---
title: "Customer Due Diligence"
url: "https://mahouse.world/glossary/customer-due-diligence"
type: "glossary term"
topic: "Compliance"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# Customer Due Diligence

Customer due diligence is the process a regulated firm must complete before and during a business relationship: identify and verify the customer, identify any beneficial owner, understand the purpose and expected activity, assess the risk, and keep it current. It is what KYC means in law, and it comes in three strengths: simplified for low-risk, standard for most, enhanced for the high-risk and the politically exposed.

**Also known as:** CDD, KYC due diligence, Customer identification

## Key facts

- **Used at:** account opening and onboarding of every customer of a bank, payment or e-money institution, lender, broker or crypto firm; refreshed periodically (every one to five years by risk) and on trigger events
- **Binding:** yes — the FATF standards, the EU AML directives, the UK Money Laundering Regulations, the US Customer Identification Program and CDD Rule; a relationship cannot begin, and must be ended, if CDD cannot be completed
- **Typical components:** identity (name, date of birth, address, identifier) verified against documents or reliable sources; beneficial ownership for companies (natural persons owning 25% or more, or otherwise controlling); purpose and nature of the relationship; source of funds where risk warrants; screening for sanctions and PEP status; a risk rating that sets the monitoring and review cycle
- **Typical failures cited in enforcement:** onboarding without verification to hit growth targets; beneficial owners not identified; risk ratings never refreshed; backlogs of incomplete files
- **Parties:** the firm's onboarding and compliance teams, the identity-verification vendors, the customer, and the regulator that inspects the files

## How customer due diligence works in practice

A neobank onboards a new customer. It collects her name, date of birth and address, verifies them — a document and a liveness check through a vendor, a database match — and screens her against sanctions and PEP lists. It asks what she will use the account for and roughly how much will move through it, and rates her risk from those answers and her profile: a salaried resident with a domestic account is low-risk and gets standard CDD; a non-resident company director with income from abroad is higher and gets enhanced. The rating sets her monitoring thresholds and when her file is reviewed. If a check cannot be completed — the document fails, the beneficial owner cannot be found — the account is not opened.

For a business customer the work multiplies: the company's registration, its directors, its beneficial owners traced through any holding structure to the natural persons, and the business's activity understood well enough to know what normal looks like. Know-your-business is CDD applied to a company, and the shell company whose owner cannot be found is the case the rules were written for.

The obligation is continuous. A file complete at onboarding and untouched for five years is a file the regulator will find; trigger events — a change of address abroad, a spike in activity, a PEP match — reopen it. Fintechs that grew fast and onboarded faster than they could verify are the enforcement actions of 2022–2024.

## Example

A payments fintech onboards 40,000 business customers a year. Its CDD: company registry check, directors and beneficial owners identified and verified, expected monthly volume declared, industry risk-rated, screening of all persons. 4% of applications fail CDD and are declined; 11% are rated high-risk and go to enhanced review, which takes three days and clears two-thirds. An inspection samples 200 files: 194 complete, 6 with beneficial-owner gaps for companies owned through a foreign trust. The regulator requires remediation of the category — 1,100 files — within six months, and the fintech's next funding round's diligence reads the remediation report before the financials. A competitor onboarding the same volume with no beneficial-owner tracing is fined €4.5m and required to re-verify its whole book.

## Common mistakes

- Verifying the person and not the business, or the business and not its owners.
- Risk ratings set at onboarding and never refreshed.
- Backlogs of "provisionally onboarded" customers transacting while their CDD is incomplete.
- Expected activity never recorded, so monitoring has nothing to compare against.
- Treating a vendor's identity check as the whole of CDD.

## Related terms

- [KYC](https://mahouse.world/glossary/kyc.md)
- [Enhanced Due Diligence](https://mahouse.world/glossary/enhanced-due-diligence.md)
- [Identity Verification](https://mahouse.world/glossary/identity-verification.md)
- [Know Your Business](https://mahouse.world/glossary/know-your-business.md)
- [Politically Exposed Person](https://mahouse.world/glossary/politically-exposed-person.md)
- [Risk-Based Monitoring](https://mahouse.world/glossary/risk-based-monitoring.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov