CDD / EDD (Customer Due Diligence / Enhanced Due Diligence)

In plain words

Think of a landlord choosing a tenant. For most applicants, a passport, a reference and a payslip are enough. If the applicant wants to pay a year’s rent in cash, through a company nobody has heard of, the landlord asks more questions before handing over the keys. And during the tenancy, the landlord notices if the flat suddenly turns into an office for twenty people.

Customer due diligence (CDD) is that process for a financial firm. Before opening an account, the firm finds out who the customer is, who really stands behind them if they are a company, why they want the account and what kind of activity to expect. It then keeps watching that the account is used the way it said. Enhanced due diligence (EDD) is the deeper version for customers who carry more risk: the firm digs into where the money and the customer’s wealth come from, a senior manager signs off, and the account is watched more closely.

Both are legal duties under anti-money laundering (AML) law, built on the international standards of the FATF. ³ The key word is risk-based: the depth of the checks must match the risk of the customer, not one size for everyone. KYC is the identity part of CDD; this page covers the whole picture around it.

How it works

How due diligence works

Four moves that repeat for every customer, from sign-up to the last day of the relationship.

1. 1

   Assess the risk

   Who is the customer, where are they, what product do they want and through which channel? The answers give a first risk rating.

2. 2

   Collect standard CDD

   Identify and verify the customer and any beneficial owners, and record the purpose of the account and the activity to expect.

3. 3

   Escalate when a trigger appears

   A politically exposed person, a high-risk country or an opaque ownership chain moves the customer to EDD before the account opens.

4. 4

   Monitor and refresh

   Activity is compared with what was declared, and the file is reviewed on a cycle set by the risk rating, or sooner if something changes.

Illustration

Three levels of due diligence, and what moves a customer between them

Swipe sideways to see the whole diagram.

What standard CDD covers

UK law and the EU directives describe CDD as the same four building blocks. ¹ A firm that can show all four for every customer has the core of its AML file.

When CDD must be done

• When a business relationship starts, such as opening an account
• For one-off transactions above the thresholds set in law, even with no account
• Whenever money laundering or terrorist financing is suspected, whatever the amount
• When the firm doubts the data it already holds
• When the customer’s circumstances change, for example a new owner or a new line of business

If a firm cannot complete CDD, the law is blunt: it must not open the account or carry out the transaction, must end an existing relationship, and must consider whether to report the customer. ¹

Simplified due diligence

Simplified due diligence (SDD) is not a shortcut you can choose because onboarding is slow. It is permitted only where the firm’s own risk assessment shows a genuinely low risk, and only to the extent the law allows. Typical candidates are listed companies and regulated financial firms, public bodies, and low-value products with tight limits, such as some prepaid or e-money products that cannot receive large sums or send money abroad.

What changes is how much evidence is collected and how often the file is reviewed. What does not change: the customer is still identified, records are kept, transactions are still monitored, and the customer moves straight back to standard checks the moment a risk factor appears. Many products use SDD as the entry tier of a tiered KYC model: low limits until the customer completes full checks.

What triggers enhanced due diligence

Some triggers are written into law, so EDD is mandatory. Others come from the firm’s own risk assessment. UK law lists the mandatory cases, and the EU rules are very similar. ^{1 4}

Source of funds and source of wealth are different questions, and EDD usually needs both. Source of funds is where the money for this account or transaction comes from: a salary, the sale of a flat, a company dividend. Source of wealth is how the customer built their overall wealth: a career, a business, an inheritance. A firm asks for evidence in proportion to the risk, such as payslips, a sale contract, company accounts or tax returns.

Politically exposed persons (PEPs)

A politically exposed person is someone entrusted with a prominent public function. The FATF standards and UK and EU law name the usual categories: heads of state and government, ministers, members of parliament, senior judges, central bank board members, ambassadors, senior military officers, members of the boards of state-owned companies, and senior officials of international organisations. ³ Junior and middle-ranking officials are not PEPs.

The definition reaches beyond the official. Family members, such as a spouse or partner, children and their spouses, and parents, are treated like the PEP. So are known close associates: people who jointly own a company with the PEP, or who own a company set up for the PEP’s benefit. Siblings are not always covered by the legal definition, but many firms treat them as higher risk anyway when the facts suggest it.

