Better Donor Checks: NGO Due Diligence Before Funds
Most grant due diligence is designed in one direction. The donor asks for the NGO's registration certificate, audited accounts, board members, policies, bank details, safeguarding systems and references. The NGO answers, often under pressure to secure the award. What is less common is the reverse question: what should the NGO know about the donor before accepting the money?
That
question is not suspicious or ungrateful. It is part of governance. A grant can
expose an organisation to sanctions risk, reputational damage, unlawful data
requests, political-activity restrictions, tax consequences or abrupt
termination. The size of the donation does not reduce those risks. In some
cases, it increases them.
The donor's legal identity comes first
An
NGO should know the exact legal person making the grant. A trading name,
foundation brand or programme logo is not enough. The agreement should identify
the legal name, place of incorporation or establishment, registered address and
the person authorised to sign. Where a donor is part of a larger group, the NGO
should understand whether the grant is made by the parent, a local affiliate, a
fiscal sponsor, a government agency or an intermediary administering another
institution's money.
This
matters when something goes wrong. Repayment demands, audit notices, tax
certificates and disputes must come from a legal person with authority under
the agreement. It also matters for sanctions screening because the entity on
the contract may not be the entity whose name appears publicly in fundraising
material.
For
a new or unfamiliar donor, basic verification should therefore include the
public register or official institutional record where one exists, the donor's
governance information and the authority of the signatory. The exercise should
be proportionate. The NGO does not need to investigate every established
multilateral donor as if it were an unknown company. It does need enough
evidence to explain to its board, bank and auditor who provided the funds.
Government affiliation can change the legal
character of the relationship
A
donor may be independent in branding but closely connected to a foreign
government. That can affect disclosure, public records, sanctions, procurement,
political-activity rules and the expectations placed on the NGO. Government
funding may also carry statutory or policy conditions that a private foundation
would not normally impose.
The
NGO should therefore ask whether the donor is a ministry, embassy, development
agency, state-owned body or entity acting under a government programme. It
should also identify whether the grant is funded from another donor upstream. A
foundation administering government money may be contractually required to pass
government terms down to local partners.
This
is particularly important where local law distinguishes foreign funding
connected with political activity. Uganda's Protection of Sovereignty Act 2026,
for example, regulates an "agent of a foreigner" engaged in specified
political activities and contains funding-declaration provisions. At the same
time, section 2(5) expressly states that lawful grants, development assistance,
humanitarian assistance and other lawful foreign exchange flows do not by
themselves require compliance with the Act. The correct lesson is therefore not
that every foreign grant is regulated under that Act. It is that an NGO working
in Uganda should examine the purpose, activity and relationship where foreign
funding is linked to conduct falling within the statute's defined political-activity
provisions.
Kenya
takes a different approach. The Public Benefits Organizations Act, in its
current form, protects research, education, publication and advocacy on
public-interest issues, including criticism of state policy, while prohibiting
public benefit organisations from fundraising or campaigning to support or
oppose a political party or candidate. Donor due diligence should therefore be
connected to the actual programme, not assumptions about the word
"foreign."
Sanctions screening should include the donor
side
NGOs
commonly screen vendors and implementing partners but may forget that funds can
also arrive from a prohibited or restricted source. The United Nations Security
Council maintains a consolidated list of persons and entities subject to
sanctions measures, and national regimes may add their own designations. The UK
Office of Financial Sanctions Implementation's 2026 NGO guidance specifically
recommends risk-based due diligence and warns organisations to consider
ownership and control, not only exact-name matches.
A
donor check should therefore cover the donor entity and, where risk justifies
it, the persons who own or control it. The relevant sanctions systems depend on
the NGO's legal connections, banking route, currency and location. A Kenyan
organisation receiving euros through a European bank may face a different
compliance chain from one receiving U.S. dollars through a U.S. correspondent
bank.
The
point is not to create a ritual in which every donor is run through every list
in the world. The point is to know which sanctions regimes could actually
affect the transaction and to record the result.
Ask where the money comes from, not only where
it is going
A
donor may be legally registered and still present source-of-funds concerns. An
NGO should understand whether the grant comes from the donor's own endowment,
government funds, corporate sponsorship, a public appeal, another foundation or
an individual benefactor. This information helps the NGO assess
anti-money-laundering risk, reputational exposure and whether conditions
imposed by an upstream funder have been passed down correctly.
Current
FATF materials on non-profit organisations continue to emphasise proportionate,
risk-based measures rather than blanket suspicion of the sector. The same logic
should work in reverse. A long-established public development agency does not
require the same source-of-funds inquiry as a newly formed offshore foundation
offering a large unrestricted transfer with little explanation.
