{"id":9833,"date":"2025-10-21T11:14:01","date_gmt":"2025-10-21T11:14:01","guid":{"rendered":"https:\/\/www.amlcc.com\/?p=9833"},"modified":"2026-08-20T10:52:52","modified_gmt":"2026-08-20T10:52:52","slug":"how-to-evidence-ongoing-customer-due-diligence-cdd","status":"publish","type":"post","link":"https:\/\/www.amlcc.com\/jm\/how-to-evidence-ongoing-customer-due-diligence-cdd\/","title":{"rendered":"How to evidence ongoing customer due diligence (CDD)"},"content":{"rendered":"\n

How to evidence ongoing customer due diligence (CDD)<\/h1>\n\n\n
\"Richard<\/div>
Richard Simms<\/span>

Director and Founder of AMLCC and AMLCC Consult<\/h3><\/div><\/div><\/div><\/div>\n\n\n
\"How<\/figure><\/div><\/div>\n\n\n\n
\n
\n

For many professionals, \u2018ongoing CDD\u2019 sounds like something complex or constant. A never-ending loop of re-verifying clients and chasing paperwork. In reality, it can be far simpler than that.<\/p>\n\n\n\n

Ongoing or continual customer due diligence isn\u2019t about repeating the onboarding process. It\u2019s about showing that you remain alert to risk and keep your client knowledge up to date.<\/p>\n\n\n\n

If you can demonstrate that you\u2019re paying attention, and recording what you see, you\u2019re already most of the way there.<\/p>\n\n\n\n

What ongoing CDD actually means<\/strong><\/strong><\/h2>\n\n\n\n

Under the FATF\u2019s Recommendation 10, ongoing CDD has two parts:<\/p>\n\n\n\n

    \n
  1. Scrutinising transactions to ensure they make sense for that client and their known activities.<\/li>\n\n\n\n
  2. Keeping CDD information up to date by reviewing and refreshing documents, data and risk assessments when necessary.<\/li>\n<\/ol>\n\n\n\n

    That\u2019s it. You\u2019re simply showing that the relationship between your client\u2019s activity and your knowledge of them still makes sense, and that you\u2019ve checked in at reasonable intervals.<\/p>\n\n\n\n

    How often to review CDD<\/h2>\n\n\n\n

    There\u2019s no fixed timetable set in law. It all depends on the level of risk.<\/p>\n\n\n\n

    For low-risk clients, a periodic review every couple of years is usually enough, provided nothing changes in the meantime.<\/p>\n\n\n\n

    For high-risk clients, including politically exposed persons<\/a> (PEPs) or those in higher-risk jurisdictions, reviews should happen much more frequently, typically at least once a year or whenever new information comes to light.<\/p>\n\n\n\n

    The important thing is that your records show a reasoned, risk-based approach<\/a>. Regulators don\u2019t expect a strict schedule. But they do expect to see that you\u2019re applying common sense and keeping client knowledge current.<\/p>\n\n\n\n

    Knowing when to trigger a review<\/strong><\/strong><\/h2>\n\n\n\n

    You don\u2019t need to refresh CDD every time you speak to a client. Instead look for triggers, for example when new information alters the level of risk.<\/p>\n\n\n\n

    For example:<\/p>\n\n\n\n