The Short Answer

Most of it. Your website can show the public half of all five pillars FCDO assesses: who governs you, what you have delivered, your accounts, how you choose and check partners, and your safeguarding and fraud policies. Bank details, full insurance schedules and anything that could expose a partner belong in a pack you send on request. Nothing in FCDO's guidance requires a public pack. What a published one does is let the assessor start from your documents instead of from a list of questions.

A due-diligence request rarely stalls for want of a document. It stalls on a document nobody can date.

What FCDO Assesses

FCDO's SEAH due-diligence guidance for implementing partners, updated on 30 June 2026, names the frame in one sentence: its due-diligence and central assurance assessments look at five pillars. They are governance and internal controls, ability to deliver, financial stability, downstream delivery and safeguarding. The guidance then explains only the fifth, in six areas, and applies to organisations receiving funds through an Accountable Grant or a Memorandum of Understanding.

It says nothing about websites. No pillar is met by publishing, and no part of the guidance asks for a public pack. The case for one is practical: the same documents are requested by every institutional funder, and by you of your own downstream partners. The NGO website section checklist carries the pack as a Best practice row for that reason.

UK trusts and foundations run a different, lighter check, covered in what grant funders check on a charity website. What the law requires every charity to show is in Charity Commission website requirements. This post assumes both and deals with the FCDO frame.

Pillar by Pillar

Pillar What the website can answer What goes in the pack on request Who owns the review date
Governance and internal controls Trustees and roles, governing document, code of conduct, conflicts of interest policy, fraud and anti-diversion statement Board minutes, the risk register, the internal controls framework Governance lead; trustees approve the policies
Ability to deliver Programme pages, where you work, evaluations, IATI data where your agreement requires it Detailed workplans, staffing, the MEL framework Programmes or MEL lead
Financial stability Annual report and accounts, who audited or examined them, the types of insurance cover held Bank details, management accounts, full insurance schedules Finance lead
Downstream delivery How you choose and check partners, what you expect of them, your safeguarding standards for partners The delivery chain map, partner due-diligence records Partnerships lead
Safeguarding Safeguarding policy, code of conduct, a route for reporting a concern, the safeguarding lead by role Case logs, investigation procedure, training records Safeguarding lead, with the board-level officer

Governance and internal controls. This is the pillar a website serves best, because most of it is already public in some form. FCDO's counter-fraud standards for external partners set out the minimum it expects partners to show on managing aid diversion, including a code of conduct that staff and downstream partners understand. Read their status carefully. They say "should" throughout, they say "Using this document is not mandatory", and they are published as a PDF on the Prevent Charity Fraud site rather than on GOV.UK. They describe what an assessor will ask about, not a publishing duty.

Ability to deliver. Programme pages and evaluations are the evidence here, and a results page that includes what did not work reads as more credible than one that only reports success. Where your agreement carries the IATI clause, your published data is part of the answer; the next section covers it.

Financial stability. The accounts and the annual report, dated on the page, with a line on whether they were audited or independently examined. Bank details never go on a public page. They are what a payment-diversion fraud needs, and an assessor who needs them will ask. I would list the types of insurance cover held on the public page and keep the schedules and limits in the pack.

Downstream delivery. The counter-fraud standards expect partners to complete due-diligence checks on each downstream partner and to keep a delivery chain map up to date. The SEAH guidance makes first-tier partners responsible for cascading its standards down the chain. The website can say how you do this: your partnership principles, what you ask of partners and the safeguarding standards you share with them. The map itself stays in the pack. It names organisations, sometimes in places where being linked to UK funding is a risk. The partner-facing side of this, and which partners to leave unnamed, is in what local partners look for.

Safeguarding. The SEAH guidance expects a designated safeguarding officer at board level, a code of conduct and a way for "beneficiaries and other stakeholders outside of the organisation" to complain and raise concerns. That last expectation is the one that needs a public route. How to build complaints and concerns routes as one structure is covered in complaints and speak-up pages. Name the safeguarding lead by role, with a role mailbox, so the page survives a change of staff. What the safeguarding page itself should let people do is in what a safeguarding page should let people do.

