How it works

CDD sits between simplified due diligence for low-risk cases and enhanced due diligence for high-risk ones. At onboarding, the institution identifies the customer, verifies identity, identifies beneficial owners of legal entities, and records the expected purpose and activity of the account. After onboarding, it monitors transactions against that profile and updates customer information when risk changes or on a scheduled basis.

Requirements by jurisdiction

• US: FinCEN's 2016 CDD Rule set four core elements: customer identification and verification, beneficial ownership identification and verification, understanding the nature and purpose of the relationship to develop a risk profile, and ongoing monitoring to report suspicious activity and update information. A February 2026 exceptive relief order narrowed when beneficial owners must be re-verified, and FinCEN has said it still intends to revise the CDD Rule.

• EU: AMLR Chapter III sets harmonized CDD measures from 10 July 2027. Occasional transactions of €10,000 or more trigger CDD, with lower thresholds for higher-risk sectors. Customer information must be updated at least annually for higher-risk customers and at least every five years for others.

• UK: The Money Laundering Regulations 2017 (regulations 27 and 28) require CDD when establishing a relationship and for certain occasional transactions. Since 30 June 2026 the thresholds are in sterling, including £12,000 for occasional transactions previously set at €15,000.

Common challenges

Static onboarding data quickly becomes stale. Firms often lack a reliable way to compare actual activity with the expected profile, and periodic reviews create backlogs. The FATF's 2025 revisions to Recommendation 1 require countries to allow and encourage simplified measures for lower-risk cases, which means firms should be able to justify differentiation rather than applying one standard to everyone.

How teams handle it in practice

Most teams segment customers by risk, apply proportionate CDD to each tier, and use event-driven triggers (ownership changes, unusual activity, adverse media) alongside scheduled refreshes. Expected-activity data captured at onboarding feeds monitoring rules directly. Compliance platforms like Corsa can link CDD data to monitoring so that profile changes adjust risk scores automatically.