CDD (Customer Due Diligence)

Customer due diligence is the process of verifying a customer's identity and sizing up their risk profile, and it's a core part of meeting AML obligations for financial and payment businesses. It's usually one of the first checkpoints a new customer passes through, and getting it right decides whether a business can confidently take on that relationship without exposing itself to fraud, money laundering or regulatory trouble. As financial crime rules have tightened worldwide, CDD has gone from good practice to a standard, non-negotiable requirement across nearly every regulated financial and payment business.

What CDD Actually Means

The standard level of identity verification and risk assessment carried out when onboarding a new customer, confirming who they are and weighing factors like expected transaction activity and any red flags in their background. A foundational requirement under most AML frameworks, not an optional add-on.

What the Process Actually Looks Like

Collecting identifying information, name, address, date of birth for individuals, company registration and ownership details for businesses, then checking it against reliable, independent sources. The process also weighs risk factors like location, industry and expected transaction patterns to decide how much ongoing monitoring makes sense.

Why This Actually Matters for Payment Businesses

Solid CDD is one of the primary defences against onboarding customers who intend to use a platform for money laundering, fraud or other financial crime. Beyond ticking a regulatory box, it protects a payment business's relationships with its own banking partners, since weak CDD can expose the whole platform to regulatory scrutiny.

Where the Line Sits With Enhanced Due Diligence

Standard CDD covers most customers, while enhanced due diligence digs deeper into higher-risk customers, those in high-risk industries or jurisdictions. Getting this risk-based call right sits at the centre of an effective AML programme, covered further in fraud and risk management in modern payment systems.

What Actually Gets Asked For

Verified identity documents, proof of address, business registration details for corporate customers, screening against sanctions and politically exposed persons lists. Ongoing monitoring, not a one-time check, is also standard in a genuinely compliant CDD programme.

CDD Doesn't Stop Once Onboarding's Done

Businesses are expected to periodically refresh customer information and watch transaction activity for anything inconsistent with a customer's declared profile, updating risk ratings and requesting more verification as circumstances shift over time. Treating CDD as a one-off box to tick at signup is exactly the mistake regulators watch for.

Where Businesses Actually Get CDD Wrong

The most common mistake isn't skipping verification outright, it's treating CDD as complete the moment a customer's onboarded and never revisiting it. Risk profiles shift, and a CDD programme that doesn't account for that drifts out of step with the very customers it's meant to be monitoring.