An examiner or auditor who opens one customer file wants four answers: who the customer is, who owns or controls it, why the account exists and what the customer has done since. Those four answers are the four CDD measures. The same measures sit underneath the KYC requirements of every major market, with local thresholds and wording.
What is customer due diligence (CDD)?
CDD stands for customer due diligence: knowing a customer well enough to judge its money laundering and terrorist financing risk. The FATF Recommendations (updated June 2026) set the standard in Recommendation 10: no anonymous accounts, and four measures for each customer, scaled to its risk.
In AML, law sets the CDD meaning. KYC (know your customer) is the industry's name for the same work, so a KYC program is how a firm meets its CDD duty. Client due diligence means the same; the rules say customer due diligence.
CDD is applicable to the firm that takes the customer on. Financial institutions apply it under Recommendation 10, and designated non-financial businesses and professions (DNFBPs) such as casinos, real estate agents and lawyers under Recommendation 22. A notary preparing a property sale for a client checks that client as a bank checks an account holder.
What are the 4 customer due diligence requirements?
Recommendation 10 lists the four measures as points (a) to (d):
- Identifying and verifying the customer "using reliable, independent source documents, data or information", because a typed name is only a claim.
- Identifying the beneficial owner and taking reasonable measures to verify that person, including a company's ownership and control structure, so nobody hides behind the company.
- Understanding the purpose and intended nature of the relationship, which sets what normal looks like. FinCEN's CDD Rule FAQs (question F.2, first issued 3 April 2018) use it to build "a baseline against which customer activity, such as the customer's expected use of wires or typical number of deposits in a month, can be assessed". Question F.1 adds that the profile "may, but need not, include a system of risk ratings". If a firm rates, customer risk assessment in complead, formerly Sanction Scanner, returns a score and a tier with each contributing factor, its weight and its source.
- Conducting ongoing due diligence on transactions, "including, where necessary, the source of funds", because a file drifts after onboarding. Ongoing monitoring carries this measure for the life of the relationship.
All four apply to every customer; risk sets their depth.
When should a bank apply customer due diligence?
FATF Recommendation 10 names four triggers: a new business relationship; an occasional transaction above USD/EUR 15,000, or a payment or value transfer covered by the note to Recommendation 16; suspicion of money laundering or terrorist financing, at any amount; and doubts about identity data obtained earlier. Thresholds differ by market:
- EU. EUR 15,000, and transfers over EUR 1,000, under Directive (EU) 2015/849 Article 11; from 10 July 2027, EUR 10,000 under Regulation (EU) 2024/1624 Article 19.
- UK. £12,000, and transfers over £800, since 30 June 2026 (MLR 2017 regulation 27).
- US. No occasional threshold in these rules: a bank identifies every customer at account opening under the CIP rule, and a legal entity's owners under 31 CFR 1010.230.
Picture a payment firm (illustrative) sending a one off EUR 1,500 transfer for a walk in customer: in the EU and the UK, that alone triggers CDD.
How do FATF, EU, UK and US rules write CDD?
Table 1. The CDD rules list (as of October 2026).
| Rule | What it requires | Trigger or threshold | In force |
|---|---|---|---|
| FATF Recommendation 10 | The four measures, (a) to (d), each scaled to risk | New relationship; occasional transactions above USD/EUR 15,000; suspicion; doubts about earlier data | Standard; text updated June 2026 |
| Directive (EU) 2015/849, Article 13(1) | The same four measures, plus checking that anyone acting for the customer is authorized | Article 11: EUR 15,000; transfers over EUR 1,000 | Through national laws until 10 July 2027 |
| Regulation (EU) 2024/1624, Article 20(1) | Nine measures: the four, plus a sanctions check, PEP status, the nature of the customer's business, the people a transaction benefits and an agent's authority | Article 19: EUR 10,000; transfers of EUR 1,000 or more | Applies from 10 July 2027 |
| UK MLR 2017, regulation 28 | Identity and purpose (28(2)); beneficial owner and structure (28(4)); ongoing monitoring (28(11)) | Regulation 27: £12,000; transfers over £800 | In force; sums changed 30 June 2026 |
| 31 CFR 1020.220 (CIP rule) | Identity: risk based verification procedures that give the bank "a reasonable belief" about each customer's true identity | Account opening | In force |
| 31 CFR 1010.230 | Beneficial owners: each person holding 25% or more, plus one person who controls the entity | A legal entity's first account, then when facts or risk call for it | In force; relief order of 13 February 2026 |
| 31 CFR 1020.210(a)(2)(v) | Nature and purpose "for the purpose of developing a customer risk profile"; ongoing monitoring | Every customer relationship | In force; April 2026 proposal would move it |
FATF and the UK write customer due diligence as four measures in one rule, and the EU's AMLR turns them into nine from 10 July 2027. US rules split the same four across three sections. Identity sits in 1020.220, beneficial owners in 1010.230, and nature and purpose with ongoing monitoring in 1020.210. A US policy that cites only "the CDD Rule" leaves the identity step without its source, so name all three sections in the procedure.
