Due Diligence Questionnaire — Armagnac Consulting

Send DDQ invitations

Add a recipient and click VALIDATE to add them to your authorized recipients. Tick the ones to invite, choose which questionnaire to send, and click Send. Each ticked recipient receives their own activation email.

Delegate (DD process)

Add a recipient

List of authorized recipients

No recipients yet. Add one above and click VALIDATE.

Select DDQ Type

DDQ to Send

Send a renewal DDQ to a delegate that already responded. The new questionnaire is pre-filled with the previous cycle’s answers and conclusion, so the recipient only edits what changed.

Loading…

Open a submitted DDQ to rate each answer, add comments and page references, then validate to produce the formal DD report.

Loading…

0 / 0 questions rated

Enter audited figures (€ thousands) for up to 3 financial years. FY'N is mandatory; if no audited report is available, leave zeros. Totals and 12 ratios compute live. You can rename any row or change its slot type — click the small ⋯ next to the row label.

FY captions

Balance Sheet (€ thousands)

Profit & Loss (€ thousands)

12 ratios · 4 families

Each family has an auto-suggested band based on FY'N values. The reviewer's pick below feeds the Financial dimension score.

Your comment on the financial analysis

Additional documents (your own files)

Drop or click to upload supporting documents you've gathered (AML screening, sanctions list, prior DD pack…). Files land in the same Drive folder named after the date of submission followed by the Delegate's name.

Drag & drop files here, or click to browse

Risk scoring (live)

DD Conclusion - delegate firm

0 / 20+ characters

Recommendation:

All stickers will be removed on validation.

PURPOSE

The purpose of the due-diligence process is to assess the delegation risk associated with a specific delegate across four key risk dimensions:

Operational
Legal
Reputational
Financial

Each required document and question is linked to one or several of these risk dimensions.

Example #1: a question such as "Please provide information about the professional track record of the members of the management / governing body and the senior management, in particular regarding their experience in dealing with the services that you provide" may simultaneously carry operational, legal, and reputational risk implications.

RISK RATING

Each document and question is reviewed and assigned a risk rating of:

LOW
MEDIUM
HIGH

Example #2: a "Certificate of incorporation (dated ≤ 3 months from request)" is required, but the delegate provides a certificate older than 3 months. The risk rating for this document is MEDIUM.

SCORING

Illustrative. Each risk rating corresponds to a numerical score (configurable per client; the values shown are the ones currently set):

LOW = 0
MEDIUM = 1
HIGH = 2

The values must always be equally spaced, so each step is the same size (for example 0 / 1 / 2, or 1 / 2 / 3). MEDIUM is always the midpoint between LOW and HIGH.

If a question is linked to multiple risk dimensions, its score is multiplied by the number of occurrences.

Example #3: a question associated with Operational, Legal and Reputational risks is rated HIGH. Score = 2 × 3 = 6.

An overall score per risk dimension is then calculated:

Sum of all LOW + MEDIUM + HIGH scores for Operational Risk
÷ Total number of Operational Risk occurrences
= Overall Operational Risk Score

RISK BANDS

A risk band is a numerical interval that groups a range of scores into a single qualitative risk level.

Supported scales:

3-tier: LOW / MEDIUM / HIGH
4-tier: LOW / MEDIUM-LOW / MEDIUM-HIGH / HIGH
5-tier: LOW / MEDIUM-LOW / MEDIUM / MEDIUM-HIGH / HIGH

Each band has a customisable numerical interval.

Example #4 (3-tier default):

LOW: 0.00 → 0.67
MEDIUM: 0.67 → 1.33
HIGH: 1.34 → 2.00

Thresholds can be customised below.

FINAL DELEGATION RISK ASSESSMENT

The Overall Delegation Risk Score is a weighted average of the four risk-dimension scores:

(Operational Score × Operational Occurrences ÷ Total Occurrences)
+ (Legal Score × Legal Occurrences ÷ Total Occurrences)
+ (Reputational Score × Reputational Occurrences ÷ Total Occurrences)
+ (Financial Score × Financial Occurrences ÷ Total Occurrences)
= Overall Delegation Risk Score

The final score falls into one of the predefined risk bands, which determines the frequency of future due-diligence reviews.

