CDD / KYC

1. Practical definition #

CDD/KYC is the process by which a regulated organisation identifies the customer, verifies identity, identifies beneficial owners, understands the purpose of the relationship and checks whether activity stays consistent with the customer risk profile.

2. Why this matters for AML practitioners #

Without CDD, the reviewer cannot know who it is screening, whether a sanctioned/PEP/criminal actor is hidden behind the customer, or whether transactions are unusual.

3. Trigger events #

  • New customer onboarding.
  • Occasional transaction above applicable threshold.
  • Suspicion of ML/TF/PF.
  • Doubt about previously obtained identity data.
  • Material change in ownership, control, activity, address, sector or transaction pattern.
  • Periodic review.

4. Source basis #

  • SRC-FATF-001: FATF Recommendation 10 and Interpretive Note to Recommendation 10.
  • Related: SRC-FATF-004 and SRC-FATF-005 for beneficial ownership depth.
  • Local override: always apply applicable regulatory thresholds and prescribed CDD requirements where stricter or more specific.

5. Practitioner workflow #

  1. Classify customer type: individual, legal person, legal arrangement, financial institution, DNFBP, VASP or other.
  2. Collect identity data and proof of existence.
  3. Verify identity from reliable independent source documents, data or information.
  4. Identify person acting on behalf of the customer and verify authority.
  5. Identify beneficial owners and controllers.
  6. Understand nature of business, ownership/control structure and purpose of relationship.
  7. Screen customer, UBOs, directors, controllers, signatories and relevant connected parties.
  8. Determine initial risk rating.
  9. Select SDD/CDD/EDD route.
  10. Store evidence and decision rationale.
  11. Escalate unresolved material gaps or suspicion to MLRO.

6. Data to collect: individual #

  • Full legal name.
  • Date and place of birth.
  • Nationality and residence.
  • Government ID/passport details.
  • Residential address.
  • Occupation and employer/business activity.
  • Source of funds where relevant.
  • Source of wealth where relevant.
  • Expected activity and transaction size.
  • PEP/sanctions/adverse media screening results.
  • Legal name.
  • Legal form.
  • Registration number.
  • Place of incorporation/registration.
  • Registered office and principal place of business.
  • Constitutional documents where relevant.
  • Directors/managers and authorised signatories.
  • Ownership chart.
  • Beneficial owners and controllers.
  • Nature of business.
  • Expected activity and transaction profile.
  • Website/domain and operating footprint.
  • Settlor/founder.
  • Trustee/administrator/council members.
  • Protector/enforcer if any.
  • Beneficiaries or class of beneficiaries.
  • Any person exercising ultimate effective control.
  • Purpose of the arrangement.
  • Source of assets settled into the structure.

9. Evidence to collect #

  • ID/passport copies or verified digital identity result.
  • Corporate registry extract.
  • Certificate of incorporation/good standing.
  • Memorandum/articles or equivalent constitutional documents.
  • UBO declaration and supporting documents.
  • Ownership/control chart.
  • Screening screenshots/logs.
  • Public registry links and retrieval date.
  • Adverse media search terms and results.
  • Analyst notes and risk rationale.

10. Red flags #

Medium#

  • Customer gives incomplete documents but cooperates.
  • Non-resident customer without clear link to product/operating context.
  • Expected activity is vague.
  • Minor mismatch in address or transliteration.

High#

  • Complex ownership without economic rationale.
  • Nominees or bearer-like instruments without clear explanation.
  • Third-party funding without clear connection.
  • Customer refuses to identify UBO/controller.
  • Documents appear inconsistent or unverifiable.

Critical#

  • Possible sanctions match.
  • Suspicion of forged identity documents.
  • Customer attempts to avoid ownership disclosure.
  • CDD request creates tipping-off risk in a suspicious context.

11. Decision matrix #

Result Required action
Complete and low risk Proceed with normal CDD; set review cycle
Minor gaps Request missing information; do not final approve until resolved if material
High-risk factors Route to EDD
Suspicion or critical hit Escalate to MLRO; avoid tipping-off
Unable to complete CDD Do not onboard / consider termination / MLRO review depending on institution-specific policy

12. Example output #

# CDD Summary

Customer: [name]
Customer type: [individual/legal person/etc.]
Geographic/operating context: [country/territory/market if relevant]
Purpose of relationship: [summary]
UBO/control: [summary]
Screening results: [sanctions/PEP/adverse media]
Risk rating: [low/medium/high/critical]
Missing information: [list]
Recommendation: [proceed/request info/EDD/escalate]
Source basis: SRC-FATF-001
Evidence index: [links/files/screenshots]

Jurisdiction overlay check#

The universal CDD process should be followed by a jurisdiction check. For European Union implementation, use the EU AML/CFT Framework and verify the current AMLR, AMLD6 national implementation, AMLA standards and competent-authority guidance.

Jurisdiction overlays: Before setting local scope, approvals, reporting, retention or sanctions handling, apply the EU, US or UK framework.