Enhanced due diligence (EDD) in KYC is designed for cases where a customer can clear standard KYC and still leave material questions unanswered, such as:

• Does the information provided fully explain the customer’s risk profile?

• Does the source of funds align with the customer’s stated profile?

• Does a geographic risk indicator require closer review?

EDD helps compliance teams investigate higher-risk customers and determine which additional checks are needed. However, it is not a fixed checklist, and the depth of review changes based on the nature and severity of the risk identified.

What Enhanced Due Diligence in KYC Actually Covers

Enhanced due diligence in KYC adds another layer of investigation when standard customer due diligence (CDD) leaves important risk factors unresolved.

EDD examines the context behind the customer relationship in greater detail. That can involve looking more closely at:

• Customer’s background

• Financial activity

• Ownership or control

• Source of funds or wealth

• Exposure to politically exposed persons (PEP), sanctions, or higher-risk jurisdictions

The scope of the review depends on what raised concern in the first place. For example, a complex ownership structure may require deeper beneficial ownership checks, while unusual financial activity may call for stronger source-of-funds verification or transaction scrutiny.

What Is the Difference Between CDD and EDD?

CDD establishes the information needed to understand and assess a customer during a standard KYC review. EDD extends that review when the case requires additional evidence, investigation, approval, or monitoring.

Here is how the two differ in practice:

When Enhanced Due Diligence Is Required

EDD may be required when a customer, relationship, or transaction presents elevated financial crime risk. The trigger depends on applicable regulation and the organization’s own risk framework, but common examples include:

• PEP exposure: A customer, beneficial owner, family member, or close associate is identified as a politically exposed person.

• Higher-risk geographic exposure: The customer, counterparty, or transaction has material links to a jurisdiction associated with elevated money laundering, terrorist financing, or sanctions risk.

• Complex ownership or control: Corporate layers, trusts, nominee arrangements, or conflicting ownership information make it difficult to establish who ultimately owns or controls an entity.

• Unusual transactions: Activity is inconsistent with the customer’s profile, expected behavior, or stated purpose of the relationship.

• Higher-risk business activity: The nature of the industry, product, service, or business relationship creates greater financial crime exposure.

• Adverse information or conflicting signals: Credible adverse media, sanctions concerns, unexplained relationships, or inconsistencies in customer information raise further questions.

EDD is not limited to onboarding. A change in ownership, transaction behavior, geographic exposure, or another material risk factor can trigger a new review later in the relationship.

Risk indicators also need context before they influence an EDD decision. The Financial Action Task Force (FATF), for example, makes clear that a country being placed under increased monitoring does not automatically mean every customer connected to that jurisdiction requires enhanced due diligence. Organizations still need to assess what that exposure means for the specific relationship.

What Are the Requirements for EDD?

The exact requirements vary by jurisdiction and the risk involved. They commonly include:

• Additional customer or business information beyond standard CDD

• Beneficial ownership and control information where relevant

• Source of funds or source of wealth information where required

• Enhanced PEP, sanctions, adverse media, or geographic risk checks

• Additional or senior-level approval where required

• More detailed records supporting the risk assessment and decision

• Enhanced ongoing monitoring for higher-risk relationships

Which requirements apply depends on the relevant regulation and the organization’s risk policies.

Related Read: Compare 10 KYC Software Platforms for Faster Customer Verification

How the Enhanced Due Diligence Process Works

Once EDD is triggered, the investigation should follow the risk that caused the escalation. Each step should resolve a specific risk question and provide enough evidence to support the final decision.

Step 1: Define What the EDD Review Needs to Resolve

Before requesting more information, teams need to be clear about what remains unexplained. For instance:

• If the concern is ownership, the review should focus on establishing who ultimately controls the entity.

• If transaction activity appears inconsistent with the customer profile, the investigation needs to determine whether there is a credible explanation for that activity.

Documenting the reason for escalation at this stage gives the review a clear scope and helps prevent EDD from turning into an open-ended request for more information.

Step 2: Collect Evidence Relevant to the Risk

With the scope defined, teams can gather evidence relevant to the risk under review.

That may include additional identity or business records, information about the purpose of the relationship, expected account activity, or evidence from credible independent sources. Consider whether the new information supports the customer’s existing profile or introduces inconsistencies that need further investigation.

Automated identity verification can support this part of the review by validating customer information within the wider EDD workflow.

Step 3: Trace Ownership and Control Where Relevant

For business customers, legal entity records may not fully reveal who owns or controls the company. Where ownership or control has raised concern, teams need to trace the structure far enough to understand who ultimately sits behind it.

That can involve:

• Identifying the legal entity

• Mapping relevant ownership layers

• Establishing ultimate beneficial owners

• Determining who exercises effective control

• Verifying directors or authorized representatives where relevant

A company owned through several holding entities, for example, may require the review to move through each layer until the individuals with ultimate ownership or control are established. Gaps or inconsistencies along that chain can then be investigated before the case progresses.

The 2025 Basel AML Index points to deterioration in financial transparency and standards, including weaknesses around beneficial ownership transparency. For compliance teams, this observation makes the entity shown on incorporation records only the starting point when a higher-risk ownership structure requires closer scrutiny.

KYB verification can help structure these ownership and business verification checks.

Step 4: Verify Source of Funds and Source of Wealth

Source of funds and source of wealth answer different questions:

• Source of funds identifies where the money involved in a transaction or relationship came from.

• Source of wealth explains how the customer accumulated their overall wealth.

Where either is relevant to the review, teams can compare the customer’s explanation against evidence such as employment or business income, financial statements, investment records, asset sales, or inheritance records.