Example #5: if the Overall Delegation Risk Score falls into the LOW band, the next due-diligence review is scheduled 3 years after the validation date.

Process supervision

Five-phase guided workflow for running a DD on a delegate. Hover any dot for a short explanation of that stage; click the dot to jump to the relevant tab and do the work.

Start

Set

Send

Review

Report

Completed Current stage Ended workflow

Open DD Processes

Name of Delegate By Period By Delegate Type

No open DD process. Click + Create new DD process to start tracking one.

Closed DD Processes

DD processes for which every step has been completed.

Name of Delegate By Period By Delegate Type

No closed DD process yet.

Operational Due Diligence Questionnaire

Counterparty profile · risk & control framework · regulatory standing & operational resilience

Before you start

This questionnaire is organised into 12 common sections + up to 8 delegate-specific sections (Fund Administrator, Depositary, Investment Manager, Broker, Distributor, IT Firm, Legal Firm, Corporate Secretary). Plus a checklist of supporting documents. Answer the common sections, then complete only the delegate sections relevant to the services you provide. You can press SAVE at any time, your draft is kept locally in this browser. Press SUBMIT when complete.

What you need to do

Start by reviewing the structure and content of the DDQ
- Review the list of all required documents
- Review the structure of all sections
- Review all questions
Add or remove documents, sections or questions
Allocate a risk dimension (Operational, Legal, Reputational, Financial) to each document and question
Save the DDQ

0 / 0 questions answered

0 / 0 documents provided

Firm *

Respondent name *

Email *

Role / title

Date

Country

📄1 — Required Documents ▼

For each document, please tick YES if the document is being provided alongside this questionnaire, or NO if it is not applicable or not available. All rows must be ticked before the questionnaire can be submitted.

Documents	YES	NO
Certificate of incorporation (dated ≤ 3 months from request)
Articles of incorporation / association / bylaws
Group or legal entity shareholding chart, signed (≤ 3 months, showing BOs with 25%+)
Valid ID or passport + proof of residence of all UBOs with 25% or plus shareholding
Organisational chart, signed (≤ 3 months — Board, ExCo, functional heads)
IT architecture chart, signed (≤ 6 months)
IDs + CVs of board members and senior management officials
RBE / RBO extract (if applicable)
Proof of regulation (if applicable)
Latest audited annual accounts (≤ 12 months)
Second-most-recent audited annual accounts (≤ 24 months)
Certificate of insurance — PII, D&O, cybersecurity (≤ 12 months)
ISAE 3402 Type II report (if applicable, ≤ 12 months)
Policies
AML / CTF
Risk Management
Conflict of Interest
Outsourcing / Delegation
Code of Conduct
GDPR
ESG
IT

0 / 21 documents acknowledged

🏛1 — The Firm Identity ▼

1Indicate the legal entity registration number (RCS / company number / equivalent).

2List each regulatory authorisation held, if applicable.

3Indicate the legal form, postal address & country of incorporation.

4Indicate the website address.

5Outline the composition of the Board of Directors — number, mix of executive / non-executive / independent members, and chairmanship.

6List the standing Board committees in place. For each, indicate composition, frequency of meeting, and standing terms of reference.

7Identify the senior leadership team — provide role and direct reporting line into the Board.

8Please provide information about the professional track record of the members of the management / governing body and the senior management, in particular regarding their experience in dealing with services that you provide.

🧑‍💼2 — People & Skills ▼

9State total headcount, and FTEs split between (a) services in scope, (b) support functions. Indicate principal locations.

10Confirm the number of FTEs physically based in Luxembourg (or the entity's home regulatory jurisdiction) and any reliance on remote / cross-border staff for in-scope services.

