Customer due diligence (CDD) is the set of steps a bank or other regulated financial institution takes to confirm who its customers are and to understand the risk they bring. For an individual, that starts with identity. For a business customer, it extends to the people behind the entity.

A US example

Under 31 CFR 1010.230, when a covered financial institution opens a new account for a legal-entity customer, it must identify each individual who owns 25 percent or more of the entity's equity, and one individual with significant responsibility to control or manage it, unless an exclusion or exemption applies. It must verify those identities using risk-based procedures, and keep identifying records for five years after the account closes and verification records for five years after each record is made.

As a hypothetical, a company opening a business checking account with three owners above the 25 percent threshold would have each of those three owners identified and verified, plus one controlling officer, before the account is opened.

CDD and the wider AML program

CDD is one part of a bank's anti-money laundering program. The beneficial ownership procedures have to be written into that program, and CDD sits alongside KYC and transaction monitoring. Our AML automation guide explains how those pieces connect in practice.