EDD automation needs six inputs from the bank before it can build a single file: the written EDD policy that says which customers get enhanced due diligence and what their files contain; past approved memos and the templates behind them; the expected activity recorded for each high-risk customer; the list of documents the bank accepts as evidence and where they are stored; read-only access to the core, the monitoring system, document imaging, the CRM and the outside services the analysts use; and the approval matrix. None of them is new. Each is usually scattered, partly out of date or held in people’s heads, and gathering them is most of the work of going live. Botminds’ Enhanced Due Diligence (EDD) Review is set up from exactly these inputs, and its usual first step is a sample: a set of your past EDD files and a year of their activity, with its memos compared against the ones you approved.
What to have ready for EDD automation, in the order you will need it
- The EDD policy, current and approved
Which ratings or factors start a file, what each customer category’s file contains, how often it is reviewed, what brings a review forward.
- Templates by customer category
The memo sections for money services businesses, cash-intensive businesses, charities, PEPs and the rest, as the bank writes them today.
- Twelve to twenty-four months of approved memos
The house style, the conclusions examiners have already accepted, and the declared ranges each review set.
- Expected activity, and where it lives
Declared ranges for cash, checks and wires per customer: a field in the core, a line in last year’s memo, or nowhere.
- The evidence list
Which documents prove what, for each category, and where each is stored in document imaging.
- Read-only access to the systems analysts use
Core banking, transaction monitoring, document imaging, the CRM’s visit notes, the adverse media service, public registration and license lookups.
- The approval matrix and reason codes
Who approves each category, each exit and each threshold change, and the reasons a checker may give.
- Settings the bank must choose
Start lead time, deadlines, escalation, the document-read confidence floor, retention, masking and restricted matters.
What data do you need for EDD automation?
Less new data than most teams expect, and more organization of existing data. The agents build each file from the same places an analyst does: activity and customer details from the core, alerts and rules from the monitoring system, statements and licenses from document imaging, visit notes from the CRM, articles from the bank’s adverse media service, and registration and license status from public lookups. If an analyst can open it, the agents can read it, given read-only access. Nothing should be written back to those systems until a person has approved the decision that changes it.
The data that is usually missing is the expectation. The FFIEC says due diligence policies “should define both when and what additional customer information will be collected based on the customer risk profile and the specific risks posed” (FFIEC BSA/AML Manual, CDD), and for an EDD file the most useful piece of that information is a numerical expectation of activity. Many banks have it only as prose in last year’s memo. Extracting those ranges into one place is often the single most valuable preparation step.
The EDD policy is the specification
Automation does what the policy says, so the policy has to say it. US rules leave most EDD design to the bank: FinCEN does not require banks to treat any customer type as automatically high risk, and sets no calendar for updating customer information (FinCEN CDD FAQs). A policy written for human readers often relies on judgment words such as “as appropriate” and “periodically”. For automation each needs a value: which ratings start a file, how many days before the due date the file starts, what each category’s file must contain.
Category templates are where the policy becomes concrete. For a money services business, the 2005 interagency guidance sets the minimum: apply the customer identification program, confirm FinCEN registration if required, confirm state or local licensing if applicable, confirm agent status if applicable, and conduct a basic BSA/AML risk assessment (FinCEN and the federal banking agencies, 2005). A bank’s template adds its own sections on top. In the solution the memo follows the template for the customer’s category, and a second agent checks the draft against both the FFIEC manual and the bank’s policy before anyone approves it.
The memo follows the bank’s own template for the customer’s category
Past memos and the EDD questionnaire: what the agents learn from
Past approved memos do three jobs. They show how the bank writes, so drafts read like the bank’s files rather than a vendor’s. They hold the expectations each previous review set, which the next review must test. And they are the test set: a pilot runs on files the bank has already decided, so every agent recommendation can be compared with a known approved decision. Twelve to twenty-four months of memos usually covers at least one full annual cycle for every high-risk customer.
