What is customer due diligence (CDD)?
Customer due diligence is the legally required set of measures: identify the customer and verify that identity, identify beneficial owners, understand the purpose and intended nature of the relationship, and monitor the relationship on an ongoing basis.
CDD is defined in FATF Recommendation 10 and transposed into the EU anti-money-laundering framework. It applies when a business relationship is established, when occasional transactions exceed the set thresholds, when there is a suspicion of money laundering or terrorist financing, and when previously obtained data is doubted. Firms tend to treat CDD as the paperwork at the start, but the fourth limb, ongoing monitoring including scrutiny of transactions and keeping documents current, is where most supervisory criticism lands.
What this workflow covers
SCOPE- Standard measures are the baseline: simplified for demonstrably lower risk, enhanced for higher, with the reasoning recorded either way.
- Onboarding a small logistics company means verifying the registration, identifying beneficial owners, screening everyone identified, recording expected volumes and setting the review date.
- Where the measures cannot be completed, the rules require you not to open the relationship, not to carry out the transaction, to terminate an existing relationship, and to consider a suspicious activity report.
- Screening is one control inside CDD, not a substitute for it.
Compliance glossary
TERMS- Simplified due diligence
- Reduced CDD measures applied where lower risk has been identified and evidenced; it never removes the identification or monitoring duty.
- Occasional transaction
- A transaction carried out outside a business relationship which triggers CDD once it exceeds the threshold set in the applicable rules.
Authoritative references
SOURCES- 01The FATF Recommendations — Recommendation 10 (Customer due diligence)
Financial Action Task Force
- 02Regulation (EU) 2024/1624 — customer due diligence
EUR-Lex, Official Journal of the European Union
Frequently asked questions
Q&A- When does CDD actually kick in?
- At the start of a business relationship, for occasional transactions above the applicable thresholds, whenever there is a suspicion of money laundering or terrorist financing regardless of any threshold, and whenever there is doubt about the veracity of data obtained earlier.
- What does simplified due diligence let us skip?
- Less than most people hope. It is a reduced set of measures permitted where you have established and can evidence lower risk, and it changes the extent or timing of measures. It never removes the obligation to identify the customer or to monitor the relationship.
- What are the four elements of CDD?
- Identifying and verifying the customer; identifying the beneficial owner and taking reasonable measures to verify them; understanding and where appropriate obtaining information on the purpose and intended nature of the relationship; and conducting ongoing monitoring including scrutiny of transactions.