Customer Due Diligence (CDD): The Complete Process, from Standard to Enhanced

A bank, a payments company, or a fund administrator meets a new corporate customer and has to answer a question that sounds simple and almost never is: who, exactly, are we doing business with? Customer due diligence (CDD) is the formal answer — the identification, verification, and risk-profiling work a regulated institution performs before and during a relationship, calibrated so that a routine retail account gets a light check and a complex offshore holding structure gets a much harder one. Get it wrong in either direction and the cost shows up later: a regulatory finding for doing too little, or a lost customer and a stalled onboarding pipeline for doing too much on a low-risk account that never needed it.

01What customer due diligence actually requires

In the United States, the baseline is codified at 31 CFR §1010.230, FinCEN’s Customer Due Diligence Rule, finalized in 2016 with full compliance required by May 2018. The rule applies to banks, broker-dealers, mutual funds, and futures commission merchants and introducing brokers, and it names four core elements every covered institution’s AML program must perform:

1. Customer identification and verification. Confirming who the customer is using reliable, independent documentation — this piece predates the 2016 rule and was already a baseline AML program requirement.

2. Beneficial ownership identification and verification. For legal entity customers, identifying and verifying every individual who owns 25% or more of the entity’s equity (the ownership prong, capturing up to four people) plus at least one individual with significant managerial responsibility to control it (the control prong). This was the genuinely new piece in 2016 — closing a gap where a bank could open an account for a company without ever learning who stood behind it.

3. Understanding the nature and purpose of the relationship. Enough information to build a customer risk profile that ongoing monitoring can actually be measured against.

4. Ongoing monitoring. Watching account activity against that risk profile to detect and report suspicious transactions, and updating customer information on a risk basis rather than treating onboarding as a one-time event.

Internationally, the same four elements appear, nearly word for word, in the Financial Action Task Force’s Recommendation 10, the global standard roughly 200 jurisdictions have committed to implementing. FATF frames CDD as mandatory whenever a business relationship is established, for occasional transactions above a designated threshold (USD/EUR 15,000 or qualifying wire transfers), whenever money laundering or terrorist financing is suspected, and whenever doubts arise about previously collected identification data. The identification step for beneficial owners — the piece that, per FinCEN’s own stated rationale, closes the gap where a covered institution doesn’t actually know who owns or controls its legal-entity customer — sits at the center of both frameworks, which is also why it’s the step most often outsourced to UBO verification tooling rather than handled on a case officer’s judgment alone.

None of this is optional risk management. It is a legal baseline, and “the customer seemed fine” is not a defense a regulator accepts in place of a documented file.

So which customers only need the standard version of this, and which need more?

02Standard CDD vs. enhanced due diligence

CDD is risk-based, not uniform. The same four core elements apply to every customer, but how deep an institution goes to satisfy them scales with the risk the customer presents. Most of a typical onboarding book sits inside standard CDD. A smaller, higher-risk slice gets escalated into enhanced due diligence (EDD) — a deeper version of the same four requirements, not a separate framework.

The decision to move a customer from standard CDD into EDD is itself a judgment call made against a risk framework — typically the customer’s jurisdiction, industry, ownership complexity, and transaction pattern, scored against criteria the institution sets out in its own AML policy. A customer with a straightforward, single-layer ownership structure and a transparent business model rarely needs more than standard CDD, however large the account. A customer with a multi-jurisdictional holding chain, a politically exposed principal, or a cash-intensive business model usually needs EDD regardless of account size — a distinction covered in more depth in this risk-scoring framework for multi-layered corporate structures.

03Source of wealth vs. source of funds — the distinction EDD runs on

These two terms get used interchangeably in casual conversation and mean genuinely different things in an EDD file, and conflating them is one of the more common review failures compliance teams flag.

