Customer Due Diligence: What It is and How It Works

Jul

2025

Time to read

Read so far

Written by:

Charlotte Bowyer

Time to read

Written by:

Charlotte Bowyer

In some industries, businesses are required to check and monitor that their customers are not engaging in illegal activities. This process is known as customer due diligence (CDD), and it’s purpose is to prevent financial crime and uncover any risks to your organization that could arise from doing business with certain customers. CDD generally a part of know your customer (KYC) and anti-money laundering (AML) regulations.

Along with preventing financial crime, CDD helps uncover any risks to your organization that could arise from doing business with certain customers.

Read on to learn more about what CDD is, how it’s implemented in various industries, and how software can help support CDD processes.

Key takeaways

Customer due diligence helps detect financial crime and manage business risk by verifying identities and assessing customer risk levels.
CDD is not one-size-fits-all. It ranges from basic checks for low-risk clients to enhanced scrutiny for high-risk ones and is dependent on the customer's profile and potential exposure.
Financial, real estate, and healthcare sectors each apply CDD differently, but have the shared goal of protecting organizations from fraud, regulatory penalties, and reputational damage.
A strong CDD process includes verifying identity, assessing risk, conducting background checks, and maintaining ongoing monitoring and records.
Entrust helps streamline CDD with digital identity verification tools, designed to reduce onboarding friction while staying compliant and keeping fraud in check.

CDD meaning

Customer due diligence (CDD) is a series of checks to help you verify your customers’ identities and assess their risk profiles.

While businesses in many industries may engage in KYC activities, which involve collecting data and documents to verify customer identities, CDD goes beyond that. As a part of CDD, businesses investigate customers’ backgrounds, including financial activities and employment history, using both public and private data sources.

The specific information you collect depends on the risk profile of your customer, but basic customer due diligence requires the following:

Information about the identity of your customers, such as their name, address and a photograph of an official identity document
An overview of your customer’s activities and the markets they operate in
An overview of any other entities that your customer does business with

For banks and other financial services organizations that operate in the U.S., CDD is one of the regulations required by FinCEN (Financial Crimes Enforcement Network), a bureau of the U.S. Department of the Treasury.

CDD types

CDD is an important part of risk management for many businesses, especially those in highly regulated industries. Different customers pose different levels of risk, therefore CDD is carried out through a risk-based approach.

By dividing CDD into different types, organizations can be more efficient in their operations by allocating more resources for customers who require more rigorous investigation.

Simplified due diligence (SDD) is the most basic type of CDD. It’s used for low-risk customers or transactions where the chance of crime is minimal. It typically involves identity verification and some ongoing monitoring. It might be used for small transactions like purchasing prepaid mobile phone credits.
Basic due diligence (BDD) applies to customers with an average risk. It requires more comprehensive identity verification and an understanding of the nature of the business relationship. For example, it might be used when an individual opens a personal bank account.
Enhanced due diligence (EDD) is the most intensive type, typically reserved for high-risk customers. These include people in high-profile public roles, such as politicians, or organizations with complex corporate structures.

When it comes to determining which type of due diligence to use, you should assess the potential risk level of each customer and adjust your due diligence approach accordingly. For the majority of clients, standard due diligence practices — which require you to identify and verify customer identities — are appropriate.

Who is CDD applicable to?

CDD implementation requires slightly different approaches depending on the industry. These are a few examples of how it is applied in sectors where CDD is required.

CDD in banking

Customer due diligence primarily applies to financial services. All businesses who operate in Financial Action Task Force (FATF) Member states must conduct CDD on customers. For example, it would apply to someone applying for a loan, opening a remittance account, or opening a bank account.

These legal requirements are designed to prevent illicit activities, especially money laundering. It’s a big problem: The FBI estimates that $300 billion of illicit funds are laundered through the U.S. every year.

The Bank Secrecy Act of 1970 outlines specific anti-money laundering processes for financial services firms doing business in the U.S. These include thoroughly vetting customers, developing a risk-based customer identification program, and conducting ongoing customer due diligence to detect potential signs of fraudulent or illegal activities. Financial firms must also have systems in place to alert the relevant authorities when they detect such activities.

