Customer due diligence
CDDAlso called customer identification, KYC checks
Customer due diligence is the set of checks a regulated firm carries out to identify and verify a customer, understand the purpose of the relationship and assess its money laundering risk. It includes identifying beneficial owners of companies and monitoring the relationship over time. It is the core of every AML programme.
How it works
When a customer applies, the firm collects identity details and verifies them against documents or reliable electronic sources. For a company, it identifies the beneficial owners and the people in control. It records the nature and purpose of the relationship, gives the customer a risk rating, and sets the level of ongoing monitoring and periodic review.
CDD decides which customers a firm takes on and how closely it watches them. Low-risk customers may receive simplified checks and high-risk customers enhanced ones. Regulators often find CDD failures, such as missing ownership data or outdated files, at the centre of enforcement cases.
The rules
Sets the global standard to identify and verify customers and beneficial owners, understand the relationship and conduct ongoing due diligence.
Financial institutions in FATF member jurisdictionsSets out the customer due diligence measures, including identification, verification, beneficial ownership and understanding the purpose of the relationship.
UK relevant personsReplaces national CDD rules with a single directly applicable EU rulebook on customer due diligence from July 2027.
EU obliged entitiesRequires covered institutions to identify and verify beneficial owners of legal entity customers and maintain risk-based customer profiles.
US banks, broker-dealers, mutual funds, futures firmsCommon questions
What is the difference between KYC and CDD?
KYC is the broad practice of knowing who a customer is. CDD is the specific legal set of measures within it, covering identification, verification, beneficial ownership, purpose of the relationship and ongoing monitoring.
When must CDD be carried out?
When a business relationship is established, for certain occasional transactions, when money laundering is suspected, and when the firm doubts previously obtained information. It is also refreshed during the relationship based on risk.
Did FinCEN change the US CDD rule in 2026?
On 13 February 2026 FinCEN issued an order letting covered institutions identify and verify beneficial owners at a legal entity's first account opening, rather than at every new account, unless risk or doubts require it.
