Enhanced Due Diligence Checklist

In the current global financial ecosystem, regulatory scrutiny is at an all-time high. Standard Know Your Customer (KYC) protocols are no longer sufficient to protect institutions from financial crime, reputational damage, or regulatory fines. This is where Enhanced Due Diligence (EDD) comes into play.

EDD is not merely a box-ticking exercise; it is a rigorous, risk-based investigation required for clients classified as “high-risk.” Whether you are dealing with Politically Exposed Persons (PEPs), clients from high-risk jurisdictions, or complex corporate structures, a robust EDD framework is your frontline defense. Below is a comprehensive checklist designed to ensure your EDD process is thorough, defensible, and effective.

Phase 1: Initial Risk Triggering & Classification

Before diving into deep research, you must establish the criteria that necessitate an EDD review. Your system should automatically flag clients who meet specific risk thresholds.

• PEP Status: Is the individual a Domestic or Foreign PEP? Are they a Relative or Close Associate (RCA)?
• Geographic Risk: Does the client reside in or operate from jurisdictions identified by the FATF as “high-risk” or “grey-listed”?
• Industry Exposure: Does the client operate in sectors prone to money laundering (e.g., gambling, cryptocurrency exchanges, arms dealing, or precious metals)?
• Transaction Red Flags: Does the client’s expected activity involve unusual transaction patterns, high volumes of cash, or frequent cross-border wires?
• Adverse Media: Has the client or their beneficial owners been flagged in global sanctions lists or negative news sources regarding corruption or fraud?

Phase 2: Corporate Structure & Beneficial Ownership (The “Ultimate” Truth)

For legal entities, the primary goal of EDD is to “follow the money” to the natural person who ultimately owns or controls the company. Masking beneficial ownership is a classic red flag for illicit activity.

• Organizational Charts: Request a detailed chart illustrating the full corporate hierarchy, including offshore holding companies and trusts.
• Ownership Calculation: Identify any individual with 25% or more ownership (or a lower threshold if local regulation dictates).
• Control Mechanisms: Identify individuals with significant control, even if they hold less than 25% of shares (e.g., senior managers, directors, or individuals with veto rights).
• Trust Arrangements: If a trust is involved, identify the Settlor, Trustees, Protectors, and Beneficiaries.
• Source of Funds (SOF) for Entity: Verify where the company obtained its initial capitalization and working capital.

Phase 3: Identity Verification & Authentication

While standard KYC relies on basic ID checks, EDD requires a higher standard of proof. You must authenticate the documents rather than simply collect them.

• Multi-Factor Authentication: Combine government-issued ID (passport/driver’s license) with a secondary proof of address (recent utility bill or bank statement).
• Certified Copies: Insist on documents certified by a notary public, embassy, or regulated professional.
• Live Verification: For high-risk accounts, consider biometric verification or video calls to match the face to the ID.
• Sanctions & Watchlist Screening: Run the client and all associated parties (directors, shareholders) against global sanctions lists, law enforcement databases, and political exposure databases.

Phase 4: Source of Wealth (SOW) & Source of Funds (SOF) Deep Dive

This is the most critical aspect of EDD. You are no longer just asking “Who are you?” but “How did you acquire your wealth, and where is this specific money coming from?”

• Narrative Explanation: Require the client to provide a written, detailed narrative explaining the history of their wealth accumulation.
• Supporting Documentation: Request concrete evidence to back up the narrative. This may include:
  • Tax returns for the last 3-5 years.
  • Audited financial statements and business accounts.
  • Pay stubs or employment contracts.
  • Inheritance documents or wills.
  • Investment portfolio summaries.
• Transaction Trail: Request bank statements from the sending institution to trace the chain of funds (often requiring the client to provide statements showing the “source” account where the money was held).

Phase 5: Enhanced Ongoing Monitoring

EDD does not end at onboarding. A static EDD file is a liability. You must establish a dynamic monitoring protocol that adapts to the client’s behavior.

• Transaction Thresholds: Set specific, lower thresholds for alert generation on EDD accounts.
• Expected Activity Profiles: Document the expected turnover and transactional behavior. Any deviation from this profile should trigger an immediate review.
• Periodic Review Cycles: Shorten the review period for EDD clients. Instead of annual reviews, consider semi-annual or quarterly file updates.
• Ongoing Adverse Media Screening: Implement continuous (daily or weekly) automated sweeps of global media for any negative press regarding the client.

Phase 6: The “Negative News” Investigation

Simply noting that a client has negative press is not enough. You must contextualize the risk.

• Corroborate Sources: Ensure the news is from a reputable source (not just blogs or unsubstantiated social media posts).
• Assess Severity: Determine the nature of the allegation. Is it a tax violation, money laundering, or a regulatory fine? Is the allegation recent or outdated?
• Client Response: Give the client the opportunity to provide a reasonable explanation or defense regarding the allegations. Document this interaction clearly.

Phase 7: Documentation & Audit Trail

If you cannot prove you did the due diligence, the regulator will assume you did not. Documentation is the pillar of defensibility.

• Risk Assessment Memo: Write a formal memo outlining the risk classification and the rationale for the decision to onboard or reject the client.
• Decision Log: Record the names of all compliance team members involved in the decision-making process.
• File Organization: Keep all documents in a central, searchable repository organized by client.

The “EDD Mindset”

An EDD checklist is only as good as the team using it. Compliance officers must adopt a “trust but verify” mindset. They must remain skeptical, ask “why” repeatedly, and refuse to accept surface-level explanations.

It is also vital to remember that EDD is not a barrier to legitimate business; it is a facilitator. By conducting thorough due diligence, you protect the integrity of the financial system and allow compliant high-risk clients to bank with confidence. In the event of a regulatory audit, a comprehensive and well-documented EDD file is the only card that matters.