The evidence should make sense alongside the customer’s profile and expected activity. Material discrepancies that remain unexplained require further investigation or escalation.

Step 5: Assess the Relevance of Screening Findings

A screening hit should be verified for accuracy and relevance before it affects the risk assessment.

Teams should verify that the information is current, credible, and actually matches the customer. For adverse media, that also means distinguishing substantiated reporting from allegations or duplicated coverage.

Confirmed findings can then be assessed to confirm whether they meaningfully change the customer’s risk profile, require additional controls, or have limited bearing on the relationship.

Step 6: Make and Document the Risk Decision

Once the investigation has answered the questions that triggered EDD, teams can assess the remaining risk against the organization’s risk appetite and applicable requirements.

An illustrative decision framework might look like this:

• Acceptable residual risk → Proceed

• Elevated but manageable risk → Proceed with enhanced monitoring

• Risk exceeds internal appetite → Escalate or decline according to policy

The final record should capture the evidence considered, updated risk assessment, approvals where required, decision, and rationale. This creates a clear audit trail for the decision.

Step 7: Keep the Risk Assessment Current

A customer’s risk profile can change after approval, so monitoring should capture changes in transaction behavior, ownership, geography, PEP or sanctions status, and other relevant factors.

Keeping customer due diligence and risk assessments current is also a regulatory expectation. In December 2025, the UK Financial Conduct Authority fined Nationwide £44 million for financial crime control failings that included ineffective systems for maintaining up-to-date customer due diligence and risk assessments.

New findings should feed back into the customer profile and trigger reassessment where necessary. Money mule detection, for example, can identify risks that only become visible through later account activity and linked relationships.

How Bureau Supports Risk-Based Enhanced Due Diligence

EDD is harder to manage when customer information, fraud signals, transaction activity, and relationship data sit across separate systems. Compliance teams then have to piece together that context before deciding whether a case needs additional review, escalation, or monitoring.

Bureau’s Unified Risk Decisioning Platform brings those signals into one decisioning layer. Identity and business verification can be evaluated alongside device behavior, network relationships, and transaction activity, giving teams a more complete view of the customer as the relationship develops.

Bureau can support EDD workflows with:

• Identity and business verification

• Device and behavioral risk assessment

• Relationship intelligence through the Graph Identity Network

• Transaction risk monitoring

• Configurable scoring and workflow rules

• Explainable risk decisions

Teams can use these signals to configure risk-based onboarding and monitoring workflows around their own EDD policies. A case that crosses a defined risk threshold can be routed for additional verification, review, or approval, while cases that do not require escalation can continue through the standard workflow.

How a Leading Insurer Applied Risk-Based Decisioning at Onboarding

A leading insurer used Bureau’s identity intelligence and fraud detection capabilities to identify suspicious applications earlier and route genuine applicants through onboarding more efficiently.

The results included:

• 30% faster onboarding

• 100+ fraudulent or inaccurate applications identified and corrected

• Fewer customer complaints related to unauthorized account activity

• More efficient onboarding without weakening verification controls

Read the full case study → A Leading Insurer Cuts Fraud to Drive 30% Faster Onboarding

While the insurer was not implementing a formal EDD program, the case shows how risk signals can help determine when a customer requires additional review, rather than applying the same review path to every application.

Make EDD More Effective Without Adding Friction

Effective EDD depends on knowing why a case needs closer scrutiny and having enough context to resolve that risk without turning every review into a lengthy investigation.

Customer information, risk signals, and monitoring outcomes need to stay connected as the relationship evolves. When those inputs inform the same decisioning workflow, compliance teams can escalate cases based on evidence and keep the review proportionate to the risk involved.

Bureau supports that model by helping teams bring risk signals into a single decisioning layer and configure workflows around their own KYC, EDD, and monitoring policies.

To see how that approach works in practice, schedule a demo with Bureau today.

FAQs

1. What triggers enhanced due diligence in KYC?

Enhanced due diligence is typically triggered when a customer presents elevated financial crime risk. Common triggers include PEP exposure, high-risk jurisdictions, complex ownership structures, unusual transactions, sanctions concerns, adverse media, or significant changes in the customer’s risk profile.

2. What documents are required for enhanced due diligence?

EDD documents depend on the customer and identified risk. They may include additional identity or business records, beneficial ownership information, financial statements, proof of income, source of funds or wealth evidence, and documents supporting the purpose of the business relationship.

3. What is the difference between CDD and EDD in KYC?

CDD is the standard level of customer due diligence used to verify customers and assess risk. EDD builds on CDD for higher-risk relationships by requiring additional investigation, supporting evidence, approvals, and potentially more intensive ongoing monitoring.

4. How often should enhanced due diligence be reviewed?

There is no single review frequency for every EDD customer. Reviews should reflect the customer’s risk level, applicable regulatory requirements, and internal policies. Material changes in ownership, transactions, sanctions exposure, geography, or customer behavior may also trigger reassessment.

5. Is enhanced due diligence mandatory for high-risk customers?

EDD may be mandatory when applicable anti-money laundering (AML) regulations require additional measures for specific higher-risk relationships or circumstances. Organizations may also trigger enhanced due diligence under their own risk-based policies when standard CDD does not adequately address the risks identified.

6. Can the enhanced due diligence process be automated?

Parts of the enhanced due diligence process can be automated, including identity verification, screening, data collection, risk scoring, workflow routing, and ongoing monitoring. Complex investigations, regulatory interpretation, and some approval decisions may still require judgment from compliance professionals.