An enhanced due diligence report, the EDD memo, sets out the evidence on a high-risk customer and ends in a call: keep the rating or change it, keep the expected activity or reset it, retain, restrict or exit. Because that call is a judgment, there is no answer key to grade it against, and the honest accuracy measure is reviewer agreement: give the same file to two competent reviewers working independently and count how often they reach the same rating and recommendation, then find out where they diverge. The same test works whether a person or an agent drafted the report. Botminds’ Enhanced Due Diligence (EDD) Review supports it by citing every sentence to its source, listing the weak claims a second reader found, and recording every reviewer’s decision with a reason code.
What can be measured in an EDD report, and what the research says is enough
22 of 22
sentences cited to their source in one drafted EDD memo
Fictional sample data
3
weak claims a second agent found before approval, all closed
Fictional sample data
0.60
kappa below which agreement between raters is inadequate, on McHugh’s reading
Biochemia Medica, 2012
What should an EDD report include?
An EDD report should answer, in order, who the customer is, how it is licensed and owned, where its money comes from, whether its activity matches what it declared, what outside sources say about it, what a visit found, and what the bank should do. The format matters less than two properties: every factual sentence points to the document it came from, and the recommendation follows from the findings above it. The FFIEC’s examination procedures test whether the bank collects enough information to understand each relationship and actually uses it in the customer’s risk profile (FFIEC CDD examination procedures). An EDD report is where that incorporation is written down.
Enhanced due diligence report format: seven sections and what each must show
| Section | What it must show | Typical sources |
|---|---|---|
| Business and owners | What the customer does, who owns and controls it, screening results | Agreements, ownership certification, screening, site visit |
| Licenses and registration | Status, coverage of every location, renewal dates, anything unconfirmed | Regulator registrations, state license lookups, amendments |
| Source of funds | Where the money comes from, with numbers | Financial statements, tax returns, interim figures |
| Activity versus expectation | The declared range, the actual activity, each gap and its cited cause | Core banking activity, monitoring alerts, prior memo |
| Adverse media | What was searched, what was set aside as about someone else, what is relevant | News and enforcement sources |
| Site visit | What was seen and when | Relationship manager’s visit note |
| Recommendation | Rating, expected activity, monitoring changes, next review, approvers | The findings above, and the bank’s EDD policy |
Why accuracy for an EDD report means agreement
Because the recommendation has no ground truth. A field on a form can be checked against a document; a decision to retain a check casher at High with a raised threshold cannot be checked against anything except another competent person’s decision on the same evidence. If two reviewers would reach different calls on the same file, the bank’s process is producing outcomes that depend on who drew the file, and that is the property examiners care about.
The FFIEC is explicit that examiners judge the process, not the individual call. Where a bank “has an established and effective customer risk decision-making process, and has followed existing policies, procedures, and processes, the bank should not be criticized for individual customer risk decisions unless it impacts the effectiveness of the overall CDD program, or is accompanied by evidence of bad faith” (FFIEC BSA/AML Manual, CDD). Agreement between reviewers is the most direct evidence a bank can produce that its process, not its staffing, determines the outcome.
Regulators also write quality control into orders. The OCC’s 2024 order against TD Bank required the bank’s new CDD program to include “a quality control process” (OCC consent order AA-ENF-2024-77). An agreement measure is a quality control a bank can report as a number.
The agreement matrix: how to read two reviewers side by side
Lay the two reviewers’ recommendations out as a grid. Files on the diagonal are agreements; files off it are disagreements, and where they sit says what kind. The illustration below uses 40 files and three outcomes.
Two reviewers, 40 files: 30 agree, and most disagreements are about changes, not exits
Reviewer B →
- Agree: 14 + 12 + 4 = 30 files
- Disagree: 10 files, 7 of them between “retain as is” and “retain with changes”
The pattern in the illustration is the common one to look for. Reviewers rarely split between retaining and exiting the same customer; they split over whether the evidence requires a change, such as a new expected range or a higher monitoring threshold. That disagreement is cheap to fix, because it usually traces to a policy that does not say when an expectation must be reset, and expensive to ignore, because a missed reset is how a customer’s alerts start to be closed as reasonable, the pattern FinCEN described in its Capital One assessment (FinCEN 2021-01).
How do you measure EDD quality? Percent agreement and kappa
Use two numbers. Percent agreement is the share of files on which the reviewers reached the same call. It is easy to explain but flatters, because some agreement happens by chance: if most files are “retain”, two reviewers will often agree without reading closely. Cohen’s kappa corrects for that. As McHugh’s review puts it, Cohen “critiqued use of percent agreement due to its inability to account for chance agreement” and introduced kappa to account for raters who “guess on at least some variables due to uncertainty” (McHugh, 2012).
How much agreement is enough is a judgment, and the research is stricter than the labels most people quote. Cohen called 0.41 to 0.60 “moderate”. McHugh argues that is too lenient, notes that “many texts recommend 80% agreement as the minimum acceptable interrater agreement”, and concludes that “any kappa below 0.60 indicates inadequate agreement among the raters”. Her context is health research, but the logic carries: a call that two trained reviewers would make differently a third of the time is not yet a process.
