Customer Due Diligence: Checks & How It Works

Customer due diligence (CDD) is the process of identifying and verifying a customer’s identity and assessing the risk they pose before or during a business relationship. It checks who the customer is, who ultimately owns or controls them, what their business activity is, and whether their profile matches the expected risk level. The goal is to prevent money laundering, terrorist financing, fraud, and other financial crimes.

Background and Legal Basis

CDD became a formal requirement in the late 1980s with the creation of the Financial Action Task Force (FATF), an intergovernmental body that sets global standards for combating money laundering and terrorist financing. FATF’s Recommendations require financial institutions and other “obliged entities” (such as lawyers, accountants, real estate agents, and casinos) to conduct CDD when establishing a business relationship, when carrying out occasional transactions above a threshold, or when there is suspicion of money laundering or terrorist financing.

National laws implement these standards. For example, in the United States, the Bank Secrecy Act (BSA) and the USA PATRIOT Act mandate CDD, and the 2016 CDD Final Rule added a requirement to identify beneficial owners. In the European Union, the Anti-Money Laundering Directives (currently AMLD6) set similar rules. The core principle is the same everywhere: know who you are dealing with, not just the named account holder.

What CDD Checks

A standard CDD process collects and verifies four main categories of information:

• Identity of the customer: For an individual, this means full name, date of birth, and residential address. For a company, it means legal name, registration number, registered office address, and legal form.
• Beneficial ownership: The natural person(s) who ultimately own or control the customer, typically anyone owning 25% or more of shares or voting rights, or who exercises control through other means.
• Nature of the business relationship: What the customer intends to do – the purpose of the account, expected transaction volumes, source of funds, and source of wealth.
• Risk profile: Whether the customer is a politically exposed person (PEP), appears on sanctions lists, operates in a high-risk industry, or comes from a high-risk jurisdiction.

Verification is not just collecting documents; it means checking that the documents are genuine and that the information is consistent. For example, a passport’s photo should match the person presenting it, and an address on a utility bill should match the one provided.

How CDD Works in Practice

The CDD process is usually automated at the first step and then manually reviewed if something does not match. Here is a typical flow:

1. Data collection: The customer provides their name, date of birth, address, and for companies, registration details and ownership structure.
2. Identity verification: The institution checks the data against trusted sources – government-issued ID databases, credit bureau records, or electoral rolls. For companies, it checks the official registry.
3. Sanctions and PEP screening: The customer’s name is checked against global sanctions lists, law enforcement watchlists, and PEP databases.
4. Risk assessment: The institution assigns a risk score based on the customer’s country, industry, transaction patterns, and ownership structure. High-risk customers get enhanced due diligence (EDD).
5. Ongoing monitoring: After onboarding, transactions are monitored against the expected profile. Unusual activity triggers alerts for review.

Types of CDD

There are three levels of CDD, each with increasing intensity:

• Simplified due diligence (SDD): Applied when the risk is low, such as a government entity or a small retail account with clear purpose. It still requires basic identification but fewer checks.
• Standard due diligence: The default level for most customers. It includes all the checks described above.
• Enhanced due diligence (EDD): Required for high-risk customers – PEPs, customers from high-risk countries, or those with complex or opaque ownership structures. EDD adds extra checks like source of wealth verification, senior management approval, and more frequent monitoring.

For example, a foreign shell company with a nominee director and no physical presence would almost certainly trigger EDD, while a local utility paying its bills on time would not.

Common Problems and Misconceptions

A frequent misconception is that CDD is just “checking ID.” In reality, it is a risk management tool. A customer can pass identity verification but still be high risk due to their activity. Another common issue is that CDD is a one-time event – it is not. Ongoing monitoring is part of CDD, and institutions must re-verify information periodically.

Practical problems include:

• False positives: Automated screening often flags common names. “John Smith” may match dozens of watchlist entries, requiring manual review.
• Data privacy conflicts: CDD requires collecting personal data, which can conflict with GDPR or other privacy laws. Institutions must balance both.
• Verification failures: Customers may not have standard documents (e.g., refugees, unbanked individuals), or documents may be expired. Institutions must have fallback procedures.
• Beneficial ownership complexity: Finding the ultimate owner of a company with multiple layers of trusts and offshore entities can be extremely difficult.

Costs and Benefits

CDD is not free. It involves software licensing, staff training, and manual review time. Large banks spend millions annually on compliance teams and technology. However, the cost of non-compliance is far higher – regulators can impose fines, and a single money-laundering scandal can damage reputation irreparably.

Beyond compliance, CDD has a practical benefit: it helps institutions understand their customers better, which can improve risk pricing and product suitability. It also protects the financial system by making it harder for criminals to use legitimate channels.

Alternatives and Emerging Approaches

Traditional CDD relies on documents and manual checks. Newer approaches include:

• Digital identity verification: Using biometrics, liveness detection, and government-issued digital IDs to verify customers remotely.
• Risk-based approaches: Using machine learning to assess risk dynamically, reducing friction for low-risk customers.
• Shared KYC utilities: Where one institution’s CDD data is shared with others (with consent), reducing duplication.
• Regulatory sandboxes: Some regulators allow testing of innovative CDD methods under supervision.

These do not replace CDD but aim to make it faster, cheaper, and more accurate.

Frequently Asked Questions

What is the difference between CDD and KYC?

KYC (Know Your Customer) is a broader term that includes CDD. KYC also covers customer identification programs (CIP), customer due diligence (CDD), and enhanced due diligence (EDD). In practice, the terms are often used interchangeably, but CDD is the specific set of checks and risk assessment steps.

How long does CDD take?

It depends on the customer’s risk level and the quality of the information provided. A simple, low-risk customer with valid ID can be verified in minutes using automated systems. A high-risk customer with complex ownership may take days or weeks of manual review.

What happens if a customer fails CDD?

If a customer cannot provide satisfactory evidence of identity or the risk is deemed too high, the institution may refuse to open an account, terminate the relationship, or file a suspicious activity report (SAR) if money laundering is suspected. The customer is not usually told the exact reason for refusal to avoid tipping off criminals.

Do small businesses need to do CDD?

Yes, if they are in a regulated sector. For example, a small money services business, a real estate agent, or a lawyer must conduct CDD. Small non-regulated businesses may still need to verify customers for fraud prevention, but they are not legally required to follow FATF standards.

Can CDD be done without documents?

Yes, in some cases. Regulators allow non-documentary verification methods, such as checking against a credit bureau, using digital identity systems, or calling the customer’s phone number. However, the method must be reliable and the institution must be able to explain why it chose it.

Conclusion

Customer due diligence is the cornerstone of anti-money laundering efforts. It verifies who the customer is, assesses their risk, and monitors them over time. While it adds friction to onboarding, it is a necessary safeguard for the financial system. Understanding what CDD checks and how it works helps both businesses and consumers navigate the process with fewer surprises.

Related

• Make Grok Imagine Videos and Upscale Them for Free
• How Long Can an Astronaut Work Outside on the Moon?
• Best Alternatives to Utility Portals for Electricity Tracking