---
title: "Enhanced Due Diligence"
url: "https://mahouse.world/glossary/enhanced-due-diligence"
type: "glossary term"
topic: "Compliance"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# Enhanced Due Diligence

Enhanced due diligence is the deeper level of customer checks the AML rules require where the risk is higher: politically exposed persons, customers from or transacting with high-risk countries, complex ownership structures, unusual business models, correspondent relationships — anything the firm's own risk assessment flags. It adds source-of-wealth and source-of-funds enquiries, senior-management approval, closer monitoring and more frequent review to the standard process, and it is where a fintech's compliance function earns its cost or fails its inspection.

**Also known as:** EDD, Enhanced KYC, High-risk customer review

## Key facts

- **Used at:** onboarding and review of customers rated high-risk; mandatory in law for PEPs, high-risk third countries (the EU and FATF lists) and correspondent banking; discretionary for whatever the firm's risk assessment identifies
- **Binding:** yes — the AML directives and national rules specify minimum EDD measures; a PEP relationship without senior-management approval is a breach in itself
- **Typical measures:** source of wealth (how the customer came by their assets) and source of funds (where this money comes from), documented; senior management sign-off; additional identity and ownership verification; adverse-media screening; tighter monitoring thresholds; review annually or more often
- **Typical fintech friction:** EDD takes days and a human, in a product built to onboard in minutes; the firms that scaled without an EDD queue are the enforcement cases
- **Parties:** the compliance analysts who do it, the MLRO or senior manager who approves, the customer who is asked for documents, and the regulator who reads the file

## How enhanced due diligence works in practice

A customer's onboarding triggers a PEP match — she is a regional official's spouse. The file moves from the automated flow to an analyst. The analyst confirms the match, screens for adverse media, asks the customer for her source of wealth (employment history, inheritance, business sales, with documents) and the source of the funds she will use (payslips, a sale contract), verifies what can be verified, assesses whether the relationship makes sense, and writes it up. The MLRO reads the file and approves or declines the relationship. If approved, the customer is rated high-risk: monitoring thresholds are tighter, alerts route to a senior analyst, and the file is reviewed every year, or when anything changes.

The same process runs for a company owned through three jurisdictions, a crypto business, a customer whose declared activity does not fit their profile, or a corridor to a listed country. The discipline is proportionality: EDD on everyone is a queue nobody clears; EDD on no one is a fine. The firm's risk assessment decides the triggers, and the regulator reads the assessment to see whether the triggers are honest.

For an acquirer, the EDD population is a diligence sample: how many high-risk customers, how many files complete, how many approved by whom, how many PEPs — and whether the firm has ever declined one.

## Example

A payments fintech has 300,000 customers, of whom 6,000 are rated high-risk: 400 PEPs and associates, 2,100 with high-risk-country links, 3,500 by business type. Its EDD: a team of nine analysts, source-of-wealth and funds documented, MLRO approval logged, annual review. An inspection samples 150 high-risk files: 138 complete; 12 with source-of-wealth "declared, not verified". The regulator accepts a remediation plan for the category. The same year the fintech declines 210 high-risk applications and exits 45 relationships after review — numbers the regulator reads as a function working. A rival with 1.2 million customers and 300 rated high-risk is asked how its risk assessment produced that ratio, and does not have an answer that survives the meeting.

## Common mistakes

- A high-risk population implausibly small, because rating customers high-risk creates work.
- Source of wealth "declared" and never verified.
- PEP relationships without the senior-management approval the law names.
- EDD done once at onboarding and never repeated.
- Treating EDD as a document collection exercise rather than as a judgement about whether the relationship makes sense.

## Related terms

- [Customer Due Diligence](https://mahouse.world/glossary/customer-due-diligence.md)
- [Politically Exposed Person](https://mahouse.world/glossary/politically-exposed-person.md)
- [Sanctions Screening](https://mahouse.world/glossary/sanctions-screening.md)
- [AML](https://mahouse.world/glossary/aml.md)
- [KYC](https://mahouse.world/glossary/kyc.md)
- [Risk-Based Monitoring](https://mahouse.world/glossary/risk-based-monitoring.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov