Enhanced due diligence is required by US regulation in three named situations: a correspondent account for a foreign bank operating under an offshore license or a license from a jurisdiction designated for its money laundering controls; a private banking account of $1 million or more held for a non-US person; and, within such an account, any senior foreign political figure. For every other customer, EDD is required when the bank’s own risk-based procedures rate the customer higher risk. No customer type is high risk by default, so the bank has to be able to show why each customer is, or is not, in its EDD population. That documentation is the work of Botminds’ Enhanced Due Diligence (EDD) Review, where agents assemble each high-risk customer’s file and people sign the decision.
“Covered financial institutions are not required or expected to automatically categorize as ‘high risk’ products or customer types listed in government publications.”
FinCEN, CDD rule FAQ F.5, carried into the consolidated FAQs of May 2026
That sentence is the hinge of the whole question. Lists of customer types that “may pose heightened risk” exist in the FFIEC manual and in FinCEN publications, but they describe risks to assess, not a roster for EDD. The decision tree below is the US rule set in the order a BSA team would apply it.
When is EDD required? The US decision, step by step
1Is it a correspondent account for a foreign financial institution?
Yes: a risk-based due diligence program for the account, “and, where necessary, enhanced”, with periodic review of its activity (1010.610(a)).
Mandatory EDD if the foreign bank operates under an offshore license, a license from a country designated as non-cooperative, or one designated for special measures (1010.610(b)–(c)).
2Is it a private banking account: $1,000,000 or more, for a non-US person, with a bank liaison?
Mandatory minimum steps: identify nominal and beneficial owners, check for senior foreign political figures, ascertain the source of funds and expected use, review activity against them (1010.620(b)).
Enhanced scrutiny if a senior foreign political figure is an owner (1010.620(c)).
3Does the bank’s risk rating place the customer in a higher-risk category?
Yes: EDD as the bank’s own policy defines it, because the CDD rule requires risk-based procedures (1020.210). The content, frequency and approver are the bank’s design.
No: standard CDD. No customer type is high risk by label alone (FAQ F.5).
4Has something happened since the last review?
Activity outside the expectation, adverse information, a change of owner, doubts about earlier data: update the information and re-rate on a risk basis. That can start an EDD file mid-cycle, or end one.
When is enhanced due diligence required by US regulation?
Only in the correspondent and private banking cases. Both implement the special due diligence duty in 31 U.S.C. 5318(i), written by FinCEN at 31 CFR 1010.610 and 1010.620, and both are narrower than most people assume. Everything else that banks call EDD rests on the general risk-based duty in the CDD rule.
For a foreign correspondent account, the bank must run a due diligence program that is “appropriate, specific, risk-based, and, where necessary, enhanced”, weighing the foreign institution’s business and markets, the account’s type, purpose and anticipated activity, the length of the relationship, the home jurisdiction’s AML regime and the institution’s AML record. It must include “a periodic review of the correspondent account activity” (31 CFR 1010.610(a)).
EDD becomes mandatory for a foreign bank that operates under “(1) An offshore banking license; (2) A banking license issued by a foreign country that has been designated as non-cooperative with international anti-money laundering principles … or (3) A banking license issued by a foreign country that has been designated by the Secretary as warranting special measures” (31 CFR 1010.610(c)). The enhanced steps include scrutiny of the foreign bank’s AML program and transactions, finding out whether it lets other foreign banks use the account, and, if its shares are not publicly traded, identifying each owner of 10% or more.
Private banking due diligence requirements
A private banking account, for this rule, is an account requiring a minimum aggregate deposit of $1,000,000 or more, held for one or more non-US persons, and managed by a bank officer or employee acting as liaison (31 CFR 1010.605(m)). All three conditions must hold. A US citizen’s wealth-management account is not a private banking account under 1010.620, however large, and the FFIEC notes that many wealth management accounts do not meet the definition (FFIEC BSA/AML Manual, private banking).
For accounts that do, the program must ensure, at a minimum, that the bank takes reasonable steps to “(1) Ascertain the identity of all nominal and beneficial owners of a private banking account; (2) Ascertain whether any person identified under paragraph (b)(1) of this section is a senior foreign political figure; (3) Ascertain the source(s) of funds deposited into a private banking account and the purpose and expected use of the account; and (4) Review the activity of the account to ensure that it is consistent with the information obtained” (31 CFR 1010.620(b)). It must also say what happens when due diligence cannot be done: decline to open, freeze activity, report it in a SAR or end the relationship.