Which CDD rules moved in 2026?
- 13 February. A FinCEN order lets covered institutions identify and verify a legal entity's owners when it first opens an account, then only when facts or risk call for it.
- 10 April. FinCEN proposed a new AML/CFT program rule; comments closed on 9 June, and no final rule had followed by October.
- May. FinCEN reissued its CDD Rule FAQs to align them with the order.
- 30 June. S.I. 2026/621 moved the UK thresholds from euros to sterling.
- 30 September. AMLA published its final report on draft standards for customer due diligence (AMLR Article 28(1)), to be submitted to the European Commission for adoption.
What does the customer due diligence process look like?
The typical CDD process runs the four measures as one flow, in the order a flow chart would draw them, each step one line of a customer due diligence checklist.
- Identity. Collect and verify the customer's details.
- Ownership. For a company, find and verify owners and controllers.
- Screening. Run sanctions and PEP checks (AMLR Article 20(1)).
- Purpose. Record purpose and expected activity as fields monitoring can test, then score the customer.
- Level. Set standard, simplified or enhanced by risk; a foreign PEP needs senior management approval.
- Records. Keep them five years after the relationship ends (FATF Recommendation 11; MLR regulation 40; AMLR Article 77).
- Handover. Pass the customer into monitoring on the same record.
A UK bank may open an account before verification ends if nothing moves through it (regulation 30). If CDD cannot be completed, the firm does not open the account, or ends the relationship, and considers a suspicious transaction report (Recommendation 10; regulation 31; AMLR Article 21).
In complead, customer onboarding runs the identity, ownership and screening steps (KYC or KYB, sanctions, PEP and adverse media) in one request, and approved customers stay in scope for ongoing monitoring.
Where does CDD sit in an AML program?
Picture a small importer (illustrative) that opens an account for "payroll" and six months later wires money abroad weekly. Kept as a free text note, that purpose gives monitoring nothing to test. Recorded as fields (payroll, domestic, about 20 payments a month), it flags the first foreign wire.
Onboarding analysts collect and verify, a designated compliance officer coordinates the program, and independent testing checks it (31 CFR 1020.210 for US banks). Customer due diligence software runs lookups, screening and scoring and keeps the file.
Among the challenges in implementing CDD, the fourth measure lasts longest, since it ends only with the relationship.
Simplified, standard or enhanced: which level of CDD applies?
The types of customer due diligence are three levels of one duty; standard CDD is the default. Simplified due diligence fits lower risk and still verifies. FATF's note to Recommendation 10 lists verifying after the relationship starts as one simplified measure, and since February 2025 FATF requires countries to allow and encourage simplified measures in lower risk areas. A foreign PEP moves the file to enhanced due diligence under Recommendation 12, adding source of wealth and funds checks and senior management approval. EDD keeps all four and goes deeper.
When may a firm apply these four measures more lightly, and when must it go further?
Related terms
- Enhanced due diligence (EDD). The deeper level of CDD for higher risk customers and transactions.
- Ongoing monitoring. The fourth CDD measure, kept up for as long as the relationship lasts.
- Suspicious activity report. The report a firm files with its FIU, including when CDD cannot be completed and the facts point to crime.
- Ultimate beneficial owner (UBO). The person who in the end owns or controls a customer that is a company or trust.
- Simplified due diligence (SDD). The lighter level of CDD a firm may use where its risk analysis shows lower risk.
- Customer identification program (CIP). The US rule for verifying identity when an account opens.
How this entry was checked. Burçak Aydın, Finance Manager at complead, wrote this entry; Dilara Diker, Head of Compliance, fact checks it before it goes live, and the date of that check is the last reviewed date. Each rule was read in its own text on 28 October 2026: FATF Recommendations 10, 11, 12 and 22 with the Interpretive Note to Recommendation 10 (June 2026 edition); Directive (EU) 2015/849; Regulation (EU) 2024/1624; AMLA's Regulatory Instruments page (last update 7 October 2026) and its final report of 30 September 2026 on the draft CDD standards; UK Money Laundering Regulations 2017 regulations 27, 28, 30, 31 and 40 as amended on 30 June 2026; 31 CFR 1010.230, 1020.210 and 1020.220; FinCEN's exceptive relief order of 13 February 2026, its proposal of 10 April 2026 and its CDD Rule FAQs. The four measures keep the wording of FATF Recommendation 10.
