Customer Due Diligence (CDD)
Customer due diligence, or CDD, is the baseline set of checks a regulated firm performs on a customer: who they are, who owns and controls them, and what activity to expect. It is done at onboarding and then kept current for as long as the relationship lasts, with risk rather than a fixed calendar setting when it is revisited.
Also called: due diligence · standard due diligence
Customer due diligence is the standard, everyday version of knowing a customer. Four things make it up: identifying and verifying who the customer is; identifying the beneficial owners behind a corporate customer; understanding the purpose and expected pattern of the relationship; and monitoring the relationship afterwards so the picture stays current.
That last element is where firms come unstuck, and it is the difference between a file and a process. A customer verified at onboarding whose volumes have quadrupled and whose counterparties have moved to a different region has not been re-diligenced simply because the passport copy on file has not expired.
Where the obligation comes from
CDD is a global concept with local law behind it. FATF Recommendation 10 describes the measures member countries are expected to require, but a Recommendation is not a statute — it reaches a firm only through the national law that implements it. The EU money laundering directive and the UK money laundering regulations both write the ongoing limb into the rule itself: monitor the relationship throughout, scrutinize transactions against what was expected, and keep the documents and information held up to date, with the extent of the measures set by risk. The United States is narrower. FinCEN’s customer due diligence rule, which made the beneficial ownership element explicit alongside the older customer identification program rule, binds covered financial institutions — banks, brokers and dealers in securities, mutual funds, and futures commission merchants and introducing brokers. There is no equivalent CDD rule for US money services businesses.
CDD, KYC and EDD
Know Your Customer is the informal umbrella term for the whole activity. CDD is the defined baseline standard inside it. Enhanced due diligence is what replaces the baseline where risk is assessed as higher: deeper evidence of source of funds, senior approval, shorter review cycles. They are three depths of one obligation, not three separate obligations, and a firm that cannot say which depth applies to a given customer has not done the risk assessment that decides it.
In practice
CDD is ongoing, not a file assembled once at onboarding: the EU directive, the UK regulations and the US rule for banks each require the relationship to be monitored and the information held to be kept up to date, with risk and materiality — not a fixed refresh calendar — deciding when. Be clear which regime you are in. The US CDD rule runs on covered financial institutions, meaning banks, securities brokers and dealers, mutual funds and futures commission merchants, and there is no equivalent rule for US money services businesses.
Example
A freight company opens an account: incorporation documents checked, two directors identified, a sixty per cent shareholder traced to one named individual, expected volumes and counterparties recorded. That is CDD. Eighteen months later the company starts paying suppliers in a high-risk jurisdiction and volumes triple. The risk picture has changed, so source-of-funds evidence is requested and a director signs off. That is EDD.
Commonly confused with
| Term | How it differs |
|---|---|
| Know Your Customer | KYC is the informal umbrella term for knowing a customer; CDD is the defined regulatory standard that sits inside it and is what a supervisor actually enforces. |
| Enhanced Due Diligence | EDD is the same work taken deeper for higher-risk customers, with senior sign-off; CDD is the baseline applied to everyone else. |
| Customer Identification Program | CIP is a narrow United States rule about verifying identity before an account opens; CDD adds beneficial ownership, expected activity and ongoing monitoring. |
See also
- Enhanced Due DiligenceEnhanced due diligence, or EDD, is the additional scrutiny applied where money laundering risk is higher. In the UK and the EU it is mandatory in prescribed cases — politically exposed persons, high-risk countries, correspondent banking — as well as wherever a firm’s own risk assessment says the baseline is not enough.
- Know Your CustomerKnow Your Customer, or KYC, is the process of identifying and verifying a customer before a business relationship starts and keeping that understanding current while it lasts, so a firm knows who it is actually dealing with. Identity verification is the first step of KYC, not the whole of it.
- Customer Identification ProgramA Customer Identification Program, or CIP, is the United States rule requiring a bank to collect a minimum set of identifying details — name, date of birth for an individual, address and an identification number — before it opens an account, and to verify identity within a reasonable time afterwards. It is not a synonym for KYC.
- Know Your BusinessKnow Your Business, or KYB, is the verification of a corporate customer rather than an individual: that the entity legally exists, who owns and controls it, and what it actually does. It is the corporate counterpart to KYC, and the ownership chain is the hard part.
- Ultimate Beneficial OwnerThe ultimate beneficial owner is the natural person who ultimately owns or controls a customer, identified by tracing ownership up through holding companies, trusts and nominees. Twenty-five percent is the common anchor in the United States, the United Kingdom and the European Union, but each states it differently and control is tested alongside it.