Simplified Due Diligence: When Lighter Checks Are Allowed
Simplified due diligence allows proportionate reductions in customer checks when a firm can show the money laundering and terrorist financing risk is low. It does not mean no due diligence, and it must be supported by documented risk assessment and ongoing monitoring.
Simplified due diligence, usually shortened to SDD, is a reduced level of customer due diligence that may be used when the risk of money laundering or terrorist financing is demonstrably low. The concept is established in European Union and United Kingdom anti-money laundering rules, which require firms to apply controls proportionate to risk rather than treat every customer and product identically.
SDD is not a shortcut for ignoring a customer. It is a risk-based adjustment to the timing, depth or frequency of checks. A bank, payments provider, crypto-asset business or other regulated firm must be able to explain why lighter measures were appropriate in the specific circumstances, and must be ready to increase scrutiny if the risk picture changes.
What simplified due diligence means
Customer due diligence, or CDD, is the process of identifying a customer, verifying identity, understanding the purpose and intended nature of a business relationship, and monitoring activity over time. For companies and other legal entities, it also generally includes identifying beneficial owners, meaning the natural persons who ultimately own or control the entity.
Under SDD, a firm may use less intensive measures than it would under ordinary or standard due diligence. Depending on the applicable rules and the firm’s documented risk assessment, that can mean verifying some information after the relationship begins, collecting less detailed information about the purpose of a low-risk account, or refreshing customer records less often. It can also mean relying on reliable information already obtained in an appropriate setting, where the law permits.
The limits matter. SDD does not remove the obligation to identify the customer, assess risk, screen and comply with applicable sanctions controls, or monitor the relationship for unusual activity. Nor does it permit a firm to disregard beneficial ownership where that information is required. A low-risk classification is not permanent: new transactions, adverse information or changes in ownership can require the firm to move to standard or enhanced checks.
When lighter checks may be appropriate
There is no universal list of customers that automatically qualify. EU and UK frameworks set factors that firms should consider, while national laws, supervisory guidance and a firm’s own policies determine the operational result. The firm must assess customer, product, delivery-channel and geographic risk together.
- A public authority or publicly owned body in a jurisdiction with effective anti-money laundering supervision, where the relationship and expected payments are transparent.
- A regulated financial institution subject to comparable anti-money laundering obligations and effective supervision, subject to the rules on reliance and correspondent relationships.
- A low-value, tightly limited financial product with restricted functionality, low transaction limits and no meaningful ability to move funds anonymously.
- A product connected to defined public policy objectives, such as certain pension, insurance or social-benefit arrangements, where payments and beneficiaries are constrained.
- A customer relationship conducted through a reliable, regulated channel with a clear source of funds and an expected activity pattern that is simple and consistent.
These are examples, not safe harbors. A product that appears low risk may not qualify if it can be used repeatedly, funded by unknown third parties or combined with other services to move significant value. Similarly, a customer category that is usually lower risk can become higher risk because of its ownership, transactions or connections to particular jurisdictions.
When SDD is not available
Suspicion overrides simplification. If a firm knows, suspects or has reasonable grounds to suspect money laundering or terrorist financing, it must apply the required measures, consider reporting obligations and avoid alerting the customer where tipping-off rules apply. SDD is not an alternative to investigating red flags.
Firms should also avoid or sharply limit SDD where higher-risk factors are present. These can include links to jurisdictions identified as high risk under applicable EU, UK or national regimes; complex or opaque ownership structures; politically exposed persons, who are individuals entrusted with prominent public functions; unusual cash activity; adverse media; or transactions that do not fit the stated purpose of the relationship. High-risk third countries can trigger specific enhanced due diligence requirements under EU and UK rules.
SDD, standard due diligence and enhanced due diligence
SDD is one point on a risk-based spectrum. Standard CDD is the baseline for ordinary relationships: identify and verify the customer and beneficial owners where relevant, understand the relationship, and monitor it. Enhanced due diligence, or EDD, applies where risk is higher. It requires additional information, deeper scrutiny of source of funds or source of wealth where appropriate, more senior approval in some cases, and more frequent monitoring.
A customer can move along that spectrum. For example, an account opened for a limited, low-value use may initially receive simplified measures. If its volume rises, its owners change, or its activity becomes inconsistent with the stated purpose, the firm should reassess the rating and obtain further evidence. Risk-based does not mean discretionary without limits. It means applying a consistent, evidence-based methodology within legal and regulatory requirements.
Building an audit trail
Regulators and internal auditors will usually expect more than a checkbox saying “low risk.” The file should show the facts supporting the classification, the risk factors considered, the measures reduced, the controls that remain in place, who approved the decision, and when it will be reviewed. Firms should retain identity and transaction records for the period required by their jurisdiction.
A useful record also explains why contrary indicators did not change the outcome, such as a non-face-to-face onboarding channel or a cross-border payment feature. Automated risk scores can support this process, but they should be tested, governed and subject to human escalation where the facts warrant it.
The US uses different terminology
This explainer is not legal advice. The United States does not use the SDD label in the same way as EU and UK anti-money laundering regimes. US Bank Secrecy Act requirements, including Customer Identification Program and customer due diligence obligations, are administered through a framework that is also risk-based, but the precise duties, exemptions and supervisory expectations differ by institution and sector. A US firm should not assume that an EU or UK SDD rationale satisfies US requirements, and a cross-border firm should map its controls to each applicable regime.