Customer Due Diligence (CDD): The Four Core Requirements Explained

Customer due diligence, or CDD, is the set of checks a regulated firm performs to establish who its customers are and assess the money-laundering, terrorist-financing and related financial-crime risk they present. Banks, payment firms, crypto-asset businesses and other covered institutions use it when starting and maintaining customer relationships.

CDD is the baseline level of diligence in a risk-based anti-money-laundering, or AML, programme. It sits between simplified due diligence, used only where lower risk is demonstrable and law permits it, and enhanced due diligence, or EDD, which adds scrutiny for higher-risk customers, products, geographies or activity. This is an explainer, not legal advice. Requirements vary by firm, product and jurisdiction.

The four requirements under the US CDD Rule

In the United States, FinCEN's Customer Due Diligence Requirements for Financial Institutions rule, commonly called the CDD Rule, became mandatory on 11 May 2018. It applies to covered financial institutions, including banks, brokers or dealers in securities, mutual funds and futures commission merchants. The rule describes four core elements of CDD:

• Identify and verify the customer. The firm collects identifying information and verifies it using reliable, independent documents, data or information. For an individual, this commonly includes name, address, date of birth and an identification number.
• Identify and verify beneficial owners of legal-entity customers. A beneficial owner is a natural person who ultimately owns or controls an entity. Covered institutions generally obtain ownership and control information when a legal entity opens a new account, subject to defined exclusions and exemptions.
• Understand the nature and purpose of the customer relationship. The institution should gather enough information to develop a customer risk profile, including the expected purpose of the account and anticipated activity.
• Conduct ongoing monitoring. This includes monitoring for suspicious transactions, filing suspicious activity reports when required, and updating customer information when risk-based monitoring identifies material changes or inaccuracies.

Why beneficial ownership matters

Legal entities can be used legitimately to hold assets, operate businesses and manage investments. They can also obscure the people who ultimately control funds. Requiring institutions to identify those people helps reduce the ability of criminals, corrupt officials and sanctions evaders to use shell companies or layered ownership structures without scrutiny.

The beneficial-ownership requirement is often described as the “fifth pillar” of an AML programme. That phrase reflects its significance, but it can cause confusion. Traditionally, the four AML programme pillars are internal controls, a designated compliance officer, employee training and independent testing. FinCEN's CDD Rule added beneficial-ownership identification as an additional programme requirement, while also setting out four elements of customer due diligence.

For US legal-entity customers, the CDD Rule's standard certification framework generally addresses an ownership prong, covering individuals who own 25% or more, and a control prong, covering one person with significant responsibility to control, manage or direct the entity. The precise obligation and available exceptions depend on the entity and account type. This bank-level CDD obligation should not be confused with beneficial-ownership reporting requirements that may apply directly to companies under separate US rules.

Comparable EU and UK approach

EU and UK frameworks express the same core idea, although the legal sources and detailed procedures differ. Under EU anti-money-laundering rules, firms identify the customer and beneficial owner, verify their identities, assess the purpose and intended nature of the business relationship, and conduct ongoing monitoring. Member states implement EU requirements through national law, so operational details can vary.

In the United Kingdom, the Money Laundering Regulations similarly require customer due diligence measures: identify the customer and verify identity, identify beneficial owners and take reasonable measures to verify them, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring. UK firms must also consider sanctions obligations, which are distinct from, but often operationally connected to, AML checks.

When CDD is triggered

CDD is not limited to a conventional bank account opening. The usual triggers across US, EU and UK regimes include establishing a business relationship, carrying out an occasional transaction above an applicable threshold, suspecting money laundering or terrorist financing, and having doubts about the accuracy or adequacy of identification information obtained earlier.

Thresholds are not universal. They depend on the jurisdiction, sector and transaction type. EU rules, for example, generally require CDD for occasional transactions of €15,000 or more, whether carried out in a single operation or linked operations, alongside lower or separate thresholds for some services. US obligations are structured differently across covered financial institutions and products. Firms should apply the rule that governs their activity rather than treating a single number as globally applicable.

Risk ratings determine the depth of diligence

CDD produces more than an identity record. It creates a customer risk rating, informed by factors such as ownership complexity, occupation or business model, products used, expected transaction patterns, countries involved, adverse information and whether the customer is a politically exposed person. A politically exposed person is an individual entrusted with a prominent public function, whose position can create elevated corruption risk.

A lower-risk rating may support simplified due diligence where the law allows it. Simplified due diligence does not mean no due diligence: firms still need sufficient information to identify the customer and monitor for changes. A higher-risk rating calls for EDD, which may include obtaining more information on source of funds or wealth, senior-management approval, closer transaction monitoring and more frequent review. The rating should be reviewed as customer activity and circumstances change.

The practical objective

Effective CDD links identity, ownership, expected activity and monitoring. A firm that verifies a document but does not understand who controls a company, why an account exists or whether activity matches expectations has only completed part of the task. Conversely, a risk-based process helps firms focus additional scrutiny where it is most needed while avoiding unnecessary friction for lower-risk customers.