KYC, CDD and EDD are three terms that compliance teams use every day, yet many firms treat them as interchangeable. In practice, KYC vs CDD vs EDD represents three distinct layers of customer verification, each with its own scope, depth and regulatory trigger. Getting the boundaries wrong leads to under-diligence on high-risk clients or wasted effort on low-risk ones.
KYC is the umbrella: the policies, procedures and controls a firm uses to verify a customer’s identity and assess risk. CDD is the baseline due diligence process, while EDD applies additional scrutiny where required by regulation or justified by the customer’s risk profile. Examples include certain PEP relationships, complex ownership structures and customers connected to high-risk jurisdictions. Below, we explain the practical differences under FATF standards and the national laws and regulations that implement them, with clear triggers and a checklist your team can use.
| Aspect | CDD (standard due diligence) | EDD (enhanced due diligence) |
|---|---|---|
| Scope | All customers at onboarding and periodically thereafter | High-risk customers only, triggered by specific risk factors |
| Trigger | Establishing a business relationship, covered occasional transactions, suspicion of money laundering or terrorist financing, or doubts about existing customer identification data | Specific regulatory requirements or risk factors warranting enhanced measures, such as relevant PEP relationships, high-risk jurisdiction exposure, complex ownership or adverse information, depending on the applicable framework and risk assessment |
| Depth of verification | Identity documents, address proof, beneficial ownership to the threshold set by local law | Source of funds, source of wealth, independent verification, senior management approval |
| Typical evidence | Government-issued ID, proof of address, tax identification number, corporate registry extracts, beneficial ownership records, and risk-based screening where appropriate | Additional source-of-funds and source-of-wealth evidence; deeper adverse-media and OSINT searches; independent corroboration of customer information; further verification of complex ownership structures |
| Review frequency | Risk-based: frequency depends on local regulatory requirements, customer risk and material changes. Some firms use annual reviews for high-risk customers and less frequent reviews for lower-risk customers. | More frequent reviews triggered by risk events, transaction anomalies or regulatory updates |
What KYC, CDD and EDD actually mean
KYC (Know Your Customer) is the overarching framework: the policies, procedures and controls a firm uses to verify who its customers are and what risks they bring. FATF Recommendation 10 sets the global baseline: identify and verify the customer, identify the beneficial owner, understand the purpose of the relationship and conduct ongoing monitoring.
CDD (Customer Due Diligence) is the standard process within that framework. Specifically, it involves identifying and verifying the customer using the methods required by the applicable regime. It also requires assessing risk factors such as geography, products and transaction patterns, determining PEP status and, for legal entities, tracing beneficial ownership to individual level.
For clarity, this article uses KYC to describe the broader customer verification and risk-management framework, and CDD to describe the specific due diligence measures applied to customers. Regulatory terminology may differ, and some frameworks use KYC and CDD interchangeably.
EDD (Enhanced Due Diligence) applies when a customer’s risk profile exceeds the standard threshold. While CDD asks “who is this customer?”, EDD asks “where does their money come from?” Depending on the applicable requirements and circumstances, EDD measures may include establishing and verifying source of funds and source of wealth. In addition, firms may need to obtain senior management approval, independently corroborate customer information and apply enhanced ongoing monitoring. The measures required differ by jurisdiction, customer category and risk scenario.
How CDD works in practice
FATF standards call for customer due diligence when establishing a business relationship and when carrying out occasional transactions covered by the applicable requirements. CDD is also required when there is suspicion of money laundering or terrorist financing, or when there are doubts about the veracity or adequacy of previously obtained customer identification data. The precise triggers and thresholds therefore depend on the applicable national framework and the type of reporting entity.
Customer identification and verification
Each reporting entity must identify and verify customers according to the requirements applicable to its entity type and jurisdiction. Depending on the customer type and applicable requirements, verification may involve government-issued identity documents, proof of address, tax identification details and information about the purpose of the relationship. For legal entities, firms may need incorporation documents, ownership information down to the beneficial owner level, and details of the entity’s nature of business, as required by the applicable framework.
