Aid Subgrants: Fair Risk Sharing for Local NGO Deals

Localisation is often described as moving money and decision-making closer to the communities where programmes are delivered. The contract tells us whether that promise is real. An international NGO may describe a local organisation as a partner, yet hand it a subgrant that transfers every donor obligation, every compliance risk and most operational exposure while keeping approval power, contingency funds and interpretation rights at the international level. That is not necessarily unlawful, but it can be a poor allocation of responsibility. A workable subgrant should ask a simpler question: who can actually control each risk, and has that party been given the authority and resources to manage it?

Start With the Donor Terms, but Do Not Stop There

Some donor obligations genuinely need to flow down. Sanctions restrictions, anti-fraud duties, safeguarding standards, audit access, procurement controls and data-protection requirements may apply to activities performed by a local partner because the lead grantee remains accountable for the award. The UK Cabinet Office’s Model Grant Funding Agreement, published in December 2025, is a useful illustration. It provides that using delivery partners does not relieve the grant recipient of its obligations and it contains detailed provisions on data protection, information security, third-party contracts, unspent funds and termination. The practical lesson for an INGO is not to copy all upstream wording into the subgrant. It is to identify which obligations must reach the local partner, which need adaptation to local law, and which remain the INGO’s responsibility because the INGO controls the donor relationship.

Sanctions: Define the Duty and the Decision-Maker

A sanctions clause should do more than say that the local NGO must comply with “all applicable sanctions.” It should identify which sanctions regimes are relevant to the project, what screening is expected, which counterparties are to be checked, who provides access to screening tools, how possible matches are escalated and who decides whether a payment can proceed. FATF’s current approach to non-profit organisations is expressly targeted and risk based. Its 2023 changes to Recommendation 8, reinforced by later work on proportionality, were intended to prevent blanket restrictions from unnecessarily disrupting legitimate NPO activity. A subgrant that demands unlimited screening without defining scope or funding can therefore create cost and exclusion without improving compliance.

Safeguarding: Liability Without Investigation Power Is a Trap

Safeguarding obligations need equal care. A local partner should have clear duties to prevent, receive and report allegations, but the agreement should also say who investigates, who may suspend staff, who protects complainants and witnesses, who communicates with the donor, and who carries the cost of specialist investigations. If the INGO reserves every decision yet requires the local NGO to accept full liability for the outcome, responsibility and control have been separated. That weakens accountability. Good drafting gives the organisation closest to the event an operational role while preserving independent escalation where the allegation concerns senior management, conflicts of interest or serious misconduct.

Data Protection: Flow Down Only What Can Be Performed Lawfully

Data clauses are another place where “flow-down” language can become unsafe. The 2025 UK Model Grant Funding Agreement requires the parties to comply with applicable data-protection law and includes a mechanism for a processor to flag a controller instruction that it considers inconsistent with that legislation. That is an important drafting principle for cross-border NGO partnerships. A local NGO should not promise to disclose beneficiary or staff data merely because an upstream donor might request it. The subgrant should define the categories of data likely to be shared, the purposes, security measures, retention, cross-border transfer rules and a process for refusing or narrowing a request that conflicts with local law or protection obligations.

Audit Rights Should Be Usable, Not Unlimited

Audit rights are legitimate, particularly where donor money is passed onward. The European Commission’s humanitarian audit practice, for example, uses document review, interviews and sample testing to verify expenditure and systems. The problem arises when a subgrant gives an INGO or donor unrestricted access to every record, device and beneficiary file without regard to confidentiality, legal privilege, safeguarding or data minimisation. The agreement should preserve financial verification while allowing sensitive material to be reviewed through controlled access, redaction, sampling or another method that proves expenditure without unnecessarily exposing personal information.

Procurement: Standards Need a Route to Compliance

Procurement obligations should also match the partner’s capacity and the project’s market. UNHCR’s current Programme Handbook for Partners does not treat procurement risk as a reason simply to shift responsibility downward. Where partner procurement capacity is assessed as higher risk, the framework allows limitations and additional controls, including how certain operating costs such as rent, communications, utilities, security and insurance are handled. A sensible subgrant therefore states the procurement thresholds, competition requirements, conflict rules, required approvals and exceptions for emergencies. It should also explain who responds when local market conditions make an upstream rule impossible or disproportionately expensive.

