EDD reviews for high risk clients: why “reasonable” is not a finding

EDD reviews for high risk clients exist to find out whether the customer is still doing what the bank believed it would, and a review that closes with “activity appears reasonable for the business” has not found that out. A real review states a specific expectation (the cash, checks and wires the customer declared), sets it against twelve months of actual activity, explains every gap with a cited cause, and then changes something: the rating, the expected activity, the monitoring threshold, or the relationship. Enforcement orders show what happens when reviews restate the business model instead. Botminds’ Enhanced Due Diligence (EDD) Review draws the declared range as a band and each month as a dot against it, so the review starts from the gap, and people decide what it means.

“As long as the activity appeared to be related to the business model … or had a ready explanation …, the activity was deemed ‘reasonable’ and the initial high-risk alert was closed without further action.”

FinCEN, assessment against Capital One, January 2021

What should an EDD review include?

Five things: the expectation being tested, the activity measured against it, an explanation of each gap backed by a document, the decision, and the changes that follow from the decision. The FFIEC expects information from higher-risk customers to be reviewed more closely, and more often, for as long as the relationship lasts (FFIEC BSA/AML Manual, CDD). Closely means against something. Without a stated expectation there is nothing to review against except last year’s memo.

The decision is the part most often missing. A review that ends “retain” but leaves the expected activity and the monitoring threshold where they were has decided nothing operational: the same customer, doing the same newly normal business, will raise the same alerts next month. The review is complete when the profile and the monitoring match the conclusion.

Why “reasonable” is not a finding: the Capital One reviews

Capital One’s Check Cashing Group served between about 90 and 150 check cashers in New York and New Jersey from 2008 to 2014. Its risk scoring placed them at the very top: one 2010 review “identified 6,000 Bank customers at highest risk for money laundering. Most CCG customers ranked in the top 100” (FinCEN assessment 2021-01). They received the bank’s most frequent regular review, every six months.

The reviews looked for negative news, assessed account activity, compared historic and current dollar volume and sampled checks. A macro aggregated each customer’s debits and credits and compared them with a sample of past volume to decide whether activity was “consistent”. Activity that fitted the business model, such as a check casher depositing checks, was “reasonable”, and the alert was closed. FinCEN found the reviews “failed to fully enable CONA to understand the nature and legitimacy of their customers’ activity and patterns therein”, and later reviews were often “perfunctory”. The penalty was $390 million.

The lesson is precise. Comparing a customer with its own past and with its business type cannot find a business whose normal activity is the problem. A check casher depositing checks is exactly what a check casher used for laundering would do. A review has to test something the customer could fail.

The same review, written twice

The difference between a review that restates and a review that tests shows in the conclusion. Take a fictional example as it runs through the solution: Quarry Street Check Cashing, a check casher at Tessaly Community Bank, rated High, declared at its last review that it would order $380,000 to $420,000 of cash a month. Eight of the last twelve months sat above that range; since March every month has been between $574,000 and $611,000. The monitoring system raised seven alerts from March to September, each closed pending this review.

The strong version could have come out the other way. If the original stores had also climbed above their old range, “expansion” would not have explained the increase, and the file would have needed a different cause or a different decision. That possibility is what makes it a finding. Each claim of cause needs support, and how to write the source of funds and wealth paragraphs covers the evidence side.

The review starts from the gap: declared range as a band, each month as a dot

Repeating last quarter is not a review either

The second common failure is a review copied forward. FinCEN’s October 2026 order against Bank of America describes quarterly “Client Activity Monitoring” reviews for elevated and high-risk customers, designed to assess whether activity remained consistent with expectations. In practice, staff carried the same observations over from one quarter to the next, and the observations failed to consider the total value of the customer’s activity in the quarter or the jurisdictions involved, even when the automated system had already generated numerous alerts on high-risk jurisdictions (FinCEN consent order 2026-03).

A copied review is cheaper to write and harder to catch, because it reads well. The defence is structural: each review must restate the period’s numbers before it restates any conclusion, and quality assurance should compare a sample of reviews with their predecessors. Measuring whether two reviewers reach the same call is one way to find copied reasoning: reviewers disagree least where nobody looked.

How often should high risk customers be reviewed?

As often as the bank’s risk assessment says, because US rules set no calendar. FinCEN’s FAQs say no rule makes banks refresh customer information continuously or on a fixed cycle; updates are risk-based and follow from what normal monitoring turns up (FinCEN CDD FAQs; perpetual KYC builds a program on that answer). The bank may choose regular reviews, and most do for high-risk customers, but the frequency is policy.

