Begin by evaluating your firm's overall risk profile. This assessment should be detailed and reflect the unique characteristics of your business activities. Step 1: Verify Customer IdentitiesValidate your customer’s full name, residential address, and date of birth. Capture and confirm their photo identity against government-issued documents such as a passport or driving licence. Leveraging tools like identity and document verification, as well as facial recognition, can help streamline and automate this crucial first step.

Based on your risk assessment, determine the extent and depth of CDD required for each client. For higher-risk cases, more detailed information and verification steps will be necessary. Step 2: Screen Against Prohibited ListsCheck whether your client appears on Politically Exposed Persons (PEPs), sanctions, or fraud watchlists. Incorporating automated screening solutions helps ensure that no critical checks are missed and makes the process more efficient.

It's essential to maintain thorough documentation.This includes detailed records of your risk analysis and written policies outlining how your firm applies AML requirements to different risk levels. Step 3: Assess and Monitor RiskMake informed, risk-based decisions about each client by combining your CDD findings with other relevant insights. For higher-risk clients, ongoing monitoring and enhanced due diligence may be required. Access to consultancy services can help you develop a robust view of client risk and automate decision-making where appropriate.

By following these steps, your firm can not only meet regulatory requirements but also create a robust defence against potential money laundering activities. This approach ensures that CDD processes are not only comprehensive but also adaptable to the varying levels of risk presented by different clients.

CDD should be conducted at the start of a business relationship and periodically reviewed. The frequency of reviews depends on the customer's risk level; high-risk customers require more frequent and thorough reviews compared to low-risk customers.

Enhanced Due Diligence (EDD) is an extended version of CDD, applied to high-risk customers. It involves more rigorous checks, ongoing monitoring, and a deeper understanding of the customer's activities to mitigate potential risks.

Non-compliance with CDD requirements can lead to severe penalties, including fines, reputational damage, and potential legal action. It can also result in regulatory scrutiny and loss of business opportunities related to trust and credibility.

You must retain records of Customer Due Diligence (CDD) documents and related evidence for a period of five years after the conclusion of a business relationship or a one-time transaction.

Customer Due Diligence, or CDD, is the process of verifying a customer or business, understanding the purpose of the relationship, and assessing the risk of money laundering or other financial crime. The findings determine the checks, approvals, and monitoring required.

A CDD check can include identity and address verification, company and beneficial ownership checks, sanctions and PEP screening, understanding the purpose of the relationship, reviewing Source of Funds, and completing a customer risk assessment. The exact checks should reflect the level of risk identified.

A risk-based approach varies the depth and frequency of checks according to the risk presented by each relationship. Lower-risk customers may follow a more proportionate process, while higher-risk cases require additional evidence, approval, and monitoring.

KYC provides the identity-verification foundation by confirming who an individual customer is. CDD is the wider risk-based workflow that uses this information alongside screening, relationship details, risk assessment, and ongoing monitoring. KYC therefore forms part of CDD.

CDD should be completed when establishing a new customer or business relationship. Further checks may also be required when circumstances change, information appears inconsistent, unusual activity is identified or the customer’s risk profile increases.

An incomplete or inconclusive result should be referred for further review rather than automatically approved. The business may need to confirm the information supplied, request additional evidence, complete document or biometric checks, reassess the risk, and apply Enhanced Due Diligence where appropriate.