Compliance

AML, KYC and KYB checks inside the deal pipeline

Guide6 min readUpdated 11 September 2026

A step-by-step guide to running verification checks as pipeline gates, recording evidence and exporting the audit trail.

Compliance works best when it is part of the workflow rather than a separate job at the end of the week. In Xova, AML, KYC and KYB checks are attached to stages, so a file cannot move past a gate until the right evidence is in place.

Set the gates for each product

Different products carry different risks, so the checks you need for a development finance case are not the same as those for a straightforward asset finance lease. Start by mapping the gates each product needs.

  • Identify the checks required before a file can enter each stage.
  • Decide which checks block progress and which can be recorded for information only.
  • Set who can override a failed check and what reason must be given.

Run the checks against the record

Once the client and company details are in Xova, verification runs against that record. There is no re-keying into a separate tool, and the result is stored against the deal it belongs to.

Export the audit trail

When a lender or regulator asks for evidence, export a single pack covering checks, documents, stage changes and communications. The trail is timestamped and searchable across every file you have processed.

The export covers who did what, when, and what they were looking at when they did it. That is usually the part firms struggle to reconstruct after the fact, and it is the part that takes the longest when it has to be pieced together from email.

Handle exceptions properly

Most checks pass without anyone needing to look at them. The value is in how you deal with the ones that do not. An exception should reach a named reviewer with the reason attached, rather than sitting in a queue that everyone assumes someone else is watching.

  • Route failed checks to a reviewer rather than back to the person who ran them.
  • Record the reason for every override, along with the approver.
  • Re-run checks when a key detail changes, such as a new director or a changed registered address.
  • Carry vulnerability flags through the rest of the journey rather than noting them once.

What good looks like

A well-configured desk rarely thinks about compliance during the week, because the process cannot move without it. Nobody is reconstructing evidence on a Friday afternoon, overrides are rare and always explained, and an evidence request is answered by producing an export rather than by opening a filing cabinet.

Where to go next

The gates, overrides and exports described here are configured in compliance management. The stages they attach to live in workflow management, and the evidence they rely on is held in document management.

Want to see this running on your own deals?

Bring a live case and we will map it from enquiry to completion.

Request a demo