Customer Due Diligence (CDD)

What customer due diligence actually means

Customer due diligence, CDD, is the process of identifying a customer, verifying that identity against reliable evidence, understanding who actually owns or controls the customer if it’s a legal entity, and assessing the money laundering or terrorist financing risk the relationship presents. It’s the operational core of what most people mean when they talk about KYC.

CDD isn’t a single check performed once. It’s a standard that has to be met at onboarding and maintained for as long as the relationship continues, which is why regulators increasingly examine not just whether a firm collected the right information, but whether it kept using that information correctly afterward.

The fifth pillar: how the US made CDD a formal AML requirement

In the US, CDD has a precise legal origin most compliance content glosses over. FinCEN’s Customer Due Diligence Requirements for Financial Institutions, published in the Federal Register on 11 May 2016 (81 Fed. Reg. 29398) and codified at 31 C.F.R. § 1010.230, formally added CDD as a fifth required pillar of every Bank Secrecy Act compliance programme.

Before this rule, BSA/AML programmes were built around four pillars: internal controls, independent testing, a designated compliance officer, and training. CDD, including identifying beneficial owners of legal entity customers, existed in practice at many institutions already, but wasn’t a codified, standalone requirement until this rule. Covered financial institutions had until 11 May 2018, two years from publication, to come into compliance, extended from an originally proposed one-year window after industry pushback over the operational complexity involved.

The four elements FinCEN’s CDD Rule actually requires

FinCEN’s rule sets out four specific elements that make up CDD in US law: identifying and verifying the identity of customers, identifying and verifying the identity of beneficial owners of legal entity customers, understanding the nature and purpose of customer relationships to develop a customer risk profile, and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, maintain and update customer information.

The third and fourth elements are the ones most often under-documented in practice. FinCEN’s own commentary noted that these two obligations existed implicitly through suspicious activity reporting requirements even before the rule, which is part of why the rule’s real effect was formalising and making auditable something many institutions were already doing informally, rather than inventing an entirely new obligation.

Beneficial ownership: the 25% threshold and the two prongs

Beneficial ownership identification is where CDD gets genuinely technical. FinCEN’s rule requires covered institutions to identify beneficial owners under two separate tests, and a legal entity customer can have beneficial owners under either one, or both. The ownership prong requires identifying any individual who owns 25% or more of the equity interests of the legal entity. The control prong requires identifying a single individual with significant responsibility to control, manage, or direct the entity, regardless of ownership percentage.

FinCEN has been explicit that 25% is a baseline regulatory benchmark, not a ceiling. Institutions can, and often do, apply a lower threshold based on their own risk assessment, particularly for higher-risk customer types. Institutions can rely on a legal entity customer’s own certification of beneficial ownership, using FinCEN’s own form or an equivalent, as long as there’s no reason to doubt its reliability, a deliberate response to industry concerns about the operational burden of independently verifying every layer of a complex ownership structure.

CDD requirements compared: US, UK, and FATF side by side

CDD requirements share a common FATF-driven foundation, but the way each jurisdiction implements it differs in ways that matter for a firm operating across borders. Here’s the same obligation, compared directly:

The pattern across all four is the same underlying logic: verify identity, find the real owner, understand the relationship, keep watching. But the US is the only one of the four with a single, precisely dated federal rule creating CDD as a standalone, numbered requirement. The UK and EU implement the same substance through broader money laundering regulations rather than a dedicated CDD-specific rule.

When CDD applies (and when it doesn’t)

CDD applies whenever a covered institution establishes a new customer relationship, and at several other trigger points: when carrying out occasional transactions above a set threshold (commonly $15,000 under FATF’s standard, though implementing jurisdictions set their own specific figures), whenever there’s a suspicion of money laundering or terrorist financing regardless of any exemption that would otherwise apply, and whenever there’s doubt about the veracity or adequacy of previously obtained customer identification data.

CDD generally doesn’t apply, or applies in reduced form, to certain low-risk, well-regulated counterparties, other regulated financial institutions in equivalent jurisdictions, for example, which is where simplified due diligence becomes relevant instead.

The CDD process step by step

1. Identify the customer: collect name, address, date of birth (individuals) or registration details (entities).
2. Verify identity against reliable, independent sources: government-issued ID, company registries, or equivalent documentation.
3. Identify beneficial owners for legal entity customers, applying the ownership and control prongs.
4. Verify beneficial owner identities using risk-based procedures.
5. Understand the nature and purpose of the relationship, building a baseline risk profile.
6. Screen against sanctions, PEP, and adverse media sources.
7. Conduct ongoing monitoring against that baseline profile, flagging activity that doesn’t fit.
8. Update customer and beneficial ownership information as circumstances change or new accounts are opened.

CDD vs EDD vs SDD

CDD, EDD, and SDD are tiers of the same obligation, not three separate processes. Simplified due diligence applies where a jurisdiction’s risk assessment supports a lighter check for genuinely low-risk relationships. Standard CDD, everything described above, is the default. Enhanced due diligence adds further measures, source of wealth verification, senior management approval, closer monitoring, for relationships a risk assessment flags as genuinely higher risk.

Every customer relationship gets assessed against this scale. None of the three tiers is optional to consider; a firm has to make an active, documented decision about which tier applies, rather than defaulting to standard CDD for everyone regardless of actual risk.

What incomplete beneficial ownership data actually costs

Incomplete beneficial ownership data is one of the more expensive gaps in CDD compliance specifically, separate from broader KYC failures. Because the FinCEN rule ties beneficial ownership so directly to a numbered federal requirement, examiners can point to a precise regulatory citation, not just a general AML weakness, when beneficial ownership records are missing or unverified.

KYC-wide enforcement data shows the scale of the exposure generally: Fenergo’s review found AML, KYC, and CDD-related fines totalled $6.6 billion globally in 2023, up 57% from 2022. Individual CDD-specific findings tend to concentrate on the same recurring gap: institutions collecting a beneficial ownership certification at onboarding, then never revisiting it as ownership structures change.

Common CDD documentation mistakes

The documentation mistakes that come up repeatedly in CDD reviews include: accepting a beneficial ownership certification without any process for triggering re-verification when circumstances suggest it’s gone stale, applying the 25% ownership threshold mechanically without considering whether the control prong also applies to someone below that threshold, treating CDD as complete once a form is filed rather than as a profile that has to hold up against actual transaction activity, and inconsistent recordkeeping that can’t show an examiner, months or years later, exactly what was verified, when, and against what source.

None of these are exotic failures. They’re gaps in discipline around information a firm typically already collected once, correctly, at the start of the relationship.

Building CDD records that survive an audit

CDD records that survive an audit generally share a specific quality: they can answer, for any customer, exactly what was verified, against what independent source, on what date, and what triggered any subsequent update. That standard applies as much to beneficial ownership information as it does to the original identity verification.

Firms that treat the FinCEN CDD Rule’s four elements, and the equivalent UK and EU obligations, as a literal checklist tied to specific regulatory citations tend to produce records that hold up better under review than firms working from a general sense of what “good KYC” should look like. The precision is the point: a compliance file that cites Regulation 28 or 31 C.F.R. § 1010.230 directly is harder to dispute than one that just says the firm followed general AML best practices.

Frequently asked questions

Read more: our ultimate guides, whitepapers and templates

Related guides and resources to help you act on what you just read.