11Provide the average tenure of all employees and executives.

12Provide turnover statistics for the last financial year with commentary.

13Describe the pre-employment screening programme: scope of checks (criminal, credit, regulatory, professional references), look-back period, and renewal cycle for sensitive roles.

14Outline the mandatory and elective training curriculum, with average hours invested per FTE per year on regulatory and technical topics.

15Is the company organised with dedicated teams by client or with dedicated teams by process?

📊3 — Risk & Control Environment ▼

16Describe the second-line risk-management function: its governance, escalation path, and the key reports it produces to the Board or its delegated committee.

17State the risk taxonomy used and the process by which new risks are added to, or retired from, the inventory.

18How are key risk indicators (KRIs) and key control indicators (KCIs) defined, monitored, and periodically tested for relevance?

19Describe how operational incidents are captured, root-caused, and tracked through to closure. Are clients notified? If yes, how?

20How does the Company ensure that employees understand their responsibilities for implementing the operational risk framework?

21Outline the internal audit charter, the reporting line of the head of internal audit, and the methodology used to set the annual audit plan.

22Has the statutory external auditor changed in the last three financial years? If yes, please explain the rationale and any material disagreement disclosed.

23Describe risk system(s) used to manage risk events.

⚖4 — Regulatory Standing & Legal ▼

24Detail the scope of permitted activities and any restrictions, including any geographic passporting arrangements relied upon.

25Summarise the firm's interactions with its primary regulator over the last 24 months — on-site inspections, thematic reviews, ad-hoc information requests, remediation plans.

26Has the firm, any subsidiary, or any current senior officer been the subject of a formal enforcement action, public censure, fine, or sanction in the last five years? Provide details if yes.

27Describe the conflicts-of-interest governance — identification, recording, mitigation, and disclosure to clients.

28Disclose any litigation, arbitration, or material disputed matter currently pending and not already disclosed under the previous question.

29Please confirm that you have a Compliance Monitoring Plan (CMP) in place, how and how often the CMP is updated.

📋5 — Compliance ▼

30Who is responsible for Compliance in your company? Add contact details.

31When was the compliance manual or policy last updated?

32What are the topics covered by the Compliance Officer in the report to the Management / Executive Committee and Board?

33How does the Compliance Officer ensure an ongoing regulatory watch?

34How are new regulations or laws detected and communicated to relevant employees in the company?

35Which system(s) does Compliance use?

36Which external service provider and services does Compliance use for supporting his mission?

37Please confirm and explain the internal controls implemented to ensure that the conflicts of interest policy is executed.

🛡6 — Financial Crime (AML / CFT / Sanctions) ▼

38Identify RR and RC, if applicable; alternatively, the MLRO. Confirm their seniority, independence, and direct reporting line to the Board.

39List the sanctions lists screening system and which lists (EU, UN, OFAC, OFSI, others) are covered.

40Describe the procedures applied where the firm relies on a third party (introducer, distributor, group entity) for any element of customer due diligence.

41State the annual hours of AML / CFT training per FTE, with a breakdown by role family (front-line, control, leadership).

42In the last 12 months, has the firm filed any suspicious activity reports with its FIU? Disclose volume in ranges only (no individual file detail).

43Confirm whether, in the last 3 years, any of the directors, owners, shareholders, senior management, key employees or representatives has been subject to any legal, compliance or regulatory review, investigation, fine, sanction or conviction in relation to the products or services rendered by the company.

44Is the entity in or has the entity had any business relationship with any sanctioned person / entity in the last 3 years?

📂7 — Onboarding (Clients & Investors) ▼

45Describe the client acceptance process from initial contact to final validation.

46Identify the body that approves the establishment of a new client relationship and the escalation triggers that move a file to senior management or Board.

47Has the company rejected any client or prospect over the last 3 years and why?

48How often and through which triggers is investor information refreshed? What happens to relationships that cannot be refreshed within the prescribed window?

