What Is EDD (Enhanced Due Diligence) and When Is Standard KYC No Longer Enough?

1. Standard KYC versus EDD

2. Common EDD triggers

Triggers differ by business and jurisdiction, but frequently include a politically exposed person or close associate, a high-risk country, sanctions exposure, opaque or multi-layered ownership, unusual source of wealth, cash-intensive or high-risk industries, non-face-to-face onboarding with weak evidence, adverse media, complex crypto flows, nominee arrangements, unexplained third-party payments or activity inconsistent with the customer's profile.

A trigger does not automatically mean the customer must be rejected. It means the risk assessment should change and the business should collect enough evidence to make a defensible decision. The reason for applying EDD, the information requested and the final decision should be recorded.

3. What an EDD file should contain

Documents should be assessed, not simply collected. A bank statement may show a balance but not explain how wealth was created. A corporate chart may show ownership but not who exercises control. A blockchain address may be identifiable but still require screening and a reason for the transfer. EDD is the analysis connecting the evidence to the risk decision.

4. PEPs and high-risk countries

PEP controls should be risk-based and aligned with the applicable law. A PEP status is not proof of wrongdoing, but it generally requires senior management approval, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. The relationship should be reviewed when the person leaves office because risk may not end immediately.

Country risk should also be specific. Consider sanctions, corruption, conflict, weak AML controls, tax transparency, regulatory restrictions, customer location, counterparties and the service being provided. Do not rely on a single public “high-risk country” list without checking the lists and rules relevant to the business.

5. When EDD should become ongoing

EDD is not completed once the first set of documents is uploaded. The business should define review frequency, event-driven triggers, transaction thresholds, expiring documents, ownership changes, adverse-media alerts, unusual wallet exposure and changes in the customer's business. If the customer cannot provide a reasonable explanation or the risk exceeds the firm's appetite, the options may include restricting services, filing a suspicious activity report where required, exiting the relationship or refusing the transaction.

1. Identify the trigger and document the initial risk assessment.
2. Request targeted evidence with a clear explanation of what is needed.
3. Verify the evidence independently and resolve contradictions.
4. Obtain senior approval where required by law or internal policy.
5. Set monitoring, refresh and escalation conditions before activation.
6. Record the outcome and review it when the facts change.

Conclusion: EDD is disciplined curiosity

Enhanced Due Diligence gives a business a structured way to understand higher-risk relationships. It protects the firm when the evidence is credible, the relationship fits the risk appetite and monitoring is active. It also provides a clear basis for declining a relationship when the customer cannot explain ownership, wealth, funds or activity.

Licensium can build an EDD procedure and risk methodology, review customer files, prepare source-of-funds controls and support a bank or regulator readiness exercise. Start a confidential discussion about your risk profile.