Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) constitute fundamental components of international AML and CFT regimes. The supervisory authorities (alongside the FATF and the various regional authorities) all require that institutions have robust CDD and EDD processes in place. Where these processes are poor or inconsistent, this will invariably lead to enforcement action, reputational damage, and wider risk. This article looks at best practice in CDD and EDD, how they work in practice, examples of non-compliance, new best practice, and practical tips and actions compliance professionals can take to implement them in their own organisations.
Beneficial Ownership
A fundamental part of CDD is working out who the Ultimate Beneficial Owner (UBO) of a legal entity is. FATF guidance requires you to identify anyone who has 25% or more of the control of an entity. Some jurisdictions (e.g. those following the EU's 6th AMLD) will use a 10% threshold. Identifying the beneficial owner is key to preventing the misuse of shell companies and layering schemes for money laundering and terrorist financing (FATF, 2023).
Politically Exposed Persons (PEPs)
PEPs (Politically Exposed Persons) are people of public profile. They are at greater risk of bribery and corruption, and so EDD controls will be more stringent in respect of them. Institutions should assess the risk in respect of both domestic and foreign PEPs as well as those who are connected to international organisations. In many cases, there will also be a requirement for intensified monitoring of family members and close associates. The FATF guidelines make it clear that being designated a PEP does not imply that the person has committed an offence; it simply means they are subject to heightened monitoring and controls (FATF, 2013).
High-Risk Clients and Jurisdictions
EDD also applies to clients operating in high-risk jurisdictions and sectors. This includes clients in jurisdictions with weak AML/CFT controls, offshore businesses, correspondent banking, and virtual asset businesses. Clients with links to negative media or to sanctioned jurisdictions would also be considered high risk. Institutions will need procedures to identify and manage these profiles, drawing on both their own risk assessment and relevant regulatory requirements. The procedures will typically involve periodic reviews of the high-risk customer, escalation of any suspicious findings to the compliance unit, the requirement for extra documentation in certain circumstances, and the application of enhanced transaction monitoring rules. A high-risk client, for example, may be subject to a quarterly account review, automated alerts for irregular activity, and senior management approval before onboarding or processing any large transaction.
Risk-Based Approach and Monitoring
Due diligence is now risk-based. Institutions will assign a score based on several factors, including location, customer type, products and services and distribution channel. The higher the score, the higher the risk and the more EDD steps you will need to take (e.g. senior management approval, extra documentation, etc.). Due diligence is not simply a one-off onboarding exercise. You will need an ongoing monitoring regime to pick up unusual changes in ownership, odd transaction trends, or activity that is out of character for the customer (FCA, 2021).
Technology and Automation
Tech has been a major enabler of CDD and EDD. ML, AI, and e-KYC tools help institutions screen sanction lists, review negative media, and track transactions in real time. They're clearly a huge time saver and improve efficiency. The issue, of course, is striking the right balance. The types of work that are best suited to automation are those that involve processing large volumes of data and/or are highly repetitive in nature (i.e. screening transactions against a sanction list and flagging transactions that are in some way unusual). Work that is better left to the human element requires professional judgement and an understanding of the client (i.e. investigating a complex ownership structure or deciding whether to escalate a suspicious transaction report). Regulators have made it clear that technology is a tool to support manual controls and not a replacement for them. Institutions must have governance in place to ensure accountability, monitoring, and independent audit trails (MAS, 2022).
Lessons from Enforcement Actions
Failures in EDD have driven some of the biggest AML scandals. The Danske Bank case is a prime example, with over €200bn in suspicious transactions flowing through its Estonian branch because of inadequate monitoring and ownership due diligence. HSBC is another case in point, having to pay $1.9bn in fines after a US investigation revealed deficiencies in its correspondent banking that allowed drug cartel money to flow through. These are classic examples of the financial penalties, reputational damage, and cross-border investigations that can result from failing to carry out EDD (European Parliament, 2019; U.S. Department of Justice, 2012).
International Standards and Guidance
The FATF recommendations form the basis of CDD and EDD rules worldwide. Rec 10 sets out the minimum CDD steps, Rec 12 requires EDD for PEPs and other high-risk customers, and Rec 20 requires prompt reporting of suspicious transactions. The FATF risk-based approach helps institutions allocate compliance resources based on risk (FATF, 2012).
Regional regulators are all developing the FATF principles. FinCEN in the US has the CDD Rule, which requires institutions to identify the beneficial owners of any legal entity in which they have a 25% or greater interest. The FCA in the UK has issued guidance on combating financial crime. The RBI requires regular KYC reviews, and the MAS in Singapore prioritises accountability, intensive monitoring, and the use of technology in AML programmes (FinCEN, 2018; FCA, 2021; RBI, n.d.; MAS, 2022). The Wolfsberg Group (a group of leading international banks) has also issued guidance, particularly on correspondent banking, emphasising transparency and ownership checks (Wolfsberg Group, 2014).
Best Practices in CDD and EDD
Effective CDD and EDD utilise a tiered approach. Standard CDD applies to low- and medium-risk customers; EDD applies to PEPs, customers from high-risk jurisdictions, and those with complex ownership. Search for negative media, keep your records up to date, and ensure your global policies align with local requirements. To do this, map the differences between the global frameworks and local rules, consult your in-country legal/compliance team, and adapt your procedures or records to meet the most stringent applicable standard. For instance, you could create a matrix that maps the FATF recommendations against each country's requirements, then use it to customise your training and processes so you're compliant in every jurisdiction you operate in. Technology can improve efficiency, but the compliance professional remains ultimately responsible. Most importantly, you need a strong compliance culture with ongoing training and regular oversight from the board and senior management.
Conclusion
CDD and EDD aren't just regulatory tick boxes. They are fundamental elements of a risk management framework. Regulators expect controls to be embedded in the institution's systems, backed by monitoring, technology, and governance. You can achieve that by complying with FATF guidance, learning from enforcement actions and applying best practice. That's how you build up your defences against financial crime and keep pace with the ever-changing regulatory setting.