Enhanced due diligence (EDD): what U.S. rules require

Enhanced due diligence (EDD) is the extra review a financial institution does for customers who pose a higher risk of money laundering or terrorist financing. It goes beyond standard customer due diligence (CDD) by collecting more information — such as where a customer’s money comes from — and reviewing the relationship more closely and more often.

This guide sticks to U.S. rules: the two Bank Secrecy Act (BSA) regulations that spell out enhanced steps, what federal examiners expect for other higher-risk customers, how EDD differs from CDD and CIP, and a practical checklist.

What is enhanced due diligence?

In the U.S., the clearest plain-language description comes from the Customer Due Diligence section of the FFIEC BSA/AML Examination Manual, the manual federal bank examiners use. (FFIEC is the Federal Financial Institutions Examination Council.) It says that “collecting additional information about customers that pose heightened risk, referred to as enhanced due diligence (EDD),” is part of an effective due diligence program, and gives private and foreign correspondent banking as examples.

So EDD isn’t a separate program. It’s the higher-risk end of the due diligence a bank already does: the more risk a relationship carries, the more you collect and the more often you check back.

Where enhanced due diligence appears in U.S. law

The federal BSA regulations write out specific enhanced steps for two situations. For everything else, the requirement is risk-based due diligence, with more scrutiny where risk is higher.

1. Correspondent accounts for certain foreign banks

31 CFR 1010.610 requires a due diligence program for correspondent accounts held for foreign financial institutions. Paragraph (b) is titled “Enhanced due diligence for certain foreign banks.” Under paragraph (c), it applies to a correspondent account for a foreign bank that operates under:

• an offshore banking license;
• a license from a country designated as non-cooperative with international anti-money laundering principles by an intergovernmental group the U.S. belongs to, with the U.S. representative’s agreement; or
• a license from a country the Secretary of the Treasury has designated as warranting special measures because of money laundering concerns.

For those accounts, the institution must at a minimum take reasonable steps to apply enhanced scrutiny (including reviewing the foreign bank’s anti-money laundering program and monitoring transactions), find out whether the foreign bank offers correspondent accounts to other foreign banks through the account, and — if the foreign bank’s shares aren’t publicly traded — identify each owner of 10 percent or more. Paragraph (d) adds that the program must say what happens when due diligence or EDD can’t be performed, including when to refuse to open the account, suspend transactions, file a suspicious activity report (SAR) or close the account.

2. Private banking accounts for non-U.S. persons

31 CFR 1010.620 covers private banking accounts. Under the definitions in 31 CFR 1010.605, that means an account requiring a minimum aggregate deposit of at least $1,000,000, set up for one or more non-U.S. persons, and managed by a bank officer, employee or agent acting as a liaison with the owner.

The program must take reasonable steps to identify all nominal and beneficial owners, find out whether any of them is a senior foreign political figure, establish the source of funds and the purpose and expected use of the account, and review activity against that information. When a senior foreign political figure is an owner, the rule requires “enhanced scrutiny” designed to detect transactions that may involve the proceeds of foreign corruption. Note the wording: this section says “enhanced scrutiny,” not “enhanced due diligence.”

Under 31 CFR 1010.605(p), a senior foreign political figure means a current or former senior official in a foreign government’s executive, legislative, administrative, military or judicial branch, a senior official of a major foreign political party, or a senior executive of a foreign government-owned commercial enterprise — plus any entity formed by or for such a person, their immediate family members and their widely known close associates.

3. Everyone else: risk-based CDD

Outside those two rules, the obligation comes from the CDD requirement in the bank anti-money laundering (AML) program rule, 31 CFR 1020.210. Banks must have “appropriate risk-based procedures for conducting ongoing customer due diligence,” including understanding the nature and purpose of customer relationships to build a customer risk profile, and ongoing monitoring to identify and report suspicious transactions and, on a risk basis, keep customer information current.

The FFIEC manual explains what that means for higher-risk customers. It says a bank should get more customer information when the customer risk profile is higher, and that these customers and their transactions “should be reviewed more closely at account opening and more frequently” over the relationship. It also says a bank’s policies should define “when and what additional customer information will be collected.”

EDD vs CDD vs CIP

These three terms overlap, so it helps to see them side by side:

• CIP (Customer Identification Program) is about identity. Under 31 CFR 1020.220, a bank must collect at least a name, date of birth (for an individual), address and identification number before opening an account, and verify identity “to the extent reasonable and practicable.” Our guide to CIP for remote account opening covers it in detail.
• CDD (customer due diligence) is about understanding the relationship: its nature and purpose, the customer’s risk profile, ongoing monitoring and, for business customers, beneficial owners. Under 31 CFR 1010.230, a beneficial owner is each individual who owns 25 percent or more of a legal entity customer, plus one individual with significant responsibility to control it.
• EDD is CDD turned up for higher-risk customers: more information, closer review and more frequent monitoring — plus the specific enhanced steps in 1010.610 and 1010.620 where those rules apply.

Put simply, CIP answers “who is this?”, CDD answers “what is this relationship, and is it behaving as expected?”, and EDD answers “this one is higher risk — what more do we need to know?”

When is enhanced due diligence required?

In the regulations, specific enhanced steps are required in two cases: correspondent accounts for the foreign banks listed in 31 CFR 1010.610(c), and private banking accounts for non-U.S. persons where a senior foreign political figure is an owner (enhanced scrutiny under 31 CFR 1010.620).

Beyond that, the trigger is your own risk assessment. The FFIEC manual notes that no single indicator decides whether a customer is lower or higher risk, and that higher-risk information and transactions get closer, more frequent review. Its list of events that may prompt a review of an existing customer includes significant unexplained changes in account activity, changes in employment or business operations, changes in ownership, law enforcement inquiries and results of negative media searches.