🔗8 — Delegation ▼

49Confirm whether your company is relying on third parties (affiliated or not) for the provision of in-scope services.

50Please confirm if you maintain a register of outsourced functions. Please describe controls to ensure such register remains up to date and if you have exit-management arrangements.

51How many delegates are you currently working with? Provide a breakdown of delegates per function.

52Are service level agreements in place between the company and its outsourced service providers? If so, how does the company monitor services against the prescribed standards?

53Who is responsible for supervising delegates?

54Have you delegated part of your internal control functions?

55Have you identified any material issues with regard to delegations?

💻9 — Technology, Data & Cyber ▼

56Who is responsible for IT in the company? Please provide their CV.

57Do you outsource or delegate the management of the company's IT architecture or systems? List service provider(s), if applicable.

58List the core platforms supporting the in-scope services — vendor, version, hosting model, data residency. Indicate which are in-house developed vs vendor-supplied.

59Describe the cyber-defence framework — standards adopted (NIST, ISO 27001, CIS), governance arrangement, and the cadence of Board oversight.

60Indicate the frequency and scope of penetration testing, red-team exercises, and continuous vulnerability scanning. State who delivers each (internal / external).

61Outline the data-classification regime and the protective controls applied to personal data and client confidential data (at rest, in transit, in backup).

62How do you ensure that the company is DORA-compliant?

63Have any cyber-security incidents impacting confidentiality, integrity, or availability been recorded in the last 24 months? Indicate severity and remediation status without disclosing protected detail.

64State the firm's policy on artificial intelligence and machine learning — permitted uses, prohibited uses, governance over model risk, and any human-in-the-loop requirements.

🔁10 — Resilience (BCP & DRP) ▼

65Provide the date of the last full review of the Business Continuity Plan and the date of the last live test. Summarise lessons learnt and remedial actions taken.

66How often is the DRP tested? Please give details of the last test or provide a copy of the last report.

🔐11 — GDPR ▼

67Have you appointed a Data Protection Officer (DPO) as required by GDPR? Provide the details of the DPO.

68How do you ensure compliance with GDPR requirements?

🌿12 — ESG ▼

69How do you ensure compliance with ESG-related legal & regulatory requirements?

70Describe the governance of ESG at firm level (Board-level, committee-level, or function-level), and how ESG considerations are factored into material business decisions (service-provider selection, technology and infrastructure choices, recruitment, and, where applicable, investment activity).

Delegate-Specific Sections Answer the section(s) relevant to the services you provide.

📊13 — Fund Administrators ▼

Q71Indicate level of assets under administration (in M EUR), number of clients, number of structures under administration, asset classes serviced, geographies covered.

Q72Describe the in-house scope of services (NAV calculation, fund accounting, transfer agency, investor servicing, regulatory and financial reporting, other). Indicate which services are sub-delegated and to whom.

Q73Describe the NAV calculation cycles (frequency, dealing day vs valuation day, dealing cut-off, NAV publication time).

Q74Describe the valuation process when not performed by the management company or an external valuer.

Q75Outline the pricing-source policy for portfolio securities - primary, secondary, and stale-price escalation procedures.

Q76State the NAV-error materiality threshold for each asset class and the standard procedure when an NAV error is identified (restatement, investor compensation, notification).

Q77Describe the management and performance-fee calculation methodology, including high-water marks, hurdle rates, and equalisation.

Q78List the regulatory reporting deliverables produced for clients (AIFMD Annex IV, FATCA / CRS, CSSF prudential reporting, etc.) and indicate the production and review cycle.

Q79Describe the transfer-agency process, including register maintenance, dealing-instruction processing, investor onboarding and KYC, payment distribution.

Q80Describe the reconciliation framework - cash, holdings, NAV - with the depositary and the investment manager. State frequency and break-handling.

Q81List the core fund-administration system(s), version, hosting model, and contingency arrangements (cold / warm / hot site, alternate provider).

Q82Describe the change-management process for fund launches, restructurings, and migrations - including timeline expectations.

