regulatory access, subcontracting, security incidents, business continuity and termination. Exit provisions should specify how data, records and knowledge return to the business if the relationship ends.

Allocate risk clearly. If the partner handles customer communications, payment instructions or complaints, specify which decisions it may make independently and which require written approval. Regulatory obligations should remain with the entity that holds the licence or legal responsibility.

Local context can reveal practical gaps. For example, a Sydney marketing agency handling customer data for a Melbourne fund should be assessed under Australian privacy requirements, while its offshore processing team requires separate scrutiny. The contract should also allow prompt reassessment when ownership, subcontractors, locations or control environment materially change.

Weigh evidence and record the decision

Compare the evidence against predetermined risk criteria and distinguish verified facts from claims, assumptions and unresolved gaps. The result may be approval, conditional approval, escalation or rejection; vague acceptance creates weak governance and unclear accountability.

Review area	Lower-risk profile	Higher-risk profile	Evidence needed
Identity and ownership	Transparent ownership and verified authority	Complex ownership or restricted information	Registry checks, ownership evidence and signed authority
Regulatory exposure	Clear licence and compliance structure	Unclear status or overseas regulatory reliance	Licence records, governance documents and remediation history
Financial crime	Low-risk products and customers	High-risk jurisdictions or transaction types	Sanctions checks, source-of-funds evidence and monitoring data
Controls and resilience	Proven controls with tested recovery	Limited testing or concentrated dependencies	Audit results, continuity plans and incident records
Contract and monitoring	Standard protections and clear reporting	Material outsourcing or rapidly changing activity	Audit rights, change controls and agreed review triggers

Record the decision, supporting documents, reviewers, unresolved issues, conditions, deadlines and accountable owners. An approval should have an expiry date or refresh trigger, while material adverse findings should be escalated and reassessed.

Finally, retain the review record under the organisation’s governance and privacy requirements. A defensible due diligence outcome is not simply a signed contract; it is a traceable, time-limited decision supported by evidence appropriate to the Australian market and the risks the relationship creates.