Enhanced Due Diligence Checklist: 12 Items Auditors Expect

Enhanced due diligence (EDD) is the deeper level of customer investigation that AML rules require when standard checks are not enough: for politically exposed persons, high-risk countries, complex ownership, unusual transaction patterns, and other elevated-risk situations. Standard due diligence asks "who are you?" EDD asks "who are you, where does your money come from, and does your story hold together?"

The checklist below is the working version: what to collect, what to verify, and what to write down. Auditors do not grade effort. They grade documentation.

When EDD is triggered

Before the checklist, the triggers. Your policy should name them explicitly, because "we apply EDD when risk is high" is not a policy, it is a shrug. The standard set:

▹ The customer or a beneficial owner is a PEP, a PEP family member, or a close associate

▹ The customer is connected to a high-risk jurisdiction (FATF grey and black lists are the floor, not the ceiling)

▹ Ownership is complex or opaque: layered entities, trusts, nominee arrangements, bearer shares

▹ The declared activity does not match observed behavior, or transaction volumes exceed the declared profile

▹ Sanctions screening produced a near-miss requiring investigation, or adverse media produced credible hits

▹ The product itself is high risk: private banking, correspondent relationships, crypto with anonymity features

The 12-item EDD checklist

1. Senior management sign-off. EDD relationships require approval above the analyst level, and the approver's name goes in the file. This is explicit in FATF guidance and most national rules.

2. Verified identity, re-confirmed. Re-verify the identity documents behind the relationship at EDD depth: original or certified documents, biometric confirmation. For remote high-risk cases, [agent-assisted video verification](https://kycaid.com/live-video-verification/) adds a recorded human interview to the file.

3. Full ownership unwrap Map the entity chain to every natural person. For each UBO: identity verification, screening, and their individual risk profile. "The trust owns it" is where the work starts, not ends.

4. Source of funds. Where did the money in this specific relationship come from? Salary, business income, sale of an asset, inheritance. Collect evidence, not assertions: a documented source of funds check captures the declaration and the supporting documents in one flow.

5. Source of wealth. Different question: how did this person accumulate their overall wealth? A PEP with a government salary and eight figures of assets has a gap your file must address.

6. Purpose and intended nature of the relationship. What will the account be used for, at what volumes, with which counterparties and corridors? This becomes the baseline that monitoring compares against.

7. Deep screening. PEP and sanctions re-screening with tighter matching thresholds than standard tier, across all relevant jurisdictions, covering the entity, UBOs, directors, and known associates.

8. Adverse media, properly done. Not one search. [Adverse media screening with relevance scoring across financial crime categories, with each credible hit assessed and dispositioned in writing.

9. Jurisdiction analysis. For every country in the structure: sanctions exposure, corruption indices, banking secrecy, and your institution's own risk appetite for it.

10. Site or activity verification where it applies. For businesses: does the operation exist as described? Website, premises evidence, licenses for regulated activities, financial statements for volume plausibility.

11. Enhanced monitoring settings. EDD does not end at approval. Lower alert thresholds, tighter velocity rules, and a named review owner for this relationship.

12. Scheduled review date. High-risk relationships get re-reviewed on a fixed cycle, typically annually or better. The date goes in the system, not in someone's memory.

Documentation: the part that actually fails audits

For each item above, the file needs four things: what was collected, how it was verified, who assessed it, and when. Regulators repeat the same finding across enforcement actions: the institution did some EDD but could not evidence it. A checklist without an evidence trail is theater.

Retention follows your jurisdiction, five years being the common floor, running from the end of the relationship, not its start.

FAQ

🔹What is the difference between CDD and EDD?

Customer due diligence is the standard tier: identity, screening, basic profile. Enhanced due diligence adds source of funds and wealth, ownership unwrapping, deeper screening, senior approval, and enhanced monitoring, applied to elevated-risk customers.

🔹Is EDD mandatory for all PEPs?

For foreign PEPs, yes under FATF standards and most national laws. For domestic PEPs, rules vary: some jurisdictions mandate EDD, others require a risk-based decision. Your policy should state which you apply.

🔹How often should EDD files be reviewed?

On a fixed schedule appropriate to risk, with annual review as the common baseline for high-risk relationships, plus event-driven review when screening hits, ownership changes, or unusual activity occurs.

🔹Can EDD be automated?

Large parts can: re-verification, screening, adverse media, source of funds collection, and monitoring all run on automated rails. The judgment calls, senior approval, and the final risk assessment stay human.