Customer Due Diligence and Beneficial Ownership

1. Why This Topic Matters

Customer Due Diligence (CDD) and Beneficial Ownership sit at the very heart of every anti-financial crime (AFC) program, and they are among the most heavily tested areas on the CAMS exam. The reason is simple: if an institution does not truly know who its customers are, who ultimately owns or controls them, and what they are likely to do with their accounts, then every other control (transaction monitoring, sanctions screening, suspicious activity reporting) is built on sand.

Money launderers, terrorist financiers, sanctions evaders, corrupt politically exposed persons (PEPs), and tax evaders rely on anonymity. Shell companies, nominee directors, bearer shares, layered trusts, and opaque corporate chains exist precisely to separate the real human being from the money. Beneficial ownership transparency is the counter-weapon. The Panama Papers, Paradise Papers, Pandora Papers, the Danske Bank Estonia scandal, and the 1MDB affair all shared a common thread: institutions that onboarded legal entities without identifying the natural persons behind them.

From a regulatory standpoint, CDD is codified in FATF Recommendation 10 (Customer Due Diligence), Recommendation 12 (PEPs), Recommendation 17 (reliance on third parties), and Recommendations 24 and 25 (transparency and beneficial ownership of legal persons and legal arrangements). In the United States, the FinCEN CDD Rule (2016, effective May 2018) made the identification of beneficial owners an explicit, so-called fifth pillar of an AML program, and the Corporate Transparency Act introduced a federal beneficial ownership registry. The EU has embedded beneficial ownership registers through successive Anti-Money Laundering Directives, and the UK operates the People with Significant Control (PSC) register. Regulators worldwide have levied enormous fines for CDD failures, and personal liability for compliance officers is a real consequence.

For the CAMS candidate, mastering this domain is essential because CDD concepts are woven into questions across the entire exam, not only in the AFC Program Governance and Risk Management domain. You will see CDD logic in scenarios involving correspondent banking, private banking, trade finance, PEPs, sanctions, and investigations.

2. What Is Customer Due Diligence?

Customer Due Diligence is the process by which a financial institution or designated non-financial business or profession (DNFBP) gathers and evaluates information about a customer so that it can (a) be reasonably confident it knows who the customer is, (b) understand the purpose and intended nature of the relationship, (c) assess the money laundering and terrorist financing risk the customer presents, and (d) detect activity that is inconsistent with what it knows about that customer.

Under FATF Recommendation 10, the core CDD measures are:

1. Identify the customer and verify identity using reliable, independent source documents, data, or information.
2. Identify the beneficial owner and take reasonable measures to verify the identity of the beneficial owner, such that the institution is satisfied it knows who the beneficial owner is. For legal persons and arrangements, this includes understanding the ownership and control structure.
3. Understand and, as appropriate, obtain information on the purpose and intended nature of the business relationship.
4. Conduct ongoing due diligence on the relationship, scrutinizing transactions to ensure they are consistent with the institution's knowledge of the customer, its business, and risk profile, including, where necessary, the source of funds, and keeping documents and data up to date.

The FinCEN CDD Rule mirrors this with four elements: customer identification and verification; beneficial ownership identification and verification; understanding the nature and purpose of customer relationships to develop a customer risk profile; and ongoing monitoring with updating of customer information on a risk basis.

Key terminology you must be able to distinguish:

KYC (Know Your Customer) is the broad umbrella concept and is often used interchangeably with CDD, though strictly KYC is the policy framework and CDD is the operational process.

CIP (Customer Identification Program), a US term from the USA PATRIOT Act Section 326, refers specifically to collecting and verifying identifying information: at minimum, name, date of birth (for individuals), address, and an identification number (such as a tax identification number, passport number, or other government-issued number). CIP is a subset of CDD.

Identification versus Verification: Identification is obtaining the information (who does the customer say they are). Verification is confirming that the information is true, through documentary methods (passport, driver's license, articles of incorporation) or non-documentary methods (database checks, credit bureaus, contacting the customer, comparing to public records). Exam questions frequently test whether you grasp this difference.

Simplified Due Diligence (SDD) applies where risk is demonstrably low (for example, a publicly listed company on a regulated exchange subject to disclosure requirements, or a regulated financial institution in a well-supervised jurisdiction). SDD never means no due diligence, and it is never permitted where there is suspicion of money laundering or terrorist financing.

