That closer look is Enhanced Due Diligence (EDD): a deeper, risk-based investigation that goes beyond routine KYC and customer due diligence (CDD). The FCA's April 2026 review of firm CDD controls found missing EDD evidence and missed periodic reviews. Weak files are a live problem.
This guide covers when EDD applies, what it involves, how it differs from KYC and CDD, and how UK fintechs and financial firms can build a defensible process.
Key Takeaways
- EDD is a proportionate layer of scrutiny for higher-risk customers, products, or relationships.
- Triggers include PEP exposure, FATF Call for Action jurisdictions, opaque ownership, and unusual activity.
- Effective EDD pairs verification, source of funds checks, screening, monitoring, and a documented rationale.
- Align EDD with current UK rules and your risk appetite as ongoing work, not a one-off checklist.
What Is Enhanced Due Diligence (EDD) in Compliance?
Under regulation 33 of the Money Laundering Regulations 2017 (MLRs), EDD means enhanced CDD and enhanced ongoing monitoring, applied on top of the regulation 28 baseline. It is not a separate alternative to CDD.
It applies when standard measures don't give enough assurance about a customer's identity, ownership, activities, source of funds, or risk profile.
EDD supports anti-money laundering (AML) and counter-terrorist financing controls by answering four questions:
- Who are we dealing with?
- Why does this relationship exist?
- How were the funds generated?
- Is activity consistent with the customer's stated profile?
Risk indicator or automatic requirement?
A risk indicator is not an automatic EDD trigger. PEP status, crypto activity, international operations, or a particular country should be weighed in context. Regulation 33(6) states that one factor does not automatically mean high risk.
Dimensions of risk
The MLRs group risk factors into three categories:
- Customer
- Product, service, transaction, or delivery channel
- Geography
In practice, firms also look at ownership structure and behavioural patterns within those categories.
The 2025 UK National Risk Assessment, published 17 July 2025, rates retail banking and prepaid card money laundering risk as high, and raised terrorist financing risk for e-money institutions and payment service providers from medium to high. Fintechs, e-money firms, and payment providers should treat those ratings as a prompt to revisit EDD triggers and monitoring intensity.
Where the rules come from
The main UK sources are the MLRs, FCA materials, JMLSG guidance, HM Treasury notices, and the FATF Recommendations. Terminology differs elsewhere: the EU's EBA guidelines refer to "enhanced customer due diligence", and the US FinCEN rule sets out its own four CDD duties. Map each jurisdiction separately.
When Is EDD Required?
EDD applies where a relationship presents higher money laundering, terrorist financing, sanctions evasion, fraud, or corruption risk than standard controls can handle. Some triggers are mandatory. Others come from your own assessment.
| Trigger | UK treatment |
|---|---|
| High-risk case | EDD and enhanced monitoring in any case assessed as high risk or higher risk by nature |
| FATF Call for Action jurisdiction | Mandatory where the person, or a party to a relevant transaction, is established there |
| PEP, family member, close associate | EDD applies |
| Unusual transactions | Examine background and purpose; increase monitoring |
| False or stolen identification | Applies if you continue dealing with the customer |
| Correspondent relationships | Regulation 34 checks and senior approval |
PEPs and proportionality
FCA guidance FG25/3 says domestic PEPs start from a lower-risk presumption unless other factors indicate otherwise. Firms shouldn't decline or close an account solely because of PEP status.
Enhanced measures for former PEPs run for at least 12 months after they leave office, longer only where assessed risk warrants it and the rationale is recorded.
Family members include spouses or civil partners, children and their partners, and parents. The FCA also treats siblings as included.
Geography: date your lists
Since 30 June 2026, the automatic country trigger is a FATF Call for Action jurisdiction. As of the 30 October 2026 update, that means the Democratic People's Republic of Korea, Iran, and Myanmar.
Jurisdictions under FATF Increased Monitoring, such as Kenya, Vietnam, and the UK's Virgin Islands, are not an automatic trigger. They remain a geographic risk factor. Don't use the old "high-risk third country" wording.
Structural and activity indicators
- Nominee shareholders, trusts, layered or offshore entities, and unclear beneficial owners
- Cash-intensive activity or reluctance to provide information
- Sudden changes in volume or counterparties
- Adverse media, sanctions or watchlist alerts, inconsistent documents
- Unexplained wealth or no clear economic purpose
An alert should be investigated and resolved, not treated as proof of wrongdoing.
Sanctions duties under OFSI are separate from AML EDD. A suspected designated-person match requires freezing and reporting regardless of your EDD outcome.
What Does the EDD Process Involve?
1. Document the risk assessment
Record the trigger, the specific risks, the scope of enhanced checks, and the reasoning behind the risk rating and decision. This is the first thing a supervisor will ask to see.
2. Verify identity, entity and ownership
- Legal names, aliases, incorporation and licensing records
- Ownership charts, control relationships, directors, authorised representatives
- Independent sources to validate each of the above
You can't rely solely on Companies House or PSC register information. For registrable trusts, HMRC expects you to obtain and check a Trust Registration Service proof of registration and report material discrepancies.
