A grandparent pays £50 a month into a junior ISA that a UK building society (illustrative) opened for a grandchild. Junior ISAs are a lower risk product factor in regulation 37 of the Money Laundering Regulations 2017, so if the society finds the relationship low risk, it may adjust the extent, timing or type of its checks while it keeps monitoring (37(1) and (2)). Then a lump sum arrives from abroad. If the society no longer considers the risk low, SDD ends (37(8)(b)).
What is simplified due diligence (SDD)?
SDD means simplified due diligence: in AML and KYC, a level of customer due diligence for lower risk customers. It concerns customer relationships, not business deals. The EBA's ML/TF risk factor guidelines say SDD "is not an exemption from any of the CDD measures" (guideline 4.40). All four measures of customer due diligence still apply, adjusted in amount, timing or type.
Each market's KYC requirements word it its own way: "simplified customer due diligence" in the UK, "simplified due diligence measures" in the EU's AMLR, "Simplified Due Diligence" in India's RBI Directions. Outside AML, SDD means other things.
What does SDD reduce, and what does it keep?
At the building society, nothing on the junior ISA is skipped. The purpose is read from the product, and payments are reviewed above a set amount.
Both moves come from FATF's four examples (FATF Recommendations, Interpretive Note to Recommendation 10 (INR.10), paragraph 21): verify identity after the relationship starts, update identification less often, monitor above "a reasonable monetary threshold", and infer the purpose from the type of transactions. The customer and any beneficial owner are still identified, and ongoing monitoring of transactions is reduced, never removed.
A delay in verification counts as SDD only with its limits attached. From 10 July 2027 the AMLR (Regulation (EU) 2024/1624) caps the wait at 60 days (Article 33(1)(a)). It also requires procedures for what the customer may do first, such as limits on the amount, number or types of transactions (33(3)). The EBA warns that a delay must not become "a de facto exemption from CDD" (4.41). If you postpone verification, set the limit the day the file opens.
Under what conditions is simplified due diligence allowed?
Table 1. Conditions for simplified due diligence (as of October 2026; the AMLR rows apply from 10 July 2027).
| Rule | Logic | Threshold | Note |
|---|---|---|---|
| Lower risk identified first (FATF INR.10 para 16; AMLR Article 33(1) and (2); MLR regulation 37(1)) | The firm's own analysis shows lower risk before any measure is reduced | "Adequate analysis of the risk" (FATF); a low degree of risk (AMLR, UK) | Procedures name the simplified measures per customer type, and decisions on extra lower risk factors are documented (AMLR 33(2)) |
| Lower risk factors (Directive (EU) 2015/849, Article 16 and Annex II; regulation 37(3)) | Public bodies, listed companies, low premium life insurance and pension schemes in both lists; regulated financial institutions and junior ISAs in the UK list | One factor may not prove low risk (regulation 37(4)) | AMLA gave no sector, product or customer category automatic SDD (final report, 30 September 2026) |
| Verification later (FATF INR.10 para 21; AMLR 33(1)(a) and (3)) | Verify the customer and beneficial owner after the relationship starts | No later than 60 days (AMLR); limits on the amount, number or types of transactions, or monitoring against expected norms | Identity must "ultimately be verified" (EBA 4.41) |
| Purpose inferred (AMLR 33(1)(c); AMLA final report text, Article 20) | Read the purpose from the product or the transactions | At least the intended use, the estimated value where applicable, and the customer's business or occupation | The information may come from the customer or other sources, or be inferred from the product |
| Fewer updates, lighter monitoring (AMLR 33(1)(b), (d) and 33(4); regulation 37(2)(b)) | Update identity data less often; scrutinize fewer transactions | "Sufficient monitoring" stays | The conditions for SDD are rechecked on a regular basis (33(4)) |
| Electronic money (Directive (EU) 2015/849 Article 12; MLR regulation 38) | An exemption, not SDD: no CDD in the UK; in the EU, where national law allows, no identity, owner or purpose measures; monitoring stays in both | EUR 150 stored and EUR 50 redeemed or paid remotely (EU); £150 and £50 since 30 June 2026 (UK) | Where those conditions are not met, the UK firm may still use SDD under regulation 37 (38(4)) |
| Sanctions check (AMLR Article 20(1)(d)) | Every customer and beneficial owner is checked against targeted financial sanctions | No reduction: Article 33 lists none | Suspected sanctions evasion ends SDD (33(5)(e)); in the US, OFAC's sanctions rules sit outside the CDD rules, in 31 CFR Chapter V |
Row 1 ends in a written record (AMLR 33(2)). In complead, formerly Sanction Scanner, the customer risk rating and KYC product stamps the model version on every rating and records each override with its reason.
A low KYC risk rating opens the door but does not settle it: AMLR Article 20(2) asks for an individual analysis of each customer's risk, which is why AMLA gave no category automatic SDD.
When must a firm stop applying SDD?
The potential risks of SDD come from a file that stays light after facts change. Five triggers end SDD:
- Suspicion. FATF rules SDD out (INR.10 para 21), and SDD never exempts a firm from filing a suspicious activity report (EBA 4.43).
- Doubtful data. The firm doubts identity documents or information it holds (regulation 37(8)(a); AMLR 33(5)(a)).