Every PEP relationship needs EDD: approval from senior management, steps to establish source of wealth and source of funds, and enhanced ongoing monitoring. ¹ Being a PEP is not an accusation, and refusing every PEP is not what regulators want. The point is proportionate scrutiny. In the UK, the rules were changed in 2024 so that domestic PEPs start from a lower level of risk than foreign PEPs, unless other risk factors are present. UK and EU law also say that once someone leaves office, they must be treated as a PEP for at least 12 months, and for longer if the risk remains.

Finding PEPs in practice means screening every customer against a commercial PEP database at onboarding and again on a schedule, usually in the same step as sanctions screening. Name matches are noisy, so the review desk needs dates of birth, nationality and enough context to clear false matches quickly.

Ultimate beneficial owners (UBOs)

An ultimate beneficial owner is the real person who ultimately owns or controls a company or trust. The common test in the UK and the EU is more than 25% of the shares or voting rights, held directly or through other companies, or control by other means, such as the right to appoint most of the board, or a veto over key decisions. If nobody meets the test after real effort, firms record the senior managers as the beneficial owners and keep evidence of the search.

The hard part is layered ownership. Ownership is multiplied through each layer: someone who owns 60% of a company that owns 50% of the applicant holds 30% indirectly, and is a UBO. Someone with 40% of that same company holds 20%, below the line, unless they control it another way.

Illustration

Tracing a layered ownership chain to the real owners

Swipe sideways to see the whole diagram.

Beneficial ownership registers

Most markets now require companies to record their beneficial owners in an official register, which firms check as part of CDD. Registers are a source, not proof: a firm must still verify, and in many markets it must report differences it finds.

• United Kingdom. The people with significant control (PSC) register at Companies House is public and free to search. Overseas entities that own UK property must also register their beneficial owners.
• European Union. Each country runs a beneficial ownership register. In November 2022 the EU Court of Justice ruled that general public access to these registers breached privacy rights, and several countries closed them to the public. Banks and payment firms keep access for due diligence, and the new EU rules give access to people with a legitimate interest, such as journalists.
• UAE. Mainland and free zone companies must keep a register of their beneficial owners and file it with their licensing authority, using the same 25% ownership and control test. The DIFC and ADGM keep their own registers.
• Saudi Arabia. Companies must identify and disclose their beneficial owners to the Ministry of Commerce, and banks and payment firms licensed by SAMA must verify them as part of CDD.

What to collect, by customer type

A starting point to agree with your MLRO and licence holder. Your own risk assessment decides the final version.

CDD and EDD in the UK, EU and Gulf

All four markets follow the FATF standards, so the shape is the same. ³ What differs is the detail of the rules, the guidance firms are judged against, and the practical sources of data.

United Kingdom

The Money Laundering Regulations 2017 set out CDD, simplified due diligence and the cases where EDD is required, including PEPs and high-risk third countries listed in the regulations. ¹ Firms supervised by the FCA are judged against the industry guidance of the JMLSG, which explains what good looks like sector by sector, from e-money to wealth management. ² In practice: a London EMI onboarding a freelancer checks the PSC register for any company, screens against PEP and sanctions lists, and records expected monthly volumes so monitoring has a baseline.

European Union

Today, each EU country applies the AML directives through its own law, so details differ: what counts as acceptable remote identification, how fast a file must be refreshed, and how registers can be searched. A Lithuanian or Irish EMI serving customers across the EU therefore follows its home country’s rules. From July 2027, the single EU AML Regulation will apply directly in every member state, with one set of CDD and EDD rules, and the new EU AML Authority will supervise some of the largest cross-border firms directly. ⁴ Firms building now should design for the harmonised rules rather than for one country’s current quirks.

United Arab Emirates

The federal AML law and its implementing regulation set CDD and EDD duties for banks, wallets and payment firms licensed by the CBUAE, which also publishes guidance on topics such as PEPs and high-risk customers. The DIFC and ADGM free zones apply their own AML rulebooks with the same principles. In practice, UAE firms see many customers with complex structures: a free zone company owned by a holding in another emirate, which in turn is owned offshore. The UAE also has a large expatriate population and big remittance corridors, so expected-activity questions about money sent home matter for remittance and wallet products.

Saudi Arabia

The Saudi AML law and SAMA’s AML rules apply the same building blocks to banks and payment firms. Identity checks lean on national digital identity: citizens and residents can be verified against government records, which makes the identity step fast and strong. That shifts the effort to purpose, expected activity and source of funds, especially for high-value wallets and business accounts. A Riyadh wallet launching through the sandbox usually starts with lower limits and simpler checks, then adds full CDD for customers who need higher limits.

Example: a remittance customer moves to EDD

Common misconceptions

FAQ