The orders regulators publish show the range of choices. Capital One reviewed its highest-risk customers every six months. Bank of America ran quarterly reviews of high-risk customers. UBS’s own policy subjected High and Higher-risk customers to EDD and “more frequent (at least annual) periodic reviews” (FinCEN consent order 2026-02). A Southwest-border bank told GAO it monitors high-risk customers every three months against every six for medium risk (GAO-18-263). From July 2027 the EU’s AML Regulation makes one year the maximum for higher-risk customers in the EU (Regulation (EU) 2024/1624, Art. 26).

Two US cases do carry a review duty in regulation. A foreign correspondent account’s due diligence program must include periodic review of the account’s activity (31 CFR 1010.610(a)(3)), and private banking accounts must be reviewed against their source of funds and expected use. Regulators also write frequency into orders: the OCC required TD Bank to set risk-based criteria for how often it conducts periodic reviews (OCC consent order AA-ENF-2024-77).

The alert that keeps firing: when the expectation is never updated

A review that does not update the expectation leaves monitoring testing the old one. That produces the quiet failure the Quarry Street file shows: seven monthly alerts on the cash-order rule, each closed pending the annual review, because the threshold had not moved with the business. Every alert was explainable, and every one consumed an analyst’s time.

The opposite failure is worse. Shinhan Bank America set its monitoring baselines from the first 90 days of actual activity rather than the activity customers declared, so it judged whether activity was unusual only against each customer’s own past activity, not against what the customer had said at opening (FinCEN consent order 2023-03). A threshold that follows the customer automatically will never alert on a customer whose activity was wrong from the start. The threshold should move only when a person has decided the new activity is explained.

Raising a monitoring threshold is a decision, back-tested and approved

High risk customer periodic review: what should change afterwards

Four things should be reset or confirmed at the end of every high-risk review: the risk rating, the expected activity, the monitoring settings tied to it, and the date and scope of the next review. In the solution all four are shown to the approver as a before-and-after list, and none is written to the core or the monitoring system until the last signature. For Quarry Street the rating stayed High, expected cash ordered moved to $560,000 to $640,000 a month, checks deposited to $2.7 million to $3.1 million, the threshold to $700,000, and the next review to November 2027 with a site visit.

The review itself should show the gap between the old expectation and the new one, and why it was closed. That is what an examiner reads when the same customer’s activity is questioned a year later, and it is what stops next year’s analyst from copying this year’s conclusion.

Every point in the review opens the entry it came from

When the review should end with an exit

Sometimes the honest finding is that the bank cannot explain the activity, or the customer will not help it to. A review that cannot close its gaps should say so and recommend a step: more information by a date, restrictions, a suspicious activity report where warranted, or an exit. For private banking accounts the program must already say when to refuse, suspend, file or close; for other high-risk customers the bank’s policy should say the same.

An exit is a decision for management, not a reflex. The 2005 interagency guidance on money services businesses says there is no BSA requirement to close an account that is the subject of a suspicious activity report, and that “the decision to maintain or close an account should be made by a banking organization’s management under standards and guidelines approved by its board of directors” (FinCEN and the federal banking agencies, 2005). In the solution an exit recommendation goes to the BSA Officer and then the Chief Risk Officer before any notice is sent or account closed, and the notice is checked for words that could reveal monitoring.

A test sheet for quality assurance on high-risk reviews

Quality assurance can apply the lessons of these orders file by file. The questions below can each be answered yes or no from the review itself, which makes them suitable for sampling, and the timing side of the process is covered in the EDD review process.

Questions people ask

What is an EDD review?

An EDD review is the periodic or triggered re-examination of a customer the bank rates high risk. It tests actual activity against the customer’s stated expectation, explains gaps with evidence, and ends in a decision on the rating, the expected activity, monitoring and the relationship, approved by someone other than the reviewer.

Must high risk customers be reviewed annually?

Not under US rules. FinCEN says no rule fixes a review cycle for updating customer information; annual review is a common bank policy. The EU’s AML Regulation will cap the interval at one year for higher-risk customers from July 2027.

What does “consistent with the business” mean in an EDD memo?

Usually that the reviewer compared activity with the customer’s business type and found no mismatch. FinCEN’s Capital One assessment shows why that is not enough: check cashers depositing checks looked consistent and the alerts were closed, while the bank failed to understand the legitimacy of the activity.

What triggers an early high-risk review?

Activity well outside the stated expectation, repeated alerts, adverse media, a change of owner or business line, or a suspicious activity report. FinCEN’s FAQs tie the duty to update information to what the bank learns in normal monitoring rather than to a date.

Should the monitoring threshold change after an EDD review?

When the review concludes that new activity is explained, yes, or the same alerts will fire again. The change should be a separate decision with a back-test and approval, so that monitoring never follows the customer automatically.

Does a bank have to close a high-risk customer whose review finds problems?

No rule requires closure, even after a suspicious activity report. The 2005 interagency guidance leaves the decision to management under board-approved standards. The review should recommend a step, such as more information, restrictions, a report or an exit, and someone with authority should approve it.