Enhanced Due Diligence: What Triggers It and What It Involves

Enhanced due diligence, or EDD, becomes operationally difficult when firms treat it as a short list of red flags rather than a decision process. For a primer on the term itself, see the UK government’s <a href="https://www.gov.uk/guidance/money-laundering-regulations-your-responsibilities">Money Laundering Regulations guidance</a>. In practice, the question for compliance teams is what additional evidence will reduce a specific, documented risk, and whether that evidence can be independently tested.

The UK framework is a useful benchmark for firms operating across the UK and EU, even though local rules and supervisory expectations differ. In the United States, Bank Secrecy Act requirements similarly rely heavily on a risk-based customer due diligence programme, rather than a single universal EDD workflow. That makes governance, case records and escalation decisions as important as the initial trigger.

Four triggers, with one that governs the rest

UK rules identify four circumstances in which enhanced measures are required. The first three are concrete: a customer is not physically present for identification; the customer is a politically exposed person, or PEP; or the customer or transaction involves a high-risk country. Firms should consult the applicable UK, EU and Financial Action Task Force country lists, rather than assume those lists are identical or static.

• Non-face-to-face onboarding, where the firm cannot rely on an in-person identity check.
• A customer who is a PEP, as well as relevant family members and known close associates under the applicable rules. PEP status is a risk indicator, not evidence of misconduct.
• A customer, beneficial owner, transaction or relationship connected to a high-risk country.
• Any other situation that presents a higher risk of money laundering or terrorist financing.

The fourth trigger is the consequential one. It means the list is not exhaustive and cannot substitute for a risk assessment. A complex ownership structure, unexplained use of intermediaries, adverse information, unusual transaction patterns, products capable of rapid movement of funds, or a mismatch between a customer’s profile and anticipated activity can each justify EDD even when the customer is not a PEP and no listed country is involved.

What the enhanced workflow should add

Government guidance points to several measures that should be applied in combination and calibrated to the case. Teams should obtain further identity information and apply additional document verification. That may mean collecting a second reliable identity document, validating document security features, checking authoritative databases, verifying an address independently, and resolving inconsistencies across records. For companies and trusts, the work extends to beneficial ownership, control arrangements and the people acting for the entity.

The review must also establish source of funds and the purpose of the relationship or transaction. Source of funds asks where the money used in a particular transaction came from, such as a sale, salary, dividend, loan or inheritance. Evidence should match the explanation: a sale agreement and bank credit for an asset disposal, for example, rather than an unsupported customer statement. Where risk warrants it, firms should also examine source of wealth, meaning how the customer accumulated their overall assets.

EDD should produce evidence that is proportionate to the risk and capable of being reviewed later by an auditor, supervisor or investigator.

The frequently missed first-payment control

One concrete control receives far less attention than document checks: for non-face-to-face cases, guidance calls for the first payment to be made through an account opened in the customer’s own name at a credit institution. The control helps bind the newly onboarded customer to an already established banking relationship and reduces the risk that an anonymous third party is funding the account.

It is not a substitute for verification. Firms still need to confirm the sending account holder, understand whether the payment path makes sense and investigate third-party funding where it is permitted. Payment operations therefore need a clear stop or escalation rule: do not activate the relationship, release value or treat an account as fully verified until the named-account requirement has been evidenced or an approved, documented exception applies.

Enforcement shows why the record matters

The consequences of weak enhanced controls are not theoretical. In 2022, Danske Bank pleaded guilty in the United States to conspiring to commit bank fraud and agreed to forfeit more than $2 billion. The case concerned high-risk non-resident customers of its Estonian branch between 2008 and 2016. The US Department of Justice said the branch processed large volumes of suspicious payments while its non-resident portfolio and related controls created significant anti-money-laundering risk.

The lesson is not that every higher-risk customer must be rejected. EDD is designed to support a defensible decision to accept, restrict, monitor or decline a relationship. A file should show the trigger, the risk assessment, evidence collected, verification results, payment-account checks, source-of-funds rationale, approvals and the schedule for ongoing review. When facts change, EDD is not complete: it must be refreshed.