Chapter 3: Customer Due Diligence (CDD)

3.1 The Foundation of CDD

Customer Due Diligence represents the cornerstone of any effective KYC/AML program. It is the process through which financial institutions verify the identity of their customers, understand the nature and purpose of business relationships, and assess the money laundering and terrorist financing risks associated with those relationships.

CDD is not a one-time event but an ongoing process that begins before account opening and continues throughout the customer relationship. The intensity and depth of CDD measures must be proportionate to the risks identified—a fundamental principle known as the risk-based approach.

3.2 Customer Identification Program (CIP)

The Customer Identification Program forms the first critical step in CDD. Financial institutions must obtain, verify, and record identifying information about each customer.

3.2.1 Individual Customers

For individual customers, institutions must collect minimum identifying information:

• Full Legal Name: Including any names previously used
• Date of Birth: To verify identity and ensure customer is of legal age
• Residential Address: Physical street address, not a PO Box (with limited exceptions)
• Identification Number: Such as Social Security Number, Tax ID, Passport Number, or national ID number

Verification of this information must occur through reliable, independent documents, data, or information sources. Acceptable documents typically include:

• Government-issued photo identification (passport, driver's license, national ID card)
• Birth certificate or citizenship certificate
• Utility bills or bank statements for address verification
• Tax documents

3.2.2 Legal Entity Customers

For business entities, the CIP process is more complex, requiring collection and verification of:

• Legal Name: As registered with authorities
• Business Address: Principal place of business (physical location)
• Tax Identification Number: Or equivalent
• Legal Form and Jurisdiction: Type of entity and where organized
• Ownership Structure: Information on controlling persons
• Purpose and Nature of Business: What the entity does

Documentary verification for legal entities typically includes:

• Certificate of incorporation or registration
• Business licenses
• Articles of association or partnership agreements
• Certificate of good standing
• Financial statements
• Tax registrations

3.3 Beneficial Ownership Identification

One of the most critical and challenging aspects of CDD is identifying beneficial owners—the natural persons who ultimately own or control a legal entity customer. Shell companies and complex ownership structures have historically been exploited for money laundering, necessitating requirements to "look through" legal entities to identify the real people behind them.

3.3.1 Beneficial Ownership Definition

While definitions vary across jurisdictions, beneficial owners typically include:

• Ownership Test: Natural persons who own 25% or more (directly or indirectly) of the entity's equity interests
• Control Test: Natural persons who exercise significant control through other means (voting rights, management authority, control through other arrangements)

If no person meets the ownership threshold, institutions must identify a controlling person (such as senior managing officials).

3.3.2 Beneficial Ownership Verification

Institutions must obtain identifying information for each beneficial owner and verify their identities. This presents challenges when dealing with:

• Multi-tier ownership structures
• Trusts and foundations
• Nominee shareholders
• Bearer shares (increasingly prohibited)
• Complex cross-border arrangements

3.3.3 Beneficial Ownership Registers

Many jurisdictions have established centralized beneficial ownership registers to enhance transparency:

Jurisdiction	Register Type	Accessibility
United Kingdom	Companies House PSC Register	Public (with some restrictions for high-risk individuals)
European Union	National Registers	Varies (public access subject to recent ECJ ruling limiting access)
United States	FinCEN BOI Database	Limited to authorities and financial institutions (under Corporate Transparency Act)

3.4 Understanding the Customer's Business

Effective CDD requires understanding not just who the customer is, but what they do and why they need the financial relationship.

3.4.1 Purpose and Nature of Relationship

Institutions must understand and document:

• The intended purpose of the account or relationship
• The nature of the customer's business or employment
• Expected account activity and transaction patterns
• Source of funds and wealth
• Geographic scope of activities
• Anticipated types of transactions

3.4.2 Source of Funds vs. Source of Wealth

These related but distinct concepts are both important for CDD:

Source of Funds: The origin of particular funds involved in the business relationship or transactions. Example: salary, sale of property, business income, loan proceeds.

Source of Wealth: The origin of a customer's total net worth or assets. Example: inheritance, business ownership, investment returns, employment career earnings.

For higher-risk relationships, understanding both is crucial. Inconsistencies between claimed sources and observable facts can indicate money laundering.

3.5 Risk Assessment

The risk-based approach requires institutions to assess and categorize the money laundering and terrorist financing risk associated with each customer relationship.

