Customer Due Diligence represents the cornerstone of any effective KYC/AML program. It is the process through which financial institutions verify the identity of their customers, understand the nature and purpose of business relationships, and assess the money laundering and terrorist financing risks associated with those relationships.
CDD is not a one-time event but an ongoing process that begins before account opening and continues throughout the customer relationship. The intensity and depth of CDD measures must be proportionate to the risks identified—a fundamental principle known as the risk-based approach.
The Customer Identification Program forms the first critical step in CDD. Financial institutions must obtain, verify, and record identifying information about each customer.
For individual customers, institutions must collect minimum identifying information:
Verification of this information must occur through reliable, independent documents, data, or information sources. Acceptable documents typically include:
Leading institutions employ multiple verification methods:
For business entities, the CIP process is more complex, requiring collection and verification of:
Documentary verification for legal entities typically includes:
One of the most critical and challenging aspects of CDD is identifying beneficial owners—the natural persons who ultimately own or control a legal entity customer. Shell companies and complex ownership structures have historically been exploited for money laundering, necessitating requirements to "look through" legal entities to identify the real people behind them.
While definitions vary across jurisdictions, beneficial owners typically include:
If no person meets the ownership threshold, institutions must identify a controlling person (such as senior managing officials).
Institutions must obtain identifying information for each beneficial owner and verify their identities. This presents challenges when dealing with:
Many jurisdictions have established centralized beneficial ownership registers to enhance transparency:
| Jurisdiction | Register Type | Accessibility |
|---|---|---|
| United Kingdom | Companies House PSC Register | Public (with some restrictions for high-risk individuals) |
| European Union | National Registers | Varies (public access subject to recent ECJ ruling limiting access) |
| United States | FinCEN BOI Database | Limited to authorities and financial institutions (under Corporate Transparency Act) |
Effective CDD requires understanding not just who the customer is, but what they do and why they need the financial relationship.
Institutions must understand and document:
These related but distinct concepts are both important for CDD:
Source of Funds: The origin of particular funds involved in the business relationship or transactions. Example: salary, sale of property, business income, loan proceeds.
Source of Wealth: The origin of a customer's total net worth or assets. Example: inheritance, business ownership, investment returns, employment career earnings.
For higher-risk relationships, understanding both is crucial. Inconsistencies between claimed sources and observable facts can indicate money laundering.
The risk-based approach requires institutions to assess and categorize the money laundering and terrorist financing risk associated with each customer relationship.
Risk assessment typically considers multiple dimensions:
Customer Risk Factors:
Geographic Risk Factors:
Product/Service Risk Factors:
Delivery Channel Risk Factors:
Institutions develop risk rating methodologies to classify customers. A typical approach:
| Risk Level | Characteristics | CDD Requirements |
|---|---|---|
| Low | Domestic retail customer, standard products, no elevated risk factors | Standard CDD, periodic reviews every 3-5 years |
| Medium | Small business, moderate transaction volumes, some complexity | Standard CDD with enhanced monitoring, reviews every 2-3 years |
| High | PEP, high-risk jurisdiction, cash-intensive business, complex structure | Enhanced Due Diligence, senior approval, continuous monitoring, annual reviews |
| Prohibited | Sanctioned parties, shell banks, anonymous accounts | Relationship not permitted |
CDD is not static; it requires ongoing monitoring and periodic updates throughout the customer relationship.
Institutions must monitor transactions to ensure consistency with the understanding of the customer and to identify unusual or suspicious activities. This includes:
Customer information and documentation must be reviewed and updated periodically, with frequency determined by risk level:
Reviews should update identifying information, beneficial ownership, risk assessments, and understanding of the business relationship.
Certain events should trigger immediate review and update of CDD:
While regulations focus heavily on enhanced measures for high-risk scenarios, many jurisdictions allow simplified due diligence for demonstrably low-risk situations, such as:
However, simplified due diligence still requires identification and basic verification; it cannot be used if there are suspicions of money laundering or terrorist financing.
Comprehensive documentation is essential for demonstrating compliance and supporting investigations.
Institutions must maintain records including:
Most jurisdictions require retention of CDD records for a minimum of five years after the end of the business relationship, though some require longer periods.
Records must be readily retrievable and available to regulators and law enforcement upon request.
Balancing thorough CDD with customer experience presents ongoing challenges. Excessive documentation requests or lengthy verification processes can drive customers away, while inadequate CDD creates compliance and reputational risks.
Solutions include:
Obtaining accurate, current information can be challenging, particularly for:
While technology offers solutions, implementation challenges include:
Digital identity solutions using blockchain, biometrics, and other technologies promise to streamline CDD while enhancing security and accuracy.
KYC utilities allow multiple institutions to share CDD information, reducing duplication and improving efficiency while maintaining compliance.
Moving beyond periodic reviews, perpetual KYC uses continuous monitoring of multiple data sources to maintain real-time understanding of customers.
Customer Due Diligence forms the foundation upon which all other KYC/AML measures rest. Effective CDD requires thorough customer identification and verification, understanding of beneficial ownership, assessment of risks, and ongoing monitoring throughout the relationship.
As technology advances and regulations evolve, CDD processes continue to become more sophisticated, leveraging automation and data analytics while maintaining focus on the fundamental objective: knowing your customer.