Enhanced Due Diligence (EDD) applies where risk is higher. It involves additional, deeper measures beyond standard CDD, discussed in detail below.

Source of Funds versus Source of Wealth: Source of funds refers to the origin of the specific money used in a transaction or deposited into the account (for example, salary from a particular employer, sale of a property). Source of wealth refers to how the customer accumulated their total net worth over time (inheritance, business ownership, investments). EDD for PEPs and high-risk customers typically requires both.

3. What Is Beneficial Ownership?

FATF defines a beneficial owner as the natural person(s) who ultimately owns or controls a customer and/or the natural person on whose behalf a transaction is being conducted. It also includes those persons who exercise ultimate effective control over a legal person or arrangement.

The critical word is natural. A beneficial owner is always a living, breathing human being. A company cannot be the beneficial owner of another company; you must keep looking through the chain of ownership until you reach the individual at the top. If an exam answer suggests that a holding company, trust, or foundation is the beneficial owner, it is wrong.

The two prongs of beneficial ownership:

Ownership prong: Natural persons who directly or indirectly own a threshold percentage of the equity interests of a legal entity. The most commonly used threshold is 25 percent (FinCEN uses 25 percent; the EU directives use more than 25 percent, meaning 25 percent plus one share). Institutions may, and often do, apply lower thresholds (10 percent is common) for higher-risk customers. There may be zero, one, two, three, or four beneficial owners under the 25 percent threshold.

Control prong: A natural person with significant responsibility to control, manage, or direct the legal entity, such as a chief executive officer, chief financial officer, managing member, general partner, president, or any individual who regularly performs similar functions. Under the FinCEN rule, at least one individual must always be identified under the control prong, even if no one meets the ownership threshold. The same individual may satisfy both prongs.

Why both prongs? Because launderers deliberately spread ownership across many nominees so that no one crosses 25 percent, while the real controller directs everything without owning shares. Control is often more revealing than ownership.

Legal persons versus legal arrangements:

Legal persons include corporations, limited liability companies, partnerships, foundations, and similar entities. For these, you identify owners above the threshold and the controlling person.

Legal arrangements primarily means trusts (and similar structures such as fiducie, treuhand, or waqf). For a trust, the beneficial owners are the settlor (or grantor), the trustee(s), the protector (if any), the beneficiaries or class of beneficiaries, and any other natural person exercising ultimate effective control over the trust. For discretionary trusts where beneficiaries have not yet been determined, the class of beneficiaries must be understood and specific beneficiaries identified before distributions are made.

Red flags associated with beneficial ownership obscurity:

Bearer shares or bearer share warrants (ownership passes by physical possession of the certificate); nominee shareholders and nominee directors; shell companies with no physical presence, employees, or genuine business activity; shelf companies (pre-registered entities aged to appear established); multi-layered ownership chains spanning several secrecy jurisdictions; frequent changes of ownership or directors; use of corporate service providers or registered agents as the only point of contact; reluctance or inability to provide beneficial ownership information; ownership structures that are unnecessarily complex relative to the business purpose; and legal entities whose ownership information in public registries conflicts with what the customer declares.

International framework for transparency:

FATF Recommendations 24 and 25 require countries to ensure that adequate, accurate, and up-to-date beneficial ownership information is available to competent authorities in a timely manner. Mechanisms include central beneficial ownership registries, requirements for companies to hold their own information, and obligations on existing sources such as financial institutions and corporate registries. FATF has progressively tightened these standards, including a 2022 revision of Recommendation 24 requiring a multi-pronged approach and prohibiting new bearer shares. The UK PSC register, EU national registers, and the US Corporate Transparency Act (with reports filed to FinCEN) are practical implementations. Note that institutions generally cannot rely solely on a registry to discharge their own CDD obligations; the registry is one source among several.

4. How CDD Works in Practice

Step 1: Onboarding and identification. Collect identifying information appropriate to the customer type. For individuals: full legal name, date of birth, residential address, nationality, identification number, and occupation. For legal entities: legal name, registered address and principal place of business, jurisdiction and date of incorporation, registration number, legal form, names of directors and officers, nature of business, and beneficial ownership information (including a certification from the person opening the account, such as the FinCEN beneficial ownership certification form).

