An enhanced due diligence checklist tells you which extra documents and checks to run when a client is flagged as high risk. Standard KYC is not enough for politically exposed persons, offshore structures, cash-intensive businesses, or clients from sanctioned or high-risk jurisdictions. Regulators expect a deeper file, and they expect you to prove it.
This article gives you the full enhanced due diligence checklist: the triggers that require EDD, the documents to collect on top of standard KYC, the checks to run per risk profile, and how to keep the file fresh through ongoing monitoring.
When enhanced due diligence is required
Enhanced due diligence applies to any client, transaction, or relationship that a risk assessment flags above the standard threshold. Most AML frameworks (FinCEN, FATF, FCA, AMF, MAS, AUSTRAC) list the same set of triggers.
| Trigger | Why EDD applies |
|---|---|
| Politically exposed person (PEP), family member, or close associate | Higher corruption and sanctions risk |
| Client from a FATF high-risk or grey-list jurisdiction | Weaker AML controls in home country |
| Complex ownership structure (multi-layered entities, trusts, nominees) | Beneficial ownership harder to establish |
| Cash-intensive business (casinos, money services, jewelers, art dealers) | Higher money laundering exposure |
| Correspondent banking relationships | Layered counterparty risk |
| Large or unusual transactions relative to the client’s profile | Possible structuring or layering |
| Adverse media hits, past sanctions, prior SAR filings | Reputational and regulatory risk |
| Reluctance to provide standard KYC documents | Concealment red flag |
If any of these triggers apply, standard KYC document collection is your starting point, not your finish line. You still need the base identity and address documents, then everything below.
The core enhanced due diligence checklist
Every EDD file should contain the following, on top of the standard KYC pack.
| # | Item | What it proves | Refresh cadence |
|---|---|---|---|
| 1 | Detailed source of funds statement with supporting evidence (payslips, dividend statements, sale contracts, tax returns) | The money in this specific relationship is legitimate | Annually |
| 2 | Source of wealth narrative covering the client’s overall net worth (inheritance, business proceeds, investments) | The client’s total assets have a lawful origin | Annually |
| 3 | Full beneficial ownership tree down to natural persons at 10% (not the standard 25%) | No hidden ultimate controllers | On change; verified annually |
| 4 | Sanctions and PEP screening with adverse media, run against all beneficial owners, directors, and signatories | No sanctioned or high-risk individuals in the structure | Every 3-6 months |
| 5 | Enhanced identity verification: live video call, biometric match, or notarized ID | Higher assurance than a document scan | At onboarding, refreshed on change |
| 6 | Certified translations of any document not in your working language | The regulator can read the file | Once per document |
| 7 | Documented approval from senior management to enter or continue the relationship | Governance sign-off, required for PEPs under most regimes | On onboarding and annually |
| 8 | Purpose and nature of the business relationship, in writing | Establishes expected activity for transaction monitoring | On onboarding |
| 9 | Expected volume and value of transactions | Baseline for detecting anomalies | Annually |
| 10 | Independent third-party references (banker, lawyer, accountant) for the client | Corroboration beyond the client’s own statements | On onboarding |
| 11 | Site visit report for corporate clients where feasible | Confirms the business operates as described | On onboarding for the highest-risk tier |
| 12 | Enhanced risk assessment memo scoring each factor and the mitigations applied | Documents your reasoning for auditors | Annually |
Keep every version of every document. Regulators will ask for the file as it stood at a specific moment, not just the current state.
Enhanced due diligence by client profile
Not every high-risk client needs the same additional work. Match the extra documents to the trigger.
Politically exposed persons (PEPs)
For a PEP, a family member, or a close associate, add:
- Public role and dates (in office, current or former)
- Declaration of assets filed with the relevant authority, if publicly available
- Documented source of wealth linked to the political role or independent activity
- Approval from a designated senior manager before onboarding
- Ongoing monitoring set to a higher sensitivity (adverse media alerts weekly, not monthly)
Most regimes require you to treat former PEPs as PEPs for at least 12 to 18 months after they leave office.
High-risk jurisdictions
For clients based in or transacting through FATF grey- or black-listed countries, add:
- Detailed rationale for the business relationship despite the geographic risk
- Evidence that the client’s local bank has adequate AML controls (correspondent due diligence)
- Sanctions screening extended to the client’s counterparties
- Explanation of the client’s ties to the jurisdiction (business, family, tax residence)
Complex ownership structures
For trusts, holding companies, offshore vehicles, or multi-jurisdiction structures, add:
- Full ownership chart (signed by the client) with every entity mapped
- Certified corporate registry extracts for each layer
- Trust deeds, settlor declarations, and letters of wishes for trust structures
- Nominee arrangement disclosures (who instructs the nominee)
- Beneficial ownership identification down to 10% or below
- Legal opinion where the structure is unusual
The KYB checklist covers the base corporate documents. EDD stacks on top with the beneficial ownership deep dive.