This is the only US regulation that names source of funds as a required step. Even here the FFIEC adds that “not all private banking clients automatically represent a uniformly higher risk”, and that due diligence should be commensurate with the relationship’s size, complexity and geography. The question of how to evidence source of funds and wealth is covered in writing a source of wealth narrative.
The two US regulations that name enhanced steps, side by side
| Foreign correspondent accounts | Private banking accounts | |
|---|---|---|
| Rule | 31 CFR 1010.610 | 31 CFR 1010.620 |
| Who it covers | Correspondent accounts for foreign financial institutions | $1M+ minimum deposit, non-US person owners, bank liaison |
| When enhanced steps are mandatory | Offshore license, non-cooperative jurisdiction or special measures | Always the four minimum steps; enhanced scrutiny for senior foreign political figures |
| What the enhanced steps include | Scrutiny of the foreign bank’s AML program and transactions, nested banks, owners of 10%+ | Owners, political exposure, source of funds, purpose and expected use, activity review |
| If it cannot be done | Procedures to refuse, close or file | Refuse, suspend, file a SAR or close |
Who is a senior foreign political figure?
A current or former senior official of a foreign government’s executive, legislative, administrative, military or judicial branch, a senior official of a major foreign political party, or a senior executive of a foreign government-owned enterprise; an entity formed by or for such a person; their immediate family; and their publicly known close associates (31 CFR 1010.605(p)). In a private banking account, a senior foreign political figure triggers enhanced scrutiny aimed at detecting and reporting the proceeds of foreign corruption.
Outside private banking, US rules do not require special steps for politically exposed persons, and the agencies do not treat US officials as politically exposed at all. The full comparison with FATF and EU rules is in PEP enhanced due diligence in the US.
Enhanced due diligence is usually required for which customers?
For the customers the bank’s own rating puts in its highest tier. In practice those ratings often include customer types the FFIEC manual discusses in its “Persons and Entities” sections: money services businesses, cash-intensive businesses, nonresident aliens and foreign individuals, politically exposed persons, charities and nonprofits, independent ATM operators, third-party payment processors and others. The manual says those types “may pose heightened risk”, and that the bank “should do more in circumstances of heightened risk” (FFIEC BSA/AML Manual, CDD).
What the manual does not say is that the types are high risk. When the FFIEC updated four of its sections on December 1, 2021, the FDIC summarized the point: “The sections remind examiners that no specific customer type automatically presents a higher risk” (FDIC FIL-76-2021). Only four sections were changed that day, Introduction–Customers, charities and nonprofits, independent ATM operators and politically exposed persons, but the July 2022 joint statement extended the principle to every customer type in the manual (joint statement, 2022).
Which customers get an EDD file is the bank’s own setting, by category
Are money services businesses automatically high risk?
No. The 2005 interagency guidance on banking money services businesses says the risk varies with the business, and sets minimum steps rather than a rating: apply the bank’s customer identification program, confirm FinCEN registration if required, confirm state licensing if applicable, confirm agent status if applicable, and conduct a basic risk assessment “to determine the level of risk associated with the account and whether further due diligence is necessary” (FinCEN and the federal banking agencies, April 2005).
The same guidance says the agencies do not expect banks to “uniformly require” the deeper steps, such as reviewing the business’s AML program or making site visits, for every money services customer. That leaves a lot of room, and banks have often used it to leave the market rather than to scale diligence: in 2016 alone, 18 banks reported terminating 1,098 money transmitter accounts, 89% of them at six very large banks (GAO-20-46).
Rules name few EDD cases; banks choose most of their EDD population
$1M+
minimum deposit that makes a non-US person’s account a private banking account under 1010.620
3
kinds of foreign bank license that make correspondent EDD mandatory under 1010.610(c)
1,098
money transmitter accounts that 18 banks reported closing in 2016
GAO-20-46
BSA enhanced due diligence requirements for financial institutions
Outside the two section 312 regulations, the BSA’s requirement is general: a bank’s AML program must include risk-based procedures for ongoing customer due diligence, including understanding each relationship well enough to build a risk profile and, on a risk basis, maintaining and updating customer information (31 CFR 1020.210(a)(2)(v)). Higher risk means more of each. How much more, how often and approved by whom, the bank decides and writes down.