The EDD questionnaire, the form a customer completes about its business, ownership, expected activity and source of wealth, is an input of a different kind. It is the customer’s claim, and the file’s job is to test it. Bring the questionnaire versions in use and the answers on file, so the agents can draw the declared ranges from the customer’s own words and set them against what the customer did. Where the questionnaire accepted unsupported answers, expect the first cycle to surface it: New York’s regulator found that one firm let customers pass its EDD requirements with unverified photographs and generalized answers (NYDFS consent order, Paxos Trust, 2025).
Expected activity: the field most banks do not have clean
An EDD file is built around the comparison of declared and actual activity, so the declared side has to exist as numbers. Ideally each high-risk customer has a range for each activity type it uses, such as cash ordered, checks deposited and wires, recorded when it was last approved. In practice the range may be in the core, in a spreadsheet, in last year’s memo or not recorded at all.
The cost of a missing expectation is well documented. Shinhan Bank America collected anticipated activity at account opening, but it was not consistently carried into monitoring, so baselines were built from the customer’s own first 90 days of activity instead (FinCEN consent order 2023-03). A customer whose early activity was already unusual became its own benchmark. For automation, an absent range should not be invented: in the solution the first cycle proposes a range from the evidence and a person approves it, after which it is written to the customer profile and becomes the expectation the next review tests.
The inputs as they usually are, and as automation needs them
What banks usually have: A narrative document with “as appropriate” and “periodically”.
What EDD automation needs: Values: which ratings start a file, lead time, deadlines, approvers by category.
What banks usually have: Prose in last year’s memo, or a field filled at opening and never updated.
What EDD automation needs: A range per activity type per customer, with the date it was approved.
What banks usually have: Documents in imaging, named inconsistently.
What EDD automation needs: A list of document types per category, findable by customer and date.
What banks usually have: An email trail and a signature line on a PDF.
What EDD automation needs: A matrix of who approves what, and the reason codes they may use.
What banks usually have: Set in the monitoring system, changed when someone remembers.
What EDD automation needs: Linked to the approved expectation, changed only by an approved request.
How to automate enhanced due diligence: a go-live plan
Start with inputs, prove on the past, run in parallel, then go live on the calendar. The plan below is an example of how the solution is usually introduced, not a commitment for every bank; the length of each phase depends mostly on how quickly the inputs above can be gathered and the system access approved.
Most of an EDD automation go-live is gathering inputs and proving them
- Gather policy, templates, memos, access4 wk
- Pilot on past files3 wk
- Parallel run on files due4 wk
- Livewk 12
The pilot is the step not to skip, because it turns a demonstration into evidence. The comparison should count where the agents’ recommendation matched the approved decision, where it differed and why, and which differences exposed a weakness in the original file rather than the draft. The method is set out in measuring reviewer agreement on EDD reports. Supervisors have encouraged this kind of trial: the agencies’ 2018 statement says a pilot that fails, or that exposes gaps, is not in itself grounds for supervisory criticism (joint statement on innovation, 2018).
The settings a bank must choose, and who chooses them
Some inputs are decisions only the bank can make, and each should be made and approved before go-live. In the solution they are policy settings that a second administrator must approve before a change takes effect.
Settings to decide before go-live, with the solution’s defaults
| Setting | Default | What to consider |
|---|---|---|
| When agents start the annual file | 45 days before the due date | Long enough for customer requests and a site visit; 60 or 30 days are common alternatives |
| Analyst’s time to complete | 20 business days from the hand-off | Workload: about 200 files a year per analyst at the fictional bank |
| Approver time | 5 business days each | Sequential approvals add up |
| Escalation | To the BSA Officer 10 days before due | And to the Chief Risk Officer and committee report at the due date |
| Document-read confidence floor | 0.80 | Below it the agents ask the analyst instead of asserting |
| Retention | 5 years after the account closes | The BSA minimum for required records is five years (31 CFR 1010.430(d)); counting from account closure meets it, and longer is a policy choice |
| Masking and restricted matters | Identifiers masked to the last four; suspicious activity decisions for the BSA Officer only | SAR confidentiality under 31 CFR 1020.320(e) |
Governance inputs belong on the same list. The interagency model risk guidance issued in April 2026 puts generative and agentic AI outside its scope and leaves their controls to the bank’s own risk management and governance (SR 26-2). European guidance on automated onboarding asks firms to state which steps run with no person involved and which need one (EBA/GL/2022/15), a useful discipline for any bank. Decide who approves a new agent version, how overrides are reviewed and what the internal auditor will test. The division of decisions between agents and people is covered in AI enhanced due diligence: agents draft, people decide.