Q83Provide the standard fee structure (basis points, minimum fees, transaction-based add-ons) and any volume discounts.

Q84Describe the BCP for NAV production - what happens if the NAV cannot be struck on time (cause, remediation, client-notification protocol).

Q85Explain the transactions booking process (investment and divestment).

Q86Which analysis or plausibility checks are performed on periodic movements: on balance sheet, equity and P/L?

Q87How do you ensure the value of the units or shares of the AIF is calculated in accordance with the applicable accounting principles, the AIF rules or instruments of incorporation?

Q88Please describe the process of NAV review and approval process in general.

Q89How do you ensure that your company has extensive experience for accounting reports in Lux GAAP / IFRS / US GAAP?

Q90Describe how pre-trade and post-trade controls ensure that trades are in compliance with investment guidelines and investment restrictions as defined in regulations, fund prospectus, contractual investment guidelines and sanctions laws?

🏘14 — Depositaries ▼

Q91Indicate level of assets under custody (in M EUR), number of clients, number of structures under custody, asset classes serviced, geographies covered.

Q92State the depositary regime under which services are provided (AIFMD Art. 21, UCITS V, EuVECA, EuSEF, ELTIF).

Q93Describe how the AIFMD Art. 21 - verification of cash flows, safekeeping of assets, oversight duties - has been implemented and how each is operationalised.

Q94Provide the sub-custody network: primary sub-custodian per market, selection criteria, and ongoing monitoring framework.

Q95Describe the asset-segregation framework - for both financial instruments held in custody and other assets (e.g. private equity).

Q96Describe the cash-flow monitoring methodology - booking patterns, reconciliation frequency, exception reporting.

Q97State the ownership-verification process for other assets not held in custody (private equity stakes, real estate, etc.).

Q98Describe the oversight duties performed on behalf of the AIFM / UCITS ManCo - NAV oversight, investment-compliance oversight, distribution-compliance, redemption monitoring.

Q99State the cadence of reconciliations between the depositary, the administrator, and the prime broker (where applicable).

Q100Describe the procedure for handling identified breaches of investment restrictions or other compliance failures.

Q101State the depositary liability framework under Art. 21(11-13) and any discharge arrangements with sub-custodians.

Q102Describe insurance coverage against loss of financial instruments held in custody.

Q103List the systems used for asset tracking, reconciliation, and oversight workflows.

Q104Outline the cadence and content of reports provided to the AIFM / ManCo and the Board.

Q105Describe the firm experience with the asset classes in scope (e.g. listed securities, derivatives, real estate, infrastructure, private debt, private equity, crypto - where applicable).

Q106State any conflicts of interest arising from group relationships (group fund admin, prime broker, asset manager affiliations) and the mitigation framework.

Q107Describe the procedure if the depositary identifies a material concern that the AIFM is unwilling to address - including escalation to the regulator.

Q108State the standard fee structure (asset-based, transaction-based, complexity premiums).

Q109Describe BCP arrangements specifically for depositary services - including substitute oversight arrangements if primary systems fail.

📈15 — Investment Managers ▼

Q110Indicate level of assets under management (in M EUR), number of clients, number of structures managed, asset classes serviced, geographies covered.

Q111Describe the investment philosophy and process - top-down vs bottom-up, research sources, decision-making body.

Q112Provide the list of services or products rendered to clients.

Q113Provide the composition and frequency of the Investment Committee, including how dissenting views are recorded.

Q114Describe the pre-trade compliance check framework - investment guidelines, regulatory limits, internal restrictions.

Q115State the firm Best Execution Policy and how execution quality is monitored (TCA, broker scoring, periodic review).

Q116List the execution venues and counterparties used and the criteria for their selection.

Q117Describe the order-management workflow, including trade allocation, pre-trade and post-trade controls.

Q118State the firm policy on inducements, soft commissions, and dealing commissions (MiFID II RTS 27 / 28).

