CDD vs EDD: Differences, Examples and a Practical Checklist

Practical guide · LearnAML Editorial Board · 18 October 2026 · 5-minute read

Customer due diligence (CDD) establishes who a customer is and how the relationship should work. Enhanced due diligence (EDD) adds targeted checks when the risk calls for closer examination. This guide compares the two and works through a fictional customer review.

What is the difference between CDD and EDD?

EDD builds on CDD. Under FATF Recommendation 10, CDD covers customer identity, beneficial ownership, the purpose of the relationship and ongoing scrutiny. The extent of those measures follows risk. Its Interpretive Note calls for enhanced measures for higher risks and gives examples such as further information on funds, closer monitoring and senior approval. National rules determine the duties that apply to a particular institution. Source: FATF Recommendations, Recommendation 10 and its Interpretive Note.

A useful review question is: what uncertainty will this extra check resolve? Requesting another document has little value if the analyst cannot explain its purpose. A file containing many pages can still leave an ownership conflict unanswered. A short, well-supported explanation can be more useful to the next reviewer.

When should a customer receive enhanced checks?

The decision starts with the applicable rules and the customer’s circumstances. Basel Committee guidance links customer acceptance to risk factors including business activities, geography, products, public functions and the source of income and wealth. It recommends proportionate due diligence, with enhanced measures where risk is higher. Customer profiles should describe expected activity so that later deviations can be identified. These are supervisory principles for banks, rather than a universal checklist for every sector. Source: Basel Committee, AFS 10, paragraphs 10.23–10.40.

Write the concern in plain language before selecting a response. “Ownership cannot yet be reconciled” is more actionable than “complex customer”. “Incoming payments now come from unexplained third parties” identifies a question that transaction records and a commercial explanation can help answer. Those descriptions also make it easier to explain why a particular check was selected.

Worked example: a customer’s activity changes

This case is fictional and illustrates an analyst’s reasoning. A small equipment distributor tells its bank that it expects monthly receipts of around USD 40,000 from domestic retailers. Its onboarding file records two individual owners and payments to three established suppliers. In September, receipts rise to USD 260,000. Several new overseas companies send funds, followed by payments to a business absent from the original supplier profile. These amounts are teaching facts, not legal reporting thresholds.

The first task is to reconcile the new activity with the customer’s business. The analyst obtains transaction dates, counterparties and payment references. The relationship manager asks for the commercial explanation through the approved process. The customer says it won an export contract and is using a new sourcing agent. That response gives the analyst propositions to test.

The extra checks should test the explanation. In this example, the analyst compares invoices with the payments, checks whether the overseas payers are the named buyers and examines the agent’s role. A current ownership record is compared with the existing file. A contract and delivery evidence may help explain the new volumes. No single document settles the review on its own.

The decision records what the evidence supports and what remains open. Suppose the invoices explain most receipts, but one payer has no documented link to a buyer. The analyst records that gap and escalates it under the institution’s procedures. A reviewer can then decide what further information or restrictions are appropriate under local rules. A higher-risk assessment alone does not establish that a crime occurred.

A practical CDD-to-EDD decision note

Use a short note that another analyst can reconstruct. The following is a suggested working format, not a prescribed regulatory form:

1. Trigger: What changed, and when was it identified?
2. Expected activity: What did the existing profile lead you to expect?
3. Checks: Which sources tested each concern?
4. Findings: Which facts were corroborated, contradicted or left unresolved?
5. Decision: What was decided, by whom, and on what basis?
6. Follow-through: Who owns the next action, and when is review due?

Common questions

Is EDD just asking for more identity documents?

Its value comes from addressing the identified concern. In the fictional case, another copy of an identity document would not explain an unrelated payer. The useful work is tracing the commercial link and recording the result.

Is a high-risk customer automatically suspicious?

Risk classification and suspicion are separate decisions. Keep the rationale for each clear. Where facts raise a reporting question, use the authorised internal escalation route and applicable reporting rules.

Where do simplified checks fit?

Simplified measures concern justified lower-risk situations within the applicable framework. FATF’s Interpretive Note excludes them where there is suspicion or a specific higher-risk scenario. Read our related guide to CDD and financial inclusion.

Practise the decision

Build a review you can explain. Work through customer verification, beneficial ownership and escalation in our free, self-paced CDD & EDD in Practice course. You can also compare all five free courses.

Educational guidance. The worked case and decision-note format are LearnAML teaching examples. Check your jurisdiction’s current rules and your institution’s procedures before applying a control or reporting decision.