Beneficial ownership
FATF Recommendation 10 requires firms to identify the beneficial owner and take reasonable measures to verify that person’s identity. Some jurisdictions use specified ownership thresholds, which vary by regime and entity type. An ownership threshold is only one part of the assessment: firms must also consider control through other means and the applicable beneficial ownership definition. Where no natural person meets the ownership threshold, the firm must identify the individual who exercises control through other means. Where no natural person can be identified after applying the relevant ownership and control tests and taking reasonable measures, the applicable framework may require the identity of the senior managing official to be recorded as a fallback. However, this does not mean that the senior managing official is necessarily the beneficial owner. Compliance teams should review the specific threshold and control definitions in their applicable regulatory framework.
Ongoing monitoring and review cycles
CDD does not end at onboarding. Firms must also conduct ongoing monitoring of the business relationship, including scrutiny of transactions to confirm they are consistent with the customer’s profile. Furthermore, most regulators require periodic KYC reviews at risk-based intervals. FATF standards require ongoing monitoring and up-to-date CDD, while countries establish their own applicable requirements. As an illustrative practice, some firms set annual reviews for high-risk customers and less frequent reviews for medium-risk and low-risk customers, but the specific intervals depend on the applicable regime. Event-driven reviews, triggered by changes such as ownership restructuring, change of domicile or suspicious activity, supplement these cycles.
Transaction reporting
Reporting thresholds and obligations are separate from CDD. Some jurisdictions require reports of specified cash transactions or other transactions that meet prescribed criteria. Cross-border wire transfers may be subject to separate reporting, recordkeeping or information-sharing requirements, depending on the applicable regime. Suspicious transaction reports (STRs) generally have no minimum monetary threshold, but the applicable filing trigger, deadline and aggregation rules depend on local law. Firms should distinguish mandatory regulatory reporting from transaction monitoring and recordkeeping obligations.
How EDD builds on CDD
EDD obligations arise when a customer, transaction or relationship presents risk factors that standard CDD cannot adequately address. While CDD establishes identity and baseline risk, EDD adds depth: verifying source of funds and source of wealth, tracing ultimate beneficial owners through complex structures, obtaining senior management approval and applying enhanced ongoing monitoring.
The measures required are proportionate to the risk and vary by jurisdiction, customer category and risk scenario. Accordingly, compliance teams must calibrate their EDD procedures to both the regulatory requirements of their home jurisdiction and the specific risk profile of each customer. FATF Recommendation 11 sets a standard of retaining transaction records for at least five years after completion of the transaction. Similarly, CDD records, account files and business correspondence must be retained for at least five years after the end of the business relationship or after the occasional transaction, as applicable. National laws may prescribe additional requirements or different retention periods and starting points.
Common EDD triggers compliance teams must recognise
Although specific thresholds differ, regulators across jurisdictions share a core set of EDD triggers.
Politically exposed persons
FATF Recommendation 12 requires additional AML/CFT measures for foreign PEPs, their family members and close associates. Firms must also take reasonable measures to determine whether customers or beneficial owners are domestic PEPs or persons entrusted with prominent functions by international organisations. For higher-risk relationships involving these latter categories, the FATF standards require specified additional measures, including senior management approval, establishing source of wealth and source of funds, and enhanced ongoing monitoring. The precise implementation requirements depend on the applicable national framework. For a deeper look, see our sanctions and PEP screening guide.
High-risk jurisdictions
Connections to jurisdictions identified by FATF as under increased monitoring or subject to a call for action are important geographic risk factors. The appropriate response depends on the relevant FATF statement, applicable national requirements and the customer’s overall risk profile. Connections may include the customer’s country of residence, the origin or destination of funds, counterparties and the jurisdiction of incorporation. Compliance teams should distinguish jurisdictions under increased monitoring from those subject to a call for action and apply any required enhanced measures or countermeasures under the applicable framework.
Inclusion on the FATF list of jurisdictions under increased monitoring does not, by itself, require enhanced due diligence under the FATF standards; firms should consider the information in their risk assessment. For jurisdictions subject to a FATF call for action, FATF calls on its members and urges all jurisdictions to apply enhanced due diligence. In the most serious cases, FATF calls for countermeasures. Firms should follow the relevant FATF statement and applicable national requirements.
