The rules make enhanced due diligence compulsory in only a few situations. For every other client, your own team’s risk rating decides. This means the people who review client files make many of these decisions themselves.
The checks are also written in legal language. A rule may ask for “additional information on the customer”, but that does not tell the client what to send. They need to hear exactly which detail or document you want, and what it is for.
Who needs enhanced due diligence, and what exactly should you ask each client to send?
Each set of rules below has two kinds of case. Some always need enhanced due diligence. Others need it when your customer risk assessment finds a higher risk, or when your country’s rules add a case.
The Financial Action Task Force (FATF) does not make law. It sets an international standard, and each country puts it into its own rules.
Three cases need more than the usual checks (Recommendations 12, 13 and 19). The first is politically exposed persons (PEPs): every foreign PEP, plus domestic and international organization PEPs in higher-risk cases.
The second is cross-border correspondent banking, when a bank provides banking services to a bank in another country. The third is business with people and firms from countries where the FATF calls for it.
These duties are not only for banks. Lawyers, notaries and accountants have the same PEP and high-risk country duties in some of their work for clients. Buying property and setting up a company are two examples (Recommendations 22 and 23).
US anti-money laundering regulations set enhanced checks in only two places. The first is a correspondent account that a US financial institution keeps for certain foreign banks (31 CFR 1010.610).
Enhanced due diligence procedures apply if the foreign bank has an offshore license. They also apply if its license comes from a country officially flagged for money laundering concerns.
The second is a private banking account for a non-US person (31 CFR 1010.620). The firm finds out who owns it on paper and in fact.
It also asks where the money comes from and what the account is for. If an owner is a senior foreign political figure, the account must be watched closely for money from foreign corruption.
For other higher-risk customers, each bank’s own policy decides. That policy should set when to collect extra customer information and what to collect (Federal Financial Institutions Examination Council manual).
Until 9 July 2027, enhanced customer due diligence (EDD) in the EU is governed by Directive (EU) 2015/849, as implemented through national laws. The Directive requires firms to carry out additional checks when a customer or transaction presents a higher risk of money laundering or terrorist financing.
EDD is mandatory in several situations:
Crypto-asset service providers face additional requirements under Articles 19a and 19b. Article 18(1) also requires EDD in other higher-risk situations identified through a firm’s risk assessment or national rules.
A high-risk country connection is not limited to where the customer lives. Under the European Banking Authority guidelines (paragraph 4.55), it can also arise when a customer is established there or when funds originate, are generated, or are transferred to that country. Firms must consider these connections even if the customer operates elsewhere.
A new law takes over on 10 July 2027. From then, most firms follow Regulation (EU) 2024/1624, which applies directly in every EU country (Article 90). The directive is repealed the same day (Directive (EU) 2024/1640, Article 77).
Non-EU countries then fall into three groups. The Commission’s high-risk list draws on the FATF call-for-action list (Article 29). For those countries, every enhanced measure applies.
Countries with compliance weaknesses get measures chosen by the Commission, starting from the FATF’s increased-monitoring list (Article 30). A third group covers countries that pose a specific and serious threat to the EU’s financial system (Article 31).
One client group also becomes a fixed case. Non-EU nationals who apply for residence rights in exchange for an investment always get enhanced checks (Article 41). Higher-risk relationships with some very wealthy clients get three fixed extra steps (Article 34(5)).
French firms apply these rules through the Code monétaire et financier, France’s monetary and financial code. Article L561-10 requires “mesures de vigilance complémentaires”, extra measures on top of the usual checks, in three cases:
Article L561-10-2 adds a closer review of particularly complex or unusually large transactions. The same applies to a transaction with no apparent economic reason or lawful purpose.
The firm then asks the client where the money comes from and where it goes, what it is for and who benefits.
The French text of Regulation (EU) 2024/1624 calls enhanced due diligence “vigilance renforcée” (Chapter III, Section 4).
New clients go through customer due diligence (CDD), the core checks of the know your customer (KYC) process. Enhanced due diligence (EDD) goes further for clients and transactions with a higher risk of money laundering or terrorist financing. It comes on top of the regular checks and never replaces them (European Banking Authority guidelines, 4.45).
