What would due diligence look like if we designed it from scratch today?

Many due diligence programmes reflect a time when thorough research took weeks or months, deeper investigations were limited to selected counterparties, and new reviews were years apart. AI can now deliver comprehensive, sourced research in minutes. But faster research achieves little if the workflows around it remain unchanged. 

Meanwhile, regulators are raising expectations. For example, the DOJ’s 2026 corporate enforcement policy rewards companies that detect and disclose misconduct promptly, which depends on catching risks as they emerge, not just at the initial onboarding stage.

Against this backdrop, risk and compliance leaders at XapienXchange London on 7 October explored how they would design due diligence today.

Investigate before the business commits

When a compliance team is asked to approve a counterparty late in a business deal, rejection can mean abandoning months of work.

During the conference’s segment on Transformation stories, a representative from a private equity firm explained how their team investigates potential investments at the shortlist stage. Findings help the deal team question management about potential risks and determine whether further enhanced due diligence is needed, before committing more time and money.

In the same session’s Q&A, a speaker from a global professional services firm described how limited public information could previously have led to a prospective client being rejected. Now, Xapien provides a more comprehensive report, allowing the firm to make better-informed acceptance decisions without changing its risk appetite.

Build workflows around AI

In the panel on The end of one-size-fits-all risk, an experienced financial services compliance leader argued that firms were adding AI to processes designed for manual work, rather than redesigning the workflows themselves.

One example of a redesigned workflow came up in the discussion on AI & software – Is software dead? Speakers discussed how registering a new deal could automatically trigger due diligence. Low-risk cases could proceed towards onboarding, while higher-risk cases would be referred to an analyst.

One client speaker from a large professional services organisation described a workflow already in use. An AI agent identifies a prospective client’s legal form and initiates Xapien research through an API, so analysts receive findings before opening the case. In one instance, Xapien identified a cryptocurrency-related concern in a client’s ownership structure on day one. The case went straight to the enhanced due diligence team, which assessed the risk and decided to escalate it.

Apply scrutiny where it is needed

As comprehensive research becomes faster and easier, should every third party receive enhanced due diligence? Speakers on the panel The end of one-size-fits-all risk suggested not. The more useful shift is that AI makes it practical to judge each relationship based on context. Traditionally, firms have assigned checks by broad category, such as all suppliers in a certain country or all clients in a certain sector. Now they can look at the specifics of each counterparty and reserve enhanced due diligence for the ones that actually warrant it.

Treat due diligence as a baseline, not a one-off

Speakers also stressed that regulators scrutinise ongoing monitoring as closely as initial due diligence. One gave an example: a company checks a supplier based in the US, and the check comes back clean. If that supplier later becomes a government-facing vendor in Mexico, new risks arise that the original assessment never covered. Rather than waiting two or three years for the next review, the company could treat the first investigation as a baseline and use monitoring to reassess risk as circumstances change.

Keep analysts responsible for decisions

The panellists throughout the day did have one throughline: most agreed that analysts still need to review the evidence and document any recommendations they make and why. Automation just gets them to that decision sooner.

No due diligence programme can eliminate risk. But based on XapienXchange London, if we designed one from scratch today, we would build it around making better business decisions. Research would be available before commitments are made, and revisited when material risks change, with analysts remaining accountable for the judgement.