Step 2: Verification. Verify identity through documentary evidence (government-issued photo identification, certified articles of incorporation, partnership agreements, trust deeds) and/or non-documentary methods (electronic identity verification, credit reference agencies, public records, site visits). For beneficial owners, the standard is to take reasonable, risk-based measures to verify; institutions may rely on photocopies and representations in lower-risk situations but should obtain original documentation for higher-risk cases. Verification should generally occur before or within a reasonable time after account opening, with limits on activity if verification is incomplete.

Step 3: Understand purpose and nature of the relationship. What products will be used? What volumes and transaction types are expected? Which countries will funds flow to and from? Who are the expected counterparties? This information creates the baseline against which future activity is measured.

Step 4: Customer risk assessment and rating. Using the institution's risk-based approach, assign a risk rating (commonly low, medium, high) based on risk factors across the categories of customer (type of entity, occupation, PEP status, adverse media, industry such as cash-intensive businesses, money services businesses, casinos, precious metals dealers, arms dealers, non-profit organizations), geography (residence, citizenship, incorporation, countries of operation, FATF high-risk and monitored jurisdictions, sanctioned countries, tax havens, high-corruption-index countries), products and services (private banking, correspondent accounts, trade finance, wire transfers, prepaid cards, trust and company services, virtual assets), and delivery channel (non-face-to-face, introduced business, intermediaries).

Step 5: Apply the appropriate level of due diligence.

For high-risk customers, EDD measures include: obtaining senior management approval to establish or continue the relationship; establishing and documenting source of wealth and source of funds; obtaining additional information on the customer and beneficial owners (such as adverse media screening, independent research, site visits); understanding the reasons for intended or performed transactions; increasing the frequency of periodic reviews; conducting enhanced ongoing monitoring with lower alert thresholds; and, where appropriate, requiring the first payment to be made from an account in the customer's name at another regulated bank.

FATF and most regulators treat the following as mandatory EDD situations: foreign PEPs (and domestic PEPs and heads of international organizations when assessed as higher risk), including their family members and close associates; cross-border correspondent banking relationships; customers from or transactions involving high-risk jurisdictions identified by FATF; private banking clients; and any customer or transaction presenting an unusual or complex pattern without apparent economic or lawful purpose.

For correspondent banking specifically, EDD requires gathering sufficient information about the respondent to understand its business, reputation, and quality of supervision; assessing its AML controls; obtaining senior management approval; documenting respective responsibilities; and, for payable-through accounts, ensuring the respondent has performed CDD on customers with direct access. Relationships with shell banks (banks with no physical presence in any country and not affiliated with a regulated group) are prohibited, and institutions must ensure respondents do not permit their accounts to be used by shell banks.

Step 6: Ongoing monitoring and periodic review. CDD is not a one-time event at onboarding. Institutions must monitor transactions against the expected profile, screen customers and beneficial owners against sanctions, PEP, and adverse media lists on a continuing basis, and refresh CDD information periodically (for example, annually for high-risk, every three years for medium, every five years for low-risk customers) and upon trigger events such as a change in ownership or control, a change in the nature of business, unusual transactions, a sanctions or adverse media hit, a law enforcement inquiry, or a request to open new products. Under the FinCEN rule, beneficial ownership information for existing customers must be updated when, in the course of normal monitoring, the institution becomes aware of information relevant to the customer's risk profile.

Step 7: Reliance on third parties and intermediaries. FATF Recommendation 17 permits institutions to rely on third parties (such as another regulated financial institution or introducer) to perform elements of CDD, provided the relying institution obtains the necessary information immediately, is satisfied that copies of documentation will be made available without delay, confirms the third party is regulated and supervised for AML, and considers the country risk of the third party. Crucially, ultimate responsibility remains with the relying institution. Outsourcing or reliance never transfers legal responsibility.

Step 8: Record keeping. CDD records, account files, and business correspondence must be retained for at least five years after the end of the business relationship (or after the transaction, for occasional transactions), and must be sufficient to permit reconstruction of individual transactions and to be made available swiftly to competent authorities. Many jurisdictions require longer periods.

Step 9: When CDD cannot be completed. If an institution cannot identify or verify the customer or beneficial owner, or cannot obtain information on the purpose of the relationship, it should: not open the account, not commence the business relationship or perform the transaction, terminate the existing relationship where applicable, and consider filing a suspicious activity report (SAR/STR). The failure or refusal to provide beneficial ownership information is itself a red flag. However, if the institution reasonably believes that performing CDD will tip off the customer, it may choose not to pursue the CDD process and instead file a report. Tipping off the customer about a suspicion or a report is prohibited.

