Customer due diligence (CDD)
Customer due diligence (CDD) is the set of checks that banks, EMIs and other obliged entities must carry out on their clients under EU anti-money laundering law. It means identifying and verifying the client, identifying its beneficial owners, understanding the purpose of the relationship and monitoring it over time. For business clients, CDD is often called know your business (KYB).
The four CDD measures
Article 13 of the Anti-Money Laundering Directive (AMLD) sets out what CDD involves:- Identify the client and verify its identity from reliable, independent documents or data.
- Identify the beneficial owner and take reasonable steps to verify who they are, including understanding the ownership and control structure of a company or trust.
- Assess, and where needed obtain information on, the purpose and intended nature of the business relationship.
- Monitor the relationship on an ongoing basis, including the payments made, so they stay consistent with what the provider knows about the client, its business and its risk profile.
The CDD process step by step
- Collect information: the client's legal name, registration number, address, directors, ownership and business activity.
- Verify the customer's identity: check it against reliable, independent sources, such as company registers and identity documents, often with electronic identity verification.
- Verify beneficial ownership: identify every ultimate beneficial owner, check registers and documents, and understand the control structure.
- Screen: check the client, its directors and owners against sanctions lists, PEP databases and adverse media.
- Assess the risk: give the client a risk rating that decides whether simplified, standard or enhanced due diligence applies.
- Decide and record: approve or decline the relationship and keep the records.
- Monitor: keep watching transactions and keep customer data up to date for as long as the relationship lasts.
When CDD applies
- when a business relationship starts, such as opening an account
- for occasional transactions of EUR 15,000 or more, or transfers of funds above EUR 1,000
- whenever there's a suspicion of money laundering or terrorist financing, whatever the amount
- when the provider doubts information it collected earlier
Simplified, standard and enhanced
The depth of CDD follows the client's risk, under a risk-based approach.| Level | When it applies | What changes |
|---|---|---|
| Simplified | Lower-risk clients, such as listed companies or public authorities | Fewer or lighter measures; monitoring still applies |
| Standard | Most clients | The four measures above |
| Enhanced | Higher-risk clients, such as PEPs or links to a high-risk third country | More evidence, senior approval in some cases, closer monitoring: see enhanced due diligence |
Customer risk assessment
EU rules and the EBA's risk factor guidelines group the factors a provider looks at into four areas:- Customer risk: the client's ownership, business model, industry and reputation, for example complex structures or a cash-intensive business.
- Geographical risk: where the client and its owners are established and where its money comes from and goes, including links to a high-risk third country.
- Product and transaction risk: the services used and the size, speed and pattern of the expected financial transactions.
- Delivery channel risk: how the relationship is set up, for example fully remote onboarding or onboarding through an intermediary.
What a business client is usually asked for
- a recent extract from the company register and the articles of association
- an ownership chart down to every beneficial owner
- identity documents for directors, beneficial owners and authorised signatories
- a description of the business, its markets and its main counterparties
- expected account activity: volumes, currencies and countries
- evidence of the source of funds for the money coming in
Ongoing customer monitoring
CDD continues after onboarding. Ongoing monitoring has two parts:- Monitoring transactions: transaction monitoring checks whether payments fit what the provider knows about the client, and flags unusual activity that could indicate money laundering or terrorist financing.
- Keeping data up to date: periodic reviews, more often for higher-risk clients, and event-driven reviews when something changes, such as new owners, new directors, a new line of business or a sanctions or adverse media alert.
If CDD can't be completed
A provider that can't complete CDD must not open the account or carry out the transaction, and must end an existing relationship. It must also consider whether to file a suspicious transaction report. This is one route to an account being closed, covered in debanking.What changes under the AMLR
From 10 July 2027, CDD rules move into the EU Anti-Money Laundering Regulation (AMLR), which applies directly in every member state. The measures stay broadly the same, but the details become uniform across the EU instead of varying with national law. One visible change: CDD on occasional transactions starts at EUR 10,000 instead of EUR 15,000, and transfers of funds trigger it from EUR 1,000.FAQ
KYC (know your customer) is the everyday name for the identity part of CDD. CDD is the legal term and also covers beneficial owners, the purpose of the relationship and ongoing monitoring.
It's ongoing. Providers review higher-risk clients more often and update records when something changes, such as new owners or a new line of business.
Usually yes. Each obliged entity stays responsible for its own CDD. EU law lets it rely on another regulated firm's checks only in limited cases, so most providers collect the documents themselves.
Under the AMLD, for five years after the business relationship ends or after an occasional transaction. National law can extend this in some cases.
The obliged entity itself: the bank, EMI or other regulated firm. It can outsource parts of the work, but stays responsible for the result.
Related terms and sources
Know your business (KYB) · Ultimate beneficial owner · Enhanced due diligence · Politically exposed person · Source of funds · Risk-based approach · Transaction monitoring · Browse the full glossary
Last reviewed October 30, 2026Disclaimer
This publication is provided for general information purposes and does not constitute legal, tax, or other professional advice from Narvi Payments Oy Ab or its affiliates, and it is not intended as a substitute for obtaining advice from a financial advisor or any other professional.
This publication is provided for general information purposes and does not constitute legal, tax, or other professional advice from Narvi Payments Oy Ab or its affiliates, and it is not intended as a substitute for obtaining advice from a financial advisor or any other professional.
What We Offer
IBAN Accounts For Your Business
Support & Compliance
Narvi Knowledge Center
Alternative Investment Funds [whitepaper]Family Offices [whitepaper]Shipping Industry [whitepaper]How to Open a Business Account in FinlandNarvi vs. Wise, Revolut, N26, and other alternativesNarvi vs. Stable.comNarvi vs. payabl.Narvi vs. ConnectPayNarvi vs. IBAN4UNarvi vs. GenomeNarvi vs. PaxumNarvi vs. BilderlingsNarvi vs. NetellerNarvi vs. KontistPayments BlogPayments Glossary
Narvi Payments Oy Ab is an Authorized Electronic Money Institution (EMI). Narvi’s EMI license is granted by the Finnish Financial Supervisory Authority (FIN FSA) with the registration number 3190214-6. Narvi’s license is passportised to all European Union countries.
Built and regulated in Finland© 2026 Narvi. All Rights Reserved.
v1.332.0