What Is Enhanced Due Diligence? EDD Rules in the Philippines
Enhanced due diligence is the heightened level of scrutiny applied to customers assessed as high risk for money laundering or terrorism financing.
Under the Revised IRR of RA 9160, EDD requires at minimum three things: senior management approval to establish or continue the relationship, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring.
A recent change matters operationally. BSP Circular No. 1230, issued 27 February 2026, raised the cash withdrawal threshold triggering EDD from PHP 500,000 to PHP 1 million.
What Is Enhanced Due Diligence (EDD)?
EDD is the deepest of the three due diligence tiers in Philippine AML regulation. The 2018 IRR of RA 9160 defines it as the enhanced level of scrutiny intended to provide a more comprehensive understanding of a customer, and Section 10 of that IRR sets out its requirements.
What separates EDD from ordinary diligence is not effort but scope. Average due diligence answers who a customer is. EDD answers where their money comes from, why the relationship makes commercial sense, and whether the institution is prepared to accept the risk at senior level.
A point of terminology worth fixing early, because global guidance gets this wrong for the Philippine market. The tiers here are Reduced, Average, and Enhanced Due Diligence, not simplified, standard, and enhanced. Our guide to customer due diligence covers how the three relate and why Average applies by default.
EDD vs Average Due Diligence: What Changes
| Average Due Diligence (ADD) | Enhanced Due Diligence (EDD) | |
|---|---|---|
| Applies to | All customers by default | Customers assessed as high risk |
| Identification | Minimum required information and documents | Additional information and documents beyond that minimum |
| Source of wealth and funds | Not routinely established | Reasonable measures required |
| Approval to onboard | Ordinary business process | Senior management approval required |
| Monitoring | Ongoing monitoring | Enhanced ongoing monitoring |
| Reliance on third parties | Possible within limits | Covered person must conduct its own separate EDD |
The last row is the one institutions most often get wrong. Where a customer has been assessed as high risk by a third party, the Manual of Regulations requires the covered person to conduct its own separate EDD procedure. Inheriting someone else’s assessment does not discharge the obligation.
What Triggers EDD in the Philippines
Two categories of trigger operate. Some are set by regulation, others by the institution’s own customer acceptance policy and risk profiling.
Regulatory triggers include foreign politically exposed persons, correspondent banking relationships, and cash withdrawals above the threshold in BSP Circular 1230. Under the Manual of Regulations, EDD also applies wherever the risks of ML or TF are higher, which functions as an open-ended trigger rather than a closed list.
Risk-profiling triggers come from the institution’s own assessment: customer type, product, delivery channel, and geography. A customer rated high through documented risk profiling moves to EDD regardless of whether any named regulatory trigger applies.
One trigger sits outside onboarding entirely. The 2018 IRR treats EDD after the ongoing monitoring process as its own requirement, meaning a customer onboarded at average diligence must move to EDD if monitoring later surfaces higher risk. EDD is not only an onboarding gate.
PEPs, Non-Residents, and High-Risk Sectors
According to BSP Memorandum No. M-2023-029, foreign PEPs require the application of EDD measures equivalent to those posing higher risk. The same memorandum reminds BSFIs to apply appropriate CDD measures to customers considered PEPs under Sections 923 and 923-Q of the Manual of Regulations.
Coverage extends beyond the individual. Under the Revised IRR, the requirements for all types of PEPs also apply to family members and close associates. A customer who is not a PEP themselves can still trigger EDD through a relationship.
Beneficial owners are covered too. AMLC guidance requires covered persons to include in their risk management system a process to determine whether a beneficial owner is a PEP, and where one is, to obtain senior management approval before establishing or continuing the relationship, conduct enhanced ongoing monitoring, and reassess the risk profile of both the customer and the beneficial owner.
Other commonly high-risk categories include non-residents, cash-intensive businesses, customers with complex or opaque ownership structures, and customers connected to higher-risk jurisdictions. Our guide to politically exposed persons covers PEP identification and screening in detail.
The Three Minimum EDD Measures
The Revised IRR of RA 9160 sets a floor. Where EDD applies, the covered person must at minimum observe three measures.
Senior Management Approval
Approval must be obtained for establishing the relationship, or for continuing it in the case of existing customers. The second half matters: a customer who becomes high risk after onboarding requires approval to remain, not merely closer watching.
Source of Wealth & Source of Funds
Reasonable measures must be taken to establish both. These are different questions. Source of funds asks where the money in this transaction came from. Source of wealth asks how the customer accumulated their assets overall.
Enhanced Ongoing Monitoring
The relationship is monitored more closely and more often than an average-risk one.
On top of these three, the Manual of Regulations requires gathering additional customer information and identification documents beyond the minimum required for average due diligence, in addition to profiling and transaction monitoring.
Source of Funds and Source of Wealth
This is where EDD most often stalls in practice, because it depends on the customer producing evidence rather than on the institution running a check.