5. Common Scenarios Involving Beneficial Ownership

Scenario A: A company is owned 20 percent each by five individuals. No one meets the 25 percent ownership threshold. The institution must still identify at least one person under the control prong (for example, the CEO). Depending on its risk appetite, it may choose to identify all five owners anyway.

Scenario B: Company X is owned 60 percent by Company Y and 40 percent by an individual, Mr. A. Company Y is owned 100 percent by Ms. B. Beneficial owners are Mr. A (40 percent direct) and Ms. B (60 percent indirect through Company Y). Company Y is not a beneficial owner because it is not a natural person.

Scenario C: A customer presents a corporate structure spanning a British Virgin Islands company owned by a Panamanian foundation whose council members are employees of a corporate service provider. The customer says the structure is for asset protection and declines to name the economic beneficiary. This is a classic high-risk pattern; the appropriate response is to decline or terminate and consider a SAR, not to accept the corporate service provider as the beneficial owner.

Scenario D: A trust account is opened by the trustee, a licensed trust company. The institution must identify the settlor, trustee, protector, and beneficiaries, and understand the source of the trust assets, even though the trustee is itself regulated. SDD on the trustee does not eliminate the obligation to understand the trust.

Scenario E: A long-standing low-risk corporate customer suddenly changes its registered owner to a company in a high-risk jurisdiction and begins receiving large incoming wires from unrelated third parties. This is a trigger event requiring immediate CDD refresh, re-rating, and potentially EDD and a SAR.

6. Exam Tips: Answering Questions on Customer Due Diligence and Beneficial Ownership

Tip 1: Think like FATF, not like your local regulator. The CAMS exam is international. Where local rules differ, the exam generally expects the FATF-aligned, principles-based answer. Avoid over-relying on US-specific or EU-specific thresholds unless the question explicitly names the jurisdiction. If a question asks about the percentage threshold without specifying a regime, 25 percent is the expected answer.

Tip 2: The beneficial owner is always a natural person. If an answer option names a company, trust, foundation, or nominee as the beneficial owner, eliminate it. Look for the option that drills down to the human being who ultimately owns or controls the entity.

Tip 3: Remember both prongs. Many questions describe ownership below the threshold and ask who must be identified. The answer will involve the person exercising control (a senior managing official). Conversely, if the question emphasizes that someone directs the company without holding shares, that person is still a beneficial owner through the control prong.

Tip 4: Distinguish identification from verification. If the question asks what the institution has done when it collected a name and date of birth, that is identification. If it asks what remains to be done, the answer is verification using reliable, independent sources. Watch for answers that confuse the two.

Tip 5: Risk-based always beats rule-based. When choosing between an answer that applies the same measure to every customer and an answer that calibrates measures to assessed risk, choose the risk-based answer. CAMS strongly favors the risk-based approach. However, note the exceptions where EDD is required regardless of the institution's own assessment: foreign PEPs, cross-border correspondent banking, and FATF-designated high-risk jurisdictions.

Tip 6: Know the standard EDD toolkit. If a scenario involves a PEP, private banking client, or high-risk customer, the expected actions are: senior management approval, establish source of wealth and source of funds, enhanced ongoing monitoring, and more frequent reviews. If one answer includes senior management approval and the others do not, that is often the signal.

Tip 7: Know the correct response when CDD fails. The pattern is: do not open or do not proceed, terminate if already open, and consider filing a SAR. Answers that suggest opening the account with restrictions and chasing documents later, or simply closing the account without considering a report, are typically incorrect. Also eliminate any answer that involves telling the customer that a report has been or will be filed.

Tip 8: Reliance does not transfer responsibility. Any answer stating that the institution is no longer responsible because an introducer, correspondent, or outsourced provider performed CDD is wrong. The relying institution retains ultimate responsibility and must be able to obtain the underlying documents without delay.

Tip 9: SDD is not no DD. Watch for options suggesting that a publicly listed company or regulated bank requires no due diligence. The correct framing is reduced or simplified measures, never zero, and SDD is never acceptable when suspicion exists.