Complex ownership and virtual assets
Multi-layered corporate structures with nominee shareholders or bearer shares require enhanced beneficial ownership tracing. For virtual asset service providers (VASPs), FATF Recommendation 15 addresses the regulation and supervision of virtual asset activities. In jurisdictions that have implemented the Travel Rule, firms must collect relevant originator and beneficiary information on covered virtual asset transfers and apply risk-based controls. Transactions involving unhosted wallets, anonymity-enhancing tokens or mixing services may increase risk and should be assessed using a risk-based approach; applicable restrictions and obligations vary by jurisdiction. For more on VASP compliance, see our guides for VASP compliance.
Unusual transaction patterns
Structuring (breaking transactions into smaller amounts to avoid reporting thresholds), rapid fund movement with no apparent economic purpose and transactions inconsistent with the customer’s profile are risk indicators. As a result, they warrant appropriate investigation and escalation. Depending on the circumstances and the customer’s overall risk profile, they may justify enhanced due diligence. They may also give rise to a suspicious transaction reporting obligation.
Typical audit findings on CDD and EDD
In practice, regulatory examinations and independent audits reveal consistent weaknesses across jurisdictions.
Risk assessments that do not match the business. For example, the OCC’s October 2026 enforcement action against a large financial services corporation highlighted this issue. The bank’s assessment emphasised deposit products while overlooking its card businesses. Auditors regularly find generic templates rather than calibrated reflections of actual customer bases.
Incomplete beneficial ownership records. Firms collect the ownership declaration at onboarding but fail to update it when ownership changes.
EDD applied inconsistently. Some high-risk customers receive full EDD while similar profiles receive standard CDD, typically because decisions depend on individual judgment rather than documented policy.
Source of funds accepted without evidence. Compliance teams treat self-declared statements as sufficient even for high-risk customers. In contrast, EDD measures should include documentary verification such as bank statements, audited financials or tax filings where the applicable regime requires it.
Periodic reviews overdue. Consequently, high-risk customers miss the required review cycle, often because firms rely on manual spreadsheets.
For a practical example, see our EDD and third-party risk assessment case study.
A quick CDD and EDD compliance checklist
Use this checklist to assess whether your KYC program covers the essentials.
CDD fundamentals:
- The firm identifies and verifies customer identity using the methods and within the timelines prescribed by the applicable regulatory framework.
- The firm traces beneficial ownership to the individual level, applying the threshold and control tests prescribed by the applicable regime.
- A documented risk assessment assigns each customer a rating based on geography, products, transaction behaviour and industry.
- The firm maintains active ongoing monitoring, with thresholds calibrated to risk level.
- The compliance team schedules and tracks periodic KYC reviews against deadlines.
EDD requirements:
- The firm documents mandatory EDD triggers and risk-based escalation criteria in its policies, including relevant PEP relationships, geographic exposure, complex ownership, adverse information and suspicious activity.
- Where the applicable regime requires it, the team verifies source of funds and source of wealth with documentary evidence rather than self-declaration.
- The firm obtains and records senior management approval for foreign PEP relationships and for other PEP relationships or cases where required by the applicable regulatory framework, including higher-risk domestic PEP and international-organisation PEP relationships.
- Enhanced monitoring applies lower thresholds and faster escalation.
- The compliance team documents all EDD decisions in an audit trail.
Governance:
- Policies define the boundary between CDD and EDD with specific escalation criteria.
- Staff training covers CDD procedures and EDD triggers.
- The firm retains records in accordance with the applicable legal requirements. FATF Recommendation 11 sets a standard of at least five years for transaction records and CDD records; national laws may prescribe additional requirements or different retention periods.
Frequently asked questions
What is the difference between KYC and CDD?
KYC is the overall framework of policies, procedures and controls. CDD is the operational process within KYC: the steps taken to identify, verify and risk-rate each customer. Every firm has a KYC program; CDD is what the team executes day to day.
When is EDD required instead of CDD?