Security and Insurance Must Follow Exposure

Security is often the clearest example of unfair risk transfer. A local NGO may be expected to work in locations where the INGO has withdrawn international staff, while the contract merely states that the partner is responsible for its own security. That wording can hide the real allocation: the local organisation bears physical risk while the intermediary controls the budget. The agreement should identify security planning, movement restrictions, incident notification, evacuation or relocation decisions, duty-of-care expectations and which insurance policies are required. If a donor or INGO requires additional cover, specialist security support or equipment, the cost should be visible in the budget rather than treated as an unfunded condition.

Indirect Costs Are Part of Safe Delivery

Localisation cannot be serious if compliance infrastructure is expected to be free. UNHCR’s current partner framework expressly recognises indirect support costs as costs necessary to manage and run an organisation, including systems, oversight, administration and capacity strengthening. That is a useful counterweight to the idea that only activity-line expenditure is “real programme money.” A local NGO asked to maintain sanctions controls, secure data, conduct safeguarding investigations, procure insurance, support audits and retain qualified finance staff needs resources for those functions. Negotiating an indirect-cost contribution is therefore not an attempt to divert aid. It is part of making the contractual obligations performable.

Incident Reporting Needs Thresholds and Protection

Incident clauses should distinguish events that require immediate notification from matters that can be reported through ordinary periodic channels. Fraud involving project funds, serious safeguarding allegations, material data breaches and severe security incidents may justify rapid escalation. Minor operational mistakes do not necessarily require the same route. The contract should also prevent notification from becoming automatic public disclosure. Information may need to be restricted while facts are verified, while a survivor’s confidentiality is protected, or while national authorities are engaged. A good clause sets the trigger, recipient, time frame and minimum information required, then allows updates as facts become clearer.

Termination: The Exit Risk Must Be Shared Too

Termination is where imbalanced agreements become most visible. An INGO may reserve a broad right to suspend or terminate while the local partner remains liable for staff notice, leases, supplier commitments, beneficiary handover and unspent restricted funds. The upstream donor may also withdraw money without reimbursing all downstream closure costs. Before signature, the parties should therefore agree what happens to unavoidable commitments, staff costs, subcontracts, records, equipment and beneficiary responsibilities after a stop-work instruction. The UK Model Grant Funding Agreement itself recognises the importance of mitigation and reasonable termination costs in defined circumstances, even though the precise donor liability remains controlled by the agreement. A local subgrant should confront those costs instead of pretending they do not exist.

A Fair Subgrant Is Not a Soft Subgrant

Fair allocation does not mean weakening compliance. It means assigning duties to the party best able to discharge them and pairing those duties with information, authority and money. The INGO may need to retain donor reporting, interpretation of upstream conditions and high-level sanctions advice. The local NGO may be best placed to supervise field procurement, community complaints and local labour compliance. Some risks, especially safeguarding, security and data protection, require shared procedures rather than a single owner. The contract should say so.

The Practical Test Before Signature

Before signing, both organisations should be able to explain what happens when something goes wrong, not only what happens when the project runs normally. Who pays for an investigation? Who can stop a risky payment? Who decides whether beneficiary data can be disclosed? Who funds insurance? Who absorbs a donor disallowance caused by an instruction from the INGO? Who manages staff and community commitments if funding stops? If the answer to every difficult question is simply “the local partner,” the agreement may describe localisation while reproducing risk transfer. The better contract makes accountability visible, reciprocal and funded.

Source note. Principal materials considered include the UK Cabinet Office Model Grant Funding Agreement published 1 December 2025; FATF Recommendation 8 and its current NPO guidance on targeted and proportionate measures; UNHCR’s current Programme Handbook for Partners, including its provisions on procurement risk and indirect support costs; the European Commission’s current humanitarian-audit framework; and recent humanitarian localisation work on equitable risk planning and the financing of local partners. These materials are used comparatively. The governing law of the particular subgrant and the law where activities are performed remain decisive.

Suggested citation: 

Ronald Serwanga, “Aid Subgrants: Fair Risk Sharing for Local NGO Deals” East Africa Legal Insight (4 September 2026).