Customer Due Diligence (CDD)

What Is Customer Due Diligence?

Customer due diligence (CDD) is the process by which financial institutions verify the identity of their customers and assess the risk each customer poses before and during a business relationship. It is the operational backbone of Know Your Customer (KYC) and anti-money laundering (AML) programs: where KYC focuses on identity verification at onboarding, CDD extends further by evaluating the source of funds, the nature of the business relationship, and the ongoing behavior of the customer.

The concept is codified in FATF Recommendation 10, which sets the international standard adopted by over 200 jurisdictions. FATF requires institutions to apply CDD when establishing a business relationship, when carrying out occasional transactions above a specified threshold (generally USD/EUR 15,000 for traditional finance), when there is suspicion of money laundering or terrorist financing, or when previously obtained customer data may be unreliable.

CDD is not a one-time check. It is a continuous obligation that spans the entire customer lifecycle, from account opening through every transaction and periodic review, until the relationship ends and records are archived.

How It Works

CDD programs follow a risk-based approach: the depth and frequency of checks scale with the assessed risk of each customer. Most regulatory frameworks organize CDD into three tiers.

Simplified Due Diligence (SDD)

Simplified due diligence applies to customers assessed as low risk, where the regulator and the firm's own risk assessment agree the customer presents a well-understood, minimal threat. SDD is a deliberate reduction in depth, not an absence of checks. Typical measures include lighter beneficial ownership verification, narrower adverse media lookback, and reliance on lower-cost identity sources. Examples of low-risk customers include regulated financial institutions, publicly listed companies, and government bodies.

Standard CDD

Standard CDD is the default tier applied to most customers. Under the FinCEN CDD Rule (effective in the US since 2018), covered financial institutions must satisfy four core requirements:

1. Identify and verify the identity of the customer using reliable, independent source documents, data, or information
2. Identify and verify the identity of beneficial owners who own 25% or more of a legal entity customer or who exercise significant control
3. Understand the nature and purpose of the customer relationship to develop a risk profile
4. Conduct ongoing monitoring to identify and report suspicious activity and maintain up-to-date customer information

Standard CDD typically includes verified identity documentation, sanctions and PEP screening, basic adverse media review, and a documented risk rating.

Enhanced Due Diligence (EDD)

Enhanced due diligence layers additional scrutiny on top of standard CDD for higher-risk customers. EDD does not replace CDD: it extends it. Triggers for EDD include:

• The customer is a politically exposed person or a close associate of one
• The customer operates in or transacts with a jurisdiction on the FATF high-risk or increased-monitoring list
• Complex or opaque ownership structures
• Unusually high or inconsistent transaction volumes
• Correspondent banking or correspondent CASP relationships across borders

Additional EDD measures can include extended beneficial ownership identification, source-of-wealth interrogation, longer adverse media lookback periods, senior management sign-off, and more frequent periodic reviews.

CDD in Crypto and Digital Assets

Crypto exchanges, VASPs, and other digital asset service providers must implement CDD just like traditional financial institutions. The FATF's guidance on virtual assets (updated under Recommendation 15) extends the same CDD obligations to any entity that facilitates the exchange, transfer, or custody of digital assets.

Identity Verification Methods

Crypto platforms typically implement CDD through a combination of document verification and biometric checks:

• Government-issued photo ID (passport, national ID card, or driver's license) verified against known document templates
• Proof of address via utility bills, bank statements, or government correspondence
• Selfie or video liveness checks compared against the ID photo to prevent spoofing
• Source-of-funds declarations for higher-risk customers or larger transaction volumes
• Sanctions screening, PEP screening, and adverse media checks run at onboarding and on an ongoing basis

Ongoing Transaction Monitoring

Beyond onboarding, CDD requires continuous transaction monitoring. In crypto, this includes on-chain analytics to trace the origin and destination of funds, blockchain analysis to flag interactions with sanctioned addresses, and automated alerts for unusual patterns such as rapid cycling of funds or transactions just below reporting thresholds (structuring).

Compliance with the Travel Rule adds another layer: VASPs must exchange originator and beneficiary information for transfers above applicable thresholds, which intersects directly with the customer data collected during CDD.

CDD Requirements Across Jurisdictions

While FATF Recommendation 10 sets the global baseline, national regulators implement CDD with significant variation.

United States (FinCEN)

The FinCEN CDD Rule, promulgated in 2016 and effective since May 2018, applies to banks, brokers, dealers, mutual funds, and futures commission merchants. It codified the four-pillar framework described above. In February 2026, FinCEN issued an order granting certain covered institutions relief from the requirement to identify and verify beneficial owners at every new account opening, limiting that obligation to initial account opening, when previous data reliability is in doubt, and as required under risk-based ongoing monitoring.

