What is Customer Due Diligence (CDD)?
Customer due diligence means taking steps to identify your customers and to check that they are who they say they are. In practice, it means obtaining and verifying a customer’s name, an official document that confirms their identity, their residential address and their date of birth.
The most reliable route is to ask for a government-issued document such as a passport, alongside utility bills, bank statements or other official documents. Other sources of information include the electoral register and data held by credit reference agencies. In certain situations you also need to identify the beneficial owner, for example where someone is acting on behalf of another person, or where you need to establish the ownership structure of a company, partnership or trust.
As a general rule, the beneficial owner is the person behind the customer who owns or controls them, or the person on whose behalf a transaction or activity is carried out. If you have doubts about a customer’s identity, you must stop dealing with them until you are sure.
The two steps of CDD
CDD has two components: understanding the customer’s activity, and assessing the money laundering risk that activity presents. Legislation such as the fourth AML Directive, or in the UK the Money Laundering Regulations 2017, sets out how due diligence should look and what criteria to consider, including:
- political exposure of the person
- residence in a high-risk country
- doing business in a high-risk sector
When onboarding a new customer, or when a customer’s activity changes substantially, an analysis of the source of funds and the risk associated with those funds is prudent and, in most countries, a legal requirement.
When CDD must be applied
You must apply customer due diligence measures:
- when you establish a business relationship with a customer
- when you suspect money laundering or terrorist financing
- when you have doubts about identification information you obtained previously
- when it is necessary for existing customers, for example if their circumstances change
- when you carry out an occasional transaction above the applicable threshold (EUR 15,000 is the common EU benchmark; the UK regime sets its own thresholds)
Enhanced due diligence
Where the risk is higher, for example for politically exposed persons, customers in high-risk jurisdictions or complex ownership structures, enhanced due diligence applies. That means more evidence, senior management sign-off and closer ongoing monitoring.
Doing it consistently
The manual version of CDD does not scale. Automating identity, company, PEP and sanctions checks keeps the process consistent and auditable. Hyperflow delivers these checks through an API that fits the onboarding flow.