Enhanced Due Diligence: Triggers and Measures

1. Why Enhanced Due Diligence (EDD) Matters

Enhanced Due Diligence is the heightened level of scrutiny a financial institution applies to customers, relationships, products, or transactions that present a higher-than-normal risk of money laundering, terrorist financing, sanctions evasion, or other financial crime. It sits at the heart of the risk-based approach (RBA) promoted by the Financial Action Task Force (FATF), the Wolfsberg Group, the Basel Committee, and virtually every national regulator (FinCEN/OCC in the US, FCA in the UK, EU AML Directives, MAS, HKMA, etc.).

EDD matters for three practical reasons:
• Regulatory expectation: Standard Customer Due Diligence (CDD) is a baseline; regulators expect institutions to escalate when risk indicators appear. Failure to do so is one of the most frequently cited deficiencies in enforcement actions and consent orders.
• Risk mitigation: High-risk relationships (politically exposed persons, correspondent banks, private banking clients, cash-intensive businesses, customers in high-risk jurisdictions) are where the largest laundering schemes historically occur. EDD is the control that detects or deters them.
• Resource allocation: The RBA says apply more resources where risk is highest and simplified measures where risk is lowest. EDD is the "more" end of that spectrum, allowing an institution to accept higher-risk business responsibly rather than simply de-risking everyone.

For the CAMS exam, EDD is examined heavily because it ties together the CDD/KYC chapter, the risk-assessment chapter, the typologies chapter, and the governance chapter. Expect multiple questions.

2. What EDD Is (and Is Not)

Standard CDD typically includes: identifying and verifying the customer, identifying and verifying beneficial owners, understanding the nature and purpose of the relationship, and conducting ongoing monitoring.

EDD adds depth and intensity to each of these elements. It is not a separate parallel process; it is CDD performed to a higher standard, with more information gathered, more verification performed, more senior approval obtained, and more frequent monitoring and review.

Simplified Due Diligence (SDD) is the opposite end: reduced measures permitted for demonstrably low-risk situations (e.g., listed companies on regulated exchanges, government entities, certain low-value products). Exam questions often test whether you can distinguish the three tiers and recognise that SDD is never permitted when there is suspicion of money laundering or terrorist financing.

3. Triggers for EDD

Triggers are the risk indicators that move a customer or activity from standard to enhanced treatment. They are generally grouped by the four classic risk factors — customer, geography, product/service, and delivery channel — plus event-based triggers that arise during the relationship.

A. Customer-based triggers
• Politically Exposed Persons (PEPs), their family members, and close associates. FATF Recommendation 12 requires EDD for foreign PEPs on a mandatory basis and a risk-based approach to domestic and international-organisation PEPs. Note the US rule (Section 312 of the USA PATRIOT Act) focuses on "senior foreign political figures" in private banking accounts.
• Cash-intensive businesses (casinos, convenience stores, car washes, restaurants, parking garages, vending operators).
• Money Services Businesses (MSBs), currency exchangers, and payment intermediaries.
• Non-resident customers and customers with no apparent connection to the jurisdiction.
• Complex or opaque ownership structures: shell companies, nominee shareholders, bearer shares, trusts with layers of entities, offshore holding companies with no clear business rationale.
• Gatekeepers and professional intermediaries acting for undisclosed clients (lawyers, accountants, trust and company service providers).
• Non-profit organisations and charities, especially those operating in conflict zones.
• Dealers in high-value goods (precious metals, stones, art, antiques, luxury vehicles, real estate).
• Arms dealers, gambling operators, adult entertainment, cannabis-related businesses (jurisdiction dependent).
• Virtual asset service providers (VASPs) and crypto-related clients.
• Customers who have been the subject of a SAR/STR, adverse media, law-enforcement inquiry, or prior account closure.
• Customers who are evasive or inconsistent about the source of funds or the purpose of the account.

B. Geographic triggers
• Jurisdictions identified by FATF as having strategic AML/CFT deficiencies (the "grey list" of jurisdictions under increased monitoring and the "black list" of high-risk jurisdictions subject to a call for action). FATF Recommendation 19 requires EDD proportionate to the risk for the latter.
• Countries subject to sanctions or embargoes (OFAC, UN, EU, UK OFSI).
• Jurisdictions with significant levels of corruption (e.g., low scores on Transparency International's Corruption Perceptions Index), drug production or transit, terrorist activity, or weak transparency (secrecy havens).
• Offshore financial centres and tax havens when combined with other risk factors.

C. Product and service triggers
• Private banking and wealth management — high net worth, confidentiality, and complex structures.
• Correspondent banking — FATF Recommendation 13 and US Section 312 require EDD on foreign correspondent relationships, including understanding the respondent's business, reputation, supervision, AML controls, and whether it allows "nested" or payable-through accounts. Shell bank relationships are prohibited.
• Trade finance — susceptible to over/under-invoicing, phantom shipments, and dual-use goods.
• Trust and corporate formation services.
• Products offering anonymity — prepaid cards, bearer instruments, certain e-money products.
• International wire transfers, especially to/from high-risk countries.
• Lending secured by cash collateral or by assets held offshore.

D. Delivery-channel triggers
• Non-face-to-face onboarding without robust digital identity verification.
• Reliance on third parties or introducers for CDD (FATF Recommendation 17) — the relying institution remains ultimately responsible.
• Intermediated or agent-based distribution where the institution does not deal directly with the end customer.