Crypto businesses operating as money services businesses must register with FinCEN and comply with the Bank Secrecy Act, including CDD obligations, currency transaction reporting, and suspicious activity reporting.

European Union (AMLR)

The EU adopted a comprehensive Anti-Money Laundering Regulation (AMLR, Regulation 2024/1624) in June 2024, applicable from July 2027. The AMLR brings crypto-asset service providers (CASPs) under MiCA fully into the AML framework as obliged entities. Key provisions include:

• A EUR 1,000 threshold for full CDD on occasional crypto transactions, lower than the EUR 10,000 general threshold for traditional finance
• Below EUR 1,000, CASPs must still identify and verify the customer
• Risk-based mitigation measures for transfers to and from self-hosted (unhosted) wallets
• A prohibition on anonymous crypto-asset wallets
• EDD requirements for cross-border correspondent relationships involving CASPs with non-EU respondent entities

Singapore (MAS)

Under the Monetary Authority of Singapore's Notice PSN02, digital payment token service providers (DPTSPs) must perform CDD when establishing a business relationship, handling any transaction for a non-customer regardless of value, when money laundering or terrorist financing is suspected, or when previously obtained customer data may be unreliable. MAS requires enhanced CDD for higher-risk customers and risk-mitigating measures for transfers to private or unregulated wallets. Suspicious transaction reports must be filed within five business days, or within one business day where sanctioned parties are involved. Records must be retained for at least five years.

CDD and Stablecoin Infrastructure

As stablecoins become a primary medium for cross-border payments and settlement, CDD takes on particular importance for stablecoin issuers and the platforms that integrate them. Stablecoin issuers like Circle (USDC) and Tether (USDT) implement CDD at the mint-and-redeem level, while downstream platforms apply their own CDD to end users.

For platforms building on Bitcoin Layer 2 networks or stablecoin rails, CDD processes must be embedded into the onboarding flow. The VASP licensing landscape varies significantly by jurisdiction, but CDD is a universal requirement across all of them. Understanding how to implement compliance automation and sanctions screening alongside CDD is essential for any payment platform handling regulated assets.

Use Cases

• Crypto exchange onboarding: exchanges collect ID documents, run biometric liveness checks, screen against sanctions and PEP lists, and assign a risk tier to each customer before allowing trading or withdrawals
• Stablecoin mint and redemption: issuers verify the identity and source of funds of institutional clients who mint or redeem large quantities of stablecoins directly
• Cross-border payments: payment providers apply CDD to both sender and receiver, with enhanced checks for high-risk corridors or jurisdictions under FATF increased monitoring
• DeFi on-ramps: regulated fiat on-ramps perform CDD before converting fiat to crypto, even if the destination protocol itself is permissionless
• Ongoing account reviews: periodic re-verification of existing customers whose risk profile may have changed due to transaction patterns, adverse media, or changes in sanctions lists

Risks and Considerations

Compliance Costs

Implementing CDD infrastructure is expensive. Identity verification providers, ongoing monitoring systems, sanctions screening databases, and compliance staff represent significant overhead, particularly for startups. These costs are often passed to customers through higher fees or minimum account thresholds, which can conflict with financial inclusion goals.

Privacy Trade-offs

CDD requires collecting and storing sensitive personal data: government IDs, biometric data, financial records, and transaction histories. This creates honeypot risk if the data is breached. The tension between regulatory compliance and user privacy is particularly acute in the crypto space, where many users value pseudonymity. Solutions like zero-knowledge compliance aim to prove regulatory compliance without exposing underlying personal data.

Jurisdictional Fragmentation

CDD requirements differ substantially across jurisdictions in terms of thresholds, required documents, record retention periods, and the scope of entities covered. A platform operating globally must navigate multiple overlapping frameworks: FinCEN rules in the US, the EU AMLR, MAS notices in Singapore, and dozens of other national regimes. This fragmentation increases compliance complexity and creates regulatory arbitrage opportunities.

De-risking

Over-cautious CDD implementation can lead to de-risking: the blanket refusal to serve entire categories of customers or jurisdictions rather than conducting nuanced risk assessments. This is particularly problematic for correspondent banking relationships and can cut off legitimate businesses and individuals from financial services.

Ongoing Monitoring Burden

CDD is not complete at onboarding. Firms must continuously monitor transactions, update customer risk profiles, and re-verify information when doubts arise. For high-volume platforms processing thousands of transactions per second, this requires sophisticated automated systems and generates a significant volume of alerts that compliance teams must review.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.