What exactly is Customer Due Diligence (CDD)? And why is it so important? CDD is a critical element of effectively managing risk and protecting you (and your business) against potential association or involvement with bad actors and financial crimes. CDD processes are crucial for Know Your Customer (KYC), and while they vary around the world, in most cases, they involve identifying your customer and understanding their activities. This then allows you to assess their risk profile.
Sometimes, Enhanced Due Diligence (EDD) is needed. This involves collecting additional information on high-risk customers to provide a deeper understanding of customer activity and to mitigate risk. Customer assessments can be used to determine which level of due diligence is required, a crucial step in creating an effective risk-based approach as part of a robust compliance program.
To ensure that your business is following best practices, we have put together the following five-step checklist to help improve your CDD processes.
Step 1: Verify customer identities
Perform CDD measures before entering into business relationships with customers to detect potential bad actors early in the process. Creating barriers to prevent financial criminals from accessing accounts on your system helps avoid questionable activities before they can even begin.
How?Ascertain the identity and location of the potential customer, and gain a good understanding of their business activities. This can be as simple as verifying their name and address. However, with increases in online fraud, collecting more information or running additional identity checks might also be advisable. Some information sources that can help the identity process include:
- Name
- Address
- Date of birth
- Telephone number
- National ID number
- Identity documents
- Mobile network data
- Geolocation
- Selfie
- Live video
- Third-party account verification
Business and other legal entity customers also require verification to ensure the legitimacy of the business and that the account holders have the proper authority to act on behalf of the business. The business verification process examines information like:
- Business registration number
- Company name
- Address
- Operational status
- Key management personnel
- Date of incorporation
Why?You have to first decide whether a client or customer fits your established risk profile, before entering into a business relationship with them. You can only do this by undertaking the appropriate CDD measures. This ensures that identity theft and any potential forgeries can be detected and dealt with early.
Step 2: Assess third-party information sources
Strengthen your processes when vettingthird parties.
How?You may rely on third parties — from banks, to lawyers, to auditors — to help you perform due diligence, however it’s important to choose these third parties wisely because the ultimate responsibility for CDD measures remains with you, not the third party.
Why?Sometimes, the only way to get the information required for CDD is through a trusted third party, so it’s important to ensure that their standards and best practices are aligned with your business. At the end of the day, you are liable and will be fined or penalized for non-compliance.
Systematically thinking about your business relationships, the potential exposures they could incur, what steps you need to implement, and then how you can operationalize and review those procedures makes good business sense — and helps ensure proper compliance.
Step 3: Secure your information
Ensure that pertinent information has been collected and stored securely.
How?When authenticating or verifying a potential customer, classify their risk category and define what type of customer they are, before securely storing this information and any additional documentation digitally. While keeping personally identifiable information (PII data) might be necessary, there are often strict legal requirements regarding how that information is collected, stored and shared; beyond any legal necessity, protecting customer data is crucial to avoid any reputational damage.
Why?Having a meticulous and comprehensive process for documenting CDD-related information is highly effective and also mitigates any potential risk for you as a business.
Step 4: Take any necessary additional measures
Detect if there is a need for EDD.
How?Beyond basic CDD, it’s important that you carry out the correct processes to ascertain whether EDD might be necessary. This can be an ongoing process, as customers have the potential to transition into higher-risk categories over time so, conducting periodic due diligence assessments can be beneficial.
For example, most jurisdictions require politically exposed persons (PEPs) to go through the EDD process. Other factors that might trigger EDD are accounts with high transaction values, accounts that deal with high-risk activities and adverse media mentions. Factors to consider to determine whether EDD is required include, but are not limited to:
- The person’s location
- Their occupation
- Transaction types
- Expected activity patterns in terms of transaction types, dollar values and frequencies
- Expected payment methods
If the account is for a business, additional EDD considerations include:
- Identifying any connected entities and Ultimate Beneficial Owners (UBOs)
- Performing AML/KYC checks on UBOs to verify their identities
- Downloading official company records to act as a Record of Authority
- Screening the company and its owners against global watchlists and sanctions lists
Why?Again, this protects you and your business against any involvement with nefarious activities and also ensures that you’re meeting various KYC and Anti-Money Laundering (AML) regulatory requirements.
Step 5: Ensure you’re audit ready
Keep historical records on hand.
How?Store records of instances of CDD and EDD securely, in a digital format.
Why?Keeping records of all the CDD and EDD performed on each customer, or potential customer, is necessary in case of future regulatory obligations (for example, an external audit).
With robust digital records in place, internal audit processes can account for deeper data sets, can re-run and re-analyze situations to decrease risk, improve performance and better guard against problematic accounts. These records are another line of defense to help protect the entire compliance process, as they can be used to double-check accounts that have passed onboarding checks. These checks also allow the auditing team to hone their strategy and tactics, test assumptions and otherwise optimize compliance procedures.
The digital audit trail is a cornerstone of creating a resilient, standardized, testable compliance program. Rising above the inconsistencies of individual people running and being responsible for account compliance, a systematic compliance program helps protect the company, besides being scalable and adaptable.
Ongoing CDD
The key to effective, ongoing CDD is to have set policies and processes for various contingencies. Anticipating scenarios helps to clarify which approaches are best and speeds up responses.
For forward-looking organizations, compliance is a competitive advantage, not just a regulatory checkbox exercise. Effective ongoing compliance lessens risk, increases knowledge of customers and enables adaptable systems. Establishing values and procedures that promote constant vigilance and respect for regulatory obligations helps create a transparent organization with solid governance.
This post was originally published on February 22, 2018. It has been updated to reflect the latest industry developments and best practices.
Compliance
Build Trust and Safety with Digital KYC
Meet global Know Your Customer requirements without burdening customers
Get the KYC White Paper
