Customer due diligence vs enhanced due diligence: what each requires and where screening fits
CDD is the baseline every regulated firm applies to every customer. EDD is the deeper review the law requires when the risk is higher. This guide sets out what each involves under the FATF standard and in Canada, the US, the UK and the EU, and where sanctions, PEP and adverse media screening sit in both.
What is customer due diligence?
Customer due diligence (CDD) is the set of measures a regulated firm applies to know who it is dealing with and why. FATF Recommendation 10 sets the international standard, and every major regime builds on the same four elements:
- Identify and verify the customer using reliable, independent documents, data or information.
- Identify the beneficial owner and take reasonable measures to verify who ultimately owns or controls a legal entity customer.
- Understand the purpose and intended nature of the business relationship, so the firm can tell later whether activity fits.
- Conduct ongoing due diligence on the relationship, keeping information current and scrutinizing transactions against what the firm knows.
CDD is risk-based. A low-risk retail customer and a cross-border corporate customer both receive CDD, but the depth of verification and the frequency of review differ. Some regimes also permit simplified due diligence where the risk is demonstrably low.
What is enhanced due diligence?
Enhanced due diligence (EDD) is the additional scrutiny applied when a customer, product, jurisdiction or transaction presents higher money laundering or terrorist financing risk. It does not replace CDD; it adds to it. Typical EDD measures include:
- Additional identity and ownership evidence, verified from more than one source.
- Establishing the source of funds for the relationship and, for higher-risk individuals, the source of wealth.
- Senior management approval to open or continue the relationship.
- More frequent reviews and closer monitoring of transactions against the expected profile.
What triggers enhanced due diligence?
The triggers are consistent across regimes, even where the legal wording differs:
- Politically exposed persons. FATF Recommendation 12 requires enhanced measures for foreign PEPs, and risk-based measures for domestic PEPs and persons entrusted with prominent functions by international organizations, extending to family members and close associates. See our guide to PEP tiers, RCA and HIO.
- Higher-risk jurisdictions. FATF Recommendation 19 calls for enhanced measures on business relationships and transactions with countries it identifies as higher risk.
- Opaque or complex ownership. Layered structures, nominee arrangements and ownership that cannot be confirmed raise the risk rating and the evidence required.
- Unusual activity or products. Complex or unusually large transactions, correspondent relationships and products that favour anonymity.
- Credible adverse media. Reporting that links a customer to financial crime typically justifies a higher risk rating and a deeper review.
How CDD and EDD work by jurisdiction
| Jurisdiction | CDD | EDD and higher-risk measures |
|---|---|---|
| Canada | Client identification, beneficial ownership, PEP and HIO determinations and ongoing monitoring of business relationships (section 123.1) under the PCMLTF Regulations. | Where a risk is assessed as high, section 157 of the Regulations requires prescribed special measures, including enhanced identity verification and more frequent updating and monitoring. |
| United States | The FinCEN CDD Rule (2016) adds beneficial ownership identification for legal entity customers (31 CFR 1010.230) and risk-based ongoing monitoring to the BSA program. | Risk-based enhanced scrutiny, plus specific due diligence for correspondent and private banking accounts under section 312 of the USA PATRIOT Act. |
| United Kingdom | CDD measures under regulation 28 of the Money Laundering Regulations 2017. | EDD under regulation 33, with specific PEP requirements under regulation 35. |
| European Union | Harmonized CDD rules under the Anti-Money Laundering Regulation (EU) 2024/1624, applying from 10 July 2027. | The same regulation sets EDD for PEPs, high-risk third countries and other higher-risk situations. |
One recent US change is worth noting. In February 2026, FinCEN issued an exceptive relief order (FIN-2026-R001) that lets covered institutions limit beneficial ownership identification to the first account opening, cases where facts cast doubt on existing information, and situations where risk-based ongoing due diligence calls for it, rather than collecting it again at every new account. The relief is optional, and it does not change the expectation that ownership information stays current for higher-risk customers.
Where screening fits in CDD and EDD
Screening is the point where CDD either clears a customer or routes it to EDD. Each kind of screening plays a different role:
- Sanctions screening is a prohibition check, not a risk input. A confirmed match on the customer or a beneficial owner usually means the relationship cannot proceed, and ownership structures have to be resolved against tests such as OFAC's 50 Percent Rule.
- PEP screening identifies the customers who require enhanced measures by law. Tiered PEP data separates a head of state from a municipal official, so EDD effort goes where the exposure is material.
- Adverse media screening informs the risk rating and the depth of EDD, with each finding sourced so the reviewer can judge credibility.
- Entity and beneficial ownership screening screens the owners and controllers behind a business, which is where much of the hidden exposure in corporate onboarding sits.
- Ongoing monitoring re-screens the book as lists, PEP status and media change, which is how a customer moves into EDD mid-relationship.
The operational problem is noise. When name-only matching produces large volumes of false positives, analysts spend their time clearing homonyms and the customers who genuinely need EDD wait in the same queue. Entity resolution, tiered data and a recorded rationale for each decision are what make the CDD to EDD handoff work at scale. Our AML risk assessment guide covers how to set the risk factors that drive it.
FAQ
What is the difference between CDD and EDD?
Customer due diligence (CDD) is the baseline applied to every customer: identify and verify the customer and its beneficial owners, understand the purpose of the relationship and monitor it over time. Enhanced due diligence (EDD) adds further measures when the risk is higher, such as source of funds and source of wealth checks, senior management approval and more frequent review.
When is enhanced due diligence required?
EDD is required when the risk is higher, most commonly for politically exposed persons, customers connected to higher-risk jurisdictions, complex or opaque ownership structures, unusual transactions and correspondent relationships. In Canada, section 157 of the PCMLTF Regulations requires prescribed special measures wherever a reporting entity assesses a risk as high.
Is PEP screening part of CDD or EDD?
Both. PEP screening runs as part of CDD on every customer, and a confirmed PEP match is what triggers the enhanced measures. The firm's risk assessment then sets how deep the EDD goes, typically depending on the PEP's tier and the customer's relationship to the public function.
Does sanctions screening belong in CDD?
Yes. Sanctions screening is performed at onboarding as part of CDD and repeated as lists change, but it works differently from other risk inputs. A confirmed sanctions match is usually a prohibition rather than a reason for enhanced review, so the relationship or payment is stopped and, where required, reported to the relevant authority.
See how screening routes customers between CDD and EDD.
Book a demo and we will screen a sample of your customers against sanctions, PEP and adverse media data, and show how each result arrives with the evidence a reviewer needs.
Book a demo