Tip 10: Read scenario questions for the key risk indicator. CAMS scenario questions often contain one or two decisive facts buried among neutral details: a jurisdiction, a reluctance to provide information, a nominee, a bearer share, a sudden ownership change, an inconsistency between stated business and actual activity. Underline (mentally) the red flag, then choose the answer that responds to that specific flag.

Tip 11: Be careful with words like always, never, all, and only. Absolute language is frequently a sign of a wrong answer, because CDD is inherently risk-based and judgment-driven. Exceptions: shell bank relationships are always prohibited, and tipping off is never permitted.

Tip 12: For trusts, list the full cast. Settlor, trustee, protector, beneficiaries, and anyone else exercising effective control. An answer that identifies only the trustee is incomplete.

Tip 13: Ongoing monitoring is part of CDD. If a question asks what CDD includes and one option is limited to onboarding activities while another includes ongoing monitoring and keeping information current, the broader option is correct.

Tip 14: Record retention is five years minimum. Records must enable reconstruction of transactions and be available promptly to authorities. If asked when the retention period begins for account records, it is from the end of the relationship.

Tip 15: For multiple-selection questions (choose two or three), evaluate each option independently. Each must stand on its own as correct. Do not select an option simply because it sounds similar to one you have already chosen.

Tip 16: Manage your time and trust your framework. Most CDD questions can be answered by running the scenario through a mental checklist: Who is the customer? Who is the natural person behind it? What is the risk level? What level of due diligence applies? Has anything changed? What do I do if I cannot complete it? Answers that follow this logic are almost always the ones the examiners intend.

7. Practice Questions

Question 1: A bank is onboarding a limited liability company. The company is owned 30 percent by an individual, 30 percent by a second individual, and 40 percent by a corporation registered in another country, which is in turn owned entirely by a third individual. The managing member of the LLC is a fourth individual who holds no shares. Under a 25 percent threshold with a control prong, whom must the bank identify as beneficial owners?
Answer: The first individual (30 percent direct), the second individual (30 percent direct), the third individual (40 percent indirect through the corporation), and the fourth individual under the control prong. The intermediate corporation is not a beneficial owner.

Question 2: A prospective customer refuses to disclose the identity of the individuals behind an offshore company that will fund the account, stating that the information is confidential under the laws of the offshore jurisdiction. What is the most appropriate action?
Answer: Decline to open the account and consider filing a suspicious activity report. Opening the account with restrictions, accepting the registered agent as the owner, or relying on the offshore jurisdiction's confidentiality laws are all incorrect.

Question 3: Which of the following is a required element of enhanced due diligence for a foreign PEP under FATF Recommendation 12?
Answer: Obtaining senior management approval for establishing the relationship, taking reasonable measures to establish source of wealth and source of funds, and conducting enhanced ongoing monitoring. Merely conducting a standard database screening would be insufficient.

Question 4: A financial institution relies on an introducing broker in another country to conduct CDD on referred clients. Which statement is correct?
Answer: The institution remains ultimately responsible for CDD and must be able to obtain identification data and copies of documentation from the introducer without delay, and must be satisfied the introducer is regulated and supervised for AML.

Question 5: A customer that was rated low risk at onboarding three years ago has recently changed its ultimate owner to an individual residing in a FATF-listed high-risk jurisdiction. What should the institution do?
Answer: Treat the change as a trigger event, refresh the CDD, identify and verify the new beneficial owner, re-assess the risk rating, and apply EDD as required given the high-risk jurisdiction. Waiting for the next scheduled periodic review would be inappropriate.

8. Summary Checklist

Identify and verify the customer. Identify and take reasonable measures to verify the beneficial owner, always a natural person, through both ownership and control prongs. Understand the purpose and nature of the relationship. Assess risk across customer, geography, product, and channel. Apply SDD, standard CDD, or EDD according to risk, with mandatory EDD for PEPs, correspondent banking, and high-risk jurisdictions. Obtain senior management approval and establish source of wealth and funds for high-risk relationships. Monitor on an ongoing basis and refresh on a periodic schedule and upon trigger events. Retain records for at least five years. Never rely on third parties to the point of abandoning your own responsibility. If CDD cannot be completed, do not proceed, terminate, and consider a SAR, without tipping off. Carry this framework into the exam room and the majority of CDD and beneficial ownership questions will become straightforward.