Simplified or enhanced due diligence?

The difference between CDD and EDD is the depth of checks used to understand a customer’s identity, activities and risk. Customer due diligence (CDD) establishes a customer’s profile and assesses the risk of the relationship. Enhanced due diligence (EDD) adds focused investigation when risk is higher or information needs closer scrutiny. EDD does not automatically mean a customer should be rejected.

KYC, CDD and EDD are related, but they describe distinct parts of customer verification. Understanding how they fit together helps you apply checks proportionately and respond clearly when risk indicators emerge.

This guide explains what EDD can involve, how it differs from CDD and KYC, and which customer, transaction or geographic indicators may prompt enhanced checks. It also covers how additional verification, screening and ongoing monitoring can build a clearer risk picture, helping you be thorough without applying the same checks to every customer.

What is Enhanced Due Diligence (EDD)?

Enhanced due diligence (EDD) means investigating a customer or transaction more deeply when the risk warrants closer scrutiny. Customer due diligence (CDD) establishes who the customer is, what they do and the risks their relationship may present. EDD adds checks targeted at higher risks, such as unclear ownership or possible links to financial crime.

Australian businesses subject to AML/CTF requirements conduct CDD during customer onboarding and when relevant risks or circumstances change. Checks should reflect the customer and relationship, rather than apply the same level of scrutiny to every case.

Due diligence can be adjusted across three levels. Simplified due diligence (SDD) applies to eligible low-risk cases where the relevant framework permits it. Standard CDD establishes customer identity and risk. EDD adds investigation and monitoring when a higher-risk factor needs resolution. The difference between CDD and EDD is the scope and depth of the response, not whether risk matters.

Choose the level by documenting the risk and the question each check needs to answer. For example, a complex ownership structure may require tracing who ultimately controls a business. Adverse media linked to financial crime may call for checking the identity, role and relevance of the person mentioned. A database match alone does not confirm identity or prove wrongdoing.

Legal requirements and internal risk policies can both prompt EDD. A politically exposed person (PEP) connection, links to a high-risk jurisdiction, unusual transactions without a clear economic purpose, or inconsistent onboarding information can warrant further examination. PEP status calls for enhanced measures, but does not by itself prove criminal activity or automatically require rejection.

Failing to conduct required CDD or EDD can expose a business to regulatory enforcement and penalties under applicable Australian requirements. Consequences depend on the breach and the law that applies; there is no single penalty for every case.

Use CDD as the foundation, then increase scrutiny when specific indicators leave material questions unanswered. Record why you chose that level, what evidence you reviewed and any changes that affect the customer’s risk profile.

Enhanced investigation and documentation under EDD

EDD should answer a defined risk question, not generate a pile of unrelated documents. For a business with layered ownership, the question may be who ultimately owns or controls it. For a PEP, it may be whether their funds and wealth align with their known activities. Define the question first, then gather evidence that can resolve it.

How do businesses conduct CDD and EDD step by step? Identify and verify the customer, understand the relationship and assess risk. If a concern emerges, define the unanswered question, gather relevant evidence, assess the results, record the decision and set any monitoring actions. For example, an unexplained payment pattern may call for transaction context and evidence about the source of funds.

EDD may draw on several sources, depending on the customer and risk:

• Ownership and control: trace a company’s structure through parent entities, trusts or other intermediaries to the people who ultimately own or control it.
• Funds and wealth: compare the stated source of funds with relevant financial records, such as bank statements, tax statements, sale contracts or loan agreements.
• Background and screening: review adverse media, sanctions and watchlist results, and relevant information about politically exposed persons and their close associates.
• Business activity: compare the customer’s stated operations with available information about suppliers, clients, subsidiaries or trading activity.

A match is a prompt to investigate, not proof of wrongdoing. Resolve whether a watchlist or adverse-media result refers to the same person, whether the information is relevant and whether it changes the risk assessment. Document the evidence and reasoning behind your conclusion.

What are the record-keeping and reporting obligations for CDD and EDD in Australia? Businesses subject to applicable AML/CTF requirements must keep records that evidence their checks and decisions. The relevant rules determine the retention period and required detail. Reporting duties also depend on the applicable requirements, including whether the facts call for a suspicious matter report.

For audit-ready evidence, retain the information gathered, its source, checks completed, unresolved discrepancies, risk assessment, approvals and rationale for the final action. A clear record should let another authorised reviewer follow the decision without reconstructing the investigation. Update it when new evidence or changed customer activity alters the risk picture.

Keep the investigation proportionate: request information that addresses the risk, record what it establishes, and note any remaining concern and response. CDD screening and record-keeping support can help organise these steps within a consistent AML/CTF process.

FATF recommendations for CDD and EDD

The Financial Action Task Force (FATF) sets international standards for countering money laundering and terrorist financing. Its 40 Recommendations include Recommendation 10 on customer due diligence. These standards guide national systems; they are not a single checklist that applies directly, word for word, in every country. In Australia, businesses must follow the AML/CTF requirements that apply to their sector and activities.

