Short answer: customer due diligence (CDD) is the standard set of checks every firm does on a customer. Simplified due diligence is a lighter version allowed where risk is demonstrably low. Enhanced due diligence (EDD) is the extra scrutiny required where risk is higher. Which level applies depends on the firm's risk assessment, not on a fixed list.
The four elements of CDD
FATF Recommendation 10 sets out what CDD means:
- Identify the customer and verify the identity using reliable, independent documents, data or information.
- Identify the beneficial owner and take reasonable measures to verify who they are, so the firm knows who ultimately owns or controls the customer.
- Understand the purpose and intended nature of the business relationship.
- Conduct ongoing due diligence, including scrutiny of transactions to check they are consistent with what the firm knows about the customer, and keep the information up to date.
CDD happens when a relationship is established, when there is a suspicion of money laundering or terrorist financing, when doubts arise about earlier information, and (for occasional customers) above a threshold.
Simplified due diligence
Where the risk is lower, firms may reduce the extent of measures, for example by verifying identity with less documentation or relying on a lower review frequency. Important limits:
- It must be justified by an assessed low risk, not by convenience.
- It is never allowed where there is a suspicion of money laundering or terrorist financing.
- Simplified does not mean skipped: the firm still monitors the relationship.
Enhanced due diligence
EDD applies where risk is higher. Typical triggers:
- Foreign politically exposed persons, always; domestic PEPs and international-organisation PEPs where the relationship is higher risk. See PEPs explained.
- Customers or transactions linked to high-risk countries, including those identified by FATF.
- Correspondent banking relationships.
- Complex ownership structures, shell companies, nominee arrangements or bearer shares.
- Cash-intensive businesses, private banking, and products or channels that obscure identity.
What EDD usually adds:
- More information on the customer and beneficial owners, and on the source of wealth and source of funds.
- Senior management approval to start or continue the relationship.
- More frequent reviews and closer transaction monitoring.
- Understanding the reason for the transactions and the expected activity in detail.
The US customer due diligence rule
For US covered financial institutions, FinCEN's CDD rule (compliance date May 2018) requires firms to identify and verify the beneficial owners of legal entity customers: each individual owning 25 percent or more, plus one individual with significant control. It also added ongoing monitoring and keeping customer information up to date as a fifth core requirement alongside the other programme elements. Note that the CDD rule's 25 percent test is a rule threshold, while the FATF standard also requires a control test and a fallback.
Common exam traps
- "Which customer always requires EDD under the FATF standard?" Foreign PEPs.
- Simplified due diligence is not allowed when there is suspicion.
- CDD is ongoing, not a one-time onboarding step.
- The risk-based approach decides the level; there is no single list of "automatic high-risk" customers except where law says so.
- Source of wealth is the origin of the customer's total assets; source of funds is the origin of the money in this specific relationship or transaction.