Enhanced due diligence, done so it survives the exam

Customer due diligence establishes who you are dealing with. Enhanced due diligence establishes whether you should be dealing with them at all, and on what terms. The distinction matters because programs frequently collect more documents and call it EDD, when what supervisors are looking for is more *understanding*.

EDD is risk-based. There is no universal list of triggers and no dollar threshold that switches it on. What your program must do is define, in writing, which relationships warrant it, apply that definition consistently, and be able to show why a given customer was or was not escalated.

The most common structural error is treating EDD as an onboarding event. For genuinely higher-risk relationships it is an ongoing obligation — the file should show refresh, not just origination.

Your risk assessment should drive this rather than a borrowed checklist, but relationships that commonly warrant enhanced treatment include:

• Politically exposed persons, their family members and close associates
• Customers with beneficial ownership that is layered, opaque, or spans secrecy jurisdictions
• Correspondent and nested relationships, particularly cross-border
• Money services businesses, and fintech programs sponsored by your institution
• Cash-intensive businesses whose activity does not match their stated model
• Customers with unresolved adverse media or a screening hit that could not be cleared
• Digital-asset exposure, including customers whose counterparties are exchanges or mixers

A file that holds up is one where a reviewer who was not there can reconstruct the decision. In practice that means:

• The stated purpose of the relationship, and the expected activity that follows from it
• Beneficial ownership established to a natural person, with the basis for each step recorded
• Source of wealth and source of funds, evidenced rather than attested
• Screening results with each hit either confirmed or excluded, and the reason stated
• A written risk rationale — why this customer, at this rating, is acceptable
• Named approval at the right level, dated
• A defined review cadence, and evidence the reviews happened

Across remediation work, the same handful recur — and almost none of them are about missing documents.

• EDD performed but never documented as a conclusion, so the file shows activity without judgment
• Beneficial ownership captured at the entity layer and never traced through to a person
• Screening alerts closed with "no match" and no record of how that was determined
• Source of wealth satisfied by the customer's own statement, uncorroborated
• Periodic review dates passed with no evidence anything was reviewed
• Risk ratings that never move, regardless of what the activity later shows

A large share of EDD is documentary and can be handled inside the compliance function. The remainder cannot: when ownership goes opaque, when adverse media cannot be resolved to a person, or when the stated source of wealth does not reconcile with the public record, you need someone to go and establish the facts.

That fieldwork runs through AM Forensics, our investigative practice — open-source intelligence, corporate registries, court and property records, with every finding cited to the record behind it, and written so it can be filed directly as the EDD record.

See how AM Forensics reports a subject

This page describes what supervisors generally expect and what a defensible file contains. It is general information, not legal advice, and it does not create an advisory relationship. Requirements are risk-based and vary by institution, charter, and jurisdiction — take advice on your own facts.