Enhanced Due Diligence (EDD): Triggers and Checks

Enhanced due diligence (EDD) is the deeper level of customer checks that regulated firms apply to high-risk customers. It goes beyond standard CDD by confirming source of funds and source of wealth, getting senior management approval, gathering more information on the customer and their transactions, and monitoring the relationship more closely.

What Enhanced Due Diligence Is

In essence, EDD is a risk response, not a separate process. When a customer’s risk score crosses a set line, the firm keeps every standard CDD step and adds more. Specifically, the aim is to understand the customer well enough that any unusual activity stands out at once.

FATF does not publish one fixed EDD checklist. Instead, it gives examples of higher-risk factors and of measures firms can use, and it expects each firm to scale its effort to the risk in front of it. For the basics of the standard checks underneath, start with our eKYC basics guide.

EDD vs CDD

The table shows what changes when a file moves from standard CDD to EDD.

Area	Standard CDD	Enhanced due diligence
Who gets it	Most customers	High-risk customers only
Identity	Verify with an ID document and face check	Same, often with extra documents or sources
Money	Expected use of the account	Proven source of funds and source of wealth
Approval	Front-line or automated	Senior manager signs off
Monitoring	Standard alert rules	Tighter thresholds, more frequent reviews
Review cycle	Every few years or on trigger	Often yearly, plus on any trigger

What Triggers EDD

In general, triggers come from FATF’s Recommendations and from each firm’s own risk assessment. Most of them fall into four groups.

• Politically exposed persons. Under FATF Recommendation 12, foreign PEPs always need EDD. Domestic PEPs and their relatives or close associates need it when the firm assesses their risk as high.
• High-risk countries. FATF Recommendation 19 calls for EDD on business with countries on its list for action. Likewise, the EU maintains a separate register of countries it flags for weak controls.
• Complex or opaque structures. For example, layered holding companies, nominee shareholders, or trusts with no clear reason for the setup.
• Risky products and behavior. Private banking, correspondent banking, large cash flows, or transactions with no clear economic purpose.

Besides these, a firm can also set its own triggers. Many add sectors such as gambling or arms trading, or any customer who has drawn a suspicious transaction report in the past.

EDD Measures, Step by Step

Usually, an EDD review runs these measures in order. Then each one leaves evidence in the file.

1. Confirm the trigger. Record why the customer is high risk, for instance a confirmed PEP match or a link to a listed country.
2. Re-verify identity. Check the person is who they claim, by comparing a new selfie with the ID photo and running a liveness check when the review happens remotely.
3. Trace beneficial owners. For companies, identify every natural person behind the structure then verify and screen every one.
4. Establish source of funds and source of wealth. Collect and test evidence for both, as the next section explains.
5. Review public information. Search reputable news and public records for links to crime or corruption.
6. Get senior approval. A senior manager then reviews the file and gives written approval to proceed.
7. Set enhanced monitoring. Lower alert thresholds, add manual reviews, and schedule the next full review.

Meanwhile, screening sits behind steps one and seven. Verihubs watchlist screening returns each result with a profile type, such as PEP, lower-risk PEP, relative or close associate, or sanctions, and an attached risk rating. So the file gets a clear, recorded reason for the EDD decision. Afterward, Monitor flags profile changes on existing customers, so a new public role or a fresh listing can reopen the review.

EDD by Sector

The core measures stay the same, yet each sector adds its own focus. The table shows typical emphasis.

Sector	Common EDD trigger	Extra focus
Private and retail banking	PEPs, high-net-worth clients, cash-heavy businesses	Source of wealth, account purpose, expected volumes
Correspondent banking	Respondent banks in higher-risk countries	The respondent’s own AML controls and supervision
Crypto platforms	Large deposits, links to risky wallets or mixers	Wallet history and fiat on-ramp sources
Insurance	Large single premiums, early surrender requests	Who pays the premium and why
Real estate and luxury goods	Cash or third-party payments, foreign buyers	Buyer identity, funding route, beneficial owners

So a policy written for one sector rarely fits another without changes. Firms that serve several sectors usually keep a shared core and add sector annexes.

Source of Funds and Source of Wealth in EDD

These two checks sit at the heart of EDD, yet firms often mix them up. Source of funds is about a specific amount of money, while source of wealth is about how the person built their total assets.

Check	Question it answers	Typical evidence
Source of funds	Where did the money for this deposit or transaction come from?	Bank statements, sale contracts, payslips, loan agreements
Source of wealth	How did this person accumulate everything they own?	Tax returns, company accounts, inheritance records, property deeds

Equally, the evidence must fit the profile. A junior civil servant with a large property portfolio, for example, needs a convincing explanation, such as an inheritance with documents to prove it. Where the story and the evidence do not match, the firm should escalate rather than approve.