What about politically exposed persons (PEPs)? In an August 21, 2020 joint statement, the Financial Crimes Enforcement Network (FinCEN) and the federal bank and credit union regulators — the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration and the Office of the Comptroller of the Currency — said BSA/AML regulations do not define PEPs, that the CDD rule does not require banks to screen for them, and that “not all PEPs are high risk solely by virtue of their status.” The due diligence should match the risk of the specific relationship.

Enhanced due diligence checklist

The steps below are common EDD practices. Apart from the specific requirements quoted above, they aren’t a legal checklist — your written procedures and your BSA officer decide which apply and when.

1. Document why the customer is higher risk. Record the risk factors and rating so an examiner can follow your reasoning.
2. Ask about source of funds and source of wealth. “Source of funds and wealth” is the first item on the FFIEC manual’s list of additional information for higher-risk customers. Ask for supporting documents, such as bank statements, where the answer isn’t self-evident.
3. Understand the business. The same FFIEC list includes occupation or type of business, financial statements for business customers, where a business is organized and operates, its trade area, and a description of operations such as total sales and cash volume.
4. Verify beneficial owners and controllers. Identify and verify the people behind a business customer, not just the person opening the account. Decide whether your procedures look at owners below the 25 percent threshold for higher-risk entities.
5. Screen against sanctions lists. Check the customer and its owners against the Office of Foreign Assets Control (OFAC) lists and any other lists your program uses. Our guide to sanctions screening explains how name matching works.
6. Research adverse information. Negative media searches are named in the FFIEC manual as a way to obtain additional information on a risk basis. PEP checks, where your program uses them, also belong here.
7. Get senior or compliance sign-off. A common practice is to have a senior reviewer or the compliance team approve higher-risk relationships. The FFIEC manual asks that procedures state who can change a customer’s risk profile; it doesn’t name a level.
8. Review more often. Set a tighter monitoring and refresh schedule, and re-review when something material changes.
9. Decide what happens if EDD can’t be completed. For correspondent and private banking accounts, the rules require procedures covering when to decline, suspend, file a SAR or close. You may want a similar plan for other higher-risk customers.

Enhanced due diligence examples

These examples are hypothetical.

• A cash-intensive business. For example, a new business customer expects large monthly cash deposits. A bank might ask for financial statements and a description of the business’s sales, verify each owner’s identity, and monitor deposits against the volumes the customer described.
• A sudden change in activity. For example, a long-standing personal account starts receiving large international wires with no explanation. The bank might ask the customer about the source of the funds, document the answer, raise the risk rating and review the account more frequently.
• A foreign official’s private banking account. For example, a non-U.S. person opens a private banking account with a $2 million deposit, and the bank learns that a beneficial owner is a former senior foreign government official. 31 CFR 1010.620 requires enhanced scrutiny designed to detect transactions that may involve the proceeds of foreign corruption.

Where identity and screening tools fit

Several EDD steps are evidence gathering that software can organize. Securely Verify covers parts of it:

• Identity verification. Every plan checks each person’s government ID, a live selfie and liveness, and screens them against the OFAC, UN, UK and EU sanctions lists.
• Owners and business documents. On the Growth plan and up, business verification collects formation, tax and banking documents and sends an identity verification to each owner and officer, recording roles and ownership percentages in one case.
• Ongoing sanctions monitoring. On Growth and up, AML screening re-screens customers when lists change and lets you screen any person or business on demand.

Securely Verify does not offer PEP or adverse-media screening, so those checks need other sources. And documents are collected and organized for your reviewers; judging source of funds is still a human decision.

Frequently asked questions

What does enhanced due diligence mean?

Enhanced due diligence means collecting more information about a higher-risk customer and reviewing the relationship more closely and more often than for a standard customer. The FFIEC manual describes it as collecting additional information about customers that pose heightened risk.

What is an example of EDD?

A hypothetical example: a new business customer expects large monthly cash deposits, so the bank asks for financial statements, verifies each owner’s identity, documents the source of funds and monitors deposits more frequently.

Is CDD required for all customers?

For banks, yes: 31 CFR 1020.210 requires risk-based procedures for ongoing customer due diligence. The level of detail scales with risk, and the FFIEC manual says a bank may not need additional information for some lower-risk customers beyond what it collects at account opening.

How do you clear EDD at a bank?

Each bank sets its own process. In general, answering the bank’s questions fully and providing the documents it asks for, such as proof of where funds came from, helps the bank finish its review.

If you want to see how owner verification and sanctions screening could support your EDD files, start a 7-day free trial — 20 verifications, no card required.

Related guides

• Sanctions screening and AML name screening: how matching works
• Proof of address: what documents count and how to verify them
• Merchant onboarding: how to verify a merchant and its owners
• How to choose a KYC provider: 10 questions to ask

Sources: Customer Due Diligence (FFIEC BSA/AML Examination Manual, accessed October 2026); 31 CFR 1010.610, Due diligence programs for correspondent accounts for foreign financial institutions (eCFR, current as of October 2026); 31 CFR 1010.620, Due diligence programs for private banking accounts (eCFR, October 2026); 31 CFR 1010.605, Definitions (eCFR, October 2026); 31 CFR 1020.210, Anti-money laundering program requirements for banks (eCFR, October 2026); 31 CFR 1020.220, Customer identification program requirements for banks (eCFR, October 2026); 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (eCFR, October 2026); Joint Statement on Bank Secrecy Act Due Diligence Requirements for Customers Who May Be Considered Politically Exposed Persons (FinCEN, Federal Reserve, FDIC, NCUA and OCC, August 21, 2020). This article is general information, not legal or compliance advice.