Customer Due Diligence (CDD): Steps, Levels, Checks
Customer due diligence (CDD) is the process a regulated firm uses to identify a customer, verify that identity, find out who owns or controls them, understand what the relationship is for, and keep watching it over time. FATF Recommendation 10 sets these duties, and firms scale them up or down by risk into simplified, standard, and enhanced levels.
What Customer Due Diligence Is
CDD is the core of anti-money laundering checks on customers. It answers three questions: who is this person or company, who really stands behind them, and does their activity make sense. So a firm that skips CDD cannot spot laundering, because it has no baseline to compare against.
CDD starts at onboarding but does not stop there. Firms must also review the relationship as it goes on, which is why regulators treat it as a lifecycle duty, not a one-time form. For the wider picture of customer checks, see our KYC basics guide.
CDD vs KYC vs EDD
People often use these terms as if they meant the same thing. In fact, they sit at different levels of the same framework.
| Term | Scope | Applies to |
|---|---|---|
| KYC (know your customer) | The broad practice of knowing who your customers are | All customers; often used as an umbrella term |
| CIP (customer identification program) | US rule for collecting and verifying basic identity data | All new US bank customers |
| CDD (customer due diligence) | Identity, beneficial owners, purpose, risk rating, ongoing review | All customers, at a level set by risk |
| EDD (enhanced due diligence) | Extra checks such as source of wealth and senior approval | High-risk customers only |
Put simply, KYC is the goal, CDD is the standard method, and EDD is the deeper version for higher risk. In the US, CIP covers the first identity step, while the CDD Rule adds beneficial owners and ongoing monitoring.
When Firms Must Run CDD: FATF Recommendation 10 Triggers
FATF lists four situations that require a firm to carry out CDD.
- Opening a business relationship. For example, a new account, loan, or wallet.
- Occasional transactions above a threshold. FATF sets USD or EUR 15,000 for one-off transactions, with lower limits for wire transfers.
- A suspected link to laundering or terror funding. This applies regardless of any amount or exemption.
- Doubts about earlier data. When the firm questions whether identity data it already holds is true or complete.
The third trigger matters most in practice. Even a low-risk customer who would normally pass with light checks must go through full CDD once suspicion arises.
The Four Core CDD Measures
FATF breaks CDD into four measures. The steps differ slightly for people and for companies, as the table shows.
| Measure | Individual customer | Company customer |
|---|---|---|
| 1. Identify and verify | Full name, birth date, home address, and ID number, checked against an ID document and a live face | Legal name, registration number, registered address, plus proof the company exists |
| 2. Beneficial owners | Check whether someone else controls the account | Identify each natural person who owns or controls the company, then verify them |
| 3. Purpose and nature | Expected use, income source, likely volumes | Business model, expected flows, counterparties |
| 4. Ongoing due diligence | Monitor activity and refresh data | Monitor activity, refresh ownership, re-screen |
Each measure also maps to a concrete control. Identification relies on reading the ID, for instance with OCR. Verification relies on matching the document photo to a selfie and confirming the selfie comes from a live person. Risk rating then draws on sanctions and PEP list checks, while ongoing due diligence relies on monitoring and re-screening.
CDD Levels: Simplified, Standard, Enhanced
Because FATF follows a risk-based approach, not every customer gets the same depth of checks. Most firms run three levels.
- Simplified due diligence. For proven low-risk cases, such as a basic account with low limits. Firms may verify identity later or collect less data, but they never skip CDD entirely.
- Standard due diligence. The default for most customers, covering all four measures.
- Enhanced due diligence. Reserved for high-risk cases, for example foreign politically exposed persons or links to high-risk countries. It adds source of wealth checks, senior approval, and closer monitoring.
The level should come from a documented risk score, not from convenience. Regulators often criticize firms that place customers in the simplified tier just to speed up onboarding.
Beneficial Owners in CDD
When the customer is a company, CDD must reach the people behind it. A beneficial owner is the natural person at the top of the ownership or control chain, directly or through layers of other companies.
The US CDD Rule, for instance, requires banks to identify every person who owns 25% or more of a legal entity customer, plus one person with significant control, such as the CEO. Other regimes use similar tests. Once the firm finds these people, it verifies and screens each of them like any individual customer. For Indonesian businesses, Verihubs KYB checks confirm company registration data, and that coverage is limited to Indonesian entities.
Running CDD Remotely: Identity Proofing, Liveness, and Deepfakes
Most CDD now happens on a phone, without any branch visit. That speeds up onboarding, yet it also opens new attack routes that paper processes never faced.
Fraudsters hold up printed photos or screens, play pre-recorded video, or inject AI-generated faces straight into the camera feed. A document check alone cannot catch these, so remote CDD needs a face match and a liveness detection step, plus deepfake detection for synthetic faces. Verihubs combines OCR, face matching, liveness, and deepfake detection for the identity step. After that, watchlist screening returns sanctions and PEP results with an adjustable similarity threshold, which feeds the risk rating.