However, CDD in banking offers additional benefits. By complying with CDD and AML requirements, financial organizations demonstrate their commitment to the rule of law and ethical practices, cultivating confidence and trust among customers, partners, regulators, and the public.

The level of CDD in banking will depend on the type of business-customer relationship and the customer’s risk profile. But broadly, banks must take necessary steps to make sure that the customer is really who they say they are.

When do you need to apply CDD in banking?

Establishing a business relationship: Ahead of a new customer-business relationship, banks must perform due diligence to check the customer’s risk profile, verify who they are and ensure they aren’t using a fake identity.
Occasional transactions: Certain transactions might require further CDD measures. For example, transactions over a certain monetary amount (USD/EUR 15,000) or if the customer is transacting with high-risk persons or regions.
Suspicious activity: Banks must implement CDD checks if the customer is suspected of activity related to money laundering or financing terrorism.
Unreliable identification: If the information your customer has provided is unreliable, suspicious or doesn’t meet requirements, banks should implement additional CDD measures.

CDD in real estate

Just like in banking, CDD in real estate prevents financial crimes: Buying property is often used for money laundering (over $1.5 trillion annually around the world) and other illegal purposes.

In addition to verifying the identities of buyers and sellers and ensuring legitimate payment sources, the CDD process also supports the identification of beneficial owners—the individuals who actually own or control a property, even if it is registered under another entity’s name. This helps real estate businesses trace the real ownership structure, revealing the true risk of illegal activities.

CDD in real estate also helps shore up economic stability for the communities where the properties are located. As with banking, compliance with real estate industry CDD requirements builds trust and credibility, helping companies attract more customers and partners for real estate investments.

CDD in healthcare

Healthcare organizations must thoroughly verify the identities of patients, providers, and staff. This process ensures that everyone is who they claim to be and that no one is compromised by financial entanglements that could put the organization at risk.

At its core, CDD in healthcare means confirming credentials and protecting sensitive patient information in the name of compliance:

For patients, this might mean verifying identity at registration and confirming insurance or payment information—a high-stakes process. In fact, studies show that approximately 35% of all denied insurance claims stem from inaccurate patient identification, costing the average hospital $2.5 million annually and the U.S. healthcare system over $6.7 billion each year.
For staff and providers, CDD means checking backgrounds and credentials to help curb fraud and maintain trust.

Beyond these direct relationships, healthcare organizations also rely on other forms of due diligence to manage risk in supply chains, vendor relationships, and during mergers and acquisitions. While those areas fall outside the strict scope of CDD, they’re nonetheless essential to protecting patient safety and financial stability.

CDD requirements

While the details of applying CDD practices may vary by industry, in the United States, the FinCEN Customer Due Diligence Rule covers four core requirements:

Identify and verify existing and potential customers. This can involve simply collecting and confirming personal details from official identification documents and confirming them with public records.
Identify and verify beneficial owners of the customer opening an account. Determining the individual(s) who actually own or control a business (usually anyone with 25% or more ownership) helps uncover hidden risks.
Understand the purpose and nature of the customer’s business. Details like the type of business, where it’s located, the nature and volume of transactions, who the business works with, and other details help organizations develop an accurate risk profile.
Monitor activity on an ongoing basis and report suspicious activity. Organizations must regularly review customer transactions and report concerns to the appropriate law enforcement or regulatory entity.

As an added note here, CDD requirements for other countries can vary or differ from these U.S. regulations.

The CDD process

Robust and comprehensive CDD requires a systematic approach, protecting an organization while building trust with legitimate customers. Here’s a closer look at the key steps:

Conduct basic customer due diligence/authenticate customer identity

The first step is to conduct simple investigations, such as identifying and verifying a customer’s identity. Businesses are required to verify the identity of their customers before or during the start of that business-customer relationship. These requirements apply to all new customers as part of know your customer (KYC) regulations.