Firms must apply EDD where required by the applicable regulatory framework or where the customer’s risk profile warrants enhanced measures. Common triggers include foreign PEP status, complex ownership, suspicious activity and connections to high-risk jurisdictions. FATF’s increased-monitoring list informs risk assessment but does not, by itself, require EDD. For jurisdictions subject to a FATF call for action, FATF calls on its members and urges all jurisdictions to apply enhanced due diligence, with countermeasures in the most serious cases.
What is the beneficial ownership threshold?
Ownership thresholds vary by jurisdiction and entity type; there is no single percentage that applies globally. Firms should apply the relevant ownership and control tests under their applicable framework. Where no natural person meets the ownership threshold, firms must identify the individual who exercises control through other means. Where neither test identifies a natural person after reasonable measures, the applicable framework may require identification of the senior managing official as a fallback. Compliance teams should review the specific threshold and control definitions in their applicable framework.
How often must KYC be updated?
Review frequency depends on the customer’s risk rating and the applicable regulatory requirements. FATF standards require ongoing monitoring and up-to-date CDD, while countries set their own specific intervals. As an illustrative practice, some firms review high-risk customers annually and lower-risk customers less frequently, but the applicable regime determines the required schedule. Event-driven reviews apply when material changes occur, such as ownership restructuring or suspicious activity.
Can simplified due diligence replace CDD?
Only where permitted by the applicable regulatory framework and justified by the customer’s lower-risk profile. Simplified due diligence may allow reduced or less frequent measures, subject to applicable safeguards. Some regimes permit postponement of identity verification to maintain normal business flow under specified low-risk conditions. However, this is a broader CDD exception, not exclusive to simplified due diligence, and must independently satisfy the relevant legal conditions. Regardless, firms must not apply simplified measures where suspicion of money laundering or terrorist financing exists or where other disqualifying higher-risk factors are present.
Does EDD apply to VASPs and crypto exchanges?
Yes. VASPs are subject to AML/CFT requirements under applicable national laws implementing the FATF standards, including customer due diligence and, where required, enhanced due diligence. FATF Recommendation 15 addresses the regulation and supervision of virtual asset activities, while Recommendation 10 sets out the core CDD measures. The Travel Rule requires relevant originator and beneficiary information to accompany covered transfers in jurisdictions that have implemented the applicable requirements. Transfers involving unhosted wallets, anonymity-enhancing assets or mixing services should be assessed using a risk-based approach; applicable restrictions and obligations vary by jurisdiction.
What happens if CDD or EDD cannot be completed?
Under FATF standards, the firm should not open the account, commence the business relationship or perform the transaction. For existing relationships, the firm should terminate the relationship and consider filing an STR. National law determines the enforceable obligation for the particular entity type. Whether to file an STR is a separate determination, based on whether the circumstances give rise to a suspicion of money laundering or terrorist financing.
What is the difference between source of funds and source of wealth?
Source of funds is the origin of money in a specific transaction: salary, business revenue or a property sale. In contrast, source of wealth refers to how the customer built their net worth over time. Where applicable, EDD measures may include verification of both.
Building a defensible KYC framework
The line between CDD and EDD is where most compliance programs succeed or fail. A well-designed program defines clear escalation triggers, backs them with thresholds calibrated to the actual customer base and maintains an audit trail that demonstrates consistent application.
Firms operating across multiple jurisdictions must map their KYC policy to each applicable regime while meeting the FATF baseline. A single framework that accounts for jurisdiction-specific thresholds, review cycles and reporting obligations reduces duplication and makes cross-border compliance manageable.
Compliance7 offers KYC/CDD/EDD framework design and advisory for banks, fintechs, VASPs, NBFCs and DNFBPs. Book a free consultation to discuss your requirements.
Related Compliance7 guides
- Core guide: AML Independent Audit: Scope, Requirements and Preparation Guide
- Core guide: Sanctions and PEP Screening: Requirements, Best Practices and Recent Developments
- Related: Why Customer Risk Scoring Models Fail During AML Audits and How to Fix Them
- Related: Independent AML Audit: What Examiners Expect
- Case study: Enhanced Due Diligence & Third-Party Risk Assessment: A Fintech Partner Onboarding Case Study
This article is for informational purposes only and does not constitute legal or regulatory advice. For guidance specific to your business, consult a qualified compliance professional.
