Banks: Four Customer Due Diligence Requirements

Customer due diligence, or CDD, is the risk-based process banks use to understand who their customers are and evaluate the risks they present. It includes collecting and verifying identifying information, identifying beneficial owners of legal entities, understanding the purpose of the relationship, assigning a risk profile, and monitoring activity over time. CDD helps banks detect suspicious activity and meet Bank Secrecy Act expectations.

The four core CDD requirements are: identifying and verifying the customer; identifying and verifying beneficial owners of legal-entity customers; understanding the nature and purpose of the customer relationship to develop a risk profile; and conducting ongoing monitoring. Ongoing monitoring includes reviewing transactions for suspicious activity and updating customer information when material changes or elevated risk warrant additional review.

The four elements of CDD are customer identification, beneficial ownership identification, customer risk profiling, and ongoing monitoring. Together, these elements establish a documented understanding of the relationship at onboarding and throughout its life cycle. A bank should apply enhanced due diligence where higher-risk customers, products, geographies, ownership structures, or transaction patterns require more detailed investigation and oversight.

A typical banking due diligence process begins with collecting customer information and validating identity using reliable, independent sources. For legal entities, the bank identifies beneficial owners and control persons. Next, it documents the relationship’s expected purpose and activity, assigns a risk rating, and applies appropriate controls. The process continues through transaction monitoring, periodic reviews, event-driven updates, and suspicious activity escalation when necessary.

A bank should apply enhanced due diligence, or EDD, when a customer or relationship presents elevated money-laundering, fraud, sanctions, or other financial crime risk. Common triggers include complex ownership, politically exposed persons, higher-risk jurisdictions, cash-intensive activity, unusual transaction volumes, and adverse information. EDD may involve collecting additional source-of-wealth details, ownership evidence, approvals, and more frequent monitoring.

CDD review frequency should be risk-based rather than identical for every customer. Higher-risk relationships generally require more frequent periodic reviews and closer monitoring, while lower-risk relationships may be reviewed on a longer cycle. Banks should also perform event-driven reviews when ownership changes, transaction behavior shifts, adverse information emerges, products change, or monitoring alerts reveal potentially inconsistent activity.

For individual customers, banks commonly use government-issued photo identification and may confirm address through reliable records or documents. For businesses, verification commonly includes formation documents, tax identification details, ownership information, and authority documentation for account signers. The specific evidence should align with the bank’s Customer Identification Program, customer type, risk rating, and applicable legal and regulatory requirements.

Banks can improve an outdated CDD program by reassessing customer risk methodology, simplifying workflows, clarifying escalation standards, and aligning data collection with actual risk. They should test whether beneficial ownership, expected activity, and monitoring data are complete and usable. Updated policies, staff training, quality assurance, technology configuration, and audit-ready documentation help create controls that are both efficient and defensible.