Import Vendor Due Diligence Patrick Munro

Import: Vendor Due Diligence (Patrick Munro)

What it does

This import adapter migrates a vendor due-diligence skill modelled on the Patrick Munro methodology into the mini-claude-for-legal standard format. Vendor due diligence (VDD) is the process of assessing a third party — a supplier, technology vendor, outsourcing partner, or acquisition target — before entering into a material commercial relationship.

The Munro VDD methodology applies a structured, multi-workstream framework that covers legal, financial, operational, compliance, and reputational risk. In MENA, vendor due diligence has heightened importance because of: beneficial-ownership transparency requirements (FATF), sanctions exposure (OFAC, EU, UK), and regulatory vendor-oversight obligations in financial services (DFSA, CBUAE).

Import config

Dry-run preview

IMPORT PREVIEW — vendor-due-diligence-patrick-munro
Source shape       : Vendor DD (Munro methodology)
VDD type           : commercial_vendor
Workstreams        : 5 (legal + financial + operational + compliance + reputational)
Sanctions check    : enabled
Beneficial ownership: enabled
Financials         : enabled
Compliance         : enabled
Reputational       : enabled
Output             : vdd_report

Five-workstream framework (post-import)

Workstream 1 — Legal

• Corporate existence and good standing: company registration, certificate of incorporation, registered address
• Ownership structure: corporate chart; identify ultimate beneficial owners (UBOs) to required threshold (UAE: 25%; EU/UK: 25%)
• Authorised signatories: verify the individuals who will sign contracts have authority to bind the vendor
• Litigation and disputes: any pending or threatened litigation material to the relationship?
• IP ownership: does the vendor own (or have adequate licences for) the IP embedded in its products/services?
• Contractual restrictions: any exclusivity, change-of-control, or non-compete provisions that affect the proposed relationship?

Workstream 2 — Financial

• Financial statements: last 2–3 years' audited accounts
• Solvency indicators: debt/equity ratio, current ratio, cash position
• Accounts payable/receivable: are suppliers being paid? Is revenue concentrated in one customer?
• Insurance: professional indemnity, cyber liability, public liability — adequate for the contract risk profile?
• Pricing sustainability: is the vendor's pricing model financially sustainable? (Relevant for critical dependencies)

Workstream 3 — Operational

• Capacity and scalability: can the vendor meet contract volume requirements?
• Business continuity and disaster recovery: does the vendor have a tested BCP/DR plan?
• Key-person dependency: is performance dependent on specific individuals? What is the retention risk?
• Sub-contractor chain: who does the vendor itself sub-contract to? Does the sub-contractor chain meet the same standards?
• Data security: ISO 27001 certification or equivalent; penetration testing cadence

Workstream 4 — Compliance

• Sanctions screening: screen vendor name, UBOs, and directors against OFAC SDN list, EU Consolidated list, UK HMT list, and UN sanctions list
• AML/KYC: source of funds verification for financial-services vendors; FATF risk classification
• Bribery and corruption: any adverse press on corruption? FCPA/UK Bribery Act/Sapin II exposure?
• Data protection: GDPR / UAE PDPL compliance for vendors handling personal data; DPA execution required?
• Sector-specific licences: does the vendor hold all required regulatory licences for its activities?

Workstream 5 — Reputational

• Adverse media screening: systematic search for negative press on vendor, directors, and UBOs
• ESG and human rights: any supply-chain labour or environmental concerns (particularly for MENA manufacturing vendors)?
• Political exposure: are UBOs politically exposed persons (PEPs)?
• Customer references: speak to existing customers; check for patterns in complaints or disputes

MENA-specific due-diligence notes

• UAE beneficial ownership: UAE Federal Decree-Law 32/2021 (Commercial Companies Law) requires UBO registers; DIFC / ADGM have their own UBO registers; check all registers for the target's registered entities
• KSA: Saudi Ministry of Commerce company registry searchable online; check Sanadic portal for sanctions
• Lebanon: company registry information quality is variable; rely on notarial records and legal counsel confirmation
• OFAC: UAE companies with Iranian or Russian beneficial ownership create OFAC exposure; this is a HIGH risk requiring immediate escalation
• DFSA / CBUAE outsourcing: regulated firms in DIFC/UAE have mandatory vendor oversight obligations; VDD report is required documentation for material outsourcing arrangements

VDD report output schema

VENDOR DUE DILIGENCE REPORT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Vendor         : [name]
VDD date       : [date]
Prepared by    : [team / counsel]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WORKSTREAM SUMMARY
Legal          : [PASS / ISSUES / FAIL] — [key findings]
Financial      : [PASS / ISSUES / FAIL] — [key findings]
Operational    : [PASS / ISSUES / FAIL] — [key findings]
Compliance     : [PASS / ISSUES / FAIL] — [key findings]
Reputational   : [PASS / ISSUES / FAIL] — [key findings]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
OVERALL RISK: LOW / MEDIUM / HIGH / CRITICAL
RECOMMENDATION: Proceed / Proceed with conditions / Do not proceed
CONDITIONS (if applicable): [list of conditions precedent to proceeding]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Failure modes

Related skills

• [[import-tech-contract-negotiation-patrick-munro]]
• [[import-legal-simulation-patrick-munro]]
• [[import-nil-contract-analysis-samir-patel]]
• [[import-legal-risk-assessment-anthropic]]
• [[import-red-team-verifier-patrick-munro]]