What is enhanced due diligence?

Enhanced due diligence (EDD) is the extra layer of scrutiny you apply when a client or transaction carries a higher risk of money laundering, terrorist financing or proliferation financing. It goes beyond standard customer due diligence (CDD), asking for more evidence, more verification and more ongoing monitoring.

The requirement comes from FATF’s Recommendations, the global standards that shape how countries build their anti-money laundering laws. FATF asks countries to require regulated business to apply enhanced measures wherever risk is higher, and each country then writes that requirement into its own legislation. 

Wherever you’re regulated, the underlying expectation is the same: match your scrutiny to the risk in front of you.

When enhanced due diligence is required

FATF’s risk-based approach requires enhanced measures wherever risk is assessed as higher. That includes where:

• the client, or a related party, is a politically exposed person (PEP), a close associate of a PEP or a family member of a PEP;
• the client, or either party to a transaction, is established in a high-risk jurisdiction, defined by FATF and/or according to your country’s own regulations;
• the transaction has no apparent economic or lawful purpose, or is unusually complex or large, or follows an unusual pattern;
• you’ve discovered the client provided false or stolen identification and you’re proposing to continue the relationship anyway;
• your own risk assessment and information from your client due diligence classify the client as high risk.

Individual countries add detail on top of this. Wherever you operate, check how your own regulator has transposed the FATF standard into local law.

What EDD involves in practice

There’s no single checklist that fits every case. But the MLRs and guidance from supervisors like the IFA, ICAEW, AIA, SRA and HMRC outline several core steps.

1. Obtain additional information

1. You’ll need to go further than standard CDD to understand who your client is, what they do and where their money comes from. That often means collecting:

• extra identification documents (e.g. secondary photo ID or corporate structure charts);
• independent, credible evidence of source of funds and source of wealth;
• details about the client’s business activities, ownership, and purpose of transactions;
• information on the intended nature of the relationship.

Under FATF’s Recommendation 12, PEP relationships specifically require you to establish source of wealth and source of funds, get senior management approval before proceeding, and “conduct enhanced ongoing monitoring of the business relationship” for as long as it lasts.

2. Apply more robust verification

Where normal verification might rely on one independent source, enhanced due diligence demands more. Apply the risk-based approach and potentially use two or more independent and reliable data sources, ideally from different channels.

3. Intensify ongoing monitoring

Enhanced due diligence doesn’t end after onboarding. You need to conduct ongoing scrutiny of transactions to ensure they align with what you know about the client. This means:

• more frequent reviews of the client’s risk assessment;
• regularly updating ID and verification documents;
• actively reviewing transactions for inconsistencies or red flags;
• refreshing risk assessments if the client’s behaviour, geography or ownership changes.

If something doesn’t add up, you should file an internal suspicious activity report. The person in charge of money laundering reporting in your business (often known as the MLRO) can then decide if it’s appropriate to make an external report to law enforcement.

Understanding “source of funds” vs “source of wealth”

These are often misunderstood but central to enhanced due diligence.

• Source of funds is about where the money for a particular transaction came from, such as a specific bank account, property sale, or investment.
• Source of wealth looks at how the client acquired their total wealth over time. For instance, through employment, inheritance or business ownership.

For high-risk clients, both must be evidenced. Vague statements like “savings” or “family money” are insufficient without documentation such as bank statements, contracts of sale, or inheritance records.

Enhanced due diligence and risk assessment

FATF’s risk-based approach expects every business to carry out its own business-wide risk assessment, and for enhanced due diligence decisions to flow from it. 

If your business works with overseas clients, handles high-value transactions, or deals with complex structures, your risk assessment should clearly outline how you identify and mitigate those risks, including the use of EDD.

When your supervisor carries out an AML review, they’ll look for evidence that EDD is built into your policies, controls and procedures (PCPs) in your AML Policy document, not treated as an ad hoc response.

Integrating EDD into your AML framework

Done properly, enhanced due diligence protects you as much as it protects the financial system. It gives you the insight to spot inconsistencies and show your supervisor that your business applies a genuinely risk-based approach. 

Your EDD work should be a natural part of your process rather than an added burden. You can make this a reality by building EDD triggers into your risk assessment templates and building the responses into your AML PCPs. Your staff training should also cover when EDD applies and how to carry it out.

AI can help here but it isn’t a substitute for judgement. Criminals can just as easily use it to bypass controls or sharpen their own methods. The best EDD process blends automation with genuine human oversight.

If your AML process currently feels like a formality rather than a safeguard, start by reviewing how you handle higher-risk clients. Ask whether your EDD tells the real story behind their money. Because if it doesn’t, that’s where your exposure lies.