CDD vs EDD comes down to depth, not to a different set of questions. Customer due diligence (CDD) is what a US bank owes every customer: verify identity, identify the owners of a legal entity, understand what the relationship is for, build a risk profile, and monitor and update on a risk basis. Enhanced due diligence (EDD) asks the same questions of customers that pose heightened risk and answers them with documents, numbers and a signed decision rather than a form. The hard part is that the depth is the bank’s own call, so an EDD file has to show its reasoning. Botminds’ Enhanced Due Diligence (EDD) Review exists for that file: agents assemble the evidence and draft a memo with a source on every sentence, and people decide.
The FFIEC’s examination manual puts it in one line: collecting “additional information about customers that pose heightened risk, referred to as enhanced due diligence (EDD)” is part of an effective due diligence program (FFIEC BSA/AML Manual, Customer Due Diligence). There is no separate EDD rule for most customers. EDD is CDD with the dial turned up.
Same five questions, three depths of evidence
Simplified: Identity verified under the CIP; owners at 25% and one controller certified by the customer
Standard: The same, plus a check that the ownership makes sense for the business
Enhanced: The same, plus how the owners came by the business and the money in it, screened against sanctions, politically exposed person lists and adverse media
Simplified: Inferred from the product and customer type, because it is obvious
Standard: Nature and purpose stated at opening, enough to build a risk profile
Enhanced: A written expectation with numbers: cash, checks and wires a month, counterparties, geographies
Simplified: Not asked beyond the obvious
Standard: Occupation or type of business
Enhanced: Source of funds and source of wealth, evidenced by statements, tax returns or contracts
Simplified: Automated monitoring only
Standard: Monitoring against the profile; updates when something changes
Enhanced: Declared against actual activity reviewed by a person, each gap explained with a cited cause
Simplified: The system or the front line
Standard: The front line, with a second review of the risk rating
Enhanced: An analyst recommends; the BSA Officer or a senior manager approves, with a reason
What is the difference between CDD and EDD?
CDD is the baseline every customer receives; EDD is the additional, documented diligence a bank applies to the customers it rates higher risk. The baseline is written into the rule. A bank’s program must include “appropriate risk-based procedures for conducting ongoing customer due diligence”, including understanding the nature and purpose of each relationship well enough to build a customer risk profile and, on a risk basis, maintaining and updating customer information (31 CFR 1020.210(a)(2)(v)). For a legal entity, the bank also identifies each person who owns 25% or more and one person with significant control (31 CFR 1010.230).
EDD is where that baseline stops being enough. The same FFIEC section lists what a bank “may consider obtaining, at account opening (and throughout the relationship)” for a customer with a higher risk profile. Read the list as the content of an EDD file:
What the FFIEC lists as additional information for higher-risk customers
- Source of funds and wealth
Where the money in the account comes from, and how the customer built what it owns.
- Occupation or type of business
Of the customer and of others who own or control the account.
- Financial statements
For business customers: the numbers that make expected activity plausible.
- Where the business is organized and operates
Its place of organization and principal place of business.
- Proximity to the bank
Why a customer far from the branch banks here is a question worth answering.
- Primary trade area and expected volumes
Whether transactions will be domestic or international, and how large.
- Business operations
Total sales, the volume of currency transactions, major customers and suppliers.
The manual adds the operational point that separates EDD from a longer form: information from higher-risk customers “should be reviewed more closely at account opening and more frequently throughout the term of their relationship”. EDD is ongoing work, not a heavier onboarding packet.
CIP vs CDD vs EDD: three layers of one file
The customer identification program (CIP) answers “is this person who they say they are”; CDD answers “what is this relationship for and how risky is it”; EDD answers “does the evidence support what we believe about this high-risk relationship”. Each layer depends on the one beneath it.
CIP is the narrowest and the most prescriptive: name, date of birth, address and an identification number collected before the account opens, and identity verified by documents or other means within a reasonable time (31 CFR 1020.220). CDD is broader and risk-based, and since 2018 it includes beneficial ownership for legal entities. EDD has no general rule of its own in the US; it is the part of CDD a bank scales up, plus two narrow regulations for foreign correspondent and private banking accounts that the guide to when EDD is required sets out.