That has three consequences for a written EDD policy. It must define the ratings or factors that start an EDD file, since no outside list does. It must define what an EDD file contains for each category, since the regulation describes outcomes, not documents. And it must say how often each file is reviewed, since FinCEN’s FAQs say updating customer information need not follow a periodic schedule; frequency is the bank’s risk-based choice.
What an EDD policy has to answer, because no rule answers it for you
- Which ratings or factors start an EDD file
Name the factors, not just the customer types. A type can inform a rating; it cannot replace one.
- What each category’s file must contain
For a money services business, the 2005 minimum steps plus the bank’s own; for private banking, the four steps of 1010.620(b).
- How often each category is reviewed
Annual is common policy, not a US rule. Say what event brings a review forward.
- Who approves, and who approves an exit
Maker and checker at least; name any category that needs a second-line signature.
- What happens when the customer will not provide information
The private banking rule requires procedures for this; good practice extends it to every EDD file.
- How a customer leaves EDD
De-rating needs a documented reason, as the OCC required of TD Bank in 2024.
What triggers EDD during a relationship?
Events, under the risk-based updating duty. FinCEN’s FAQs say the obligation to update customer information is triggered when, in normal monitoring, the bank learns something relevant to the customer’s risk profile. A change of beneficial owner is the clearest case: the new owner must be identified, certified and verified, while a mere change of address can be confirmed more simply (FinCEN CDD FAQs).
Regulators now write triggers into their orders. The OCC’s 2024 order against TD Bank required fresh due diligence whenever an event suggested updated information would be prudent, along with risk-based rules on how often each customer is reviewed (OCC consent order AA-ENF-2024-77). Typical events are activity well outside the declared expectation, repeated alerts, adverse media, a change in ownership or business line, and a suspicious activity report filing.
Checking a file against the minimum steps the guidance sets
How do international rules differ?
They name more cases. FATF’s Recommendation 10 requires enhanced measures “where the risks of money laundering or terrorist financing are higher”, and Recommendation 12 requires them for all foreign politically exposed persons (FATF Recommendations). The UK’s Money Laundering Regulations make EDD mandatory in listed cases including high-risk third countries, correspondent relationships and politically exposed persons (MLR 2017, reg. 33). From 10 July 2027 the EU’s AML Regulation sets enhanced measures for higher-risk customers and caps their review interval at one year (Regulation (EU) 2024/1624).
For a US bank these are context, not obligations, unless it has operations in those jurisdictions. They are useful as a check on the bank’s own policy: if a category is mandatory EDD abroad and absent from the bank’s rating factors, the policy should say why. The cost of doing EDD versus exiting such customers is weighed in the comparison of EDD software, outsourcing and in-house teams.
Questions people ask
When is EDD required on a customer?
Under US rules, when the customer holds a foreign correspondent account from a bank with an offshore, non-cooperative or special-measures license, when it holds a private banking account of $1 million or more as a non-US person, and whenever the bank’s own risk rating places it in a higher-risk tier. For a bank without foreign correspondent or private banking business, the last case is the only one.
Is EDD mandatory for high-risk customers?
The CDD rule requires risk-based procedures, so a bank must do more for customers it rates high risk. The rule does not define the extra steps, which is why the bank’s written EDD policy matters: it is what examiners compare each file against.
What are examples of high risk customers in banking?
The FFIEC manual discusses money services businesses, cash-intensive businesses, nonresident aliens, politically exposed persons, charities, independent ATM operators and third-party payment processors as types that may pose heightened risk. FinCEN says none of them is to be rated high risk automatically; the bank’s assessment of each customer decides.
Does a US wealth management client need private banking due diligence?
Not under 1010.620 unless the account is held for a non-US person, requires at least $1,000,000 and has a bank liaison. A bank may still apply enhanced steps to wealthy domestic clients if its risk assessment calls for them.
Is enhanced due diligence required for MSBs?
The 2005 interagency guidance sets minimum steps for every money services business customer: CIP, FinCEN registration, state licensing, agent status and a basic risk assessment. Further due diligence depends on that assessment; the agencies do not expect banks to apply every extra step to every such customer.
Can a bank simply decline high-risk customers instead?
It can make individual risk decisions, but blanket exits draw scrutiny. Treasury’s 2023 de-risking strategy found profitability, not regulation, to be the main driver, and FinCEN’s 2026 program proposal aims to curb account closures made under inappropriate pressure.