3.5.1 Risk Factors

Risk assessment typically considers multiple dimensions:

Customer Risk Factors:

• Customer type (individual, SME, large corporation, nonprofit, etc.)
• Business or profession (cash-intensive businesses higher risk)
• PEP status
• Reputation and public information
• Complexity of ownership structure

Geographic Risk Factors:

• Customer's country of residence or incorporation
• Countries of business operations
• Countries involved in transactions
• FATF high-risk jurisdictions
• Countries with high corruption or limited AML controls

Product/Service Risk Factors:

• Private banking or wealth management
• Correspondent banking
• Trade finance
• Electronic/digital banking
• Cryptocurrency services
• Wire transfer services

Delivery Channel Risk Factors:

• Non-face-to-face customer relationships
• Third-party intermediaries
• Anonymous or pseudonymous channels

3.5.2 Risk Rating Methodology

Institutions develop risk rating methodologies to classify customers. A typical approach:

Risk Level	Characteristics	CDD Requirements
Low	Domestic retail customer, standard products, no elevated risk factors	Standard CDD, periodic reviews every 3-5 years
Medium	Small business, moderate transaction volumes, some complexity	Standard CDD with enhanced monitoring, reviews every 2-3 years
High	PEP, high-risk jurisdiction, cash-intensive business, complex structure	Enhanced Due Diligence, senior approval, continuous monitoring, annual reviews
Prohibited	Sanctioned parties, shell banks, anonymous accounts	Relationship not permitted

3.6 Ongoing Due Diligence

CDD is not static; it requires ongoing monitoring and periodic updates throughout the customer relationship.

3.6.1 Transaction Monitoring

Institutions must monitor transactions to ensure consistency with the understanding of the customer and to identify unusual or suspicious activities. This includes:

• Automated transaction monitoring systems with scenario-based rules
• Alert generation and investigation
• Comparison of activity against expected patterns
• Identification of structuring, layering, or other typologies

3.6.2 Periodic Reviews

Customer information and documentation must be reviewed and updated periodically, with frequency determined by risk level:

• Low-risk customers: Every 3-5 years
• Medium-risk customers: Every 2-3 years
• High-risk customers: Annually or more frequently

Reviews should update identifying information, beneficial ownership, risk assessments, and understanding of the business relationship.

3.6.3 Event-Triggered Reviews

Certain events should trigger immediate review and update of CDD:

• Significant change in transaction patterns
• Customer request to expand relationship or add services
• Change in beneficial ownership or control
• Adverse media or negative news
• Changes to PEP status
• Regulatory changes affecting the customer's risk profile

3.7 Simplified Due Diligence

While regulations focus heavily on enhanced measures for high-risk scenarios, many jurisdictions allow simplified due diligence for demonstrably low-risk situations, such as:

• Government entities or public companies
• Financial institutions subject to AML regulation
• Low-value or limited-purpose accounts
• Pension or employee benefit plans

However, simplified due diligence still requires identification and basic verification; it cannot be used if there are suspicions of money laundering or terrorist financing.

3.8 Documentation and Record-Keeping

Comprehensive documentation is essential for demonstrating compliance and supporting investigations.

3.8.1 Required Records

Institutions must maintain records including:

• All documents obtained for customer identification and verification
• Beneficial ownership information and supporting documentation
• Risk assessments and ratings
• Purpose and nature of business relationship documentation
• Source of funds and wealth information
• Periodic review documentation
• Transaction records
• Correspondence with customers regarding CDD matters

3.8.2 Retention Requirements

Most jurisdictions require retention of CDD records for a minimum of five years after the end of the business relationship, though some require longer periods.

Records must be readily retrievable and available to regulators and law enforcement upon request.

3.9 Challenges in CDD Implementation

3.9.1 Customer Experience vs. Compliance

Balancing thorough CDD with customer experience presents ongoing challenges. Excessive documentation requests or lengthy verification processes can drive customers away, while inadequate CDD creates compliance and reputational risks.

Solutions include:

• Digital onboarding with instant verification
• Risk-based approach allowing streamlined processes for lower-risk customers
• Clear communication about requirements and purposes
• Efficient processes and technology

3.9.2 Data Quality and Availability

Obtaining accurate, current information can be challenging, particularly for:

• Customers in jurisdictions with limited public records
• Complex ownership structures
• Trusts and other legal arrangements
• Unbanked or underbanked populations

3.9.3 Technology and Automation

While technology offers solutions, implementation challenges include:

• Integration of multiple data sources and systems
• Maintaining accuracy and reducing false positives
• Keeping pace with rapidly evolving technologies
• Cybersecurity and data protection

3.10 Best Practices and Emerging Trends

3.10.1 Digital Identity

Digital identity solutions using blockchain, biometrics, and other technologies promise to streamline CDD while enhancing security and accuracy.

3.10.2 Utility Models

KYC utilities allow multiple institutions to share CDD information, reducing duplication and improving efficiency while maintaining compliance.

3.10.3 Perpetual KYC

Moving beyond periodic reviews, perpetual KYC uses continuous monitoring of multiple data sources to maintain real-time understanding of customers.

3.11 Conclusion

Customer Due Diligence forms the foundation upon which all other KYC/AML measures rest. Effective CDD requires thorough customer identification and verification, understanding of beneficial ownership, assessment of risks, and ongoing monitoring throughout the relationship.

As technology advances and regulations evolve, CDD processes continue to become more sophisticated, leveraging automation and data analytics while maintaining focus on the fundamental objective: knowing your customer.