Q119Describe the personal-account-dealing policy and monitoring mechanism.

Q120Describe market-abuse and insider-information controls - surveillance, wall-crossing procedures, watch and restricted lists.

Q121Describe the voting policy, the body or function responsible for voting decisions, and the cadence of voting-record publication.

Q122Describe the use of derivatives - types, purposes (hedging vs investment), limits, and risk controls.

Q123State the leverage limits applied to each fund / mandate type and the monitoring framework.

Q124Describe the liquidity-risk management framework - liquidity profiling, stress testing, redemption tools.

Q125State the firm stress-testing methodology - scenarios used, frequency, and reporting cadence.

Q126Describe how investment performance is calculated, attributed, and independently verified.

Q127State the firm seeding / co-investment policy - including investment in own products by directors and employees.

Q128Describe the procedure for handling breaches of investment guidelines - detection, escalation, remediation, investor notification.

Q129State the firm SFDR classification by product (Article 6 / 8 / 9) and approach to PAI consideration.

Q130How does the company ensure compliance with EMIR, where applicable?

⚖16 — Brokers ▼

Q131Indicate level of assets under brokerage (in M EUR), number of clients, types of financial instruments brokered, geographies covered.

Q132Describe the scope of services offered (execution-only, advisory, prime brokerage, custody) and the relevant regulatory framework.

Q133List the execution venues and asset classes covered, by geography.

Q134Describe the firm Best Execution Policy and how execution quality is monitored and reported (MiFID II RTS 27 / 28).

Q135State the client-classification framework (retail / professional / eligible counterparty) and the procedures applied at onboarding and on reclassification.

Q136Describe the order-handling procedure - including allocation, aggregation, and client-priority rules.

Q137Describe the firm Smart Order Routing methodology and the criteria used to select execution destinations.

Q138State the trade-reporting framework under MiFIR / EMIR and the systems used for reporting.

Q139Describe the client-asset-protection framework (CASS-equivalent in the relevant jurisdiction) - segregation, reconciliation, breach reporting.

Q140State the insolvency / investor-protection-scheme coverage applicable to client assets.

Q141For prime brokerage: state financing terms (margin methodology, haircuts, rehypothecation), cross-margining arrangements, and disclosure to clients.

Q142Describe how counterparty exposure to the broker and its affiliates is monitored and disclosed to clients.

Q143Describe algorithmic-trading controls - kill switches, pre-trade risk controls, capacity limits, code review.

Q144Describe direct-market-access (DMA) / sponsored-access risk controls.

Q145State the firm affiliate-relationship disclosures (where execution counterparts include group affiliates).

Q146Describe the trade-confirmation and statement-delivery cadence (with sample templates available on request).

Q147Describe the default-management procedure for client positions and the lessons from any historical default event.

Q148State BCP arrangements specific to execution and clearing - including alternative venue access.

📢17 — Distributors ▼

Q149Indicate level of assets under distribution (in M EUR), number of clients, types of structures / clients, asset classes distributed, geographies covered.

Q150Describe the distribution model - direct, agent, sub-distribution, nominee structures, online platform.

Q151Where sub-distributors are used, describe the onboarding and ongoing oversight framework (initial DD, periodic review, audit rights).

Q152State the procedures for cross-border distribution (passporting, private placement, reverse solicitation).

Q153Describe the target-market identification process and how products are matched to target markets (MiFID II product governance).

Q154Describe the suitability and appropriateness assessment process applied to clients.

Q155Describe the marketing-material approval procedure - internal review, regulatory pre-clearance where required, version control.

Q156State the firm policy on inducements, retrocessions, and trail commissions - including disclosure to clients (MiFID II).

Q157Describe the AML / KYC procedures applied to investors at onboarding and on an ongoing basis. State whether reliance is placed on third parties.

Q158State the firm approach to PEPs, sanctioned persons, and high-risk jurisdictions.

Q159Describe the investor-complaint-handling procedure - register, response SLAs, escalation, regulator reporting.

