Enhanced due diligence (EDD): meaning, triggers and steps

Picture a bank (illustrative) opening an account for a trading company. The ownership check shows that 40 percent of its holding company belongs to the brother of a minister in another country. FATF Recommendation 12 applies its measures for foreign politically exposed persons (PEPs) to their family members, so the file moves from standard customer due diligence (CDD) to EDD before the account opens. Country risk works the same way. Customers tied to high risk countries on FATF and EU lists move to EDD too.

What does EDD mean in banking and KYC?

EDD stands for enhanced due diligence. In banking and KYC, and in any AML and CFT (countering the financing of terrorism) program, it is the deepest of three levels of customer checks: simplified due diligence (SDD) where the risk is lower, standard customer due diligence (CDD) for everyone else, and EDD where the risk is higher. Outside AML the same letters mean other things, such as California's Employment Development Department. The FATF Recommendations (updated June 2026) set the rule: "Where the risks of money laundering or terrorist financing are higher, financial institutions should be required to conduct enhanced CDD measures, consistent with the risks identified" (Interpretive Note to Recommendation 10, para 20).

In practice EDD means the bank learns where the customer's money and wealth come from, a senior manager signs off, and monitoring tightens for the life of the relationship.

It is important because supervisors test due diligence on exactly these accounts. On 13 October 2026, the US Treasury listed a failure to "conduct due diligence for correspondent accounts for foreign financial institutions" among the BSA violations behind Bank of America's penalties.

When is enhanced due diligence required?

Table 1. Where the rules make EDD required, by trigger (as of October 2026).

Beyond the named triggers, high risk customers and financial transactions need EDD as well. FATF's note to Recommendation 10 lists the profiles that explain why they require EDD (para 15): non resident customers, companies or trusts that hold personal assets, companies with nominee shareholders or bearer shares, cash intensive businesses, ownership that looks unusually complex for the business, and links to countries with weak AML systems, sanctions or high corruption.

India adds a channel trigger. Under para 44 of the RBI Directions, a commercial bank treats an account opened remotely without video KYC, other than one opened through Aadhaar OTP, as high risk, under enhanced monitoring, until the customer is verified face to face or by video KYC.

The law names some triggers. The firm's own risk assessment names the rest. Every rulebook above reaches PEPs, which is why PEP screening runs at onboarding, and most reach correspondent banking.

US regulations name two places for enhanced checks: correspondent accounts for certain foreign banks, and private banking accounts of at least $1,000,000 for non US persons where a senior foreign political figure is an owner. Any other EDD file in a US bank rests on the bank's own risk assessment, and that assessment has to show why each customer is there.

What changed in 2026:

• 29 January: Russia joined the EU list of high risk third countries.
• 30 June: the UK tied its country trigger to FATF's call for action list and reworded its unusual transaction trigger.
• 1 October: the RBI updated its 2025 KYC Directions for commercial banks.
• 13 October: Treasury's Bank of America actions named failed due diligence on correspondent accounts for foreign financial institutions.

How does a risk score cross the EDD line?

Take the trading company again, scored by an illustrative model from 0 to 100 with a bank set EDD line at 70.

Table 2. An illustrative risk score before and after the PEP finding.

At 58 the company gets standard CDD. The PEP link adds 20 points and carries it past 70, so the file goes to EDD and to a senior manager before any money moves. The numbers are illustrative; each firm sets its own weights and its own line.

In complead, formerly Sanction Scanner, customer risk assessment rates each customer on factors and weights the firm sets and shows every factor behind the rating. When the score reaches the level the firm has specified, EDD is triggered automatically and the case carries the factors that moved it.

How is enhanced due diligence done? A checklist

To execute enhanced due diligence, start from the EDD requirements the EU's AML Regulation lists (Article 34(4)) and the measures FATF recommended in its note to Recommendation 10 (para 20). Items 5 and 9 are best practices a firm adds itself:

1. Verifying the beneficial owners (UBO) through every layer, because the PEP sat two layers up.
2. Recording the purpose and expected activity, so monitoring has a baseline to test against.
3. Analyzing the source of funds: the origin of the first payment and of the regular inflows.
4. Obtaining the source of wealth: how the owners built what they hold.
5. Conducting an adverse media search on the company and its owners, for example with a free adverse media check.
6. Getting senior management approval before opening or continuing the relationship.
7. Using the customer's own account for the first payment, held at a bank with comparable CDD standards (AMLR Article 34(4)(g); RBI para 44).
8. Tracking ongoing transactions under enhanced ongoing monitoring, with closer thresholds and a fixed review date.
9. Writing the decision down: who approved, on what evidence, and what would change it.

If the checks cannot be completed, FATF Recommendation 10 says the firm should not open the account or should end the relationship, and should consider a suspicious transaction report.

SDD, CDD or EDD: what changes at each level?

Table 3. Simplified, standard and enhanced due diligence compared.

The difference between CDD and EDD is one of depth: EDD keeps every CDD step and adds the checklist above. SDD still verifies identity: FATF lets the check happen after the relationship starts, but rules SDD out "whenever there is a suspicion" (para 21). No level removes the duty to file a suspicious activity report when the facts call for one.

Settle where your firm draws its EDD line and put it in writing: which triggers come from law, which come from your score, and where both are recorded for the next review.

Related terms

• Correspondent banking. A bank holding accounts for another bank, often abroad.
• Ongoing monitoring. Keeping a customer's file and transactions under review after onboarding.
• Suspicious activity report. The report a firm files with its FIU when it suspects crime.
• Politically exposed person (PEP). Someone with a prominent public function, plus family and close associates.
• Source of funds and source of wealth. Where a payment comes from, and how a customer built what they own.
• DNFBP. Lawyers, accountants, casinos and other designated non financial businesses and professions that carry their own CDD duties.

How this entry was checked. The sources were checked on 26 October 2026: FATF Recommendations 10, 12, 13 and 19 (June 2026 text), Regulation (EU) 2024/1624 Article 34, Commission Delegated Regulation (EU) 2026/46, 31 CFR 1010.610 and 1010.620, the UK Money Laundering Regulations 2017 (regulations 33 and 35, as amended on 30 June 2026), the RBI's Know Your Customer Directions, 2025 for commercial banks (updated 1 October 2026) and the Treasury release of 13 October 2026. The definition follows the FATF Interpretive Note to Recommendation 10. Burçak Aydın, Finance Manager at complead, is the author, and Dilara Diker, Head of Compliance, is the reviewer. Last reviewed: 26 October 2026.