What it means
Customer due diligence has three basic parts: identify the customer and verify that identity with reliable evidence, identify anyone who ultimately owns or controls a corporate customer, and form a sensible view of the purpose and expected pattern of the relationship. Only when those pieces are in place can a firm judge whether later activity looks normal or looks wrong.
Without them, monitoring has nothing to compare transactions against. For a business, CDD is both a compliance obligation and a commercial friction point.
Regulators impose heavy penalties for weak controls, and correspondent banks will withdraw services from firms whose standards look poor, so the cost of getting it wrong is far larger than the cost of doing it. At the same time every extra document requested slows down onboarding and loses some proportion of prospective customers.
The controlling principle is risk sensitivity. A retail customer opening a small savings account with a locally issued identity document is low risk and gets simplified checks, while a company registered offshore with layered ownership, operating in a high-risk jurisdiction, triggers enhanced due diligence involving source of funds, source of wealth and senior sign-off.
Firms score customers across factors such as country, product, delivery channel and customer type to decide which route applies. The common nuance is that CDD is a continuing obligation rather than a one-off form.
Beneficial ownership changes, customers move into new markets, and transaction patterns drift away from what was declared at onboarding, so periodic review and ongoing monitoring are as important as the initial file. Many enforcement cases turn not on a missing passport copy but on a firm that never looked again after day one.
In practice
Real-world examples.
Example
A commercial bank onboarding a construction company asks for certificates of incorporation, a shareholder register and identification for two individuals who each own more than 25%. One shareholder turns out to be a nominee, so the bank keeps digging until it identifies the person actually behind the holding.
Example
An accountancy practice takes on a new client whose declared turnover is $400,000 but whose bank statements show $3,000,000 flowing through in a year. The mismatch between declared purpose and actual activity triggers an internal review and a report to the firm's money laundering reporting officer.
Example
An online payments provider uses electronic verification against credit and public records for low-risk retail sign-ups, clearing most applications in under a minute. Applications that fail the electronic check are routed to a manual team that requests documents instead.
Think of it
“CDD is the abbreviation for Customer Due Diligence-checking out customers.
Formula
Calculation
Weighted customer risk score = sum of (factor score x factor weight)
A bank scores each new business customer on four factors from 1 (lowest risk) to 5 (highest), with weights that add up to 100%. A freight forwarding company scores 4 on country risk (weight 30%), 2 on product risk (weight 25%), 3 on delivery channel risk (weight 20%) and 5 on customer type risk (weight 25%). The weighted score is (4 x 0.30) + (2 x 0.25) + (3 x 0.20) + (5 x 0.25) = 1.20 + 0.50 + 0.60 + 1.25 = 3.55. Because the bank's policy sends anything above 3.50 into enhanced due diligence, this customer requires evidence of source of funds and approval from a senior manager before the account opens, and it is placed on an annual rather than a three-yearly review cycle.Case study
Seen in the real world.
This illustrative and entirely fictional example concerns Alder Cross Bank, an invented mid-sized commercial bank. A regulatory visit found that while the bank collected identity documents diligently at account opening, it had never refreshed files for customers onboarded more than five years earlier, and roughly 3,000 corporate files showed ownership information that was demonstrably out of date.
The bank ran a remediation programme, prioritising customers with high weighted risk scores. Around 300 files were escalated to enhanced due diligence, 40 relationships were exited after the bank could not establish who ultimately controlled the customer, and the review cycle was rebuilt so that high-risk customers were revisited annually and low-risk ones every three years.
The fictional programme cost about $4,000,000 over eighteen months, which the illustrative board accepted as far cheaper than a penalty or the loss of a correspondent banking relationship. The lasting change was cultural: relationship managers stopped treating due diligence as paperwork that ended at onboarding.
Watch out
Common mistakes.
- Treating CDD as a one-off task completed at onboarding, when the obligation to monitor and refresh the customer file continues for the life of the relationship.
- Collecting an identity document without verifying it against an independent source, which satisfies a checklist but not the actual requirement.
- Stopping at the registered shareholder of a corporate customer rather than working through to the individual who ultimately owns or controls it.
Questions
People also ask.
What is the difference between CDD and KYC?
Know your customer is the broader everyday label for identifying customers, while customer due diligence is the specific regulatory process of identification, verification, risk assessment and ongoing monitoring.
When is enhanced due diligence required?
Typically for politically exposed persons, customers in high-risk jurisdictions, unusually complex ownership structures, and any relationship the firm's own risk scoring pushes above its threshold.
Can a firm rely on due diligence carried out by another regulated business?
In many jurisdictions yes, but the reliance must be documented and the relying firm normally remains responsible if the underlying work was inadequate.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%