Customer Due Diligence
Domain 3 tests the mechanics of CDD: when it must be performed, what the four core elements are, how identification differs from verification, and what to do when CDD cannot be completed.
The four elements
- Identify the customer and verify identity using reliable, independent sources.
- Identify the beneficial owner and take reasonable steps to verify.
- Understand the purpose and intended nature of the relationship.
- Conduct ongoing monitoring to keep the profile current and consistent with activity.
Timing and standards
CDD is normally completed before establishing the relationship or carrying out an occasional transaction above the applicable threshold. Limited deferral may be permitted for low-risk cases where it is essential not to interrupt business, with safeguards such as a cap on transactions and prompt completion. Simplified measures may apply only where risk is demonstrably low and must still include identification and verification. Enhanced measures apply to higher-risk situations.
Non-face-to-face and third parties
Remote onboarding needs compensating controls: liveness checks, document authentication, independent data sources, address verification, and sometimes first-payment-from-an-account-in-the-customer's-name. Where an introducer or third party performs CDD, the institution remains responsible, must obtain the information immediately, and must confirm the third party is regulated and supervised.
Worked example
A company applies to open an account. The director is a nominee, the shareholder is a BVI company, and the stated purpose is 'consulting'. The analyst verifies the director's identity, then traces the shareholder chain to a natural person, confirms the consulting contract and expected turnover, and notes the mismatch between the stated turnover and an expected single large deposit. Verification of the director alone is insufficient because it does not answer who really owns or controls the entity. The file escalates to EDD.
Traps that cost marks
- Photocopying an ID and calling that verification.
- Accepting certified copies without checking who certified and whether they are independent.
- Using simplified measures for a PEP or a high-risk jurisdiction.
- Omitting the purpose and intended nature element, then being unable to judge monitoring alerts.
- Failing to define the outcome when CDD cannot be completed: do not open, consider an STR, and consider exiting.