There are several ways that businesses can verify customer identities. One approach is online document verification, which involves digitally assessing the legitimacy of a customer’s identity document as part of onboarding processes. This can be accomplished by checking the details of the information collected with public records, bank statements, and other sources to verify the identity of the individual or organization.

In addition to identity verification, businesses should also consider a customer’s financial information (both current and previous) as well as their business activity.

Select any third parties

Often businesses will opt to work with third parties when conducting customer due diligence. This could be lawyers, auditors, or providers of CDD solutions such as digital identity verification. Businesses should ensure that any third parties they work with are reliable and trusted.

Decide if enhanced due diligence is needed through a risk assessment profile

If the customer is considered high risk, the business might need to carry out enhanced due diligence checks. To determine if EDD is necessary, look out for indicators like inclusion on sanctions lists, negative media reports, complex ownership structures, connections to countries with high rates of financial crime, or if the customer is a politically exposed person (PEP).

Secure all record-keeping

By law, businesses must now keep a record of all financial transactions for at least five years. This includes any information collected through CDD measures, account files and business correspondence, as well as any related analysis. Businesses must also securely document and store any such information obtained during the previous steps. As this information is often sensitive, it would be problematic if it were ever lost or leaked.

Maintain up-to-date records

If the circumstances of your customers ever change, as a business you’ll need to amend their risk assessment and carry out further due diligence if necessary. Examples of when this might happen are if there was a change in ownership or structure of a business. Keeping detailed records can provide evidence in case of suspicious customer behaviors and show proof of CDD activities.

Supporting customer due diligence through identity verification with Entrust

Meeting regulatory requirements for CDD can be complex. At Entrust, we can streamline your compliance journey with comprehensive identity verification solutions to help secure every digital interaction with your customers.

Entrust Identity Verification delivers fast, compliant customer onboarding with trusted biometric authentication, NFC-enabled document verification, and liveness detection. It’s designed to stop fraud before it starts while significantly reducing the costs of manual review.

Today, effective customer due diligence is essential for regulatory compliance and fraud prevention. Take a tour of our Identity Verification suite to learn how Entrust can help your business meet KYC requirements and navigate compliance regulations—without compromising the user experience.

FAQs

What are the key components of a strong customer due diligence process?

A strong CDD process includes four essentials: verifying a customer’s identity, confirming beneficial ownership for business accounts, understanding the customer’s business and risk profile, and conducting ongoing monitoring to catch red flags over time. Together, these steps help ensure compliance with regulatory requirements and provide early detection of potentially suspicious activity.

When is enhanced due diligence (EDD) required over standard CDD?

Enhanced due diligence is triggered when a customer presents a higher risk of financial crime. This might include politically exposed persons (PEPs), customers in high-risk jurisdictions, or those involved in complex corporate structures. EDD adds more rigorous verification steps, such as deeper background checks, source-of-funds documentation, and tighter ongoing monitoring.

How does customer due diligence help prevent financial crimes like money laundering?

CDD helps organizations uncover suspicious behavior before it escalates. By verifying who a customer is, understanding their typical transactions, and identifying the individuals behind the business, companies can detect unusual patterns and report them as required. It turns potential blind spots into checkpoints that disrupt criminal activity early.

What technologies can organizations use to streamline and automate CDD?

Identity verification platforms like Entrust can digitize and simplify CDD with biometric checks, document authentication, liveness detection, and API-driven integrations. When paired with adaptive risk analytics and real-time monitoring, these tools reduce manual effort, improve accuracy, and speed up onboarding, without compromising compliance or user experience.

Struggling to find that delicate balance of KYC checks and UX?

Dive into the “do’s and don’ts” of digital onboarding in our report, End-user expectations of digital identity.

Download Now

Identity Verification

Charlotte Bowyer

Product Marketing Manager

Charlotte Bowyer is a Product Marketing Manager at Entrust. She specializes in creating impactful narratives focusing on identity verification technology and identity fraud.

View all of Charlotte's Posts