For most financial services firms, customer due diligence (CDD) is a familiar part of onboarding. Verify the customer’s identity, check their address, identify beneficial owners, run the relevant screening and build a picture of the relationship. Job done.
Except, sometimes, it isn’t.
A customer might have links to a higher-risk jurisdiction, a politically exposed person (PEP) connection or an ownership structure that raises questions. A screening result might flag adverse media. The customer’s source of wealth might not quite add up. Suddenly, the standard checks that worked perfectly well for one client aren’t enough for another. That’s where enhanced due diligence (EDD) comes in.
But knowing when to move from CDD to EDD, and how far those enhanced checks should go, is where firms can run into trouble.
Get it wrong and you risk spending too much time investigating low-risk customers while missing the warning signs in higher-risk relationships. Neither is a good outcome.
CDD sets the baseline, EDD responds to increased risk
CDD is the starting point for understanding who you’re dealing with. It covers identity and address verification, beneficial ownership where applicable, the purpose and nature of the relationship, screening for PEPs, sanctions and adverse media, and an initial risk rating.
For a standard-risk customer, that may be enough, provided the checks support the assessment and ongoing monitoring reflects the risk.
EDD starts when the available information, screening results or risk assessment point to a higher level of exposure to money laundering.
The aim is to build a deeper understanding of the customer and the risks associated with the relationship. That could mean stronger identity verification, mapping the full ownership structure, investigating adverse media in greater depth, establishing the source of wealth, obtaining senior management approval and increasing the frequency of monitoring and reviews.
The important distinction is that EDD builds on CDD. It doesn’t replace it.
A higher-risk customer still needs the standard checks. The difference is the depth of investigation required to understand the risks and decide what the firm should do next.
So, when should EDD start?
The short answer is when a customer, transaction or business relationship presents a higher risk that standard CDD alone cannot adequately address.
The longer answer depends on what the evidence tells you.
A domestic PEP, for example, might have recently held a senior government role. Screening could also reveal media reports linking them to a corruption investigation, although no charges have been brought. That doesn’t automatically mean the customer should be rejected. It does mean the firm needs to look beyond the initial screening result, assess the reliability of the reporting and consider what further evidence is needed.
The same principle applies to ownership structures when onboarding corporate customers as part of Know Your Business (KYB) checks. A customer wanting to hold assets through a trust isn’t automatically high risk. But if an overseas company sits several layers up the ownership chain and the ultimate beneficial owner remains unclear, there’s a clear reason to investigate further.
Jurisdiction, product complexity, transaction values, PEP connections, sanctions exposure and uncertainty around source of wealth can all influence the decision.
The trick is to assess these factors together rather than treating any single flag as an automatic answer. A customer living in a higher-risk jurisdiction might present a different overall risk from someone with the same geographical connection who also has opaque ownership, unexplained wealth and concerning adverse media.
EDD should begin when the combined picture warrants it, in line with your firm’s risk appetite and defined escalation criteria.
Taking a risk-based approach to each case
EDD shouldn’t become an open-ended request for documents, information and explanations simply because a customer has been classified as high risk. The aim is to resolve the questions that prompted the enhanced checks, not to collect as much information as possible.
Start with the specific risk. If the concern is unclear ownership, map the structure and establish who ultimately owns or controls the customer. If the issue is source of wealth, gather independent evidence that explains how the wealth was accumulated and whether it fits the customer’s profile. If adverse media raises concerns, assess the source, credibility, relevance and context of the reporting.
Each additional check should have a purpose. What are you trying to establish? What evidence would help answer the question? Does the information obtained reduce the uncertainty, or does it raise further concerns?
There won’t always be a neat finish. Some customers may be able to explain an apparent red flag with credible evidence. Others may leave important questions unanswered. In some cases, the evidence may point to risks your firm isn’t prepared to accept.
The endpoint is a defensible decision based on the evidence available, the firm’s risk appetite and the applicable requirements. That decision might be to onboard, decline the relationship or apply restrictions and closer monitoring where appropriate.
If the risk cannot be adequately understood or managed, collecting another stack of documents isn’t necessarily the answer.
The evidence matters just as much as the checks
Even a well-run EDD investigation can fall short if nobody can explain what happened and why.
A reviewer or regulator should be able to follow the file from the original risk trigger through to the final decision. Why was the customer classified as high risk? What further information was requested? Which sources were consulted? How was the evidence assessed? Who approved the outcome, and what monitoring will follow?
Recording the answers creates an audit trail that shows the decision wasn’t arbitrary. It also gives the next person reviewing the account a clear starting point.
EDD doesn’t stop at onboarding, either. Changes in ownership, new PEP or sanctions exposure, adverse media and unusual activity can all prompt further investigation. Review schedules should reflect the customer’s risk rating, with higher-risk relationships receiving more frequent attention.
A file that was satisfactory twelve months ago might tell a very different story today.
Getting the balance between CDD and EDD right with technology
Compliance solutions like ID-Pal can help firms draw a clearer line between CDD and EDD. Configurable, rules-based engines allow compliance teams to set thresholds and escalation criteria that reflect their own risk appetite, rather than relying on a one-size-fits-all approach.
By tailoring rules around factors such as jurisdiction, PEP status, transaction values, product risk and ownership complexity, firms can make more consistent decisions about when standard checks are enough and when enhanced scrutiny is needed.
As risk profiles and business requirements change, those rules can be adapted too.
The result is a more targeted approach to due diligence, with routine checks handled efficiently and compliance teams free to focus on the cases that need closer attention.
And, since the rules and decisions are recorded, firms can also build a clearer audit trail of why EDD was triggered and how the final decision was reached. Ultimately, the goal is to make sure the depth of due diligence reflects the risk in front of you, giving your team the information it needs to make informed, defensible decisions.
Ready to make CDD and EDD work smarter?
