Enhanced due diligence (EDD) is the additional investigation an institution performs on a customer whose risk profile is higher than its standard customer due diligence is built for: more information, stronger evidence, senior sign-off and closer ongoing monitoring. The FFIEC BSA/AML Examination Manual describes it as "collecting additional information about customers that pose heightened risk."
Why it matters in KYB review
Standard CDD establishes who a business is, who owns and controls it, and what it plans to do. EDD tests whether that story holds up when the risk is higher. The FFIEC manual says higher-risk customers "should be reviewed more closely at account opening and more frequently throughout the term of their relationship." Regulation hard-codes enhanced steps in some places; for private banking accounts held by non-US persons, 31 CFR 1010.620 requires ascertaining the source of funds and applying extra scrutiny to senior foreign political figures.
EDD is also where onboarding queues stall. A single case can need registry pulls in several countries, ownership tracing through holding companies and a source-of-wealth narrative, and it often lands at the end of the day.
Common EDD triggers
- A high-risk business category or licensed activity, such as a money services business.
- A politically exposed person among owners or controllers, where the risk warrants it.
- Complex or opaque ownership, including trusts, nominee arrangements or multi-layer holding companies.
- Exposure to high-risk jurisdictions or sanctioned-country neighbours.
- Material adverse media.
- Expected activity out of proportion to the business's size or age.
What an EDD file contains
- Full ownership chain to the natural persons, with evidence at each layer.
- Source of funds and source of wealth, corroborated where possible.
- Screening results for the entity, owners, controllers and key counterparties, with how each potential match was resolved.
- An assessment of the business model and expected activity.
- Open items, what was requested, and what could not be established.
- A risk rating and a recommendation, with sign-off by someone with authority to accept the risk.
Common pitfalls
- Treating EDD as a longer checklist rather than an investigation with a question to answer.
- Collecting documents without testing them against independent sources.
- Silent gaps: a file that reads as complete when a key fact was never verified.
- Applying EDD to every case, which spends analyst time where risk does not justify it.
Related terms
Customer due diligence, source of funds vs source of wealth, adverse media screening, alert escalation.
Sweat AI is an AI-native BPO for banks and fintechs, working onboarding and fraud queues 24/7. For EDD cases our analysts build the ownership chain, corroborate the applicant's claims and list exactly what remains open, then give your team a recommendation to decide on. See a sample KYB review or business investigations.
Questions
Is EDD a separate legal requirement in the US?
For most relationships, EDD is how an institution applies its risk-based CDD obligations to higher-risk customers. Specific enhanced steps are written into regulation for some products, such as private banking accounts for non-US persons under 31 CFR 1010.620.
Does every PEP need EDD?
Not automatically. The 2020 interagency statement says not all PEPs are higher risk solely by virtue of their status; the level of diligence should match the risk of the relationship.
Sources
- FFIEC BSA/AML Examination Manual, Customer Due Diligence, accessed 2026-09-30
- 31 CFR 1010.620, Due diligence programs for private banking accounts (eCFR), accessed 2026-09-30
- Interagency Joint Statement on BSA Due Diligence Requirements for Customers Who May Be Considered PEPs (August 21, 2020), accessed 2026-09-30