CDD (Customer Due Diligence)

What it is

Customer due diligence (CDD) is the core obligation of anti-money laundering law. FATF Recommendation 10 sets the global standard, and EU law applies it to banks, payment firms, insurers, crypto-asset service providers, auditors, notaries and other obliged entities.

CDD has four standard measures:

1. Identify the customer and verify the identity with reliable, independent sources.
2. Identify the beneficial owner and take reasonable measures to verify it, including understanding the ownership and control structure.
3. Assess and, where needed, obtain information on the purpose and intended nature of the relationship.
4. Conduct ongoing monitoring, including scrutiny of transactions and keeping data up to date.

CDD applies when a business relationship starts, for occasional transactions above set thresholds, when there is a suspicion of money laundering, and when there are doubts about data already held. If CDD cannot be completed, the firm must not start the relationship or must end it, and consider a suspicious activity report.

Why it matters

CDD produces the customer profile that every later control depends on. It also allocates effort: low-risk customers can receive simplified due diligence, while high-risk ones require enhanced due diligence (EDD). The Anti-Money Laundering Regulation (AMLR), applicable from 10 July 2027, replaces national transpositions of the directives with one set of directly applicable CDD rules, with detail in AMLA technical standards.

Worked example

Illustrative numbers.

A company applies for an account. Its structure is: Person A owns 60% of Holding X, and Holding X owns 50% of the applicant. Person B owns 30% of the applicant directly. The remaining 20% is widely held.

• Indirect stake of A: 60% x 50% = 30%.
• Direct stake of B: 30%.
• Both meet the EU threshold of 25% or more, so both are beneficial owners to identify and verify.
• The analyst also records the expected activity: 40 incoming payments a month, average 25,000 euro, from EU customers. Later monitoring compares real flows with this profile.

Who uses it

• KYC analysts apply CDD measures at onboarding.
• Corporate onboarding analysts calculate ownership and document control by other means.
• Periodic review analysts repeat CDD on schedule and after trigger events.
• AML analysts and financial crime investigators rely on CDD data when assessing alerts.
• Compliance officers write the CDD policy and approve exceptions.

Common confusions

• CDD is the legal term and KYC the everyday one; the content is the same.
• Simplified due diligence still requires identification and monitoring, with lighter verification or timing.
• Ongoing monitoring is part of CDD. It is a legal duty as binding as onboarding checks.
• The beneficial owner is always a natural person. A holding company cannot be the final answer.
• Registers of beneficial ownership help, but firms cannot rely on them alone and must report discrepancies.