The EDD review process is the cycle a bank runs on each customer it rates high risk: a trigger or a due date, a file assembled from the customer, the relationship manager and the bank’s own systems, an analysis of what the customer said it would do against what it did, a memo with a recommendation, and approval by someone other than the person who wrote it. The analysis is the short part. Most of the elapsed time goes on hand-offs, because several people and as many systems each wait on the one before. Botminds’ Enhanced Due Diligence (EDD) Review is built around that point: agents assemble the file and draft a cited memo weeks before the due date, the analyst answers what they could not settle, and the BSA Officer and, where policy says so, the Chief Risk Officer sign.
No US rule prescribes the steps. GAO’s description of the common account-opening workflow, drawn from 11 banks, is a chain of people: front-line staff collect the information, then a second person, often the BSA/AML officer, reviews it for gaps and for high-risk signs that could call for more due diligence (GAO-20-574, 2020). An enhanced review is the same chain, run every year or on a trigger, with more links in it.
Who waits on whom: the six hand-offs in one EDD review
Who waits: Relationship manager
On: The customer
For: Statements, tax returns, licenses, an updated ownership list, answers about a change in activity
Why: The customer owes the bank nothing on a deadline, and the request may not say why it is being made.
Who waits: Relationship manager
On: The calendar
For: A site visit, where the policy asks for one
Why: Visits are booked around branch and customer schedules, often weeks out.
Who waits: Analyst
On: The relationship manager
For: The documents and the visit note
Why: The analyst cannot write about activity she cannot explain.
Who waits: Analyst
On: The bank’s systems
For: Twelve months of activity, alerts, prior memo, adverse media, license lookups
Why: Each system has its own export, and the declared range sits in last year’s memo.
Who waits: BSA Officer
On: The analyst
For: A finished memo with a recommendation
Why: The checker cannot approve a draft, and returns cost a second cycle.
Who waits: Second line
On: The BSA Officer
For: The first approval, for the relationships the policy names
Why: Sequential signatures add their queues together.
What is the EDD review process? Seven steps from due date to signature
The enhanced due diligence process has seven steps, whatever a bank calls them. A file is opened by a calendar date or a trigger. It is assembled: documents from the customer, notes from the relationship manager, activity and alerts from the bank’s systems, public license and registration checks, adverse media. It is analysed, chiefly by comparing declared activity with actual activity. A memo is written with a recommendation: retain at the same rating, change the rating or the expected activity, restrict, or exit. The analyst submits. A checker approves or returns it. Then the customer profile and the monitoring settings are updated to match the decision.
Two of those steps have a legal backbone for some customers. For a private banking account of $1 million or more held for a non-US person, the program must include procedures for when due diligence “cannot be performed”: whether to refuse the account, “suspend transaction activity, file a suspicious activity report, or close the account” (31 CFR 1010.620(d)). For every other high-risk customer the steps, their order and their deadlines are the bank’s design. That freedom is also why files drift: nothing outside the bank’s own policy says when the memo must be done.
The frequency is the bank’s choice too. FinCEN’s consolidated FAQs on the CDD rule say there is no categorical requirement to update customer information on a periodic schedule; updating is risk-based and follows from normal monitoring, though a bank may choose regular reviews (FinCEN CDD FAQs, re-issued May 2026). Annual reviews for high-risk customers are a common policy, not a rule. What a high-risk review should test covers the content of each cycle; this page is about its timing.
Who waits on whom: the dependencies that set the pace
The relationship manager waits on the customer, the analyst waits on the relationship manager, and the BSA Officer waits on the memo. Each wait is reasonable on its own. Stacked, they turn a few hours of analysis into weeks of elapsed time, and they all land in the last fortnight before the due date if nobody starts early.
The customer wait is the hardest to compress, because the bank cannot always say why it is asking. A bank may not disclose a suspicious activity report, or anything that would reveal one exists (31 CFR 1020.320(e)), so a document request for a customer with open alerts has to be written with care and sent by someone who has not seen the alerts. Regulators have noticed the cost of customers who never answer: the OCC’s 2024 order against TD Bank required procedures that impose prompt consequences on customers who do not supply required CDD information (OCC consent order AA-ENF-2024-77; KYC outreach to non-responders sets out the sequence).
The document wait is long because high-risk files ask for more. One Southwest-border bank told GAO it asks to see three months of some high-risk businesses’ prior bank statements to judge the typical volume of cash and wires, and called that kind of due diligence “very time-consuming”. Others send compliance staff to Mexico to establish that businesses across the border are legitimate (GAO-18-263, 2018).
How long does an EDD review take?
No government source measures the time an enhanced review takes. GAO measured the ordinary case: about 30 minutes of staff time to collect and review customer information for a new consumer account and over an hour for a business account, at an average cost of $15 an account, with enhanced due diligence explicitly left out of the figure (GAO-20-574). An EDD file is a multiple of that, and its calendar time is a multiple again.
