Customer Due Diligence Requirements in the UK: When SDD, CDD and EDD Apply

A customer can pass an identity check and still present a material risk. The document may be genuine, but the company behind the application may have opaque ownership. A screening tool may return no direct sanctions match while connected parties, the source of funds or the purpose of the relationship remain unclear.

Customer due diligence (CDD) is designed to close those gaps. It gives a regulated organisation a reasoned basis to approve, escalate, restrict or decline a relationship. It is not a single database search, and it does not end when an account is opened.

This guide explains the UK framework. Organisations operating elsewhere should apply the rules of each relevant jurisdiction and obtain legal advice where the position is unclear.

What Is Customer Due Diligence?

Customer due diligence is the process of establishing who a customer is, who ultimately owns or controls a legal entity, why the relationship is being formed and whether the activity fits the risk profile.

Under the UK Money Laundering Regulations 2017, a relevant person must identify the customer and verify that identity using reliable, independent evidence. For a company, trust or similar arrangement, the review must also identify and take reasonable measures to verify the beneficial owner, understand ownership and control, and assess the purpose and intended nature of the relationship.

Recommendation 10 from the Financial Action Task Force sets a similar international baseline. FATF standards inform national AML regimes but do not replace local law. CDD therefore combines verification with judgement: a passport or registry extract is a starting point, not the decision.

When Is CDD Required in the UK?

Regulation 27 sets the main triggers for businesses within scope of the UK regime. CDD is required when a relevant person:

• establishes a business relationship;
• carries out a qualifying occasional transaction, including certain linked transactions;
• suspects money laundering or terrorist financing; or
• doubts the accuracy or adequacy of identity information obtained earlier.

The regulations include monetary thresholds for certain occasional transactions. Since 30 June 2026, the general threshold for most sectors has been £12,000, while a transfer of funds by a money service business can trigger CDD when it exceeds £800. Different thresholds apply to some activities: for example, high-value dealers and art market participants use £10,000, while certain estate agency and letting agency transactions have their own rules. A threshold should never be used without checking the current provision for the activity concerned.

Existing customers are not exempt. CDD must be refreshed at appropriate times on a risk-sensitive basis, including when relevant circumstances change. Scope depends on the sector, activity and supervisory regime: companies outside the regulated sector may use CDD as a commercial control, but should not present a voluntary check as a statutory duty.

What Do CDD Checks Cover?

The evidence should match the customer and the proposed relationship. A low-value domestic account for an individual does not create the same questions as a cross-border relationship with a privately held company and layered ownership.

An Individual Customer

The organisation normally records the person’s full legal name, date of birth and other identifying details required by its policy and applicable rules. It then verifies identity using reliable, independent evidence. Depending on the risk and service, that may include a passport, national identity document, driving licence, address evidence or a suitable electronic identity process.

The review should also establish whether the person is acting for someone else and has authority to do so. The stated purpose, expected activity, relevant jurisdictions and source of funds may require examination. Collecting more personal data does not automatically produce a better risk decision.

A Company or Other Legal Entity

For a business customer, CDD should establish the entity’s legal name, registration details, status, registered office, principal activity, directors and authorised representatives. The next task is to trace ownership and control to the relevant natural persons.

A shareholder register, confirmation statement or Companies House record can provide useful evidence, but not the complete answer. Companies House warns that its public service is not a complete source of company information. Registry data may be outdated or fail to show control exercised through nominees, agreements or connected companies.

Beneficial ownership thresholds depend on applicable law, and ownership is not the only form of control. Voting rights, appointment powers, trusts and partnership arrangements may matter. Contradictions between filings, customer declarations and independent sources need to be resolved.

Risk and Relationship Context

Identity answers “who”. CDD must also answer “why” and “what should normal activity look like”. Relevant questions can include:

• What product or service does the customer want?
• Why has the customer selected this organisation or jurisdiction?
• What transaction size, frequency, counterparties and countries are expected?
• Does the operating footprint support the stated business model?
• Where do the funds or wealth come from when that evidence is required?

