Customer Due Diligence vs. Enhanced Due Diligence: A Practical Guide
Customer due diligence (CDD) and enhanced due diligence (EDD) are two levels of the same process: getting to know who your customer is and whether the relationship makes sense. CDD is the standard every customer goes through. EDD is the extra layer applied when the risk is higher. Many regimes also allow a third level — simplified due diligence (SDD) — for demonstrably low-risk situations.
This guide explains what each level involves, when EDD is mandatory, what enhanced measures look like in practice, and how to avoid the most common mistakes.
Customer due diligence: the standard
FATF Recommendation 10 sets out the core CDD measures that national laws build on. For every customer, firms must:
- Identify the customer and verify their identity using reliable, independent sources — documents, data or information.
- Identify the beneficial owner — the natural person who ultimately owns or controls the customer — and take reasonable measures to verify their identity. For legal entities, this means understanding the ownership and control structure. Many regimes use a 25% ownership threshold as a starting point, though some use lower thresholds, and control can exist without ownership.
- Understand the purpose and intended nature of the business relationship, and obtain information about it where appropriate.
- Conduct ongoing due diligence — scrutinising transactions throughout the relationship to make sure they are consistent with what you know about the customer, and keeping information up to date.
CDD must generally be completed before establishing a business relationship or carrying out an occasional transaction above the applicable threshold. If you can't complete it, you shouldn't proceed — and you should consider whether a suspicious activity report is warranted.
The output of CDD is a customer risk rating, based on factors like customer type, geography, products used, delivery channel and expected activity. That rating determines whether standard, enhanced or simplified measures apply, and how often the customer is reviewed.
Enhanced due diligence: when the risk is higher
EDD applies whenever your assessment identifies a higher risk of money laundering or terrorist financing. Beyond that general rule, FATF identifies situations where enhanced measures are required regardless of your own assessment.
When EDD is mandatory
- Politically exposed persons (FATF Recommendation 12). Foreign PEPs always require enhanced measures. For domestic PEPs and people with prominent functions at international organisations, enhanced measures apply when the relationship is higher risk. Some regimes, including the EU and UK, apply EDD to all PEPs. Family members and close associates are usually in scope too.
- Correspondent relationships (Recommendation 13). Cross-border correspondent banking and similar relationships require additional measures, including understanding the respondent's business and AML controls and obtaining senior management approval.
- High-risk countries (Recommendation 19). Business relationships and transactions with persons from countries for which FATF calls for action must be subject to enhanced measures. Some regimes maintain their own lists — the EU, for example, publishes a list of high-risk third countries, and its new AML Regulation sets out EDD rules in more detail.
National laws often add further mandatory cases, such as complex or unusually large transactions with no apparent economic purpose.
What enhanced measures look like
EDD is not a fixed checklist; the measures should address the specific risk that triggered it. Common measures include:
- Source of funds — where the money involved in the relationship or transaction comes from.
- Source of wealth — how the customer accumulated their overall wealth. This matters especially for PEPs and high-net-worth customers.
- Additional information on the customer and beneficial owners — occupation, business activities, reputation, adverse media.
- More information on the intended nature of the relationship and the reasons for planned transactions.
- Senior management approval to establish or continue the relationship.
- Enhanced ongoing monitoring — more frequent reviews, lower monitoring thresholds, and closer scrutiny of transaction patterns.
- Independent verification of information the customer provides, rather than relying on their declarations.
The key is proportionality. Asking a PEP for source of wealth evidence that corroborates their declared career is proportionate. Asking every high-risk customer for the same generic document pack, regardless of why they are high risk, is not.
Simplified due diligence: when the risk is lower
Where a firm's risk assessment shows a lower risk, many regimes allow simplified measures — for example, verifying identity after the relationship is established, collecting less information, or reviewing less often. SDD is never a complete exemption: you still have to identify the customer, monitor the relationship and report suspicion. And it's never available where there is a suspicion of money laundering or terrorist financing, or where specific higher-risk scenarios apply.
CDD vs EDD at a glance
| CDD | EDD | |
|---|---|---|
| Applies to | All customers | Higher-risk customers and mandatory cases |
| Identity verification | Reliable, independent sources | Additional or more robust verification |
| Beneficial ownership | Identify and take reasonable measures to verify | Deeper understanding of structure and control |
| Purpose of relationship | Understand it | Understand it in detail, with supporting evidence |
| Source of funds / wealth | Where relevant to risk | Usually required |
| Approval | Standard onboarding approval | Senior management approval |
| Ongoing monitoring | Standard | Enhanced: more frequent reviews, tighter scrutiny |
Common mistakes
- Treating EDD as a document checklist. Collecting more documents without analysing what they show doesn't reduce risk. Record your conclusions, not just the files.
- Not linking EDD to the reason for high risk. If a customer is high risk because of their country, source of funds evidence may matter more than another ID document.
- Missing PEP family members and close associates. Screening only the customer misses a large part of the PEP population.
- Never revisiting the rating. A customer rated low at onboarding can become high risk. Trigger events and periodic KYC reviews should catch that.
- Inconsistent decisions. Two analysts reaching different conclusions on similar customers suggests the methodology isn't clear enough.
Key takeaways
- CDD applies to every customer: identify and verify, understand beneficial ownership and purpose, and monitor on an ongoing basis.
- EDD applies when risk is higher, and is mandatory for foreign PEPs, cross-border correspondent relationships and high-risk countries identified by FATF.
- Enhanced measures should address the specific risk — source of funds and wealth, senior approval and closer monitoring are the most common.
- SDD can apply where risk is demonstrably low, but never removes core obligations.
CDD sits at the heart of a risk-based AML program, and your customer risk methodology should follow from your business-wide risk assessment. Regpin helps compliance teams manage that methodology and the program around it — talk to us to learn more.
This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.