Source of funds (SoF) traces the money involved in a specific transaction or relationship back to where it came from — this transfer, this deposit, this capital contribution. The evidence is transactional: a payslip, a sale agreement, a bank statement showing the funds moving from a verifiable origin into the account being opened.

Source of wealth (SoW) explains how the customer accumulated their overall net worth, not just the balance in front of the institution today. The evidence is biographical: an inheritance, a business sale, decades of career earnings, an equity stake that vested and was liquidated. A property deed, a probate grant, or a trust deed typically stands in as evidence here, because SoW is a claim about history, not about one transaction.

The distinction matters because satisfying one does not satisfy the other. Showing that a wire transfer originated from a named corporate account (source of funds, done) says nothing about why that company holds the wealth it does, or whether the money sitting in it has a legitimate origin several steps further back (source of wealth, still open). A customer who can readily produce a bank statement showing where this payment came from but goes quiet when asked how they built the wealth behind it has, in EDD terms, answered the easy question and left the hard one unanswered. FATF and FinCEN both treat SoW as something an institution establishes only where the customer’s risk profile actually warrants it — it is not a universal CDD requirement, but it is close to universal practice for politically exposed persons (PEPs) and their family members and close associates once a relationship is escalated into EDD.

04What triggers CDD, and what escalates it to EDD

CDD itself is triggered, per FATF Recommendation 10, at four points: establishing a new business relationship, an occasional transaction above the designated threshold, suspicion of money laundering or terrorist financing regardless of any exemption that would otherwise apply, and doubt about the veracity or adequacy of previously obtained customer data. None of these is discretionary once the trigger is met.

Escalation from standard CDD to EDD is risk-based rather than rule-bound in the same mechanical sense, but a consistent set of factors recurs across FATF guidance and national regulators’ expectations:

Politically exposed persons. A customer, beneficial owner, or close associate holding or having held a prominent public function — the single most consistent EDD trigger across jurisdictions.

High-risk or non-cooperative jurisdictions. A customer, or a layer in its ownership chain, based in a country flagged by FATF or the institution’s own country-risk rating.

Complex or opaque ownership structures. Multiple intermediate holding entities, nominee arrangements, or an ownership chain that can’t be fully resolved to named individuals at the first layer of disclosure.

Cash-intensive or higher-risk sectors. Money services, casinos and gaming, precious metals and stones, and certain real estate transactions carry elevated baseline risk regardless of the specific customer.

Adverse media or negative news. Credible reporting linking a customer or principal to financial crime, corruption, or sanctions evasion, even absent a formal listing.

Correspondent banking and non-face-to-face relationships. Cross-border institutional relationships and remote onboarding both reduce the institution’s own first-hand visibility into who it’s actually dealing with.

Unusual transaction patterns. Activity inconsistent with the customer’s stated purpose or risk profile, surfaced through ongoing monitoring rather than at onboarding.

05CDD risk-rating in practice

A jurisdiction flag here, a PEP hit there, a complex ownership chain somewhere else — how does an institution turn scattered risk factors into one decision?

The FFIEC’s BSA/AML Examination Manual frames the answer as a customer risk profile: customer type, products used, geography, and the ownership picture CDD has already built, rolled into one of three tiers — Low, Moderate, or High. Crossing that threshold is what moves a file from standard CDD into EDD, and sets the monitoring frequency and sign-off level.

06Escalating from CDD to EDD: a worked example

What does that escalation actually look like, from a clean onboarding file to an MLRO’s desk?

Take a hypothetical — call it Northfield Commerce Holdings. (Illustrative only; not a real registry record.) Standard CDD finds a sole corporate shareholder with no individual named at the first layer, enough on its own to push the composite score across the EDD threshold. Escalation adds what standard CDD skipped: the chain is traced to a second layer, resolving to an individual who turns out to be a PEP; source of wealth is documented alongside source of funds; and approval moves from a front-line analyst to the MLRO.

The lesson generalizes beyond this one file: EDD isn’t a different process, it’s the same four CDD elements pushed deeper exactly where the risk factors point.