Sanctions, politically exposed person (PEP) and adverse-media screening inform the assessment. An alert is not a confirmed match, and PEP status is not evidence of wrongdoing. A confirmed sanctions match can create separate legal restrictions or reporting duties.

Simplified, Standard and Enhanced Due Diligence

The UK framework is risk-based. This affects the extent and timing of measures, but it does not allow a firm to disregard inconvenient information.

Simplified Due Diligence

Simplified due diligence (SDD) may be appropriate where the organisation has established a lower risk and the law permits a reduced approach. The firm should document why the relationship is lower risk and adjust its measures accordingly. It must still monitor the relationship and apply ordinary or enhanced measures if suspicion arises or the risk changes.

SDD is not “no due diligence”. A familiar company name, UK registration or referral from an existing customer is not enough on its own to justify a lower-risk rating.

Standard Customer Due Diligence

Standard CDD applies the core measures: identify and verify the customer, establish beneficial ownership, understand the purpose and intended nature of the relationship, assess risk and monitor the relationship. The exact evidence depends on the customer, product, geography and delivery channel.

Enhanced Due Diligence

EDD is required in cases specified by the regulations and in other situations assessed as high risk. Triggers may include a PEP, a party in a FATF Call-for-Action jurisdiction, a transaction that is unusually complex or large for its context, opaque ownership, false identity evidence, unclear funds, sanctions concerns or credible adverse information. FATF’s separate increased-monitoring list remains a risk factor, but does not now create an automatic UK EDD duty on geography alone.

Measures can include further evidence, deeper ownership tracing, source-of-funds or source-of-wealth checks, senior approval and closer monitoring. Each measure should address the identified risk, not simply add documents.

A Practical CDD Process

A useful process produces a decision trail, not only a folder of documents.

1. Define the relationship and obligations. Identify the customer, service, jurisdictions and regulatory rules. Set what the review must establish.
2. Collect the required information. Obtain identity details, corporate records, ownership declarations, authority to act, purpose and expected activity.
3. Verify through independent sources. Compare declarations with appropriate registries, official records and other evidence. Assess each source for authority, recency and relevance.
4. Map ownership and control. Follow each layer to natural persons and record gaps, circular structures, nominees and inconsistencies.
5. Assess the context. Compare the stated purpose, business activity, geography, expected transactions and funding with the evidence.
6. Resolve screening results. Confirm identifiers, dates, locations and relationships before treating sanctions, PEP or adverse-media alerts as findings. Local-language sources may be necessary.
7. Assign risk and decide. Request more evidence, impose conditions, seek senior approval, move to EDD, approve or decline.
8. Record the reasoning. Preserve material sources, discrepancies, resolution steps, the risk rating, decision basis, limitations and review triggers.

Standard tools can collect records and generate alerts. When sources conflict or ownership remains unclear, analyst-led KYC and customer due diligence services can provide the context needed for a defensible decision.

Electronic Verification or Manual Review?

Electronic identity systems can improve speed and consistency, but no method is always the most reliable. FATF’s digital identity guidance recommends assessing a system’s assurance level, technology and governance before using it for CDD.

Document authentication, biometric comparison and liveness checks can detect some impersonation or tampering, yet they can also produce false positives and say little about ownership or purpose. Manual review can be inconsistent. A risk-based process combines appropriate technology, escalation rules and human judgement.

CDD and KYC: Is There a Difference?

There is no universal sequence in which KYC happens first and CDD follows. In some policies, “Know Your Customer” is the wider onboarding and monitoring framework, while CDD describes the specific AML measures used within it. Other organisations and guidance use the terms almost interchangeably.

What matters is not the label but whether the policy covers identity, beneficial ownership, relationship purpose, risk assessment, escalation and monitoring.

