What is Customer Due Diligence (CDD)?
Last updated: 26 October 2026
What is customer due diligence (CDD)?
Customer due diligence (CDD) is the process banks and other regulated firms use to verify a customer’s identity, understand their business and assess the money laundering and terrorist financing risk they present. It is a core part of know your customer (KYC), and covers everything from basic identification to understanding a customer’s financial behavior and risk over time.
What are the core elements of CDD?
Under FATF Recommendation 10 and the laws built on it, CDD has four main elements:
- Identify and verify the customer using reliable, independent documents or data.
- Identify the beneficial owner of a business, and take reasonable steps to verify who ultimately owns or controls it. See UBO.
- Understand the nature and purpose of the relationship, including the expected activity.
- Conduct ongoing due diligence, monitoring transactions and keeping information current.
Why do banks do customer due diligence?
Banks need CDD to understand the money laundering risk of their customers. For FATF member states, CDD is mandatory under national AML/CFT laws, and weak CDD is one of the most common causes of regulatory penalties. It also underpins every other control, since screening, monitoring and reporting all depend on knowing who the customer is.
How do banks perform CDD?
Institutions use financial crime software to gather identity, occupation and account-use information, and run it through a verification process. Accepted documents typically include passports, driving licenses, national ID cards, utility bills, bank statements and birth certificates. Businesses also provide corporate documents, such as registration details and ownership structures. Where a customer acts through a third party or a complex structure, the institution should identify the ultimate beneficial owner (UBO).
Customers are also screened against sanctions, PEP and adverse media sources through name screening, and assigned a customer risk rating that determines the level of due diligence.
What are the levels of customer due diligence?
Under a risk-based approach, the depth of CDD depends on the risk the customer presents.
When is CDD required?
- When onboarding a new customer
- When there are problems with identification documents
- When transaction monitoring flags a risk, such as unusually large amounts or links to high-risk countries or persons
- When there is suspicion of money laundering or terrorist financing
- During periodic audits, when risk levels are rechecked over time
- When there is a change in the customer’s circumstances, such as ownership or activity
What is enhanced due diligence (EDD)?
Enhanced due diligence (EDD) involves deeper research on high-risk customers, such as politically exposed persons (PEPs) or those connected to sanctioned targets. It can require more documents, source of funds and source of wealth checks, closer transaction scrutiny and more frequent reviews. High-risk customers are not automatically rejected. The institution must understand and manage the risk, and document its decision.
What is ongoing due diligence (ODD)?
Ongoing due diligence (ODD), also called ongoing monitoring, is the continuous analysis of customers, their transactions and their business. It helps manage money laundering and terrorist financing risk and confirms the customer still fits the bank’s risk appetite.
Most institutions still rely on periodic reviews. In the FinCrime Frontier 2026-27 report, only 4.7% of respondents said the majority of their monitoring is continuous, while 22.1% run entirely in periodic cycles. The findings are indicators from 202 respondents, not statistically representative. The shift to event-driven updates is known as perpetual KYC (pKYC).
Do all banks and financial institutions do CDD?
Yes. Banks and other regulated financial institutions in FATF member states must perform CDD. They may outsource parts of the process, but regulatory responsibility stays with the institution, which must make sure the provider meets FATF criteria. Other obligated sectors, such as lawyers, accountants and gaming operators, also have CDD duties in many jurisdictions.
How long do banks keep CDD documentation?
Rules vary by jurisdiction, but most require CDD records to be kept for at least five years after the relationship ends or the transaction occurs. Keeping records lets institutions respond quickly to requests from financial crime authorities.
What is the difference between CDD and KYC?
The two terms are closely related and often used interchangeably, but KYC is the broader concept. CDD is a core part of KYC, covering the checks used to understand a customer and assess their risk, while KYC also includes identity verification at the start of the relationship and the processes that keep it up to date. CDD continues throughout the relationship. To differentiate the two, think of KYC as the whole discipline and CDD as the due diligence at its center.
What are the main CDD regulations?
- FATF: Recommendation 10 sets the global standard.
- United States: the Bank Secrecy Act and FinCEN’s CDD Rule. See the OCC’s overview of compliance obligations.
- European Union: the AML Regulation (AMLR), which sets harmonized CDD rules from 10 July 2027, and the Anti-Money Laundering Authority (AMLA). See what AMLA means for CDD and KYC and our EU AMLA technology readiness hub.
- United Kingdom: the Money Laundering Regulations 2017.
What are the challenges of CDD?
- Fragmented customer data across systems
- Slow, manual onboarding and review
- Complex ownership structures that hide beneficial owners
- Differing rules across jurisdictions
- Stale information between periodic reviews
- High costs from manual data gathering and rework
CDD best practices
- Apply a risk-based approach, with deeper checks for higher risk customers.
- Create a single customer view using entity resolution.
- Verify beneficial owners, not only the named customer.
- Trigger reviews from events, in addition to scheduled cycles.
- Screen at onboarding and on an ongoing basis.
- Document decisions so they can be explained to a regulator.
- Reuse data collected once, to avoid asking customers repeatedly.
How is AI used in CDD?
AI speeds up CDD and improves its quality. It can extract data from documents, resolve entities, map ownership structures, score risk and keep profiles current. Agentic AI can gather evidence, complete checks and draft a documented recommendation for a human reviewer. Oversight and explainability remain essential.
SymphonyAI delivers customer due diligence software
SymphonyAI CDD software gives you a single view of customer risk, with integrated name screening, risk scoring and real-time onboarding. It maps corporate structures, supports EDD workflows and integrates customer data from multiple systems. It runs on Symphony Risk Intelligence and supports Always-on Compliance.
Frequently asked questions
What is customer due diligence?
Customer due diligence is the process of verifying a customer’s identity, understanding their business and assessing the money laundering and terrorist financing risk they pose.
What is the difference between CDD and KYC?
CDD is a core part of KYC, covering the checks used to understand a customer and assess risk. KYC is the broader process, which also includes identity verification and ongoing updates.
What are the four elements of CDD?
Identifying and verifying the customer, identifying the beneficial owner, understanding the purpose and nature of the relationship, and ongoing monitoring.
What is the difference between CDD and EDD?
CDD is the standard level of due diligence. Enhanced due diligence applies deeper checks to higher risk customers, such as PEPs.
How long should CDD records be kept?
Most jurisdictions require at least five years, though requirements vary.
How often should CDD be refreshed?
It depends on the customer’s risk. Higher risk customers are reviewed more often, and many institutions now supplement scheduled reviews with event-driven updates.