Customer Due Diligence (CDD)

The mandatory foundation of CDD requiring the collection and verification of a customer's core identity before account opening. This process must be completed prior to establishing a business relationship.

• Core Identifiers: Full legal name, date of birth (for individuals), physical address, and government-issued identification number (e.g., TIN, passport).
• Verification Methods: Documentary verification (validated ID documents), non-documentary verification (credit bureau checks, database queries), or a combination of both.
• Recordkeeping: Institutions must retain CIP records for five years after account closure, including a description of how identity was verified.
• Customer Notice: Financial institutions are legally required to provide adequate notice to customers that they are requesting information to verify their identity.

A systematic methodology to assign a risk score to each customer based on inherent risk factors. This score dictates the intensity of ongoing monitoring and the need for Enhanced Due Diligence (EDD).

• Geographic Risk: Jurisdiction of incorporation, nationality, and operational footprint, cross-referenced with FATF high-risk lists and sanctions regimes.
• Product & Channel Risk: Inherent anonymity of private banking, cross-border wire capabilities, or virtual asset exposure versus low-risk retail deposit accounts.
• Entity Type Risk: Complexity of corporate structure, presence of bearer shares, or status as a Politically Exposed Person (PEP).
• Dynamic Adjustment: Risk scores are not static; they must be recalculated based on trigger events like adverse media hits or material changes in transactional behavior.

The process of piercing the corporate veil to identify the natural persons who ultimately own or control a legal entity. This is a critical control against shell corporations and opaque structures.

• Ownership Prong: Identify any individual who owns, directly or indirectly, 25% or more of the equity interests of the legal entity.
• Control Prong: Identify a single individual with significant responsibility to control, manage, or direct the legal entity (e.g., CEO, Managing Member).
• Verification: Rely on certified ownership charts, audited financial statements, or direct access to official registries; self-certification alone is insufficient for high-risk clients.
• Complex Structures: Requires recursive unwinding of intermediate holding companies, trusts, and foundations to reach the ultimate flesh-and-blood beneficiary.

The continuous comparison of a customer's transactional activity against their established behavioral baseline to detect anomalies that may signal money laundering or fraud.

• Baseline Construction: Uses initial CDD data to predict expected transaction volume, velocity, geography, and counterparty types for a given risk profile.
• Deviation Detection: Automated systems flag transactions that deviate materially from the expected baseline, such as sudden spikes in cash deposits or wires to high-risk jurisdictions.
• Periodic Reviews: Low-risk profiles require standard refresh cycles (e.g., every 3 years), while high-risk profiles mandate annual or continuous review.
• Trigger Events: Specific occurrences—such as a new PEP designation, adverse media, or a law enforcement inquiry—immediately trigger a CDD refresh regardless of the review cycle.

The mandatory identity verification process that forms the operational backbone of CDD. While CDD assesses risk, KYC executes the verification:

• Identity Verification: Validating government-issued IDs, biometrics, and personal data
• Document Collection: Gathering proof of address, incorporation certificates, and licenses
• Liveness Detection: Ensuring the person presenting identity is physically present and not a deepfake

KYC provides the verified data inputs that feed CDD risk models. Without robust KYC, CDD risk assessments operate on unverified assumptions.

An escalated investigation protocol triggered when standard CDD flags high-risk indicators. EDD applies to:

• Politically Exposed Persons (PEPs) and their close associates
• Customers in high-risk jurisdictions with weak AML controls
• Entities with complex ownership structures suggesting concealment
• Clients in high-risk industries such as arms dealing or precious metals

EDD requires deeper scrutiny of source of wealth and source of funds, often involving external intelligence gathering and senior management approval before onboarding.

The quantitative output of the CDD process. A composite score derived from weighted risk factors:

• Geographic Risk: Country corruption indices and sanctions exposure
• Product Risk: Inherent vulnerability of specific financial products to misuse
• Entity Type Risk: Shell corporations, trusts, and non-profits carry different risk weights
• Transaction Pattern Risk: Expected vs. actual behavior deviations

Risk ratings determine monitoring frequency, review cycles, and escalation thresholds. Models must be periodically validated to prevent rating drift.

The ultimate objective of CDD investigations—piercing corporate veils to identify the natural persons who control legal entities. Key challenges include:

• Multi-jurisdictional layering: Entities nested across secrecy havens
• Nominee directors: Figureheads obscuring true controllers
• Bearer shares: Ownership instruments with no registered holder

Regulatory standards like the FATF 40 Recommendations mandate a 25% ownership threshold for identification. Failure to identify beneficial owners is the most common CDD deficiency cited in enforcement actions.

The ongoing monitoring phase that operationalizes CDD findings. Once a baseline risk profile is established, behavioral profiling detects deviations:

• Expected transaction volume vs. actual throughput
• Typical counterparty geography vs. sudden high-risk jurisdiction transfers
• Normal velocity vs. rapid structuring patterns
• Declared business activity vs. actual transaction purpose codes

Deviations trigger alert generation and may prompt a CDD review cycle. Machine learning models increasingly automate this comparison at scale.

A continuous intelligence feed that supplements static CDD profiles with dynamic reputational data. Automated systems scan:

• Global news sources in multiple languages
• Regulatory enforcement actions and watchlist publications
• Leaked datasets such as the Panama Papers and FinCEN Files
• Court filings and criminal proceedings

Negative hits trigger reassessment of risk ratings and may escalate to EDD. False positive management is critical—fuzzy matching and entity disambiguation prevent alert fatigue.