Botminds’ own estimate for one annual review of a money services business, done by hand, is about four and a half hours of analyst time: an hour and a half gathering statements, licenses, visit notes and a year of activity, three quarters of an hour rebuilding declared against actual activity, half an hour each on licensing and adverse media, an hour on the memo and a quarter of an hour on a second read and chasing signatures. The calendar time around those hours is set by the waits in the figure above, and by the bank’s own deadlines.
Where the hours of one hand-built EDD file go
The solution’s default deadlines show how a bank can make the calendar explicit. The agents start the file 45 days before it is due; the analyst has 20 business days from their hand-off; the BSA Officer and the Chief Risk Officer have five business days each; the file escalates to the BSA Officer ten days before the due date. Each of those is a setting the bank changes, with a second administrator approving the change.
An annual file in the calendar: most of the time is buffer for waiting
- Agents assemble and draft15 d
- Analyst: answer, check, submit20 d
- BSA Officer5 d
- Chief Risk Officer5 d
- Assembled Sep 22 to Oct 2129 d
- Opened, answered, submitted and signed on Oct 22 (1 day)
- Signed the same day; 15 days to spare15 d spare
Who approves an EDD decision?
Someone other than the person who prepared the file, usually the BSA Officer, and for some relationships a second line or senior manager as well. US rules do not name an approver for most EDD files; FATF’s standard asks for senior management approval to establish or continue relationships with foreign politically exposed persons (FATF Recommendation 12). Most banks write a maker-checker rule into their own EDD policy and name the customer categories and decisions, such as exits, that need a higher signature.
In the solution the roles are separated by duty. The analyst prepares and submits as maker and cannot approve her own file. The BSA Officer approves or returns with a reason code. The Chief Risk Officer signs money services businesses, third-party payment processors and every exit, because the fictional bank’s policy names them. No agent may approve, close, send or change a customer’s details, and where the line between drafting and deciding sits is the subject of its own guide.
Four people carry one EDD file, and each waits on another
Today
Rebuilds the file from several systems and chases the relationship manager for documents before writing a word.
With agents
Opens a file already assembled, checks the source behind any sentence, answers the one open question and submits.
Still theirs: The judgment on whether the evidence explains the activity
Today
Gets document requests late and in batches, close to the due date, and must word them without revealing monitoring.
With agents
Sends a request the agents drafted weeks ahead, already checked for words that could tip off the customer.
Still theirs: The conversation with the customer and the site visit
Today
Receives files in a wave in the last week and reads each one whole to find what changed.
With agents
Sees what approving would change, how each weak claim was closed and who signed so far.
Still theirs: Approval, return with a reason, thresholds and exits
Today
Signs the relationships the policy names at the end of the queue, after every other wait.
With agents
Gets the decision, the change and the evidence on one screen; nothing is written to a system before the last signature.
Still theirs: The second-line signature on named relationships and exits
What does an EDD analyst do?
An EDD analyst builds and defends the file on each high-risk customer: gathers the documents, compares declared and actual activity, checks licenses and registrations, reads adverse media, writes the memo and the recommendation, and answers the checker’s questions. Most of the job is assembly; the part only a person can do is deciding whether the evidence explains what the customer did.
The Bureau of Labor Statistics has no occupation called KYC or EDD analyst. The work sits in the broader compliance officer category, which counted 436,400 jobs across all industries in 2025, at a median wage of $80,730, and is projected to grow 3.8% by 2035 (BLS Employment Projections). The arithmetic of the desk is simple and unforgiving: the fictional bank in the solution has about 620 high-risk customers, roughly 600 annual reviews and three analysts, so each analyst owns some 200 files a year, about four a working week, alongside alerts and everything else.
About 600 annual EDD reviews on one calendar, with what each is waiting on
Why files stall on the customer, and how to ask once
A file waiting on the customer is the most common reason an annual review runs late, and the usual cause is a request sent too late or asked in pieces. Each round trip through the relationship manager adds a week. The fix is procedural: know what is missing before the first request goes out, ask for all of it once, and send it early enough that a second reminder still lands before the due date.
In the fictional calendar above, Harbor Lane Food Mart is seven days overdue, waiting on its 2025 tax return; it was escalated to the BSA Officer on October 16 and a second reminder is drafted. The policy question that case raises is the one the TD order put in writing: what happens to a customer who does not provide the information, and who decides. In the solution an exit is a recommendation that needs the BSA Officer and the Chief Risk Officer, and the notice letter is checked for words that could reveal monitoring before it can be sent.
