The Legal Basis

The requirements come from Part 3 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, usually called the MLRs. The main provisions are:

The FCA supervises compliance for the firms it regulates, and its Financial Crime Guide sets out what it expects in practice. The JMLSG guidance gives detailed, sector-specific direction that the FCA takes into account. Our guide to the Money Laundering Regulations 2017 covers the wider framework.

When CDD Applies

Under regulation 27, firms must apply customer due diligence when they:

• establish a business relationship;
• carry out an occasional transaction above the relevant threshold;
• suspect money laundering or terrorist financing;
• doubt the accuracy of information previously obtained; and
• at appropriate times for existing customers, on a risk-sensitive basis, including when their circumstances change.

That last point is often overlooked. CDD isn’t a one-off onboarding exercise. Existing customers must be brought up to date when the firm learns something relevant, and on a periodic cycle linked to their risk.

What Standard CDD Involves

Regulation 28 sets out the core elements:

• Identify the customer. Obtain the customer’s identity, and for corporate customers their name, registration number, registered office and principal place of business.
• Verify identity. Check the information against reliable, independent sources, such as documents, electronic verification or registers.
• Identify the beneficial owner. Establish who ultimately owns or controls the customer, and take reasonable measures to verify their identity.
• Understand ownership and control. For legal entities and arrangements, understand the structure well enough to know who is behind it.
• Assess the purpose and intended nature of the relationship. Know what the customer expects to do, so unusual activity can be spotted later.
• Verify anyone acting on the customer’s behalf. Confirm their identity and authority.
• Conduct ongoing monitoring. Scrutinise transactions and keep due diligence information up to date.

The MLRs require firms to apply these measures on a risk-sensitive basis. The extent of checks should reflect the risk the customer presents, informed by the firm’s own business-wide risk assessment.

Beneficial Ownership

For corporate customers, the beneficial owner is generally any individual who ultimately owns or controls more than 25 per cent of the shares or voting rights, or who otherwise exercises control over the management of the entity. Where no one meets that test, firms must identify the senior managing official and record the steps taken. Trusts and other arrangements have their own rules, covering settlors, trustees, beneficiaries and anyone exercising control.

Firms can use registers such as Companies House as part of their checks, but shouldn’t rely on them alone. The MLRs also require firms to report material discrepancies they find between the information they hold and the information on the register. Complex structures, nominee arrangements and entities in multiple jurisdictions all call for closer examination, and they are also where sanctions ownership and control questions arise. Our guide to sanctions screening covers that overlap.

Simplified Due Diligence

Regulation 37 allows firms to apply simplified due diligence where they determine that a relationship or transaction presents a low risk of money laundering, taking into account their risk assessment and relevant risk factors. SDD is a reduction in the extent, timing or type of measures, not an exemption from CDD. Firms still need to identify the customer and monitor the relationship, and must stop applying SDD if the risk changes or suspicion arises.

Supervisors pay close attention to how SDD is used. The decision to apply it should be documented and justified, not applied by default to whole customer segments without analysis.

Enhanced Due Diligence

Regulation 33 requires enhanced due diligence and enhanced ongoing monitoring in higher-risk situations. These include:

EDD measures typically include obtaining more information about the customer and beneficial owners, establishing the source of funds and source of wealth, obtaining senior management approval to establish or continue the relationship, and monitoring the relationship more closely. For PEPs, senior management approval and source of wealth and funds checks are specifically required. Our guide to politically exposed persons explains the PEP rules in detail, including the FCA’s guidance on treating domestic PEPs proportionately.

Source of funds and source of wealth

These two concepts are often confused. Source of funds is where the money for a particular transaction or relationship comes from, such as a salary account, a property sale or an inheritance. Source of wealth is how the customer built up their overall wealth. EDD usually requires both to be understood and, where the risk warrants it, evidenced. A plausible explanation backed by appropriate documents is the standard; firms are not expected to audit every customer’s life history.

Reliance on Third Parties

Regulation 39 allows a firm to rely on certain third parties, such as other regulated firms, to carry out CDD measures. Reliance can save duplication, but the relying firm remains liable for any failure. It must obtain the relevant information immediately and have arrangements to obtain copies of the underlying documents on request. Firms that rely on introducers or intermediaries need to check that the conditions for reliance are genuinely met, rather than assuming another firm’s checks are adequate.

Ongoing Monitoring

CDD continues for the life of the relationship. Ongoing monitoring has two parts: scrutinising transactions to make sure they are consistent with what the firm knows about the customer, and keeping documents, data and information up to date. Most firms set periodic review cycles by risk rating, for example more frequent reviews for high-risk customers, and trigger event-driven reviews when something changes. Our guide to transaction monitoring covers the transaction side.

Overdue periodic reviews are one of the most common supervisory findings. A firm that onboarded customers well five years ago but hasn’t reviewed them since may have little idea what its higher-risk customers now look like.

Common Failings

The FCA’s published final notices and thematic reviews regularly cite these issues, and they often reflect resourcing and governance problems rather than gaps in policy.

Who Owns Customer Due Diligence?

CDD is usually carried out by the first line: onboarding teams, relationship managers and operations. The MLRO, as SMF17, is accountable for oversight of the firm’s anti-money laundering systems and controls, which includes setting CDD standards, monitoring their application and reporting to the board. Under the MLRs, firms must also appoint a board member or senior manager responsible for compliance with the regulations, which at FCA-regulated firms is often aligned with the SMCR responsibilities.

As firms grow, CDD quality often becomes a dedicated role: a KYC or onboarding lead, sitting within a financial crime function led by the MLRO or a head of financial crime. Our guides to the head of financial crime and MLRO roles and deputy MLROs explain how those roles fit together.

What This Means When You Hire

Strong CDD depends on people who understand the firm’s customers and can make sensible, documented judgements about risk. When we recruit MLROs and financial crime leaders, we look for evidence that candidates have set and enforced CDD standards, handled complex beneficial ownership and source of wealth cases, and remediated backlogs. Our pages on MLRO recruitment and financial crime leadership recruitment explain how we run those searches. For smaller firms, a fractional MLRO or a combined compliance officer and MLRO can provide the senior oversight, and an interim MLRO can lead a remediation.

Frequently Asked Questions

What is the difference between CDD and KYC?

“Know your customer” is the common industry term; customer due diligence is the term used in the MLRs. In practice they describe the same process.

Is EDD required for all PEPs?

Yes, but the extent should be proportionate. The FCA expects firms to treat domestic PEPs and their family and associates as lower risk than foreign PEPs unless other factors indicate otherwise.

How often should customers be reviewed?

The MLRs don’t set fixed periods. Firms set review cycles by risk, typically more frequently for high-risk customers, and review when circumstances change.

Can we rely on another firm’s CDD?

Yes, under regulation 39, if the conditions are met. The relying firm remains responsible and must be able to obtain the underlying documents.

Who signs off EDD cases?

Senior management approval is required for certain EDD relationships, including PEPs. Many firms involve the MLRO or a delegate in high-risk approvals.