The illustrative double review falls just short on both tests
How to QA an EDD report: running the double review
A double review is a small study, and it needs a design. Pick a sample of recently approved files across the categories the policy names. Give each to a second reviewer who has not seen the first decision and asks the same questions from the same evidence. Capture the second reviewer’s rating and recommendation in the same categories as the original, plus the two or three findings that drove it. Compute agreement overall and by category, then read every disagreement.
Sample size depends on what the bank wants to say. Forty files makes a useful benchmark: if 40 randomly chosen files show no disagreement at all, the bank can say with 95% confidence that the true disagreement rate is below about 7.2%, since 1 − 0.051/40 ≈ 0.072. Any disagreement widens that bound, which is the point of reading each one.
Six steps to a double review an examiner can read
- Sample across categories
Money services businesses, cash-intensive businesses, PEPs and the rest, in proportion to the policy’s population, plus every exit.
- Blind the second reviewer
No sight of the first decision, the approver’s note or the reason code.
- Fix the categories in advance
Rating, recommendation and whether expected activity or thresholds must change: the same choices for both reviewers.
- Note the driving findings
Two or three per file. Disagreement on findings explains disagreement on calls.
- Compute both measures
Percent agreement for the committee, kappa for the honest view, overall and by category.
- Close the loop
Each disagreement ends in a template change, a policy clarification or training, written down with a date.
Where agreement breaks: the sections that cause it
Disagreements cluster in the sections that require judgment about causes. Licensing and ownership rarely produce them; the details are checkable. Activity versus expectation and source of funds produce most, because they ask whether an explanation is good enough. A second, adversarial read before approval catches many of these early, by asking of each causal claim what an examiner would ask.
In the solution that read is done by a second agent, the Examiner Reader, against the FFIEC manual and the bank’s EDD policy. On the fictional Quarry Street Check Cashing file it raised three weak claims: the increase in cash orders was blamed on two new stores without a per-store split; license coverage of the new stores rested on a scan read at 0.62 confidence; and the source of funds rested on statements that predated the expansion. Each is the kind of point on which two human reviewers would split, one accepting “explained by expansion” and the other asking for proof.
A second reader lists the claims two reviewers would disagree about
The same test for reports an agent drafted
An agent-drafted report should be held to exactly the same test, with one addition: compare the agent’s recommendation with the decision the bank approved. Run the solution on a set of past files the bank has already signed, hold back the approved memos, and measure agreement between the agents’ recommendations and the approved decisions the same way as between two people. Then read every disagreement, because some will be cases where the original file was the weaker one.
Once live, two numbers keep the measure current: how often approvers return or change the agents’ recommendation, by reason code, and how often the examiner read’s weak claims survive to approval. European guidance on automated onboarding asks for the same kind of discipline, listing sample testing and manual reviews among the controls for highly automated processes (EBA/GL/2022/15). How agents and people divide the work is set out in AI enhanced due diligence: who decides.
Every reviewer’s decision, with its reason, ready to sample
Enhanced due diligence report sample: what reviewers should compare
When two reviewers compare reports, they should compare the parts that carry the decision, not the prose. In the fictional Quarry Street report those are: rating High and unchanged; expected cash ordered moved from $380,000 to $420,000 a month to $560,000 to $640,000; the cash-order monitoring threshold raised from $460,000 to $700,000 after a back-test of the seven alerts since March; next review in twelve months with a site visit; approvals by the BSA Officer and the Chief Risk Officer. A second reviewer who would have retained the customer but left the threshold at $460,000 has disagreed on the call that matters most operationally.
How the narrative behind those numbers should be written is covered in the source of wealth narrative guide, and the review discipline that keeps each year’s report from copying the last in EDD reviews for high risk clients. Reports and their evidence must be kept for at least five years under 31 CFR 1010.430(d) (eCFR); a bank may keep them longer as policy.
Questions people ask
What is an enhanced due diligence report?
The written result of an EDD review on a high-risk customer: business and owners, licensing, source of funds, activity against expectation, adverse media, a visit where relevant, and a recommendation with its approvals. Each factual statement should cite its source document.
What is a good EDD report format?
One that follows the bank’s template for the customer category and ends with a recommendation that changes something concrete: the rating, the expected activity, the monitoring threshold or the next review date. Seven sections cover most categories; the order matters less than citations and a recommendation that follows from the findings.
How do you measure the quality of EDD reports?
By double review: a second reviewer reaches an independent call on a sample of files, and the bank computes percent agreement and Cohen’s kappa. Research on interrater reliability treats 80% agreement and a kappa of 0.60 as minimums worth aiming for, and every disagreement should be read and resolved.
How many EDD files should QA sample?
Enough to support the statement the bank wants to make. With 40 random files and no disagreements, the bank can say with 95% confidence that the disagreement rate is under about 7.2%; smaller samples give wider bounds.
Can an EDD report drafted by AI be as reliable as one written by an analyst?
It can be tested the same way: run the agents on past files with approved decisions, measure agreement, and read every disagreement. The approver remains a person, so the measure that matters live is how often approvers change the agents’ recommendation, and why.
Where can I find an enhanced due diligence report template?
Regulators do not publish one. The FFIEC manual lists the information a bank may collect for higher-risk customers, and the private banking rule names four minimum steps; banks build templates by customer category from those, with the seven sections above as a common shape.