There is no single set of extra checks. Under the Financial Action Task Force (FATF) standards, the measures should be “consistent with the risks identified” (Interpretive Note to Recommendation 10). So you choose the ones that fit each client.
In a few cases, though, the law decides both that enhanced due diligence applies and which measures to use.
The FATF and EU law list the same seven measures. You pick the ones that fit the risk, unless the law sets them. For EU banks and other financial firms, the European Banking Authority’s guidelines give examples for most of them (guideline 4.64).
|
Measure |
What to ask the client for |
What the file should show |
|---|---|---|
|
1. More on the client and owners |
Job or business, past activities, family and business partners |
Answers and any negative news found |
|
2. The planned relationship |
Number, size and frequency of payments, and where the money goes |
What normal activity looks like |
|
Where this money came from and how their wealth was built |
Each document and what it shows |
|
|
4. Reasons for transactions |
What a large or unusual payment is for |
Whether the reason fits the relationship |
|
5. Senior management approval |
Nothing: it is an internal step |
Who approved, when and why |
|
6. Enhanced monitoring |
Explanations if later payments do not fit |
Review dates and results |
|
7. First payment from the client’s own account |
Payment from an account in their name at a bank with similar checks |
The paying bank and account name |
Some cases leave no choice. For a high-risk third country, the first six measures apply today, and EU countries may add the seventh (Directive (EU) 2015/849, Article 18a(1)). From 10 July 2027, all seven apply (Regulation (EU) 2024/1624, Article 29(4)).
The Regulation also fixes the measures in two more cases. Applicants for residence by investment need at least the first, third, fifth and sixth measures (Article 41).
Financial firms and trust or company service providers add three steps for very wealthy clients (Article 34(5)). The client holds at least 50 million euros in assets, not counting their home. The higher-risk relationship also handles at least 5 million euros through personalized services.
One targets the risks of those services. Another asks for more on the source of funds. The third prevents and manages conflicts of interest between the client and the senior managers or staff who check that client.
The enhanced due diligence process builds on the standard KYC form the client has already filled in. Ask only for the new details and documents, and say in plain words what each one is for.
Then record which measures you used and why. EU firms must be able to show their supervisor that the measures fit the risks (Directive (EU) 2015/849, Article 13(4)).
With a Clustdoc onboarding form, clients can pause and resume at any time. A client who needs to find older bank statements can stop, then pick up where they left off.
You can start from our client onboarding KYC checklist template, which covers both standard and enhanced due diligence. Then tailor it to the exact steps your team follows.
Book a demo call and name one situation in which your policy asks for enhanced due diligence. We will walk you through how those extra requests reach the client in Clustdoc.
Enhanced due diligence is the extra checking that anti-money laundering (AML) rules require for higher-risk clients and transactions. It comes on top of standard customer due diligence. It often means more information about the client, proof of where the money comes from, senior approval and closer monitoring.
Yes, in the cases each law names, and whenever a firm finds a higher risk. EU law names politically exposed persons and high-risk third countries, for example.
US rules set special checks for some correspondent and private banking accounts. Other US cases are left to each firm's risk-based procedures.
Take a client from a country on the EU's list of high-risk third countries. The firm asks for more about the client, its owners and the planned relationship.
It checks the source of funds and wealth and the reasons for transactions. A senior manager approves, and the account is monitored more closely.
No. Enhanced monitoring is one of the measures. It means more frequent checks on the relationship and a closer look at certain transactions.
Enhanced due diligence also covers more information, the source of funds and senior approval, often before the relationship starts.
No. The European Banking Authority's guidelines say the risk-based approach does not, by itself, require refusing whole groups of higher-risk clients. Risk varies from one client to the next, even within a group.
A business should decline a client when it cannot complete the checks or cannot manage the risk.
Still stitching emails, files, and approvals together?
Clustdoc gives teams one place to run client-facing work, boost customer engagement and increase compliance.
Claire writes about customer onboarding, digital processes, and the day-to-day challenges faced by operations teams. At Clustdoc, she focuses on practical insights: how organizations collect information, guide customers through complex steps, and improve service delivery with automation.