“Reasonable measures” is deliberately proportionate language. It does not require forensic tracing of every peso. It does require a documented basis for believing the explanation, which means the file should show what was asked, what was provided, and why it was accepted.
Our guide to source of funds under BSP CDD rules covers acceptable documentation and how to handle customers who cannot readily evidence their income.
BSP Circular 1230: The Cash Withdrawal Threshold Doubled
This is the most recent change to Philippine EDD practice, and any compliance manual written before March 2026 has the wrong number in it.
BSP Circular No. 1230, titled Risk-based Recalibration of Enhanced Due Diligence Threshold for Large Value Cash Transactions, was issued on 27 February 2026 under Monetary Board Resolution No. 153. It raised the cash withdrawal threshold triggering EDD from PHP 500,000 to PHP 1 million, amending Circular No. 1218 from September 2025.
According to the Philippine News Agency (March 2026), the BSP said the increase followed consultations with banks and industries showing a large number of legitimate cash transactions above the original threshold, including payroll, loan, and project-based disbursements, and reflected the results of the latest anti-money laundering National Risk Assessment.
Four details carry more operational weight than the headline number:
- Cash only. The threshold applies to large cash withdrawals. Digital and other traceable channels are outside it.
- Per customer, not per transaction. For individuals and businesses with recurring large cash needs, the BSP clarified that EDD is conducted on a per-customer basis rather than per transaction, so regular activity does not face repeated review.
- A floor, not a ceiling. BSFIs retain autonomy to set lower internal thresholds based on their own risk assessments.
- Above the threshold, the customer must evidence legitimacy. The burden of explanation sits with the depositor.
The per-customer clarification is the part worth building around. It converts EDD from a transaction gate into a customer-level status, which changes where the record lives and how monitoring is structured.
When EDD Cannot Be Completed
The framework prescribes the outcome rather than leaving it to judgment.
Where a BSFI fails to complete the EDD procedures, or reasonably believes that performing them would tip off the customer, the BSP requires it to file a suspicious transaction report, closely monitor the account, and review the business relationship.
Read that carefully, because the tipping-off limb catches people out. If asking the source of funds question would itself alert a customer under suspicion, the correct response is not to ask more carefully. It is to file an STR and escalate. An incomplete EDD file is not a neutral outcome to be left open.
Frequently Asked Questions About EDD in the Philippines
What does EDD mean?
- EDD stands for enhanced due diligence: the heightened level of scrutiny applied to customers assessed as high risk for money laundering or terrorism financing. The 2018 IRR of RA 9160 defines it as the enhanced level of scrutiny intended to provide a more comprehensive understanding of the customer.
What are the minimum EDD measures in the Philippines?
- Three, under the Revised IRR of RA 9160: obtain senior management approval for establishing or continuing the relationship, take reasonable measures to establish source of wealth and source of funds, and conduct enhanced ongoing monitoring. The Manual of Regulations adds gathering additional customer information and identification documents beyond the average due diligence minimum.
What is the cash withdrawal threshold that triggers EDD?
- PHP 1 million. BSP Circular No. 1230, issued 27 February 2026, raised it from PHP 500,000, amending Circular No. 1218 of September 2025. The threshold applies to cash withdrawals only, not to digital or other traceable channels, and BSFIs may adopt lower internal thresholds based on their own risk assessments.
Is EDD applied per transaction or per customer?
- For individuals and businesses with recurring large cash transactions, the BSP clarified that EDD is conducted on a per-customer basis rather than per transaction, so routine activity does not trigger repeated reviews.
Do domestic PEPs automatically require EDD?
- BSP Memorandum No. M-2023-029 states that foreign PEPs require EDD measures equivalent to those posing higher risk. For other PEPs the approach is risk-based, and the requirements extend to family members and close associates. Where a beneficial owner is determined to be a PEP, AMLC guidance requires senior management approval, enhanced ongoing monitoring, and reassessment of the risk profile.
What happens if we cannot complete EDD on a customer?
- The BSP requires the institution to file a suspicious transaction report, closely monitor the account, and review the business relationship. The same applies where the institution reasonably believes that performing EDD would tip off the customer.
EDD Is a Documentation Problem Wearing a Verification Costume
Institutions tend to treat EDD as more checking. In practice most of it is evidence gathering and record building: what senior management approved and when, what the customer said about their wealth, what supported that explanation, and what monitoring followed.
Which is why the identification layer underneath matters more than it looks. Every EDD file rests on a customer identity that was established once, at onboarding, and never independently revisited. If that foundation is weak, the source of wealth documentation sits on top of a person who may not be who the file says they are, and senior management approved a risk profile built on an unverified premise.
Verihubs eKYC API establishes that layer for Philippine covered persons, with government ID verification across 15+ document types, PhilSys authentication, biometric liveness, and deepfake detection.
Talk to the Verihubs team about the identity foundation beneath your EDD files.
