What Is Enhanced Due Diligence (EDD) and When Do You Need It?

What Is Enhanced Due Diligence?

Enhanced Due Diligence (EDD) is a heightened level of customer investigation required when a business relationship or transaction presents a higher risk of money laundering, terrorism financing, or other financial crime. It goes well beyond the standard identity verification that applies to most customers — EDD demands a deeper examination of who a person is, where their money comes from, and whether the business relationship makes sense given everything compliance teams can establish.

At its core, EDD is a risk-proportionate response. Regulations don't require the same scrutiny for a low-risk domestic retail account and a politically exposed person moving large sums through complex corporate structures. EDD is the mechanism that allocates additional compliance resources where the risk actually sits.

EDD is required under multiple regulatory frameworks globally, including FinCEN's Customer Due Diligence Rule in the United States, the EU's Anti-Money Laundering Directives (particularly 4AMLD and 6AMLD), the UK's Money Laundering Regulations, and the Financial Action Task Force (FATF) Recommendations that underpin AML frameworks in over 200 jurisdictions.

EDD vs. CDD vs. SDD: When Each Applies

AML compliance programs typically operate across three tiers of due diligence, applied based on the assessed risk level of the customer or transaction:

The key principle: SDD is never a default — it requires a specific, documented basis for the reduced risk assessment. CDD is the baseline. EDD is triggered by risk factors that standard CDD cannot adequately address.

Red Flags That Trigger EDD

Regulators identify specific categories of customers and situations that require EDD. Most AML programs use a risk-based approach: the more risk factors present, the more extensive the EDD measures required.

Step-by-Step EDD Process

There is no single prescribed EDD process — regulators require a risk-based approach, meaning EDD measures should be proportionate to the specific risks identified. That said, most defensible EDD programs follow a structured sequence.

• 1

  Document the EDD Trigger

  Before conducting any additional investigation, document why EDD was triggered. Is this a PEP? A transaction from a high-risk jurisdiction? An adverse media finding? A complex ownership structure? The trigger determines the scope of EDD measures required and creates the audit trail regulators expect.

• 2

  Obtain Senior Management Approval

  Most AML regulations require senior management sign-off before establishing or continuing a high-risk business relationship. This isn't a formality — it assigns accountability and ensures the institution's risk appetite is consciously applied to the decision.

• 3

  Verify Identity to a Higher Standard

  Standard CDD identity verification is typically insufficient for EDD. Obtain additional identification documents, verify through independent sources, and confirm that the identity presented is consistent with what public records, corporate registries, and screening databases show.

• 4

  Establish Source of Funds

  Identify the specific origin of the funds being used in the transaction or relationship. Bank statements, wire transfer records, or third-party verification may be required. Source of funds answers: where did the money in this transaction come from?

• 5

  Establish Source of Wealth

  For individuals, establish how they accumulated their overall wealth — not just the funds in this transaction. Business activities, employment history, investments, inheritance. Source of wealth answers: how did this person become wealthy? For PEPs in particular, this step is non-negotiable.

• 6

  Screen Against Global Databases

  Run comprehensive screening across sanctions lists (OFAC, EU, UN, national lists), PEP databases, adverse media sources, litigation records, and regulatory enforcement databases. Document every source checked, the date of the search, and the results — including negative results that confirm no matches were found.

• 7

  Identify and Verify Beneficial Owners

  For corporate customers, trace the ownership structure through all layers to identify the ultimate beneficial owners (UBOs). For complex structures, this may require reviewing company registries, shareholder agreements, trust deeds, and nominee arrangements across multiple jurisdictions.

• 8

  Understand the Purpose and Nature of the Relationship

  Document the expected pattern of activity: what transactions are anticipated, in what volumes, for what business purpose? This baseline is essential for ongoing monitoring — you can only detect anomalous activity if you've established what normal looks like.

• 9

  Implement Enhanced Ongoing Monitoring

  EDD doesn't end at onboarding. High-risk relationships require heightened transaction monitoring, regular re-screening for new sanctions or PEP status, and periodic file reviews (annually or more frequently for the highest-risk relationships). Any changes in customer circumstances that affect the risk assessment must trigger a re-evaluation.

• 10

  Document Everything

  The completeness and quality of EDD documentation is as important as the investigation itself. Regulators assess both the substance of your EDD program and whether you can demonstrate what you did, when you did it, and why you reached the conclusions you reached. Records should be retained for at least five years in most jurisdictions.

Regulatory Basis for EDD

EDD requirements are embedded across multiple regulatory frameworks. Understanding which rules apply to your organization determines the specific EDD obligations you face.

