Introduction
Financial institutions are expected to know who their customers are, understand associated risks, and monitor relationships throughout the customer lifecycle. This is where Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) play a critical role.
While both are essential components of a risk-based AML framework, they serve different purposes and are applied to different levels of risk. Understanding when to use CDD and when to escalate to EDD is crucial for maintaining compliance and mitigating financial crime risks.
What Is Customer Due Diligence (CDD)?
Customer Due Diligence (CDD) is the standard process used by financial institutions and regulated entities to verify customer identities, understand the nature of customer relationships, and assess potential risk during onboarding.
CDD forms the foundation of Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance programs by helping organisations establish confidence that customers are who they claim to be.
The process typically involves:
Customer Identification and Verification:
CDD begins with verifying a customer's identity using reliable documents and information. This helps organisations confirm the legitimacy of customers and reduce the risk of fraud and financial crime.
Verification of Address and Contact Information:
Organisations validate key contact and address details to ensure customer records are accurate and up to date. Accurate information supports effective monitoring and regulatory compliance.
Understanding the Purpose of the Relationship:
Institutions assess why a customer is seeking a product or service and how they intend to use it. This helps establish an expected customer profile from the outset.
Assessing Expected Transaction Activity:
Understanding anticipated transaction volumes, geographies, and business activities enables organisations to identify unusual or potentially suspicious behaviour later in the relationship.
Screening Against Sanctions and Watchlists:
Customers are screened against sanctions lists, watchlists, PEP databases, and other risk sources to identify potential compliance concerns and determine whether additional due diligence is required.
For individuals, verification is generally completed using government-issued identification documents such as passports, driver's licenses, or national identity cards. For businesses, organisations may also review registration documents, ownership information, and operational details.
What Is Enhanced Due Diligence (EDD)?
Enhanced Due Diligence (EDD) is a more comprehensive and risk-focused investigation conducted when a customer, transaction, or business relationship presents a heightened risk of money laundering, terrorist financing, sanctions breaches, corruption, fraud, or reputation damage.
EDD goes beyond standard verification by providing deeper insight into a customer's background, source of wealth, ownership structure, and business activities. Common EDD activities include:
Source of Wealth Verification:
This involves understanding how a customer has accumulated their overall wealth. It helps organisations assess whether the customer's financial profile aligns with their known business activities.
Source of Funds Verification:
Source of funds checks focus on the specific origin of money involved in a transaction or business relationship. This helps confirm that funds are derived from legitimate sources and reduces financial crime risk.
Adverse Media and Reputation Screening:
Organisations review public sources to identify negative news related to fraud, corruption, money laundering, sanctions violations, or other reputation concerns that may indicate elevated risk.
Detailed Sanctions and PEP Checks:
Enhanced screening is conducted to identify individuals or entities that appear on sanctions lists or are classified as Politically Exposed Persons (PEPs), helping organisations meet regulatory obligations and manage risk effectively.
Ultimate Beneficial Owner (UBO) Identification and Verification:
EDD often requires a deeper examination of ownership structures to identify and verify the individuals who ultimately own or control a business. This improves transparency and helps uncover hidden risks.
The objective of EDD is to obtain a comprehensive understanding of high-risk customers and identify hidden risk indicators that may not be detected through standard due diligence processes. It also helps institutions demonstrate to regulators that appropriate controls have been applied where elevated risk exists.
CDD vs EDD: Key Differences
CDD and EDD are conducted for the same goal, but their depth varies. The main difference is how far the investigation goes and the level of risk each one addresses.
| Criteria | CDD | EDD |
|---|---|---|
| Risk Level | Standard/Low | High |
| Depth of Verification | Basic | Extensive |
| Source of Funds Review | Usually not required | Required |
| Adverse Media Checks | Limited | Comprehensive |
| Monitoring Frequency | Periodic | Ongoing |
| Regulatory Scrutiny | Standard | Higher Regulatory Expectations |
In simple terms, CDD establishes a baseline understanding of every customer, while EDD provides additional assurance where risk exposure is elevated.
When Is CDD Required?
CDD is typically required whenever a financial institution establishes or maintains a customer relationship. Common situations include:
Customer Onboarding
CDD is conducted during onboarding to verify customer identity and assess initial risk.
New Account Opening
Organisations perform CDD before opening new accounts or providing regulated services.
New Business Relationship
CDD helps in verifying the customer before entering into a formal business relationship.
Changes in Customer Information
It may be refreshed when there are significant changes to customer details, ownership, or activities.
Periodic Customer Reviews
Organisations conduct periodic reviews to ensure customer information and risk profiles remain up to date.
For example, a salaried individual opening a savings account and providing standard identification documents, proof of address, and income information would generally undergo routine CDD procedures.
Since the customer presents a relatively low level of risk, enhanced investigation would not normally be required.
When Is EDD Required?
EDD is triggered when higher-risk indicators are identified during onboarding, screening, or ongoing monitoring.
Financial institutions must apply enhanced scrutiny whenever the risk profile exceeds acceptable thresholds or when regulations specifically require additional verification. Common EDD Triggers are:
Politically Exposed Persons (PEPs):
Individuals holding prominent public positions may present higher corruption-related risks.
High-Risk Jurisdictions:
Customers connected to countries with elevated AML concerns or sanctions exposure.
Complex Ownership Structures:
Businesses with layered ownership structures that obscure beneficial ownership.
High-Value Transactions:
Customers expected to conduct unusually large or complex transactions.
Adverse Media Findings:
Negative news related to financial crime, corruption, fraud, or sanctions.
Why a Risk-Based Approach Matters
Regulators worldwide increasingly expect organisations to adopt a risk-based approach rather than applying the same level of due diligence to every customer.
By assessing risk and applying controls proportionately, organisations can:
- Allocate compliance resources efficiently
- Reduce customer onboarding friction
- Improve risk detection
- Meet regulatory expectations
- Strengthen AML controls
How Technology Supports CDD and EDD
Modern compliance technology enables organisations to perform due diligence more efficiently while improving accuracy and consistency.
- Automate identity verification
- Conduct sanctions screening
- Screen PEPs and adverse media
- Identify beneficial owners
- Monitor customer risk continuously
- Generate audit-ready compliance records
This allows compliance teams to focus on investigation and decision-making rather than manual administration.
Conclusion
CDD and EDD are complementary components of an effective financial crime compliance program. While CDD establishes a foundational understanding of every customer, EDD provides the deeper investigation necessary for higher-risk relationships and complex risk scenarios.
As regulatory scrutiny continues to increase, organisations must move beyond checklist-based onboarding and adopt a risk-based approach that combines robust due diligence, ongoing monitoring, and continuous risk assessment. By applying the appropriate level of scrutiny at the right time, institutions can strengthen compliance outcomes, improve operational efficiency, and make more informed risk decisions across the customer lifecycle.
Modern compliance technology can further support these efforts by helping organisations streamline customer screening, verify ownership structures, monitor risk indicators, and maintain audit-ready records. By centralising due diligence and risk intelligence workflows, organisations can enhance risk visibility, improve consistency, and respond more effectively to evolving regulatory expectations.