CDD in Practice: Two Customers, Two Levels
Two short examples show how the same rules lead to very different workloads.
Customer A is a salaried employee opening a basic savings account in their home country. The firm reads their ID with OCR, compares their selfie with the photo on the card, and runs a liveness check. Screening returns no sanctions or PEP hits. The stated purpose, receiving a salary and paying bills, fits their profile, so the risk score lands at low or standard. Onboarding takes a few minutes, and the next full review comes years later unless something changes.
Customer B is a company registered abroad that wants a business account for cross-border payments. Its ownership runs through two holding companies, and one shareholder turns out to be a former minister’s spouse. Here, the firm must trace each layer to the natural persons behind it, verify and screen each of them, and record why the structure exists. Because a relative of a politically exposed person sits in the chain, the case moves to enhanced due diligence, with source of wealth checks and senior approval before the account opens. After approval, reviews happen at least yearly.
The lesson is that CDD is not one process but a range. Firms that design for both ends, quick for Customer A and thorough for Customer B, avoid both slow onboarding and missed risk.
Ongoing CDD and Record-Keeping
Ongoing CDD means checking that a customer’s activity still matches what the firm knows about them. It has two parts.
- Monitoring activity. Comparing transactions against the expected profile and investigating anything that breaks from it.
- Refreshing data. Updating identity, ownership, and risk details on a schedule, with high-risk customers reviewed more often, for example yearly.
Re-screening belongs here too. Lists change daily, so a customer who passed screening at signup can later turn into a sanctions target or take a public role. Verihubs Monitor flags such profile changes after onboarding. Meanwhile, FATF Recommendation 11 requires firms to keep CDD records for a minimum of five years once the relationship ends.
What to Do When a Firm Cannot Complete CDD
Sometimes a customer cannot or will not provide what CDD requires. FATF’s answer is clear: the firm should not open the account or carry out the transaction, and it should end an existing relationship. It should also consider filing a suspicious transaction report.
That rule protects the firm from becoming a channel for laundering, however legitimate the customer may seem. Still, a refusal should follow a set process, so staff record the reason and decide on reporting the same way every time.
CDD Documentation Checklist
In the end, examiners judge CDD by the file. So each customer record should hold the following.
- Identity data and the method used to verify it, with the date.
- For companies, the registration record and the names of every beneficial owner, with how each was verified.
- The stated purpose of the relationship and expected activity.
- Screening results and how the team resolved any hits.
- The risk score, the level of due diligence applied, and the reason.
- The date of the next scheduled review.
Together, these six items let anyone outside the team see why the firm accepted the customer.
Common CDD Failures
- Risk scores that never change. Customers keep their onboarding score for years, even after their activity shifts.
- Missing beneficial owners. Company files list directors but not the people who actually own or control the business.
- Weak remote identity checks. Document photos accepted without a live face check, which invites impersonation and deepfakes.
- Screening only at signup. Customers never re-checked after lists change.
- Purpose left blank. Without an expected activity profile, monitoring has nothing to compare against.
In fact, most of these failures appear in enforcement findings again and again. So fixing them first gives the biggest gain for the effort.
Frequently Asked Questions
What is customer due diligence?
Customer due diligence is the process of identifying and verifying a customer, finding their beneficial owners, understanding why the relationship exists, and monitoring it over time. FATF Recommendation 10 sets the standard.
What is the difference between CIP and CDD?
CIP is the US rule for collecting and verifying basic identity data such as full name, birth date, home address, and ID number. CDD is broader, adding beneficial owners, purpose of the relationship, risk rating, and ongoing monitoring.
Is CDD the same as KYC?
Not exactly. KYC is the broad practice of knowing your customers, while CDD is the specific set of checks that regulations require to achieve it.
How often should firms refresh CDD?
It depends on risk. Many firms review high-risk customers every year and lower-risk ones every few years, plus whenever a trigger event occurs, such as a change in ownership or unusual activity.
What documents are needed for CDD?
For individuals, firms usually need an ID document and a way to confirm the person matches it, such as a selfie with liveness. For companies, they also need registration documents, ownership records, and IDs for each beneficial owner.
Who is responsible for performing CDD?
The regulated firm itself. It can use technology providers or, in some cases, rely on another regulated firm. Even so, it stays responsible for the result.
What are the three levels of CDD?
The three levels are simplified, standard, and enhanced due diligence. Firms choose the level from each customer’s risk score.
CDD Is How a Firm Earns the Right to Say It Knows Its Customer
Customer due diligence turns a name on a form into a verified person, a known owner, a clear purpose, and a risk score that guides every later check. When identity proofing resists deepfakes, screening runs at onboarding and after, and reviews follow the risk, CDD stops being paperwork and starts catching real threats. So the measure of a CDD process is not how fast it approves customers, but how reliably it stops the wrong ones.
Building remote CDD with liveness and watchlist checks? Talk with our onboarding specialists about your requirements.