An analyst’s answer becomes a cited sentence, and the trail shows who gave it
What not to wait for
Three things delay EDD automation projects without improving them. The first is a perfect data clean-up: missing expected-activity ranges can be proposed from the evidence in the first cycle and approved by a person, which is how they should be set anyway. The second is a full policy rewrite: the policy needs values where it now says “as appropriate”, not new prose, and those values can be agreed category by category. The third is waiting for the rules to settle. FinCEN’s April 2026 program proposal and the Federal Reserve’s July 2026 proposal are not final, but neither would change what an EDD file has to show, only how a program is supervised.
What is worth waiting for is approval of read-only system access and of the pilot’s scope by the people who will be accountable for the result: the BSA Officer, the second line and internal audit. A pilot they have agreed in advance is evidence they will accept afterwards.
Enhanced due diligence checklist template: what each file must contain
The last input is the per-file checklist the automation enforces, built from the policy and the category template. For a money services business it combines the 2005 minimum steps with the bank’s own sections. Every item should be answerable from evidence the agents can cite, or flagged as a question for the analyst.
Enhanced due diligence checklist template for a money services business file
- Customer identification program applied
Identity and beneficial owners on file; owners screened against sanctions and politically exposed person lists.
- FinCEN registration confirmed, if required
Registration number, renewal date and the agent relationship where the customer acts for an issuer.
- State licensing confirmed for every location
License numbers, expiry dates and coverage of each store, including new ones.
- Source of funds evidenced
Financial statements or tax returns covering the period being explained.
- Activity against expectation
Declared ranges per activity type, twelve months of actual activity, each gap with a cited cause.
- Adverse media searched and resolved
Sources searched, name matches set aside, relevant items cited.
- Site visit, where policy requires
Date, who visited, what was seen.
- Recommendation and approvals
Rating, expected activity, threshold, next review; maker, checker and any second-line signature with reasons.
With these inputs in place, the remaining go-live work is configuration and proof, not discovery. The full cost comparison of building files this way against outsourcing or staying by hand is in EDD software vs outsourced reports vs in-house, and the review cycle the automation runs is described in the EDD review process.
What the examiner will ask for is an input too
Questions people ask
What are due diligence automation tools?
Software that gathers customer information and documents, compares activity with expectations, and drafts or checks due diligence files. For enhanced due diligence the defensible tools leave every risk decision to people, cite the source of each statement, and write to bank systems only after approval.
How long does EDD automation take to implement?
Mostly as long as gathering the inputs takes: an approved policy with values, templates, past memos, expected activity and system access. An example plan runs about twelve weeks including a pilot on past files and a parallel run, but the inputs set the pace, not the software.
What is an EDD questionnaire?
The form a high-risk customer completes about its business, owners, expected activity and source of funds or wealth. In an automated file it supplies the customer’s claims, which the file then tests against the bank’s own activity data and independent documents.
Do we need clean data before automating EDD?
No, but you need to know where the data is. Missing expected-activity ranges, for example, can be proposed by the agents from the evidence in the first cycle and approved by a person, after which they are recorded properly.
Can EDD automation work with our existing core and monitoring systems?
It should read from the systems analysts already use, read-only, and write back only approved changes such as expected activity, thresholds and the next review date. A tool that needs analysts to export and upload documents keeps most of the hours it claims to save.
Who should own an EDD automation project?
The BSA Officer or the EDD program lead, because the policy, templates and approval matrix are compliance decisions. IT provides read-only access, and internal audit should agree early on what it will test.