The cost follows the same shape. GAO found CDD at account opening cost the banks it studied $15 an account on average, from $5 to $44, and that figure explicitly excludes enhanced due diligence and ongoing monitoring. Across the BSA, CDD was the most expensive area of all (GAO-20-574).
CDD is already the costliest part of BSA compliance, before EDD
29%
of direct BSA/AML compliance cost went on customer due diligence, on average
15% to 59% across 11 banks, 2018
$15
average CDD cost per new account
$5 to $44; excludes EDD and ongoing monitoring
25%
ownership threshold for beneficial owners, plus one control person
31 CFR 1010.230
What is simplified due diligence, and does the US allow it?
Simplified due diligence (SDD) is the lighter treatment of customers whose risk is low. FATF goes further than allowing it: where risks are lower, institutions “should be allowed and encouraged to implement simplified CDD measures” (FATF Recommendations, Interpretive Note to R.10). US rules never use the term, but they permit the same thing. FinCEN’s FAQs say understanding nature and purpose is required for all customers, yet for lower-risk categories it can rest on what is obvious, such as the kind of customer or account (FinCEN CDD FAQs).
The limit is that simplified must be earned by risk, not chosen for convenience. In October 2026 the OCC found that Bank of America had, before August 2024, “inappropriately relied on ‘simplified customer due diligence,’ which does not provide sufficient information” for the correspondent accounts of its own foreign branches and affiliates (OCC order AA-ENF-2026-41). Those accounts are among the few where US rules ask for enhanced steps.
So “cdd vs edd vs sdd” is one dial with three positions, and the risk profile decides the position. The bank must be able to show why a customer sits where it does.
Where does CDD end and EDD begin?
At the bank’s own risk rating. No US rule draws the line by customer type; the agencies have said repeatedly that a type of customer does not set its risk. Their joint statement of July 2022 put it plainly: “no customer type presents a single level of uniform risk or a particular risk profile” (Joint statement on the risk-based approach, 2022). The rating, built from the bank’s own factors, sends a customer to EDD.
That makes the rating the most consequential step in the whole file, and the place where CDD failures become EDD failures. FinCEN’s August 2026 order against UBS Financial Services describes a customer whose income had a nexus to Russian sources: “Based on the information provided at onboarding,” the firm “rated this customer as Low-risk, meaning this customer was not subject to enhanced due diligence” (FinCEN consent order 2026-02). The firm’s own policy put high-risk customers through EDD and at least annual reviews. The customer never reached them, and the penalty was $125 million.
“Based on the information provided at onboarding, UBSFS … rated this customer as Low-risk, meaning this customer was not subject to enhanced due diligence.”
FinCEN, consent order against UBS Financial Services, 2026
CDD vs EDD in banking: one check casher, two files
The difference is easiest to see on one customer. Take a fictional example, Quarry Street Check Cashing, a licensed check casher and money order agent at Tessaly Community Bank, as it runs through the solution. Its standard CDD file would hold the company’s identity, its two owners (60% and 40%, the first also the control person), confirmation that it is a money services business, and a stated purpose: business operating account, cash for check cashing.
Its EDD file answers the same questions with evidence. The customer declared it would order $380,000 to $420,000 of cash a month. Its FinCEN money services business registration and state check casher license are confirmed against the public lookups. Its FY2025 statements show $2,840,000 of revenue, $2,110,000 of it check-cashing fees. Twelve months of activity are laid against the declared range, a relationship manager’s site visit is on file, four news and enforcement sources were searched, and a memo with a recommendation goes to the BSA Officer.
The same customer, answered at two depths
Standard CDD file: Company verified; two owners certified at 60% and 40%; one control person.
EDD file: The same, plus owners screened against sanctions and politically exposed person lists, and the agent agreement with the money order issuer on file.
Standard CDD file: “Operating account for a check-cashing business.”
EDD file: A declared range: $380,000 to $420,000 of cash ordered a month, with checks deposited and wires expected alongside.
Standard CDD file: Type of business: check cashing.
EDD file: FY2025 statements: $2.84 million revenue, $2.11 million of it fees; interim figures to June 30, 2026.
Standard CDD file: Customer says it is licensed.
EDD file: FinCEN registration and state license confirmed against public lookups, with renewal dates and locations covered.
Standard CDD file: Automated monitoring rules.