United States — FinCEN CDD Rule

FinCEN's Customer Due Diligence Rule (31 CFR 1010.230) requires covered financial institutions — banks, broker-dealers, mutual funds, futures commission merchants, and introducing brokers — to implement risk-based CDD programs. While the rule doesn't use the term "EDD" explicitly, it requires enhanced measures for higher-risk customers. The Bank Secrecy Act (BSA) and FinCEN guidance consistently require additional scrutiny for PEPs, correspondent relationships, and customers with complex ownership structures. See our article on the FinCEN Beneficial Ownership Rule for related background.

European Union — AMLD4 and AMLD6

The EU's Fourth Anti-Money Laundering Directive (AMLD4, 2015/849) and Sixth Anti-Money Laundering Directive (AMLD6, 2018/1673) explicitly mandate EDD for high-risk situations. Article 18 of AMLD4 specifically requires EDD for business relationships and transactions involving high-risk third countries, PEPs, and certain other categories. Member states must transpose these requirements into national law.

FATF Recommendations

The Financial Action Task Force's 40 Recommendations establish the international standard for AML/CFT. Recommendation 10 covers CDD, and Recommendation 12 specifically requires EDD for PEPs. Recommendation 13 mandates EDD for correspondent banking. Countries rated by FATF are assessed on whether their domestic laws and practices implement these standards — making FATF the de facto global floor for EDD requirements.

UK Money Laundering Regulations 2017

The UK's Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) implement AMLD requirements in UK law. Regulation 33 sets out mandatory EDD situations including high-risk third country transactions, PEPs, and correspondent relationships. The Financial Conduct Authority (FCA) supervises financial firms' compliance and has levied significant fines for inadequate EDD programs.

How Veridact Automates EDD Checks

The most time-consuming part of any EDD process is the investigative work: finding relevant information across dozens of disparate sources, assessing its significance, and documenting what was checked. Manual EDD research for a complex relationship can take days. Veridact compresses that research phase from days to minutes.

14-Source Simultaneous Screening

Veridact's screening engine searches across 14 data sources in parallel, covering the major categories required for defensible EDD documentation:

• Global sanctions lists — OFAC SDN, EU Consolidated List, UN Security Council, OFSI (UK), and national lists across major jurisdictions
• PEP databases — Politically exposed persons and their relatives and close associates (RCAs) globally
• Adverse media — News coverage of financial crime, fraud, bribery, corruption, regulatory violations, and reputational risk
• Regulatory enforcement databases — SEC, DOJ, FTC, FINRA, CFPB, OCC, FDIC enforcement actions and settlements
• Litigation intelligence — Federal and state court records, civil judgments, criminal proceedings across 14 sources including CourtListener, Harvard Caselaw, and Violation Tracker
• Beneficial ownership registries — Corporate ownership data from SEC EDGAR, OpenCorporates, GLEIF, and national business registries
• OSINT signals — Open-source intelligence across digital presence, corporate history, and public information relevant to risk assessment

Documented, Auditable Reports

Every Veridact screening produces a structured due diligence report that documents each source checked, the date and time of the search, what was found (and what wasn't), and a risk assessment synthesizing the findings. This documentation is exactly what regulators expect to see during examinations — a clear record demonstrating that EDD was conducted systematically and thoroughly.

Ongoing Monitoring Integration

EDD isn't one-and-done. Veridact supports re-screening workflows to maintain current information on high-risk relationships, surfacing new sanctions designations, PEP status changes, adverse media, or regulatory actions as they occur — ensuring your EDD program covers the ongoing monitoring obligation, not just the initial onboarding check.

For compliance teams managing dozens or hundreds of EDD relationships, the difference between manual research and automated screening isn't just speed — it's consistency, coverage, and documentation quality. Every search is systematic, every source is checked, and every result is recorded.

Frequently Asked Questions

Building a Defensible EDD Program

Regulators don't expect perfection — they expect a risk-based, documented, consistently applied program. An EDD failure that results in enforcement action is rarely a failure to check a box; it's usually a failure of process: inconsistent application, poor documentation, no ongoing monitoring, or senior management who weren't genuinely informed of the risks they approved.

The fundamentals of a defensible EDD program: clear policies that define EDD triggers and required measures, systematic implementation that applies those policies consistently regardless of who handles the review, thorough documentation of what was investigated and why conclusions were reached, and genuine ongoing monitoring that treats EDD as a continuous obligation rather than a one-time onboarding event.

Technology can help with the investigative and documentation burden — but the judgment calls, the risk appetite decisions, and the accountability for those decisions remain with the institution and its compliance leadership.