- Lower risk gone. The risk assessment changes, or monitoring excludes a lower risk scenario (37(8)(b); 33(5)(b), (c)).
- An enhanced due diligence case. Any regulation 33(1) case ends SDD in the UK (37(8)(d)); the EBA says the same of any EDD obligation (4.44). UK rules make every politically exposed person (PEP) such a case (33(1)(d)); FATF requires the PEP measures for foreign PEPs, and for domestic PEPs only in a higher risk relationship (Recommendation 12).
- Suspected sanctions evasion. This trigger is EU only, from 10 July 2027 (33(5)(e)).
Does every rulebook have a simplified level?
An illustrative US bank onboards a company listed on the NYSE. The customer identification program (CIP) rule's definitions leave both that company and a regulated financial institution out of "customer" (31 CFR 1020.100(b)(2)), and SEC registered issuers fall outside the beneficial ownership rule (1010.230(e)(2)(iii)).
FATF, the EU and the UK keep every lower risk customer inside CDD and let the firm reduce how much it collects, how soon it verifies and how often it reviews. US rules have no simplified level. Some customers are out of scope by definition, and everyone else gets the full measures, with depth set by the bank's risk based procedures (31 CFR 1020.210(a)(2)(v)) and identity verified within a reasonable time after the account opens (31 CFR 1020.220).
India's RBI KYC Directions for commercial banks name three simplified regimes (paragraphs 47 to 49: self help groups, foreign students, foreign portfolio investors), beside a capped small account that opens before full KYC documents (paragraph 28).
Why do regulators allow SDD at all?
The benefits of SDD are proportion and access. FATF's February 2025 revision set out to "increase focus on proportionality of measures" and obliged countries to allow and encourage simplified measures where risk is lower. Its examples of lower risk include products built "for financial inclusion purposes" (INR.10 para 17), and AMLA's report adds that SDD should "ease the administrative burden" (recital 17).
The 2026 changes, by date
- 30 June. Statutory instrument 2026/621 amended the UK rules: regulation 37(2)(a) now reaches the pooled account measures added to regulation 29, regulation 38's limits moved from 150 and 50 euros to £150 and £50, and regulation 33(1)(b) now names a FATF call for action country.
- 30 September. AMLA's final report on its standards for customer due diligence (AMLR Article 28(1)) came out, and the text goes next to the European Commission for adoption (AMLA's instruments page).
Where does SDD sit between CDD and EDD?
As SDD vs CDD vs EDD, the differences lie in how much of each measure runs: standard CDD runs all four in full.
SDD lowers their amount, timing or type where risk is lower, while enhanced due diligence adds measures on top for higher risk, such as source of wealth checks and senior management approval (AMLR Article 34(4)). A firm may choose SDD; EDD is mandatory in the cases the rules name (AMLR Article 34(1); regulation 33(1)).
Which steps make up the SDD process at onboarding?
The SDD process and its requirements fit into six onboarding steps, with screening never reduced:
- Rate the customer and keep the lower risk factors on file.
- Set the level per measure. FATF's note to Recommendation 1 suggests normal CDD at acceptance with simplified or enhanced monitoring, or the reverse (INR.1 para 16).
- Collect the minimum. For a low risk individual in the EU, AMLA's final report text asks for names, place and date of birth and nationality, without the address (Article 18; recital 18).
- Run KYC verification now, or within the limit.
- Date the review and the triggers that end SDD.
- Screen for sanctions and PEPs on every file (AMLR Article 20(1)(d) and (g)), since Article 33's simplified measures reduce neither.
One choice stays with the firm: which customer groups and products qualify for SDD. Write each into the risk assessment with the measure it reduces and the trigger that ends it.
Related terms
- Customer due diligence (CDD). The four standard checks on every customer, which SDD makes lighter.
- Enhanced due diligence (EDD). The level above standard CDD, required where risk is higher or a rule names the case.
- KYC risk rating. The low, medium or high tier that points a customer to a level of due diligence.
- Customer risk assessment. The method behind the rating: the factors, their weights and the documented result.
- Ongoing monitoring. The CDD measure that SDD may reduce but never removes.
- Customer identification program (CIP). The US rule for verifying identity at account opening, whose "customer" leaves out regulated institutions and some listed companies.
How this entry was checked. Burçak Aydın (Finance Manager) wrote this entry for review by Ufuk Gürdaş (Compliance Specialist); last reviewed 29 October 2026. On 28 October 2026 each rule was reread in its own text: the FATF Recommendations (June 2026 text: Recommendations 1, 10 and 12, the Interpretive Notes to Recommendations 1 and 10, and the February 2025 revision), Directive (EU) 2015/849 as consolidated on 9 July 2024, Regulation (EU) 2024/1624, AMLA's final report on the CDD standards (30 September 2026) and its instruments page, the EBA ML/TF Risk Factors Guidelines (EBA/GL/2021/02), the UK Money Laundering Regulations 2017 (regulations 29, 33, 37 and 38 as amended on 30 June 2026), 31 CFR 1010.230, 1020.100, 1020.210, 1020.220 and Chapter V, and the RBI (Commercial Banks, Know Your Customer) Directions, 2025, in the version updated to 1 October 2026. FATF's and the EBA's examples of simplified measures keep their own wording. Quotes are verbatim.