3. Establish purpose and expected activity
Map what the relationship is meant to look like in practice:
- Business model, products and markets
- Counterparties and expected volumes
- Payment corridors
- Intermediaries or virtual asset service providers
4. Check source of funds and source of wealth
JMLSG says EDD may require establishing that both are not criminal proceeds and are consistent with what you know of the customer. Evidence can include:
- Tax returns and audited accounts
- Payslips, property or sale records
- Credible independent media
Assess it for consistency. Collecting documents isn't the same as testing them.
5. Screen and research
Cover sanctions, PEPs and associates, adverse media, enforcement records, litigation, and fraud indicators. Document false-positive decisions and unresolved discrepancies.
For crypto, FATF's red flags include mixing services, anonymity-enhanced coins, and deposits inconsistent with a new user's profile. These flags need context, not automatic conclusions.
6. Monitor, review, escalate
- Tailored transaction monitoring and periodic or event-triggered reviews
- Senior management approval and escalation
- Restrictions or exit where risk can't be mitigated
- Records kept at least five years under regulation 40 of the Money Laundering Regulations
EDD doesn't automatically mean filing a suspicious activity report (SAR). The NCA's SAR guidance sets the test as knowledge or suspicion of money laundering or terrorist financing, assessed separately.
KYC vs CDD vs EDD: What's the Difference?
KYC is the broad idea of knowing your customer. In UK law, HMRC notes CDD is sometimes called KYC; the MLRs define CDD, not a separate KYC measure.
CDD covers identification, beneficial owners, relationship purpose, and ongoing monitoring. EDD adds deeper investigation where risk is higher.
| Aspect | KYC | CDD | EDD |
|---|---|---|---|
| Purpose | Know the customer | Verify, assess risk, monitor | Mitigate elevated risk |
| Depth | Basic identity | Identity, owners, purpose | Source of funds and wealth, deeper research |
| Trigger | Every customer | Every customer | Higher-risk cases |
| Monitoring | Routine | Ongoing | Enhanced |
| Approval | Standard | Standard | Senior management |
Simplified due diligence sits at the other end. Regulation 37 allows it only after you determine low risk, and monitoring continues.
EDD doesn't replace KYC or CDD. It builds on them. New red flags during monitoring can push a customer into enhanced review. Scope still isn't identical across firms; it follows your risk assessment.
How to Build an Effective EDD Programme
Governance foundations
The MLRs set the framework for a defensible programme:
- A written firm-wide risk assessment (regulation 18)
- Proportionate policies, controls, and senior approval (regulation 19)
- A board-level compliance officer and independent audit where appropriate (regulation 21)
- Regular staff training with records (regulation 24)
- For FCA-regulated firms, an MLRO with authority, independence, and resources, and an annual MLRO report
Beyond that baseline, document your risk appetite, clarify ownership between compliance and operations, and keep quality assurance plus decision records.
The FCA's £21,091,300 fine of Monzo in July 2025 shows the cost of gaps: more than 34,000 high-risk customers were onboarded despite a restriction. Customer risk assessment must connect to onboarding controls.
Mapping UK and cross-border obligations
Map procedures to the UK framework first, then list obligations in other jurisdictions separately. Before relying on any list or guidance, check current FCA, JMLSG, HM Treasury, FATF, and NCA pages.
JMLSG's October 2026 Part I is current, though some 2026 revisions await HM Treasury approval. Crypto firms should note regulation 34A takes effect 1 February 2027.
Where Fraxtional fits
Fraxtional provides director-led compliance expertise to fintechs, crypto firms, money transmitters, embedded finance companies, banks, and growing startups without a full-time hire. For EDD, that means:
- Risk assessments grounded in product, geography, and crypto exposure
- EDD policy design and tailored AML procedures
- Fractional or interim MLRO and CCO oversight for firms under UK, EU, and Canadian frameworks
- Staff training, workflows, and version-controlled documentation
- Ongoing programme refreshes tied to product launches or market entries
Frequently Asked Questions
What is EDD compliance?
EDD compliance is the enhanced, risk-based investigation and monitoring applied to higher-risk customers or relationships. It goes beyond routine KYC and CDD.
What is KYC vs CDD vs EDD?
KYC is the broad process of knowing the customer. CDD is the standard identity and risk assessment. EDD is the deeper level applied when higher risk is identified.
When is EDD required?
UK law requires EDD for cases such as FATF Call for Action jurisdictions, PEPs, unusual transactions, or any relationship your risk assessment rates as high risk. Exact triggers still vary by sector.
When should a business conduct enhanced due diligence?
Common triggers are PEP exposure, high-risk jurisdictions, complex ownership, adverse media, sanctions concerns, unusual transactions, and unexplained source of funds or wealth.
What information is collected during EDD?
Firms typically collect enhanced identity and beneficial ownership details, business purpose, evidenced source of funds and wealth, expected transactions, screening results, and background research.
How often should EDD be reviewed?
Frequency follows the customer's risk level; JMLSG states no universal interval. Review sooner after ownership changes, adverse media, unusual activity, or new products.