Q160State sales-staff licensing requirements (where applicable - e.g. MiFID II RTS 6 knowledge and competence).

Q161Describe the sales-incentive structure and the controls in place to prevent misselling.

Q162State the firm approach to PRIIPs KID delivery obligations.

Q163Describe the procedure for handling product changes, terminations, or restrictions - including investor notification and switch-out arrangements.

Q164Describe BCP arrangements for client-facing functions (call centre, advisory, online portal).

💻18 — IT Firms ▼

Q165Indicate the number of clients, types of clients, number of users managed, geographies covered.

Q166List the in-scope IT services provided (hosting, application support, managed security, development, network, etc.).

Q167State the hosting model (on-premise, dedicated, private cloud, public cloud) and the cloud providers used.

Q168Confirm the geographic location of (a) primary data processing, (b) backup, (c) any sub-processors.

Q169State the standard service-availability SLA per service tier, and provide actual availability for the last 12 months.

Q170Describe the change-management procedure - request flow, approval gates, segregation of dev / test / production, back-out planning.

Q171Describe the incident-management framework - severity classification, response SLAs, client-notification thresholds.

Q172State the standards held (ISO 27001, ISO 22301, SOC 2 Type II) - including scope, certifying body, and next renewal date.

Q173Describe the security-operations-centre arrangements - internal, outsourced, or hybrid. Detection coverage and response times.

Q174State the cadence and scope of penetration testing, red-team exercises, and continuous vulnerability scanning. Confirm whether summary results can be shared.

Q175Describe access-control mechanisms - privileged access management (PAM), multi-factor authentication, joiner-mover-leaver process.

Q176State data-encryption standards at rest, in transit, and in backup. Confirm key-management arrangements.

Q177Describe the sub-contractor / sub-processor inventory and the disclosure framework for new sub-processors.

Q178State the firm classification under DORA as a critical technology service provider and any direct supervisory regime applicable.

Q179Describe DR / failover arrangements, RTO / RPO commitments per service tier, and the most recent successful test.

Q180State the source-code escrow arrangement (or alternative IP-protection mechanism) for bespoke or critical software.

Q181Describe the right-to-audit framework offered to clients and the conditions under which it can be exercised.

Q182State the firm policy on the use of AI / ML in service delivery - permitted uses, data handling, and human-in-the-loop requirements.

⚖19 — Legal Firms (incl. outsourced Compliance Services) ▼

Q183List the scope of legal / compliance services in scope (legal opinions, contract drafting, advisory, outsourced compliance officer, legal Due Diligence, DPO services, company formation, etc.).

Q184State the firm regulatory licensing or registration (e.g. Bar admission, Ordre des Avocats, CSSF authorisation for outsourced compliance services).

Q185Provide the qualifications and years of relevant experience of the lead practitioner(s) assigned to the engagement.

Q186State the firm practice areas and the percentage of revenue from financial-services / asset-management clients.

Q187Describe the client-conflict-check procedure - including how conflicts are identified, registered, and managed across partners and offices.

Q188Describe the supervision framework - partner involvement on individual matters, peer review, and quality control.

Q189State the firm confidentiality framework, including arrangements for matter teams, ethical walls, and physical / IT segregation.

Q190Provide the scope and limits of professional indemnity insurance and any other relevant cover.

Q191Describe the firm standard engagement-letter terms, particularly limitation-of-liability and indemnity provisions.

Q192Describe the knowledge-management system used to maintain regulatory horizon-scanning and update of precedents.

Q193For outsourced compliance services: describe the deliverables, cadence, and reporting templates used.

Q194For outsourced RR / RC / DPO services: confirm regulatory approval status of the named individual, and the firm substitution arrangements if they depart - where applicable.

Q195State the average number of mandates per outsourced compliance officer and any cap on concurrent mandates - where applicable.

Q196Describe how confidential client information is handled when staff leave the firm (NDAs, file segregation, post-employment confidentiality).

