Customer due diligence (CDD)

Customer due diligence (CDD) is the set of steps a financial institution takes to know who its customer is, who owns and controls it, why it wants the relationship, and whether its activity continues to match that picture over time. For business customers, CDD is what the industry usually calls KYB.

The US requirements

In the US, CDD for banks rests on two pieces of regulation:

• Beneficial ownership (31 CFR 1010.230). Institutions must identify and verify each individual who owns 25% or more of a legal entity customer, and a single individual with significant responsibility to control, manage or direct it (see ultimate beneficial owner and control person).
• Risk profile and monitoring (31 CFR 1020.210(b)(5)). The AML program must include "understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile," and ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, including beneficial ownership.

Timing changed in 2026. FinCEN order FIN-2026-R001 (February 13, 2026) relieves covered institutions from re-identifying beneficial owners at each new account. They must do so when a legal entity customer first opens an account, when they learn facts that would reasonably call the prior information into question, and as their risk-based ongoing CDD procedures require.

Why it matters in KYB review

CDD sets the baseline every other control depends on. Transaction monitoring compares activity to the customer risk profile, so a vague profile produces weak alerts. The FFIEC BSA/AML Examination Manual calls risk-based CDD "the cornerstone of a strong BSA/AML compliance program."

What an analyst checks

• The entity exists, is in good standing, and matches the application (name, number, address, formation date).
• Beneficial owners and the control person, identified and verified.
• Nature and purpose: what the business does, its customers, geographies and expected volumes.
• Screening of the entity and its people against sanctions, PEP and adverse media sources.
• A risk rating that follows from the findings, and whether the case needs enhanced due diligence.

Common pitfalls

• Collecting beneficial ownership but no real understanding of the business model.
• Risk ratings that default to "low" because a field was left blank.
• No refresh trigger, so the profile ages while the business changes.
• Relying on the applicant's own certification when a registry or document contradicts it.

Related terms

Enhanced due diligence, KYB vs KYC, 25% ownership threshold, request for information (RFI).

Sweat AI is an AI-native BPO for banks and fintechs, working onboarding and fraud queues 24/7. Our analysts run the CDD review on each business application, return the evidence behind every finding and one consolidated list of what is still missing, and your team makes the decision. See KYB review.