Customer Due Diligence (CDD): What It Is, Its Requirements & How to Perform It

Customer due diligence is both a compliance issue and a challenge that fraudsters love to solve.

In this guide, we’ll show you how fraudsters fool KYC checks, and why sourcing alternative data is one of the best solutions to flag them. But first, a quick recap of the key terms.

What Is Customer Due Diligence?

Customer due diligence (CDD) means collecting, verifying and analyzing key information about a customer or client as a background check – so you can be confident they are who they claim to be. It is a form of risk management and can include the verification of identity documents (IDV), collection of alternative data, as well as data enrichment.

CDD is a legal requirement for certain industries – especially banks and neobanks, who must therefore comply with CDD regulations to avoid fines. It is generally split into two types: SDD (simplified CDD) and EDD (enhanced CDD).

Customer Due Diligence Requirements

Certain types of organizations, including banks, fintech firms, and investment companies, are required to conduct customer due diligence in a variety of scenarios. The below table shows some of these scenarios and the customer due diligence requirements that they relate to.

As reflected above, there are many types of customer due diligence requirements, and their stringency often depends on the level at which the organization finds the given customer to be law-abiding or suspicious.

With that said, the nature of CDD requirements depends on each organization’s policy, jurisdiction, and many other factors such as the risk appetite of the business itself.

What Are the Types of CDD?

Different customers present varying levels of risk, necessitating a risk-based approach to CDD. This method ensures that the intensity and scope of your due diligence efforts align with the potential risks posed by each customer.

For most clients, standard CDD practices are sufficient. These involve not only identifying but also verifying customer identities to understand their business nature and assess associated risks. 

However, for customers perceived as low-risk, simplified CDD may be adequate. In such cases, the process can be less stringent, often only requiring customer identification without the full extent of verification.

Conversely, there are scenarios where standard CDD might not suffice due to higher risk factors. Here, enhanced due diligence (EDD) becomes necessary. EDD involves a more thorough investigation, including deeper scrutiny of the customer’s source of funds, their business transactions, and more frequent transaction monitoring.

Customer Due Diligence for Banks

CDD is a fundamental requirement for banks and other financial institutions, mandated by anti-money laundering (AML) regulations and Know Your Customer (KYC) standards. Here are the main reasons banks need to do CDD:

• Preventing financial crimes: Banks must ensure that the customer is who they claim to be to prevent fraudulent activities. This verification helps mitigate risks associated with identity theft and other forms of financial deception.
• Regulatory compliance: CDD ensures that banks comply with local and international AML regulations. This compliance is crucial for avoiding penalties, fines, or more severe regulatory actions like licensing issues.
• Risk management: Implementing a risk-based approach allows banks to adjust the intensity of the due diligence process based on the customer’s risk profile. This tailored approach is essential for efficiently managing potential risks that vary with each type of customer and their activities.
• Operational integrity: Through ongoing monitoring and updates to CDD procedures, banks maintain operational integrity and keep up with changes in customer status or risk profiles.

Under AML/KYC regulations, banks have several obligations: they must verify the identity, address, and source of funds of new customers, a requirement for both initiating and maintaining financial relationships. 

For high-risk customers, banks are required to perform Enhanced Due Diligence involving a thorough investigation into the customer’s background and financial activities. Additionally, CDD is an ongoing duty, requiring banks to monitor transactions to identify and report any suspicious activities continuously. 

Overall, while CDD is a critical component of AML efforts, AML encompasses broader measures to prevent money laundering and maintain the integrity of the financial system.

What Is the Difference Between CDD and KYC?

Both Customer Due Diligence and KYC are required by law in some sectors, such as banking. CDD includes KYC checks, but also adds a focus on the source of funds, for purposes to do with money laundering and terrorism financing concerns.

Importantly, KYC is a process that takes places when a new customer signs up. On the other hand, CDD checks need to be ongoing throughout your relationship with the user.

The KYC happens at the onboarding stage. Its three key components include a first and last name, date of birth and residential address, but CDD typically looks into more than this.

More specifically:

How to Perform Customer Due Diligence

The CDD process is a legal requirement, and it must be performed for new business relationships (new customers), for transactions over a certain threshold, upon money laundering suspicion, or if a user presents unreliable documentation.

1. Basic CDD: The first step involves identifying and verifying a customer’s identity as part of the KYC regulations. This is essential at the start of any new business relationship. Verification can be achieved through various methods, such as online document verification, which checks the legitimacy of identity documents during customer onboarding.
2. Gathering additional information: Alongside identity verification, businesses should analyze the customer’s financial information and business activities. This helps in assessing potential risks associated with the customer.
3. Collaborate with third parties: Often, businesses may need to involve third parties like lawyers, auditors, or digital identity verification providers to enhance the due diligence process. It’s crucial to ensure these third parties are reliable and trusted.
4. Enhanced Due Diligence if needed: For customers identified as high-risk—such as politically exposed persons (PEPs) or individuals from high-risk countries—EDD is required. This involves a more in-depth investigation into the customer’s background, financial activities, and the sources of their funds.
5. Keeping records secure and up-to-date: Businesses must maintain records of all financial transactions and CDD data for at least five years. This documentation must be securely stored to protect sensitive information and ensure it is accessible for regulatory inspections. It’s also important to keep customer records up-to-date, particularly if there are significant changes in the customer’s circumstances, such as changes in ownership or business structure. 
6. Leverage technology: Utilizing open banking APIs and digital footprint analysis can provide additional insights into a customer’s financial behavior and identity. This includes analysis of email addresses, phone numbers, IP addresses and device intelligence to validate their authenticity and detect potential risks.
7. Continuous monitoring: Continuous monitoring of the customer’s transactions and activities is essential to detect any suspicious behavior promptly. This ongoing vigilance helps in adapting to any changes in the risk landscape and ensuring compliance with AML regulations.

The CDD process is integral to AML efforts, requiring a combination of traditional verification methods and modern technological tools to gather relevant and up-to-date data and to ensure thorough and effective risk management. This process not only helps in preventing financial crimes but also ensures that businesses comply with relevant regulatory requirements.

How to Save on CDD Costs with SEON

By offering one of the most advanced customer intelligence solutions on the anti-risk market, SEON can help you spend less on CDD checks. Leverage digital footprint analysis as a pre-KYC and pre-CDD step to block bad actors from gaining access, thus reducing your CDD workload.

Using a single email address or phone number, SEON checks 90+ social media and digital platforms. You will get access to public information on user profiles, bios and avatars, and even a “last seen” date – hundreds of data points about a user.

This means that you can weed out many criminals before they even reach CDD. IDV providers charge per CDD or KYC check. With SEON, you end up conducting fewer checks, more of which will be approvals.

The data enrichment information can be aggregated via manual query, API call or even a Chrome browser extension. Working in the background, this wall of defense can streamline CDD while also keeping an organization safe from all manner of fraud.

By building a fuller user profile using SEON’s fresh alternative data, you’ll:

• know exactly who you’re dealing with
• spot hidden connections between customers
• remove the risk of onboarding money launderers
• spend less on KYC and AML
• Help automate your KYC
• Improve AML fraud detection.

All with zero extra user friction, and a choice of integration that works with your business. SEON also provides AML checks, ensuring your customer is not on any watchlists, sanctions lists, blacklists or PEP lists.

Frequently Asked Questions

Sources

• Thales Group: Annual Report Ebook
• Identity Force: What Are the Odds of Getting Your Identity Stolen?
• CNBC: 25% of households are either banked or unbanked