Q197State the firm policy on the use of external counsel and the procedure when matters fall outside in-house expertise.

Q198Describe billing arrangements - hourly vs fixed-fee, retainer terms, and disbursement policy.

Q199State BCP arrangements for legal-advisory continuity (key-person succession, file accessibility off-site).

📋20 — Corporate Secretary Services Firms ▼

Q200Indicate the number of clients and types of clients serviced, number of structures serviced, geographies covered.

Q201List the scope of corporate-secretarial services offered (board support, statutory filings, register maintenance, KYC on directors, AGM / EGM support).

Q202State the qualifications of the lead practitioner(s) (ICSA / Lux equivalent) and years of experience.

Q203State the average number of corporate-secretary mandates per professional and any cap on concurrent mandates.

Q204Describe the procedure for organising board meetings - agenda preparation, pack circulation timing, minute-taking and approval.

Q205State the deadline-tracking system used to monitor statutory filings (RCS, RBE, tax, regulator).

Q206Describe the material-event-filing framework - events that trigger an RCS filing, response SLAs, escalation.

Q207State the procedure for AGM and EGM organisation, board meetings, and any other meetings - including notice-period compliance and quorum verification.

Q208Describe the statutory-books-maintenance procedure (electronic and / or physical) and retention period.

Q209Describe the procedure for verifying director identity, fit-and-proper status (where applicable), and changes in declared roles.

Q210State the firm procedure for maintaining the directors register, including conflict-of-interest declarations and PEP screening.

Q211Describe the director-induction process for newly appointed directors of client entities (regulatory and company-specific obligations).

Q212State the document-retention policy applied to board materials, minutes, statutory books, and supporting documentation.

Q213Describe the procedure when a corporate-secretary resignation occurs - handover process, file transfer, and continuity guarantees.

Q214State the firm involvement (if any) in regulatory reporting (e.g. CSSF prudential reporting for AIFMs) and confirm whether this is a separate engagement.

Q215Describe BCP arrangements for corporate-secretarial services, particularly access to statutory books and document repositories.

Supporting Documents (optional — drop or click)

📎

Drag & drop files here, or click to browse

Up to 100 files · max 8 MB per file · PDF, DOC, DOCX, XLS, XLSX, PPT, PPTX, PNG, JPG accepted

Restricted Access

Data Privacy Notice

Who is responsible

What data we process

Why we process it (lawful basis)

Where data is stored

How long we keep it

Your rights

Contact

You've been invited to complete a DDQ

Your request has been sent

This invitation has been revoked

This DDQ has already been submitted

Send DDQ invitations

Loading…

Balance Sheet (€ thousands)

Profit & Loss (€ thousands)

12 ratios · 4 families

Additional documents (your own files)

Risk scoring (live)

DD Conclusion - delegate firm

Process supervision

Open DD Processes

Closed DD Processes

Compare

Search results

Comparison list (0 of 5)

Subscription

Questionnaires opted in

Documents

More detail requested on your DDQ

Before you start

What you need to do

Restricted Access

Data Privacy Notice

Who is responsible

What data we process

Why we process it (lawful basis)

Where data is stored

How long we keep it

Your rights

Contact

You've been invited to complete a DDQ

Your request has been sent

This invitation has been revoked

This DDQ has already been submitted

Send DDQ invitations

Reuse a previous questionnaire

Sent invitations

DD Reviews

Loading…

Balance Sheet (€ thousands)

Profit & Loss (€ thousands)

12 ratios · 4 families

Edit row caption

Additional documents (your own files)

Risk scoring (live)

DD Conclusion - delegate firm

DD Register

Process supervision

Open DD Processes

Closed DD Processes

Compare

Search results

Comparison list (0 of 5)

Governance

Ongoing monitoring

My account

Subscription

Questionnaires opted in

Documents

Send selected questions back to recipient

Import questionnaire from Excel

More detail requested on your DDQ

Before you start

What you need to do