Customer due diligence, or CDD, is the process of identifying a customer, verifying relevant information, understanding the intended business relationship and assessing financial-crime risk. It is broader than collecting an identity document: the depth of review should reflect the customer, ownership structure, activity, jurisdictions and services involved.
What does customer due diligence examine?
A CDD review normally connects the legal customer to the people who own or control it and to the activity expected through the account or service. The exact evidence depends on the institution, jurisdiction and risk assessment.
- Legal name, registration status, address and business activity
- Directors, authorized representatives and beneficial owners
- Purpose and expected nature of the relationship
- Expected transaction size, frequency, currencies and counterparties
- Relevant sanctions, politically exposed person and adverse-information screening results
- Changes that may require the record or risk assessment to be refreshed
How does the CDD process work?
- Identify: collect the customer and ownership information required for the relationship.
- Verify: compare that information with reliable documents, databases or other permitted sources.
- Understand: record why the customer needs the service and what activity is expected.
- Assess: assign and document the applicable risk level and approval path.
- Monitor and refresh: compare later activity and material changes with the established profile.
CDD vs. KYC
Know Your Customer is often used as the wider label for customer-identification and verification controls. CDD is the risk-based work used to understand the customer and relationship. The expressions may overlap in practice, so a policy should define what each stage includes rather than relying on the label alone.
When is enhanced due diligence needed?
Enhanced Due Diligence applies additional scrutiny when the assessed risk calls for it. An unusual ownership chain, higher-risk geography or activity inconsistent with the stated profile may prompt more evidence, senior approval or closer monitoring. A risk indicator is a reason to investigate; it is not by itself proof of wrongdoing.
What should the record show?
Keep the information reviewed, source and date of verification, ownership analysis, stated purpose, expected activity, screening results, risk rationale, approvals and next review trigger. The record should let a reviewer understand how the decision was reached without reconstructing it from email.