Customer due diligence should also be distinguished from broader corporate due diligence, which may support an acquisition or investment, and third-party due diligence, which focuses on vendors, agents, contractors and other external relationships. The checks may overlap, but the decision and legal context differ.

Ongoing Monitoring and CDD Reviews

CDD continues throughout the relationship. Under Regulation 28, ongoing monitoring includes scrutinising transactions to check whether they fit the organisation’s knowledge of the customer, its business and risk profile. It also requires relevant documents, data and information to remain current.

Monitoring intensity should reflect risk; every customer does not need the same daily review. Higher-risk relationships may require more frequent screening, closer transaction analysis and shorter intervals. Lower-risk files may be reviewed less often if material changes can still be detected.

Events that can trigger a new review include:

• a change in directors, shareholders, beneficial owners or authorised representatives;
• a move into a new jurisdiction, product line or type of activity;
• identity documents expiring or customer information becoming inconsistent;
• a new sanctions or PEP result;
• transactions that do not fit the stated purpose or expected pattern;
• material litigation, regulatory action or credible adverse reporting; or
• a request that changes the nature or scale of the relationship.

Under UK rules, CDD records are generally kept for five years after the relationship ends or an occasional transaction completes, then deleted unless another lawful basis applies.

What Happens When CDD Raises a Concern?

An unresolved discrepancy does not prove criminal conduct, but it changes the decision the organisation can responsibly make. The team may request more evidence, move the file to EDD or escalate it to the money laundering reporting officer or legal team. Where required CDD cannot be completed, the regulations may prevent the relationship or transaction from proceeding.

Where suspicion meets the reporting threshold, the responsible team should follow its legal process. The National Crime Agency states that UK Suspicious Activity Reports should be submitted through the SAR Portal. Staff must observe confidentiality and tipping-off rules. A business should seek advice rather than infer a reporting duty from a generic checklist.

Complex ownership, financial crime indicators or connected-party activity may require separate AML investigations and compliance support to establish what sits behind the alert.

CDD Across the UK, EU and United States

CDD obligations are jurisdiction-specific. The FATF Recommendations provide a shared policy baseline, but local legislation determines who is regulated, when checks are required and what reporting follows.

EU firms currently follow applicable national AML rules. The new EU Anti-Money Laundering Regulation 2024/1624 introduces directly applicable CDD rules, mostly from 10 July 2027. Directive 2018/1673, sometimes called 6AMLD, concerns money laundering through criminal law; it is not a complete CDD code.

In the United States, the FinCEN CDD Rule applies to specified covered financial institutions, not every business. It covers customer and beneficial-owner identification, relationship purpose and ongoing monitoring. Since February 2026, covered institutions need not repeat beneficial-owner identification at every new account opening in all cases. UK, EU and US requirements should be implemented separately.

Making the CDD Decision Defensible

CDD cannot guarantee that a customer is legitimate or that no future risk will emerge. It reduces uncertainty and creates an evidence trail for action.

Molfar Intelligence supports teams when routine checks leave material questions unresolved. Analysts verify records, map ownership and affiliations, examine sanctions and PEP links, and place local-language adverse information in context. Findings separate what is confirmed, what remains unclear and what may require escalation. This work supports internal decisions; it does not replace legal advice, regulatory ownership or transaction-monitoring controls.

Frequently Asked Questions

How often should customer due diligence be updated?

There is no single interval. Reviews should be risk-based, with material changes, inconsistent activity, new ownership, sanctions or PEP results and credible adverse information prompting an earlier review.

Does a PEP match mean the customer must be rejected?

No. PEP status is not proof of misconduct. The organisation should confirm the match, assess the exposure and apply measures required by law and policy. The evidence may support approval with controls, escalation or rejection.

Can a business outsource CDD?

External providers can support verification and investigation, but outsourcing does not automatically transfer regulatory responsibility. The regulated organisation should understand the work, assess the evidence and retain ownership of the decision.