Warning
signs include reluctance to identify the source of a large grant, requests to
route funds through an unrelated account, unexplained third-party payments,
unusual secrecy about the donor's identity or demands that the NGO misdescribe
the transaction to its bank. A legitimate donor should not need the recipient
to disguise the money.
Publicity conditions can create duties the NGO
cannot safely perform
Some
grants require the NGO to display the donor's logo, name the donor in events,
publish beneficiary stories or obtain photographs and testimonials. These
requests may be reasonable in a communications plan, but they should be
reviewed through protection and privacy rules.
A
donor should not be promised unrestricted access to beneficiary identities
simply because it funded the programme. In Kenya, the Data Protection Act
regulates cross-border transfers and requires safeguards for personal data,
with stronger conditions for sensitive information. Similar questions arise
under other East African data-protection regimes.
Before
accepting publicity terms, the NGO should ask what will be published, whose
consent is required, whether refusing publicity affects a person's access to
services, and whether disclosure could expose beneficiaries or staff to stigma,
retaliation or security risk. The safest grant agreement allows anonymised
reporting where identification is unnecessary.
Data requests deserve their own due diligence
The
donor's data practices should be examined before the NGO sends anything. Where
will information be stored? Will it be shared with governments, contractors or
other funders? How long will it be retained? Can the donor require copies of
safeguarding files? What happens if local law prevents a transfer?
These
are not technical questions for the IT team alone. They determine whether the
NGO can lawfully perform the contract. A clause requiring "all
beneficiary-level data on request" should be narrowed to information that
is necessary, lawful and proportionate. Where the donor needs verification, the
parties can often use coded records, aggregated reports, secure review or
independent audit rather than wholesale disclosure.
Termination powers reveal how balanced the
relationship really is
An
attractive grant can become dangerous if the donor may terminate immediately
for convenience while the NGO must carry employment, rent, supplier and
subgrant costs after the money stops. The Cabinet Office Model Grant Funding
Agreement illustrates why this matters: it permits termination for convenience
on notice, requires return of certain unspent funds and states that the
authority will not be liable for the recipient's employment termination costs.
An
NGO conducting donor due diligence should therefore examine the donor's history
and contractual approach to suspension and termination. Does the agreement
include notice? Is there a cure period for remediable breaches? Are committed
close-out costs eligible? Can the NGO terminate if local law changes or donor
instructions create unacceptable risk? These questions are part of evaluating
the donor, not merely negotiating wording.
Tax and foreign-funding consequences belong in
the acceptance decision
A
grant described as "tax free" by the donor is not necessarily tax
exempt in the recipient's country. Local law determines whether the
organisation itself is exempt, whether a particular supply attracts VAT,
whether withholding applies, or whether imported goods receive relief. The NGO
should also check whether accepting foreign funding creates reporting
obligations under its NGO or public-benefit organisation framework.
Uganda's
NGO Act requires organisations to keep accounts and report information on funds
received and their sources. Kenya's Public Benefits Organizations Act likewise
emphasises transparent use and control of financial resources. These rules make
donor identity and funding documentation part of ordinary compliance.
The board should know what it is accepting
The
most useful product of donor due diligence is not a thick investigation file.
It is a short acceptance record. The board or authorised committee should be
able to see the donor's legal identity, government or political affiliation
where relevant, sanctions result, source of funds, payment route, major data
and publicity conditions, termination exposure and any local regulatory or tax
issue requiring action.
This
turns the grant decision into a governance decision. It also protects the NGO
if a bank later asks where the money came from or a regulator asks why the
organisation accepted it.
Donor
due diligence should not become a reason to reject legitimate foreign support.
NGOs depend on cross-border cooperation and many donors operate to high
standards. The value of the exercise is different: it prevents the organisation
from treating money as legally neutral. Funding always arrives through a
person, a contract, a bank and a purpose. Knowing those four things before the
money arrives is often far easier than explaining them after a problem begins.
Source note. This article
draws on the United Nations Security Council Consolidated List as updated in
2026; the UK Office of Financial Sanctions Implementation guidance for
charities and NGOs updated 28 January 2026; FATF Recommendations and its
risk-based materials for non-profit organisations; Kenya's Public Benefits
Organizations Act as amended in 2025 and Data Protection Act 2019; Uganda's
Non-Governmental Organisations Act 2016; and Uganda's Protection of Sovereignty
Act 2026. The national examples illustrate different legal approaches and
should not be treated as interchangeable rules.
Suggested citation:
Ronald Serwanga, “Better Donor Checks: NGO Due Diligence Before Funds” East Africa Legal Insight (4 September 2026).