Customer Due Diligence and Enhanced Due Diligence Auditing
This domain tests whether you can determine that customer files meet the required standard at onboarding and stay current afterwards. The exam focuses on the difference between evidence existing and evidence being adequate, and on sampling that reflects the institution's real risk distribution.
The standards you audit against
- Customer identification: name, date of birth, address and identification number, verified within a reasonable time through documentary or non-documentary means; records retained five years after account closure.
- Customer due diligence: understand the nature and purpose of the relationship, identify beneficial owners using both the ownership prong (typically 25 percent or more) and the control prong, and conduct ongoing monitoring.
- Enhanced due diligence triggers include politically exposed persons, high-risk jurisdictions, correspondent relationships, private banking, complex structures and unexplained wealth.
- EDD content: source of funds, source of wealth, adverse media, senior management approval and enhanced ongoing monitoring.
- Risk rating and periodic review: test whether refreshes happened within the institution's own stated cycle.
Designing the sample
Stratify by risk tier, product, channel, region and onboarding date. Include files onboarded during the period and files due for refresh, and consider exited or dormant relationships where relevant. Test existence and adequacy separately.
Worked example
From 4,000 high-risk files, the auditor selects 25 across three regions, weighted toward private banking. Four contain an EDD memo stating source of wealth as business owner with no supporting documentation, and in two of those the stated wealth is inconsistent with account activity. One file lacks the required senior management approval for a PEP. She reports a 16 percent error rate on EDD adequacy, distinct from a 100 percent pass rate on document existence - a distinction that reframes the finding from recordkeeping to control design.
Traps that cost marks
- Sampling only new accounts and never testing periodic refreshes.
- Equating a document's presence with adequate EDD analysis.
- Forgetting the control prong when the ownership prong reveals nothing.
- Overlooking third-party reliance arrangements and whether the institution obtained the underlying records.