7.3 KYC to EDD: Applying CDD and Enhanced Due Diligence Across Customer Types
Key Takeaways
FATF Recommendation 10 sets four CDD elements: identify and verify the customer, identify beneficial owners, understand the relationship's purpose and nature, and conduct ongoing due diligence.
CIP is the US rule for identifying and verifying account openers; KYC is the umbrella term, and eKYC means performing it electronically and remotely.
Expected-activity information collected at onboarding becomes the baseline that transaction monitoring compares against actual behaviour.
FATF Recommendation 19 requires enhanced due diligence for business relationships and transactions with persons from countries FATF calls for action against.
CAFCA sub-topic 2.1 covers CIP, KYC, eKYC, CDD and EDD: what each term means, the core activities, and best practices such as understanding account purpose and ownership and setting baseline activity. It also covers how the risk-based approach decides how far to go. The two previous sections cover the US CIP rule and the FinCEN beneficial ownership rule in depth. This section ties the terms together and applies them to the customer types FinTechs actually serve.
The vocabulary
| Term | Meaning | Typical scope |
|---|---|---|
| KYC (know your customer) | Umbrella term for knowing who the customer is and what they do | All of the below |
| CIP (customer identification program) | The US requirement to collect identifying information and verify identity at account opening | Name, date of birth, address, ID number; documentary or non-documentary verification |
| eKYC | Doing KYC electronically and remotely: document capture, NFC chip reads, biometrics, database checks | The onboarding technology stack (Chapter 8) |
| CDD (customer due diligence) | Standard measures: identify and verify, beneficial owners, purpose and nature, ongoing monitoring | Every customer |
| SDD (simplified due diligence) | Reduced measures where risk is shown to be low and the law allows | Some low-value e-money products, public companies, government bodies |
| EDD (enhanced due diligence) | Additional measures for higher risk | PEPs, high-risk countries, complex ownership, unusual activity, high-risk sectors |
FATF Recommendation 10 sets out the four CDD elements. Firms must identify and verify the customer using reliable, independent sources. They must identify beneficial owners and take reasonable measures to verify them. They must understand, and where appropriate obtain information on, the purpose and intended nature of the relationship. Finally, they must conduct ongoing due diligence, scrutinising transactions and keeping information up to date.
Purpose, ownership and the activity baseline
Identity checks show that a person exists. Purpose and expected activity show whether their behaviour makes sense later. Capture enough to build a baseline:
- Consumers: occupation or source of income, expected use (salary account, savings, P2P, crypto purchases), expected monthly inflows, and whether international transfers are expected.
- Sole traders and gig workers: platform or trade, expected receipts, typical payers.
- Businesses (KYB): what the business sells, to whom and where, licences, website and channels, expected volumes and average ticket size, payment methods, top counterparties and countries, and ownership and control.
Transaction monitoring compares actual activity with this baseline. A "student" receiving US$45,000 a week in P2P credits is suspicious because the baseline said US$1,000 a month. Without a baseline, monitoring has nothing to compare against.
Applying CDD across customer types
| Customer type | Key CDD questions | Common EDD triggers |
|---|---|---|
| Retail consumer | Is the identity real and does it belong to the applicant? What is the income source and intended use? | PEP status, high-risk residence, adverse media, mismatched device or location data |
| Sole trader / gig worker | Does the stated trade match the payers and the volumes? | Payouts from many unrelated cardholders; cash-intensive trades |
| Private company / partnership | Who owns and controls it? What is the business model and where are its customers? | Complex or offshore layers, nominee directors, bearer shares, recent incorporation with high volumes |
| Trust / foundation | Who are the settlor, trustees, beneficiaries and controllers? | Discretionary structures with unclear beneficiaries; high-risk jurisdictions |
| Non-profit | What is the mission, where does it operate and who funds it? | Activity in conflict zones; cash distribution; unclear partners |
| MSB / PSP / VASP as a customer | Is it licensed and supervised? How strong is its AML programme? Who are its customers? | Unlicensed status, nested providers, high-risk corridors, crypto mixing exposure |
| Marketplace sellers / sub-merchants | Is the seller real? Does the merchant category match the actual sales? | Transaction laundering signals, mismatched merchant category codes, chargeback spikes |
Enhanced due diligence
When. EDD applies when the customer risk rating is high, and when the law requires it regardless of rating. Legal triggers include foreign PEPs (FATF Recommendation 12), correspondent-type relationships (Recommendation 13), and business with countries FATF calls for action against (Recommendation 19). The EU also requires EDD for its list of high-risk third countries. Event-driven triggers include alerts, adverse media and ownership changes.
What. Typical measures:
- More information on the customer, the beneficial owners and the business, with independent corroboration.
- Source of funds (where this money comes from) and source of wealth (how the customer built their overall wealth), with documents.
- Senior management approval to open or continue the relationship.
- Enhanced monitoring: tighter scenarios, lower thresholds and more frequent reviews.
- More frequent refresh of KYC information.
- Controls on the relationship: transaction limits, restricted products or corridors.
Best practices
- Risk-based refresh cycles: for example, high-risk customers reviewed every year and lower risks less often, plus event-driven reviews after alerts, adverse media or changes in profile.
- Proportionality: SDD only where the law allows and the risk is documented as low. No CDD at all is never an option.
- Clear exit criteria when CDD cannot be completed. Do not open the account, or restrict and close it, and consider a SAR or STR.
- Document the rationale for every risk decision (Chapter 14).
Realistic exam scenario
A marketplace FinTech onboards a seller registered in a country on FATF's call-for-action list. The seller expects US$200,000 a month in sales of "industrial equipment" and its website was created three weeks ago. The firm must apply enhanced due diligence. That means verifying the company and its owners through reliable registries, obtaining evidence of the goods and the customers, establishing source of funds, getting senior approval, and setting enhanced monitoring and limits. It should also check whether its policy or bank partner prohibits the jurisdiction. If the information cannot be corroborated, the relationship should not proceed.
Common exam traps
- Treating CIP as the whole of CDD. CIP covers identity only, not purpose, ownership or monitoring.
- "EDD means automatic rejection." EDD is a set of deeper measures, and many high-risk customers can be accepted with controls.
- Skipping the activity baseline, which leaves monitoring blind.
Which element is part of customer due diligence but is NOT satisfied by identity verification alone?
Understanding the relationship's purpose and expected activity
Matching the selfie to the ID photo with a liveness check
Confirming the applicant's date of birth against an independent database
Checking that the passport is unexpired and undamaged
A FinTech wants to apply simplified due diligence to all retail customers to speed up onboarding. What is the main problem?
SDD can only be used for politically exposed persons and their families
Simplified due diligence is never allowed in any jurisdiction for any customer
SDD needs a documented low-risk finding and legal permission, not blanket use
SDD requires a separate senior management approval for each customer it is applied to
Which pair of measures is most characteristic of enhanced due diligence?
Sending a welcome email and a marketing survey after the account opens
Source-of-funds and source-of-wealth evidence plus senior management approval
Collecting a nickname, a social media handle and a hobby list for each account holder
Raising the customer's transaction limits to reflect their importance
Sections you finish are checked off in the contents.