Recommendation 10 sets out the core CDD approach. Institutions identify customers, verify identity, understand the purpose and intended nature of a relationship, and conduct ongoing due diligence. For a company, that assessment includes its beneficial owners and leadership. The information gathered should help the institution understand the relationship and assess whether activity fits the customer’s profile.

FATF recommendations also show where enhanced measures become relevant:

• Recommendation 10: Apply CDD measures and use enhanced measures for higher-risk relationships or transactions.
• Recommendation 12: Apply enhanced measures to politically exposed persons (PEPs), including measures to establish the source of wealth and source of funds.
• Recommendation 19: Apply enhanced measures to relationships or transactions involving higher-risk countries.
• Ongoing review: Keep customer information and risk assessments current, whether or not EDD is being applied.

These recommendations link the level of investigation to the identified risk. For example, a transaction involving a higher-risk country may need further context about its purpose, counterparties and supporting information. A PEP relationship may require checks to establish the person’s role and assess relevant funds. Collecting more documents without tying them to a specific risk question does not strengthen the assessment.

FATF standards also distinguish preventive checks from assumptions of wrongdoing. A PEP connection or sanctions result should be assessed in context, including whether the match refers to the customer and what the relationship means for risk. Adverse media can inform an assessment, but its relevance, reliability and connection to financial crime matter.

For Australian businesses, FATF recommendations provide a framework for understanding why CDD and EDD are risk-based. Applicable Australian requirements determine a particular business’s obligations. A practical process is to identify the customer, understand the relationship, assess risk, apply proportionate checks and update the assessment when relevant information changes. For instance, a previously straightforward business relationship may need reassessment after an ownership change or unusual transaction.

Use FATF’s Recommendations 10, 12 and 19 as distinct reference points, not substitutes for local obligations. That distinction helps institutions explain why they collected particular information, what risk it addressed and how the evidence informed their decisions.

Indicators that can trigger EDD

EDD may be appropriate when customer information, screening results or transaction activity indicate higher risk. In Australia, assess each indicator in context: a flag starts an enquiry but does not by itself prove suspicious conduct or financial crime.

Politically exposed persons (PEPs) warrant particular attention because their public roles can create exposure to bribery or misuse of funds. A PEP match needs to be resolved: confirm whether it identifies the customer, establish their role and assess relevant relationships. PEP status calls for enhanced measures, but does not automatically mean the person is high-risk or should be rejected. The customer’s circumstances and other risk factors still matter.

Other indicators can include:

• Geographic exposure: a customer, counterparty or transaction linked to a higher-risk jurisdiction may need closer assessment of purpose, counterparties and funds.
• Unclear ownership: layers of companies, trusts or nominees can make it difficult to identify who ultimately controls a business.
• Unusual activity: transactions without a clear economic purpose, a sudden rise in volume, or a marked change in funding sources may depart from the customer’s known profile.
• Adverse media: credible reporting associated with financial crime can prompt checks into whether the coverage concerns the same person and remains relevant.
• Sanctions or watchlist results: a potential match requires examination of identity and the list entry before the business decides what action is appropriate.
• Sector or profession: work involving substantial cash, complex cross-border flows or access to public funds may affect the customer’s risk assessment.

How do politically exposed persons and high-risk customers affect CDD and EDD? Apply CDD to understand each customer, then use enhanced measures where PEP exposure or other factors raise the risk. For instance, a PEP’s role combined with opaque company ownership may warrant deeper checks than either factor alone.

Monitoring can reveal indicators after onboarding. Compare current activity with the customer’s expected pattern, then investigate unexplained changes, such as payments to new jurisdictions or a sudden shift in transaction size. Screening is a separate control: it can surface sanctions, PEP or adverse-media information, while transaction monitoring identifies behaviour that may need explanation.

Respond systematically when a trigger appears:

1. Identify the specific alert, such as a watchlist match or unexplained payment.
2. Resolve identity and gather information that addresses the concern.
3. Reassess the customer’s risk and document the evidence and decision.
4. Set proportionate monitoring actions, then review them if activity changes.

A single indicator may have an innocent explanation, while several connected indicators can change the overall risk picture. Record why you selected the checks and whether the evidence resolved the concern, including any suspicion relating to money laundering or terrorist financing.

Differences between KYC, CDD, and EDD

KYC, CDD and EDD are connected but distinct parts of customer risk management. KYC is the broader process of knowing who a customer is and understanding the relationship. CDD is the due diligence used to identify and assess that customer. EDD adds deeper checks when higher risk or unresolved information calls for closer investigation.

The terms are not interchangeable. KYC provides the overall framework; CDD is a core assessment within it; EDD is a more intensive response to risk. The practical difference between CDD and EDD is the depth and focus of the checks, not a separate customer-identification system.

For example, consider an Australian business customer with clear ownership and activity consistent with its stated purpose. CDD can establish relevant identity details, clarify the relationship and form a risk profile. If the business has several intermediary entities, EDD can investigate the ownership chain and establish who ultimately controls it.