Site visits deserve the same planning. The 2005 interagency guidance on money services businesses lists on-site visits among the steps a bank may take, but says the agencies do not expect them to be required uniformly for every such customer (FinCEN and the federal banking agencies, 2005). A policy that says which customers get a visit, and books it with the file’s start date rather than its due date, removes one of the six waits.
Start the file before the analyst does
The single biggest change to the process is moving assembly ahead of the analyst. When a person opens an empty file 15 days before it is due, every wait in the chain is still ahead of her. When she opens a file that is already assembled and drafted, the waits that remain are the ones that genuinely need her: an unanswered question, a document that would not read, a judgment.
Take a fictional example as it runs through the solution. Quarry Street Check Cashing, a licensed check casher at Tessaly Community Bank, has its annual review due November 6, 2026. The agents start on September 22, 45 days ahead, pull from the core, the monitoring system, document imaging, the CRM’s visit notes, the adverse media service and the public license lookups, and finish the draft on October 21. The analyst opens it at 9:40 the next morning.
The analyst opens a file that is already assembled and drafted
By 9:58 she has answered the agents’ one question and submitted. The BSA Officer approves at 11:20 with the reason code “Activity explained and evidenced”, and because the bank’s policy names money services businesses, the Chief Risk Officer signs at 2:05 PM. Only then, at 2:06, are the new expected activity, the raised monitoring threshold and the next review date written to the systems. The analysis took minutes; the file was ready weeks early because nobody waited for it to start.
One question, not an email chain
The other wait worth removing is the analyst’s own hunt for an answer the file cannot give. In the Quarry Street file the state’s public license lookup lists only the customer’s two original stores. A license amendment adding the two new ones is in document imaging, but the scan reads at 0.62 confidence, under the bank’s 0.80 floor. The agents do not guess. The memo ends with one question line, and the analyst opens the scan herself.
What the agents could not settle becomes one question for the analyst
Her confirmation becomes a cited sentence in the licensing paragraph, with the scan and her name as its sources. The difference is not speed alone. A question asked once, with its evidence, leaves an answer the checker and later the examiner can read; an email thread leaves nothing in the file. The inputs that make this work, from the policy triggers to past memos, are listed in what to have ready for EDD automation.
What to measure in your EDD process in banking
Measure the waits, not just the deadline. A file that is on time because an analyst worked a weekend tells you nothing about the next quarter. Five numbers show where an EDD process actually loses its time, and every one can be taken from the files a bank already keeps.
Five measures that show where an EDD process loses time
- Elapsed days by stage
Assembly, customer response, analyst work, each approval. The stage with the longest median is the one to fix first.
- Share of files started more than 30 days before due
Late starts explain most late files. If assembly begins when the analyst opens the file, every wait is still ahead.
- Customer requests per file
More than one request per file means the first one was incomplete. Track it by relationship manager.
- Returns by reason code
A checker who returns a quarter of files for the same reason is pointing at a template or training gap.
- Files past due, and for how long
Count them by category and by what they are waiting on, not only in total, so the committee report shows the cause.
Questions people ask
What are the enhanced due diligence steps?
Trigger or due date, file assembly, analysis of declared against actual activity, a memo with a recommendation, submission by the preparer, approval by a checker and, where policy requires, a second line, then updating the customer profile and monitoring to match. US rules set minimum content only for named cases such as private banking accounts of $1 million or more for non-US persons; the rest is the bank’s written procedure.
How long does an EDD review take?
There is no official figure. GAO measured about 30 minutes for a consumer account and over an hour for a business account at ordinary onboarding, excluding enhanced due diligence. Botminds estimates about four and a half hours of analyst time for a hand-built annual review of a money services business; the calendar time is set by waiting on the customer, the relationship manager and the approvers.
Who approves EDD in a bank?
The bank’s EDD policy names the approvers. The common pattern is maker-checker: the analyst prepares, the BSA Officer approves or returns, and a senior or second-line officer signs named categories and exits. FATF asks for senior management approval of relationships with foreign politically exposed persons.
How often must high-risk customers be reviewed?
US rules set no calendar. FinCEN’s CDD FAQs say updating customer information is risk-based and need not follow a periodic schedule, though a bank may choose one. Many banks review high-risk customers annually as policy; from July 2027 the EU’s AML Regulation caps the interval at one year for higher-risk customers in the EU.
Can a bank tell the customer why it needs more documents?
Only up to a point. A bank may not reveal a suspicious activity report or information that would reveal one, under 31 CFR 1020.320(e), so requests are usually framed as the bank’s regular review and are checked before they go out. In the solution, relationship managers never see alerts, and every request is screened for words that could reveal monitoring.
What is the difference between an EDD review and a periodic KYC review?
A periodic review refreshes customer information on a schedule; an EDD review is the deeper version for customers rated high risk, with source of funds, activity analysis, a memo and a higher approval. The steps overlap, but the EDD file must explain the customer’s activity, not just confirm its details.