EDD file: Twelve months against the declared range; every month outside it explained with a cited cause.
Standard CDD file: Risk rating set at opening.
EDD file: A memo recommending retain, restrict or exit, approved by the BSA Officer and, under this bank’s policy, the Chief Risk Officer.
An EDD memo answers each CDD question with a cited source
EDD meaning in KYC: evidence the bank actually uses
In KYC language, EDD means more than collecting more. The information has to be used: compared with what the customer does, and acted on when it does not match. Collecting an expectation and then ignoring it is a CDD failure regulators have penalized on its own.
FinCEN’s 2023 action against Shinhan Bank America is the cleanest example. The bank’s policy required first-line staff to collect anticipated account activity at opening, but at times it “was not validated or transferred over” to the monitoring system; instead, the baselines came from the customer’s first 90 days of actual activity (FinCEN consent order 2023-03; expected account activity reads the order). A customer whose first three months were already unusual became its own benchmark. The penalty was $15 million.
That is why an EDD file in the solution starts from the declared range. The customer’s own expectation is drawn as a band, and each month is a dot against it, so a gap is visible before anyone writes a sentence about it.
Declared against actual: the comparison that turns CDD data into an EDD finding
Does EDD need a different approver than CDD?
Usually yes, by policy rather than US rule. International standards make senior approval part of enhanced diligence: FATF lists “obtaining the approval of senior management to commence or continue the business relationship” among its examples of enhanced measures (FATF, INR.10), and from July 2027 the EU’s AML Regulation lists senior management approval among the enhanced measures firms apply (Regulation (EU) 2024/1624, Art. 34).
US banks generally write the same into their EDD policy: the analyst recommends, the BSA Officer approves, and named categories or exits go higher. The approval is where the depth of EDD becomes a decision someone owns. The memo it approves needs to carry the reasoning, and how to write the source of wealth narrative covers the hardest paragraph in it.
Is CDD or EDD the bigger risk for an examiner?
Both, in different ways. Examiners test CDD by sampling files to see whether the bank gathers enough to understand what each relationship is and what it is for, and they review individual risk decisions mainly to test the process behind them. An EDD file is the harder of the two to defend when it is sampled, because its customers are the ones with the most activity to explain.
The practical test for any file, CDD or EDD, is whether a reader who has never met the customer can follow from the evidence to the rating. A standard file passes with a few lines. An EDD file passes only if each claim has its source, which is the standard the solution drafts to, and the line between US and international rules on politically exposed persons shows how much of that depth is the bank’s choice.
Questions people ask
What is CDD vs EDD in simple terms?
CDD is the due diligence every customer gets: identity, owners, purpose, a risk profile and monitoring. EDD is the additional diligence for customers rated higher risk: source of funds and wealth, a numerical expectation of activity, closer review and a senior approval. The questions are the same; EDD answers them with evidence.
What is CIP vs CDD vs EDD?
CIP verifies identity under 31 CFR 1020.220, using four items collected before opening. CDD adds beneficial ownership, nature and purpose, a risk profile and ongoing monitoring under 31 CFR 1020.210 and 1010.230. EDD is the deeper level of CDD a bank applies to its higher-risk customers.
Is enhanced due diligence a legal requirement in the US?
In two narrow cases it is written into regulation: certain foreign correspondent accounts under 31 CFR 1010.610 and private banking accounts of $1 million or more for non-US persons under 1010.620. For everyone else, the risk-based CDD rule requires the bank to do more where risk is higher, and the bank’s policy defines what more means.
What is enhanced due diligence meaning in banking?
Collecting and verifying additional information about a customer that poses heightened risk, and reviewing that customer more closely and more often. In practice it means a file with source of funds, expected activity, licensing where relevant, adverse media, a memo and an approval.
Can a customer move from EDD back to standard CDD?
Yes, if the bank’s risk rating changes and the reason is documented. Regulators have asked for exactly that discipline: the OCC’s 2024 order against TD Bank required procedures to document the removal of customers from high-risk status, including analysis of sources and uses of funds.
Does CDD cost less than EDD?
Per file, yes. GAO put CDD at account opening at $15 an account on average, excluding EDD. An EDD file takes hours of analyst time, which is why the rating that sends a customer there deserves care in both directions.