Customer due diligence

Customer due diligence (CDD) is a fundamental set of processes and controls used by banks, financial institutions, and regulated businesses to verify the identity of their customers, assess associated risks, and monitor activity to prevent crime such as money laundering, terrorist financing, and fraud.

History

The concept of customer due diligence evolved in tandem with early anti-money laundering (AML) measures and the increasing demand for regulatory controls within the global financial system. Early steps date to the adoption of the Bank Secrecy Act in the United States in 1970, but formal CDD frameworks gained international traction in the 1990s when the Financial Action Task Force (FATF) was established to standardize AML requirements worldwide.

CDD was institutionalized through international recommendations, then embedded in laws such as the USA PATRIOT Act, the EU Anti-Money Laundering Directives, and, in 2016, the introduction of the CDD Final Rule by the U.S. Financial Crimes Enforcement Network (FinCEN), which clarified and expanded CDD obligations for banks and related sectors. The implementation of these rules established CDD as a central pillar of AML regimes globally.

Usage

Customer due diligence is a continuous process that begins at onboarding and continues throughout the customer relationship. The primary goal is to ensure that institutions are not unwittingly facilitating illegal activity. The process incorporates the following steps:

• Customer identification: Gathering personal or business information such as names, addresses, identification documents (passports, business licenses), and, for corporate entities, beneficial ownership details.
• Verification: Cross-checking collected information with independent and reliable sources to validate authenticity.
• Risk assessment: Evaluating each customer's risk based on factors such as origin, business activities, transaction types, and connections to high-risk jurisdictions or politically exposed persons.
• Ongoing monitoring: Reviewing transactions and maintaining up-to-date records to detect unusual, suspicious, or inconsistent activity.
• Enhanced due diligence (EDD): Applying more rigorous checks for higher-risk customers, such as those flagged for possible links to crime or corruption.

Failure to adhere to CDD protocols can result in significant regulatory penalties and reputational harm for the institution involved.

Key Users

CDD requirements primarily apply to financial institutions—including banks, credit unions, broker-dealers, money services businesses, insurers, and fintechs—but increasingly extend to real estate firms, law practices, accounting firms, and other professionals exposed to risk of financial crime.

Supervisory and regulatory bodies such as FinCEN in the United States and the Financial Conduct Authority in the United Kingdom oversee compliance. At the same time, noncompliance can lead to serious legal and financial consequences. Technologies such as digital identity verification, big data analytics, and AI-driven platforms have also become critical in automating and meeting CDD obligations in both traditional financial institutions and emerging digital finance sectors.