07What the underlying registry data actually shows

The beneficial-ownership element of CDD assumes an institution can pull shareholder data on a legal-entity customer and find a named individual sitting behind it, at least often enough that escalation to EDD is the exception rather than the rule. We ran a live, stratified query against Zavia’s own company dataset on 2026-10-20 — 350 companies sampled, 50 per country across seven jurisdictions (the US, UK, Germany, France, Italy, the Netherlands, and Singapore) — to see how often that assumption actually holds at the first layer of public disclosure.

The gap between the first and second figures is the real finding. Nearly every sampled company discloses shareholder data of some kind — a bank running baseline CDD rarely hits a blank field. But in more than four out of five of those cases, what comes back at the first layer is another company, a holding vehicle, or in several UK cases an institutional fund, not a named person. That is exactly the shape the CDD Rule’s beneficial-ownership requirement anticipates and exists to look past: identifying who owns or controls the legal-entity customer means tracing through that corporate layer to the individual behind it, not stopping at the first name the registry returns. A reviewer who treats a disclosed corporate shareholder as if it satisfied the beneficial-ownership element has done the easy 99.7% of the work and skipped the part the rule was written for.

A methodology note: shareholder type was read directly from each record’s own shareholder_type field rather than inferred from the holder’s name, and a company counted as naming a natural person if any disclosed holder carried a person/individual type marker. Several UK records in the sample disclosed index-fund or asset-manager holdings at well-defined percentages of a tracked free-float sample rather than a full share register, which is a known characteristic of certain UK filings and doesn’t change the core finding: a disclosed holder being a fund or a company is still not a disclosed natural person.

Does a 16.6% natural-person rate mean the other 83.4% are hiding something? Not inherently — a corporate holder at the first layer is routine in group structures and fund-managed stakes, and most chains resolve cleanly once traced. The number shows how much tracing the beneficial-ownership element of CDD actually carries: for roughly five companies out of six here, the first layer alone would have handed a reviewer a company name instead of a person’s.

08CDD record-keeping and retention requirements

Who has to produce a five-year-old onboarding file on demand, and what happens if they can’t?

In the US, the Bank Secrecy Act’s recordkeeping rule at 31 CFR §1010.430 sets a general five-year retention period, kept in a way that allows retrieval within a reasonable time. FATF Recommendation 11 sets the same five-year floor but starts the clock differently by record type: transaction records run from the transaction date; CDD documentation and account files run from the end of the business relationship or the occasional transaction.

The EU’s AMLD framework — Directive (EU) 2015/849, as amended by the Fifth AML Directive (2018/843) — mirrors that five-year baseline in Article 40, extendable by member states to ten years total after a documented necessity assessment. GDPR’s erasure right doesn’t override this: Article 17(3)(b) carves out processing necessary to meet a legal obligation, which is exactly what the retention rule is.

09The CDD process, step by step

1. Collect and verify customer identity. Government ID for individuals; certificate of incorporation and registry extract for entities.

2. Identify beneficial owners. Apply the ownership prong (25% equity threshold) and the control prong, then verify each individual independently rather than relying solely on the customer’s own disclosure form.

3. Screen the customer and every identified owner. Sanctions lists, PEP databases, and adverse media, run against the entity and each individual separately — a hit on a beneficial owner is a hit on the relationship.

4. Build the risk profile. Score the customer against jurisdiction, industry, ownership complexity, and screening results to reach a standard-CDD or EDD classification.

5. Apply EDD measures where warranted. Full ownership-chain tracing, source of wealth and source of funds documentation, and senior-management sign-off.

6. Monitor on an ongoing basis. Re-screen periodically and refresh customer information on a risk-calibrated schedule, not only at renewal.

7. Document everything. A regulator examining the file afterward needs the evidence and reasoning behind a conclusion, not just the conclusion itself.

10Frequently asked questions