Enhanced Due Diligence Checklist: What to Collect and Verify

Enhanced Due Diligence is not just a more thorough version of your standard KYC process — it is a qualitatively different level of scrutiny that requires specific additional documentation, different approval processes, and more intensive ongoing oversight. Understanding exactly what EDD requires in practice is essential for building a program that actually satisfies regulators and sponsor banks.

This checklist covers what to collect and verify for each category of customer that triggers EDD.

Before the Checklist: EDD Triggers

EDD is required when a customer meets defined high-risk criteria. Your CDD policy should specify which of the following triggers EDD for your specific business:

Politically Exposed Person status — the customer or any beneficial owner is a current or former senior government official, their immediate family member, or a known close associate.

High-risk geography — the customer's country of residence, citizenship, or primary business operation is on the FATF grey or black list, subject to OFAC comprehensive sanctions, or identified as high-risk in your AML risk assessment.

High-risk industry — the customer operates in a sector associated with elevated financial crime risk: money services, cannabis, gambling, adult entertainment, precious metals dealing, or arms dealing.

Complex or opaque ownership — a business customer has layered ownership structures, offshore holding companies, nominee shareholders, or trust structures as owners that make beneficial ownership difficult to establish.

Adverse information — the customer has been flagged by adverse media screening for prior financial crime, regulatory violations, or reputational issues.

EDD Checklist — Individual Customers

For individual customers triggering EDD, collect and verify the following in addition to your standard CIP requirements.

Source of funds — documentation showing where the specific funds being transacted originated. This may include bank statements, income documentation, proceeds of sale documentation, or other evidence appropriate to the customer's stated source of funds.

Source of wealth — documentation showing how the customer accumulated their overall wealth. This goes beyond source of funds to address the broader financial picture — employment history, business ownership, inheritance, investment proceeds, or other wealth sources.

Purpose of the relationship — a more detailed explanation of why the customer needs your specific product and what they intend to do with it, beyond the standard account purpose question asked at standard onboarding.

Enhanced identity verification — additional government-issued identification, particularly for customers from jurisdictions where identity document reliability is lower.

Adverse media screening documentation — evidence of the adverse media screening conducted and the conclusions reached.

For PEP customers specifically, also collect:

Confirmation of current position or confirmation and date of departure from prior position, the specific government position held, and any relevant information about the government's jurisdiction and the nature of the PEP's authority.

EDD Checklist — Business Customers

For business customers triggering EDD, collect and verify the following in addition to your standard KYB requirements.

Enhanced beneficial ownership verification — go beyond the standard 25% threshold. For EDD business customers, verify ownership down to a lower threshold where warranted by risk, and obtain additional documentation supporting the beneficial ownership information provided — not just a self-certification.

Full corporate structure chart — a complete, visual representation of the ownership chain from the ultimate natural persons at the top through every intermediate entity to your direct customer.

Source of business funds — documentation showing where the funds being transacted in your platform originate from a business perspective — business banking statements, audited financials, or other evidence appropriate to the business's size and type.

Business purpose documentation — more detailed explanation of the specific business activities, the rationale for the customer's need for your product, and the expected pattern of transactions.

Key person identification — for business customers, identify and verify the key individuals who will actually operate the account and direct transactions, beyond just the named beneficial owners.

Reference checks — for higher-risk business customers, third-party reference verification or background investigation may be appropriate.

For businesses with complex ownership structures specifically, also complete:

Tracing analysis documentation — document the process of tracing ownership through each layer, identifying each intermediate entity, and reaching the ultimate natural person beneficial owners. Note and explain any layers where full documentation was unavailable and what alternative verification was conducted.

EDD Approval Requirements

For all EDD customers, document and retain:

Senior management or compliance officer approval — the decision to onboard an EDD customer must be approved by a designated senior individual — typically the BSA Officer, a senior compliance officer, or in some cases a member of the executive team. This approval must be documented.

Approval rationale — the specific reasons why the relationship was approved despite the elevated risk, and what risk mitigation measures are in place.

Ongoing EDD Requirements

EDD does not end at onboarding. For EDD customers, document and execute:

Enhanced monitoring parameters — lower alert thresholds, more frequent review of account activity, and closer attention to transactions from EDD accounts. Document what enhanced monitoring has been implemented for each EDD customer.

Periodic EDD review schedule — high-risk customers should be reviewed at minimum annually. Document the next scheduled review date at onboarding.

Periodic review documentation — at each periodic review, document what information was refreshed, whether the customer's risk rating has changed, and whether continued onboarding remains appropriate.

Frequently Asked Questions

How long must EDD documentation be retained?

EDD documentation must be retained for a minimum of five years from the date of the record or the closing of the account, consistent with BSA recordkeeping requirements.

What if a customer refuses to provide EDD documentation?

If a customer required to undergo EDD refuses to provide required additional documentation, the account should not be opened. If an existing customer refuses to provide EDD documentation during a periodic review, the institution should consider exiting the relationship. Document the refusal and the decision made.

Can EDD requirements be satisfied by relying on documentation collected by a third party?

In some cases, financial institutions can rely on due diligence conducted by other regulated institutions — for example, relying on the KYC conducted by an introducing broker. The reliance must be documented, the third party must be regulated and subject to similar AML requirements, and the institution must be able to obtain the underlying documentation when needed. Blanket reliance without these conditions is not appropriate.

How ComplyOne Helps

ComplyOne helps fintechs design and implement EDD programs that collect the right documentation, meet FinCEN requirements, and satisfy sponsor bank expectations — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.