Unit
- Definition and scope: Customer Due Diligence (CDD) is the process of gathering and verifying information about a customer to assess their risk profile. It forms the foundation of Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) programs. CDD applies to all customer relationships at onboarding and throughout the business relationship.
- Legal basis: International standards set by the Financial Action Task Force (FATF) require financial institutions and designated non-financial businesses to conduct CDD. National laws implement these standards, such as the US Bank Secrecy Act and EU Anti-Money Laundering Directives. Non-compliance can result in fines, license revocation, and criminal liability.
- Three pillars of CDD: Customer identification and verification, understanding the nature and purpose of the business relationship, and ongoing monitoring. These pillars ensure the institution knows who its customers are and can detect unusual activity.
- Risk-based approach: CDD intensity should match the assessed risk level. Low-risk customers may undergo simplified CDD; high-risk customers require enhanced measures. This principle allows efficient resource allocation while focusing on higher threats.
- Key terms: Know Your Customer (KYC) is often used interchangeably with CDD but is a subset focusing on identity verification. Beneficial owner refers to individuals who ultimately own or control a legal entity. Politically Exposed Persons (PEPs) are individuals with prominent public functions and require additional scrutiny.
- Typical triggers for CDD: New customer onboarding, one-off transactions above a threshold, suspicion of money laundering, doubts about previously obtained data, and periodic reviews. Each trigger initiates a CDD process of appropriate depth.
- Consequences of poor CDD: Regulatory fines, reputational damage, loss of correspondent banking relationships, and exposure to financial crime. High-profile cases show penalties reaching hundreds of millions of dollars for systemic CDD failures.
- Integration with broader compliance: CDD is one component of an AML framework that also includes transaction monitoring, suspicious activity reporting, and employee training. Effective CDD feeds into these other functions by providing baseline customer profiles.
- Role of technology: Modern CDD relies on digital identity verification tools, biometric authentication, and automated screening against watchlists. These technologies improve efficiency and accuracy but require robust data protection measures. Regulators expect institutions to validate the reliability of technology solutions used for identity verification and risk assessment.
- Data quality and recordkeeping: Accurate, complete, and up-to-date customer data is essential for effective CDD. Institutions must maintain records of identification documents, risk assessments, and monitoring activities for at least five years after the business relationship ends. Poor data quality undermines risk detection and can lead to regulatory penalties.
- Customer risk categorization: Institutions typically assign customers to risk tiers (low, medium, high) based on factors like geography, occupation, transaction patterns, and entity type. This categorization determines the extent of initial and ongoing due diligence. Periodic reassessment ensures the risk rating reflects current information and emerging threats.
Regulatory Requirement
Regulation: FATF Recommendation 10
Financial institutions must conduct CDD when establishing business relationships, carrying out occasional transactions above a threshold, when there is suspicion of money laundering, or when doubts about previously obtained customer data arise. The CDD measures include identifying the customer and verifying identity using reliable, independent sources; identifying the beneficial owner; understanding the purpose and intended nature of the business relationship; and conducting ongoing due diligence.
Quick Revision
- CDD is a legal obligation to identify and verify customers, understand their business, and monitor activity.
- It follows a risk-based approach: higher risk means deeper scrutiny.
- Three pillars: identification, understanding, and ongoing monitoring.
- Failure to perform adequate CDD leads to severe regulatory and reputational consequences.