Enhanced Due Diligence (EDD)

What is enhanced due diligence?

Enhanced due diligence is the set of additional steps a bank or fintech takes when a customer's risk profile is higher than normal. Standard customer due diligence (CDD) identifies and verifies the customer, understands the nature and purpose of the relationship, and monitors it. EDD adds to that baseline when the risk justifies it.

In the US, the Bank Secrecy Act requires covered institutions to run an AML program, and the CDD rule at 31 CFR 1010.230 requires covered institutions to identify and verify the beneficial owners of legal entity customers. Examiners expect more rigorous diligence for higher-risk customers, as the FFIEC BSA/AML Manual discusses. The statute, 31 U.S.C. 5318(i), requires due diligence for private banking and correspondent accounts held for non-US persons, including enhanced due diligence for correspondent accounts of certain foreign banks. For private banking accounts of senior foreign political figures, 31 CFR 1010.620(c) requires enhanced scrutiny.

When does a customer need EDD?

Institutions decide this through their own risk assessment, so triggers vary. Common ones include:

• A politically exposed person (PEP), a family member or a close associate, identified through PEP screening.
• Customers in or connected to higher-risk jurisdictions.
• Complex ownership structures, shell companies or bearer-share entities.
• Cash-intensive businesses, money services businesses and similar higher-risk business types.
• Private banking and foreign correspondent accounts.
• Unusual activity surfaced by transaction monitoring, or adverse media findings.

What does EDD involve?

The steps depend on the risk, but a typical EDD file includes the following.

• Additional identity and background information on the customer and, for entities, the beneficial owners.
• Documented source of wealth and source of funds, with supporting evidence.
• The expected purpose of the account and expected activity volumes.
• Adverse media and public-record searches.
• Approval from senior management before opening or continuing the relationship.
• A shorter review cycle and tighter monitoring thresholds.

How is EDD different from CDD and KYC?

KYC is the overall process of knowing who the customer is. Customer due diligence is the standard risk-based work within it: verification, beneficial ownership, purpose of the relationship and ongoing monitoring. EDD is the higher tier of that work, applied only where risk is elevated. Simplified due diligence sits at the other end for lower-risk customers, and in the US it is applied through the institution's risk-based program rather than a separate rule.

How can AI employees support EDD?

An AI employee can assemble an EDD file: it gathers registry and ownership data, runs adverse media searches, compares stated source of funds against account activity, and drafts a risk summary with citations. People still approve the relationship, accept or reject the risk, and own the final decision. See AI agents for financial crime investigations for how this fits into investigations.

Frequently asked questions

What is the difference between CDD and EDD?

CDD is the standard due diligence applied to every customer. EDD adds deeper checks for higher-risk customers, such as source-of-funds verification, senior management approval and more frequent reviews.

Is EDD required for all PEPs?

US rules do not label every PEP as requiring EDD by statute. Institutions treat PEPs as higher risk in their risk assessment and usually apply EDD, with stricter rules for senior foreign political figures in private banking accounts under 31 CFR 1010.620.

How often should EDD be refreshed?

There is no single fixed interval. Institutions set review cycles by risk, and higher-risk customers are usually reviewed more often, for example annually, and also when a trigger event such as unusual activity occurs.

Who approves an EDD relationship?

Institutions typically require senior management or compliance approval before onboarding or continuing a high-risk customer. The approval and its reasoning should be documented in the customer file.