A PEP illustrates another distinction. Screening may identify a possible PEP connection, but screening alone is not CDD or EDD. Resolve the result against the person’s identity and role, then assess the relationship and apply enhanced measures where the risk warrants them.

Screening and transaction monitoring are not synonyms for due diligence. Sanctions screening compares customers against relevant lists; adverse-media screening surfaces reporting for assessment; monitoring looks for activity that differs from the expected pattern. Each control can inform a customer’s risk profile, but none replaces the assessment and decision-making involved in CDD or EDD.

In practice, keep the sequence clear: establish the customer and relationship, complete CDD, then use EDD to investigate a defined risk concern. Maintain records that connect each document or result to the question it helped answer. This makes the decision easier to explain, especially if a customer’s ownership, activity or politically exposed status changes. A consistent workflow can keep verification and screening connected to these decisions through customer due diligence workflows.

Trancher: End-to-End AML/CTF Program Management

Trancher brings customer verification, risk monitoring and reporting into an end-to-end AML/CTF program management process. If your team needs to apply CDD consistently, respond to higher-risk indicators or review customer activity over time, Trancher connects these practical compliance activities.

Client Verification & Due Diligence covers KYC/CDD and screening, while Ongoing Risk Monitoring & Client Activity Tracking supports reviews as customer activity changes. Regulatory & Suspicious Matter Reporting helps manage reporting workflows within the broader AML/CTF program management platform.

Consider Trancher when disconnected checks, monitoring and records make it harder to maintain a clear view of customer risk. Contact Trancher to discuss how its AML/CTF program management platform can support your compliance process.

Turn your risk approach into clear next steps

Make due diligence a working part of how your business understands and manages customer risk. Specify who reviews a concern, what evidence informs the decision and how changes in customer activity prompt reassessment. A clear process helps staff act consistently and keeps decisions grounded in the available information.

The difference between CDD and EDD matters in practice when it guides what happens next, not simply how a customer is labelled. Review whether your procedures help staff recognise risk indicators, escalate unresolved questions and record the reasoning behind decisions. As your business and customer relationships evolve, keep the process aligned with your operating needs.

Trancher can help Australian businesses put their AML/CTF processes into practice. Explore how Trancher can support your compliance needs and take a considered next step towards a clearer, more organised approach.

Frequently Asked Questions

What is Customer Due Diligence (CDD)?

Customer due diligence is a documented way to establish and maintain reliable customer information. For a sole trader, for example, a business may need to distinguish the person’s legal name from their trading name in its records. Clear notes on information sources help staff understand where details came from and when they were last reviewed, rather than relying on informal knowledge held by one employee.

What’s the Difference Between CDD and EDD?

CDD is the customer assessment process; EDD describes the extra scrutiny applied within that process when the assessment warrants it. A business can keep one customer file while recording which additional tasks were completed and why. This makes the review history easier to follow without treating EDD as a separate customer type or creating a second, disconnected onboarding record.

When Is EDD Required?

EDD is required when the AML/CTF obligations that apply to a business call for enhanced measures. Map each such requirement to your procedures, so staff know which circumstances need additional review rather than relying solely on individual judgement. Applicable Australian requirements depend on the business’s regulated activities; internal policy can also set out how staff escalate risk concerns.

When is EDD needed?

EDD may be needed after a relationship begins, not just during onboarding. For instance, a customer may start using a service in a way that differs materially from the purpose recorded in their file. Staff can compare the new use with the existing profile, note what has changed and decide whether the assessment remains adequate. This gives reviewers a clear reason to revisit the file.

Why are CDD and EDD necessary?

CDD and EDD help a business make consistent, explainable decisions about customer relationships. A documented approach can help staff handle similar cases consistently, even when the original reviewer is unavailable. For example, recording why information was accepted or queried gives a colleague context for later interactions and helps avoid assumptions when a customer’s circumstances change.

How to navigate EDD?

Keep an EDD case file organised around the questions that remain open. Assign responsibility for gathering each piece of evidence, record what has arrived and note whether it resolves the concern. Before closing the review, have the decision-maker confirm that the file explains the rationale and any follow-up actions. This simple case-management discipline helps prevent unanswered requests or unresolved issues from falling between teams.

Is EDD part of CDD?

Yes. EDD is an enhanced application of customer due diligence, not an unrelated compliance process. A practical procedure can use the same customer record and add a clearly identified enhanced-review stage when needed. Staff should be able to distinguish the original assessment from later work, so the record shows what prompted deeper scrutiny and how the additional review affected the relationship.

What do CDD and EDD stand for in anti-money laundering?

CDD stands for Customer Due Diligence, and EDD stands for Enhanced Due Diligence. These terms describe different levels of customer review within anti-money laundering controls. In procedures or training materials, define each acronym when it first appears, then use it consistently. Consistent terminology helps staff distinguish the customer assessment from additional review tasks in forms, case notes and internal handovers.