Cash-intensive or high-risk industries
For casinos, money service businesses, precious metals dealers, art galleries, crypto operators, or adult entertainment:
- Copy of every relevant operating license, with expiration tracking
- Written AML policy from the client’s own compliance program
- Independent AML audit report if the client is regulated
- Evidence of transaction monitoring on the client’s side
- Higher-frequency review cycle (every 6 months instead of 12)
High-net-worth private clients
For private banking or wealth management with balances above your firm’s threshold:
- Detailed source of wealth timeline (career, inheritance events, liquidity events)
- Tax residency certificates for every jurisdiction the client is exposed to
- FATCA and CRS self-certifications
- Historical account statements from prior institutions covering 2 to 5 years
- Investment mandate and rationale for the account’s purpose
Ongoing monitoring for EDD clients
Enhanced due diligence is not a one-time event. Under FATF Recommendation 10 and every regime that follows it, you monitor the relationship for as long as it exists.
- Rerun sanctions and PEP screening on all beneficial owners at least every 6 months, monthly for the highest-risk tier
- Compare actual transaction patterns to the expected volumes captured at onboarding
- Refresh source of funds documentation annually
- Trigger a full file review on any material change: new beneficial owner, new jurisdiction, adverse media hit, or unusual activity
- Log every review and its outcome in the client file
If you cannot maintain this cadence, the relationship should be exited. Regulators penalize firms that keep high-risk clients on the books without the monitoring to match.
How to run enhanced due diligence efficiently
The problem with EDD is not knowing what to collect. It is chasing 12 to 20 documents from a client who is often based abroad, busy, and reluctant to share sensitive paperwork by email.
A structured document collection workflow removes most of the friction. Superdocu is a document collection platform that gives every client a branded portal with the exact EDD list, tracks what is missing, and automates reminders until the file is complete.
Concretely, for enhanced due diligence, you can:
- Build an EDD workflow template with every document, form, and screening question from the checklist above
- Set expiration dates on documents that need periodic refresh (IDs, proof of address, source of funds)
- Add conditional steps that only appear for PEPs, offshore structures, or specific jurisdictions
- Assign each file to a compliance officer with senior manager sign-off as a mandatory step
- Track document status, sanctions screening results, and review dates in one place
- Export the complete file as a ZIP for regulator requests
Because the portal is white-labeled, your clients see your brand, not a third-party tool asking them for their tax returns. That matters when the person on the other side is a PEP or a high-net-worth private client.
You can also connect Superdocu to your existing systems through Zapier or webhooks, so an onboarding approval in your CRM triggers the EDD workflow automatically. See the pricing page for plan details.
Frequently asked questions
What is the difference between CDD and EDD?
Customer Due Diligence (CDD) is the standard set of checks required for every client: identity verification, address, beneficial ownership above 25%, and a basic risk assessment. Enhanced Due Diligence (EDD) is a deeper level applied when a client, transaction, or jurisdiction is flagged as higher risk. EDD adds source of wealth documentation, extended screening, senior management approval, and more frequent monitoring.
When is enhanced due diligence required?
EDD is required for politically exposed persons, clients from FATF high-risk jurisdictions, complex ownership structures, cash-intensive businesses, correspondent banking relationships, and any client whose activity is inconsistent with their profile. Most AML frameworks (FinCEN, FCA, AMF, MAS, AUSTRAC) list these triggers and expect firms to apply EDD proportionately.
How often should EDD files be refreshed?
At minimum annually for source of funds and risk assessment documents, every 6 months for sanctions and PEP screening, and immediately upon any material change (new beneficial owner, new jurisdiction, adverse media hit). The highest-risk clients should be reviewed at least every 6 months in full.
Is enhanced due diligence the same as ongoing monitoring?
No. EDD is the enhanced set of checks and documents you collect at onboarding and periodic review. Ongoing monitoring is the continuous process of comparing the client’s actual activity against their expected profile, rerunning screenings, and flagging anomalies. EDD clients require both, and the monitoring cadence is more intensive than for standard clients.
Do I need senior management approval for every EDD client?
Yes for PEPs and their families under most regimes (FATF, EU AMLD6, UK MLR 2017). For other EDD categories, senior management approval is a strong best practice and is often required by internal policy even where the regulation is silent. Document the approval in the client file with the name, date, and rationale.
Start collecting EDD documents in one place
Enhanced due diligence gets easier when the checklist lives in a workflow instead of a folder of email threads. Try Superdocu free and build your first EDD workflow today. No credit card required.