CDD (Customer Due Diligence)

Definition

Customer due diligence (CDD) is the standard process a regulated firm uses to understand who it is dealing with. It applies to every customer in scope of anti money laundering rules, and it is the foundation on which simplified and enhanced due diligence are built.

CDD has four core components:

1. Identify the customer and verify their identity using reliable, independent sources.
2. Identify the beneficial owner where the customer is a legal entity or arrangement, and take reasonable measures to verify who they are.
3. Understand the purpose and intended nature of the business relationship.
4. Conduct ongoing monitoring of the relationship, including scrutiny of transactions and keeping information up to date.

The phrase "know your customer" (KYC) is often used as a synonym. Strictly, KYC describes the broader practice, and CDD is the regulatory term for the measures themselves.

Why a regulated firm cares

Every later control depends on CDD being right. Sanctions screening is only as good as the names and dates of birth collected at onboarding. Transaction monitoring can only spot unusual activity if the firm recorded what usual activity was supposed to look like. Beneficial ownership checks determine whether a sanctioned or politically exposed person is hiding behind a company.

CDD also sets the level of scrutiny for everything that follows. The information gathered feeds the customer risk assessment, and that assessment decides whether simplified measures are enough, whether standard CDD applies, or whether the relationship needs enhanced due diligence.

When CDD is required

Rules generally require CDD when a firm:

• establishes a business relationship;
• carries out an occasional transaction above a set threshold;
• suspects money laundering or terrorist financing, regardless of any threshold;
• doubts the accuracy of information previously obtained.

CDD is not a one-time event. It must be refreshed when a customer's circumstances change, and existing customers should be brought up to date on a risk based schedule.

How it is done in practice

For individuals, firms collect name, date of birth and address, and verify them against identity documents, electronic data sources or both. Increasingly, verification is done remotely with document checks and liveness tests.

For legal entities, firms collect the registered name, number, address and details of directors, then work through the ownership and control structure to find the individuals behind it. This is where most of the effort goes. Layered structures, trusts and nominee arrangements can obscure the people who ultimately own or control the customer.

Purpose and nature is often reduced to a dropdown, but it deserves more. Expected products, volumes, counterparties and geographies give monitoring a baseline to measure against.

Every customer, and relevant connected parties such as beneficial owners and directors, is normally screened against sanctions, PEP and, depending on the firm's policy, adverse media sources as part of the same process.

Regulatory basis

FATF Recommendation 10 sets the international standard for CDD, including the four components above, the circumstances in which CDD must be carried out, and the expectation that the extent of measures is set on a risk sensitive basis. Recommendation 22 applies CDD requirements to designated non financial businesses and professions such as lawyers, accountants, real estate agents and dealers in precious metals and stones.

In the EU, Directive (EU) 2015/849 sets out CDD obligations and defines beneficial ownership, including an indicative threshold of more than 25% ownership for corporate entities. Directive (EU) 2018/843 strengthened beneficial ownership transparency and access to registers.

In the UK, the Money Laundering Regulations 2017 set out when CDD must be applied, the measures it involves and the beneficial ownership test, which also uses a 25% threshold.

In the US, the FinCEN CDD Rule (31 CFR 1010.230) requires covered financial institutions to identify and verify the beneficial owners of legal entity customers: each individual owning 25% or more of the equity interests, and one individual with significant responsibility to control or manage the entity. Related rules require risk based procedures to understand the nature and purpose of customer relationships and to conduct ongoing monitoring.

These are summaries. Firms should confirm the detailed requirements that apply in their own jurisdiction and sector.

Worked example (hypothetical)

Northgate Trading Ltd, a fictional import business, applies for a business account. The firm verifies the company against the corporate register and records its two directors.

The register shows that Northgate is wholly owned by Harbour Holdings Ltd. The analyst requests Harbour's ownership details and finds three shareholders: Lena Marsh with 60%, Omar Reyes with 30% and a third individual with 10%. Ms Marsh and Mr Reyes each exceed the 25% threshold and are recorded and verified as beneficial owners. The third shareholder falls below it and is not a beneficial owner on ownership grounds, though the analyst checks that no other control arrangement exists.

The company states that it will receive payments from retailers in two countries and pay suppliers in a third. That becomes the expected activity profile. All parties are screened, no matches are confirmed, and the relationship is rated standard risk with a scheduled periodic review.

Related terms

• EDD (Enhanced Due Diligence)
• KYB (Know Your Business)
• UBO (Ultimate Beneficial Owner)
• Beneficial Owner
• Ongoing Monitoring
• Risk-Based Approach (RBA)