EDD in Practice: A Worked Example

Consider a customer who applies online for a premium account and plans to deposit a large sum from abroad. Screening then returns a match to a deputy minister in a neighboring country, and the similarity score is high. So the analyst confirms the match using date of birth and nationality, which makes the customer a foreign PEP and triggers EDD at once.

Next, the analyst asks for evidence. The customer explains that the deposit comes from the sale of a family property, and provides the sale contract and a bank statement showing the proceeds. For source of wealth, the customer supplies tax returns covering their salary and earlier business income. A public records search finds no corruption allegations, although it confirms the property sale. Because the story and the documents line up, the analyst writes a short assessment, and the head of compliance approves the account with yearly reviews and lower alert thresholds.

Now change one detail. Suppose the sale contract names a company the customer never mentioned, registered in a secrecy jurisdiction. In that case, the analyst must trace the company’s owners before any approval, and if the customer will not explain, the file moves toward an exit and a possible report.

Common EDD Mistakes

• Collecting documents without testing them. A payslip proves little if no one checks that it fits the claimed wealth.
• Approving by habit. Senior sign-off loses its value when managers approve files they have not read.
• Treating EDD as a one-off. High-risk customers need fresh reviews, not just a strong onboarding file.
• Ignoring relatives and associates. A PEP’s spouse or business partner often carries the same risk.

What to Automate in EDD, and What to Keep Human

EDD is the least automatable part of due diligence, yet technology still removes much of the busywork. The split usually looks like this.

• Automate: trigger detection from screening results, fresh selfie checks against the ID with a liveness test, public records searches, reminders for periodic reviews, and file assembly.
• Keep human: judging whether the money story makes sense, weighing conflicting evidence, deciding to approve or exit, and writing the reasoning.

In practice, automation lets analysts spend their time on judgment rather than on gathering documents. That matters, because examiners criticize EDD files where the analysis is thin, not just files where evidence is missing.

Documenting EDD for Auditors

After all, an EDD decision is only as good as its file. Auditors and examiners look for a clear chain from trigger to decision, so use this checklist on every case.

• The trigger, with the date and the screening or risk result behind it.
• Verified identity for the customer and every beneficial owner.
• Source of funds and source of wealth, with copies of evidence and the analyst’s assessment.
• Results of the public information review, including the sources and search terms.
• Senior manager approval, with name, date, and reasoning.
• The monitoring plan and the date of the next review.
• Any open questions, and how the firm resolved them.

Later, periodic reviews follow the same pattern. Because high-risk accounts attract takeover attempts too, a fresh selfie verification at review time also confirms that the original customer still controls the account, which helps against account takeover.

When a Firm Cannot Complete EDD

Sometimes the customer will not explain their money, or the evidence does not hold up. In that case, the firm should decline to onboard, or it should exit the relationship. It should also consider a suspicious transaction report, since a refusal to explain wealth is itself a warning sign.

Still, EDD is not a polite way to refuse business. FATF warns against de-risking whole groups of customers, so the decision should rest on the facts of each case.

Frequently Asked Questions

What is enhanced due diligence?

Enhanced due diligence is the higher level of customer checks for high-risk customers. It adds source of funds and wealth checks, senior approval, extra information gathering, and closer monitoring on top of standard CDD.

When do firms need EDD?

EDD covers the high-risk end of the customer base, such as foreign PEPs, customers linked to high-risk countries, complex ownership structures, and risky products such as private or correspondent banking.

What is the difference between CDD and EDD?

CDD, by contrast, covers the standard checks for most customers. EDD keeps every CDD step and adds deeper checks on money, approval, and monitoring for high-risk cases.

How often should firms review EDD customers?

Many firms review EDD customers at least once a year, and again whenever a trigger occurs, such as a new screening hit or unusual activity.

What are examples of EDD measures?

Common measures include senior management approval, source of funds and source of wealth checks, extra information on the customer and their business, public records and news searches, and more frequent monitoring and reviews.

Who approves enhanced due diligence?

A senior manager, often from compliance or the business line with authority to accept risk, gives written approval before the bank onboards or retains the customer.

Is source of wealth the same as source of funds?

No. Source of funds covers the origin of a specific amount, while source of wealth covers how the customer built their total assets.

Good EDD Leaves a File That Explains Itself

Enhanced due diligence works when the trigger is clear, the firm re-verifies identity, evidence backs the money story, a senior manager owns the decision, and monitoring keeps watching. Each of those steps should leave a record that an auditor can follow without asking questions. So the real test of an EDD program is simple: could someone outside the team read the file and reach the same decision?

Need PEP and sanctions results that clearly flag when EDD applies? Request a walkthrough of Verihubs screening for your compliance team.