Two Pages That Come From the Agreement

Two website duties are real, and both arise from the funding agreement rather than from statute.

Acknowledging the funding. FCDO's branding guidance for ODA-funded programmes makes branding a condition of accepting funding for implementing partners. It lists websites, on the home page or a page listing donors, among the places to acknowledge it. The main mark has been UK International Development since the brand launched in April 2023. The guidance also allows exceptions where showing UK support would endanger the people a programme serves or its staff. How to govern funder logos, including taking them down when a grant ends, is in logo walls as governance.

Publishing to IATI. FCDO's IATI guidelines say it "encourages, and in most agreements mandates" implementing partners to publish organisation and activity data to the IATI Standard, with activity data updated at least quarterly. The publishing happens through IATI's own systems, not on your site, and the IATI Registry was replaced in December 2025, so check any old links. The page on your site is what an assessor actually clicks: your organisation identifier, a link to the data and how often it is refreshed. Check your own agreement for the deadline; the guidelines do not set one.

Christian Aid's accountability and transparency hub shows the shape of a page like this. Annual reports, safeguarding, an anti-diversion and abuse policy, codes of conduct, a link to its IATI data and its complaints routes sit on one page. I loaded it on 30 September 2026. It is a public example of the pattern, not a template for your own documents.

Sanctions and Counter-Terrorism

Sanctions and counter-terrorism law apply to your organisation whether or not FCDO funds you. The Charity Commission's guidance on charities and terrorism sets out the legal framework and the lists trustees need to know about. How you screen is a matter for your trustees and your adviser, not your website.

What the page can carry is short: a zero-tolerance statement, a sentence saying that you screen partners and suppliers, and a confidential route for reporting suspected fraud, bribery or diversion. The screening procedure and its records go in the pack.

Public or On Request

The line between the two is not about how sensitive a document feels. It is about what harm the document could do in the wrong hands, and to whom.

Publish what describes you: who you are, how you are governed, what you have delivered, what you spent and the policies you hold yourself to. Send on request what could be used against you or against someone else:

  • Bank details, which are what a payment-diversion fraud needs.
  • Full insurance schedules, which carry limits, policy numbers and insurer details that nobody outside the agreement needs.
  • Management accounts, which are unaudited and go out of date quickly.
  • The delivery chain map, and any document that names partners or staff where the association carries risk.

The public page should still say that each of these exists and how to request it. A pack sent on request must carry the same dates as the public versions. If it does not, the reader holds two versions of your organisation and has to decide which one is true.

Who Owns Each Review Date

A due-diligence page collects documents from four or five teams, which is why it goes stale faster than any other page on the site. The fix is not a stricter editor. It is a date on every document and a named owner behind each one.

For each document, the page needs the date it was last approved, the role that owns it and the event that triggers its next review. Most triggers are predictable: new accounts filed, a policy re-approved by the board, a new FCDO agreement signed, a change of safeguarding lead. Write those triggers into your website governance policy, and put the page itself on the review cycle described in content governance for nonprofit websites.

I would show the approval date beside each document on the page, not only inside the PDF. An assessor reads the dates before the documents. A current date tells them the policy is live. A missing one tells them to ask.

A public pack will not pass due diligence for you, and FCDO does not ask you to publish one. What it does is answer the first round of questions before they are sent, so the conversation starts with your evidence. The documents answer the question. The dates answer the next one.

Further Reading

What This Post Does Not Cover

This is about the website: what it can publish, what it should hold back and who keeps it current. It is not advice on how FCDO scores an assessment, on meeting its standards or on sanctions and counter-terrorism compliance, which belong with your trustees and your own legal adviser. It does not cover the terms of any particular funding agreement; where this post and your agreement differ, the agreement governs.