E. Event-based triggers (during the relationship)
• Material change in customer information (new beneficial owner, new country of operation, new business line).
• Transaction monitoring alerts, unusual patterns, or activity inconsistent with the stated purpose and expected volume.
• Negative news or adverse media screening hits.
• Receipt of a subpoena, law-enforcement request, Section 314(a) match, or similar inquiry.
• Filing of a SAR/STR — many institutions automatically re-rate the customer and require a review within a defined period.
• Periodic review date based on risk rating (e.g., annually for high risk, every 3 years for medium, every 5 years for low).

4. EDD Measures: What "Enhanced" Looks Like in Practice

Once a trigger is identified, the institution applies a package of measures. FATF's Interpretive Note to Recommendation 10 and regulators' guidance describe the following core measures:

A. Obtaining additional information
• More detailed identification of the customer and all beneficial owners (frequently lowering the ownership threshold from 25% to 10% or lower for high-risk customers).
• Information on the source of funds (where the money in this transaction/account came from) and source of wealth (how the customer accumulated their total net worth). Exam tip: these are distinct concepts and both are expected for PEPs and private banking clients.
• Detailed understanding of the purpose and intended nature of the relationship, expected transaction types, volumes, counterparties, and countries.
• Information on the reasons for intended or performed transactions that appear unusual.
• For legal entities: ownership charts, articles of incorporation, register extracts, financial statements, licences, and the rationale for any complex structure.
• For correspondent banks: the Wolfsberg CBDDQ (Correspondent Banking Due Diligence Questionnaire), information on the respondent's AML programme, regulatory status, ownership, and management, and whether it offers downstream correspondent (nested) services.

B. Enhanced verification
• Independent verification of information through reliable sources — public registers, credible databases, documentary evidence, site visits, or third-party reports.
• Verification of source of wealth via tax returns, audited accounts, sale agreements, inheritance documents, employment contracts.
• Adverse media and PEP/sanctions screening on the customer, beneficial owners, directors, and key controllers, with periodic re-screening.

C. Senior management approval
• FATF requires senior management approval to establish (or continue) a relationship with a PEP and to establish new correspondent relationships. Many institutions extend this to all high-risk customers via a committee or designated approver.
• The MLRO/BSA Officer or Compliance typically has a formal role, and approval must be documented.

D. Enhanced ongoing monitoring
• Lower thresholds and more sensitive scenarios in automated transaction monitoring for high-risk accounts.
• Increased frequency of periodic reviews (commonly annual or more frequent) and event-driven reviews.
• Closer scrutiny of transactions against the documented customer profile.
• For correspondent accounts: monitoring for nested accounts, unusual payment patterns, and payment messages lacking originator/beneficiary information.
• For private banking: relationship manager attestations, review of large or unusual movements, and scrutiny of activity involving related structures.

E. Restrictive measures
• Limiting products, transaction types, geographies, or volumes available to the customer.
• Requiring the first payment to be made from an account in the customer's name at a regulated bank.
• Imposing conditions such as pre-approval for transactions above a threshold.
• Ultimately, declining or exiting the relationship when risk cannot be mitigated to within appetite — while ensuring tipping-off rules are respected and any required SAR/STR is filed.

F. Documentation and record-keeping
• Every EDD step, decision, approval, and rationale must be documented and retained (typically at least five years after the relationship ends, longer in some jurisdictions). Regulators and examiners assess EDD largely through the paper trail.

5. How EDD Fits Into Programme Governance

EDD is a control that flows from the institution's enterprise-wide risk assessment and risk appetite. Governance expectations include:
• Written policies and procedures defining EDD triggers, required measures per risk category, approval authorities, review frequencies, and escalation paths.
• Customer risk-rating methodology that is documented, consistently applied, and periodically validated.
• Clear roles: first line (business/relationship managers) gathers information and owns the relationship; second line (Compliance/MLRO) sets standards, approves, challenges, and monitors; third line (Internal Audit) independently tests.
• Board and senior management oversight via MI on the high-risk portfolio, overdue reviews, exits, and SAR trends.
• Training tailored to staff who onboard and manage high-risk customers.
• Independent testing of EDD files for completeness and quality.
• Technology: screening tools, risk-rating engines, case management, and monitoring systems calibrated to risk.

6. Worked Illustrations

Scenario 1: A newly onboarded import-export company owned through a BVI holding company and a Panamanian foundation wants to receive large USD wires from several Eastern European counterparties. Triggers: complex opaque ownership, multiple high-risk jurisdictions, trade-related activity. Measures: identify natural-person beneficial owners through the layers, obtain and verify corporate documents, understand commercial rationale for the structure, obtain contracts/invoices supporting expected flows, screen all parties, obtain senior approval, set enhanced monitoring with trade-finance red-flag scenarios, annual review.

Scenario 2: An existing private banking client is appointed finance minister of a foreign country. Trigger: customer becomes a foreign PEP. Measures: re-rate as high risk, obtain senior management approval to continue, refresh and verify source of wealth and source of funds, enhanced monitoring for inflows inconsistent with official salary, adverse media screening, increased review frequency.

Scenario 3: A bank is approached by a foreign bank seeking a USD correspondent account. Measures: confirm it is not a shell bank, obtain the Wolfsberg CBDDQ, assess the home-country AML regime and the respondent's supervision, ownership, management reputation, and AML controls, determine whether it offers nested services to other banks, obtain senior approval, and monitor for payment messages with missing information and unusual patterns.

7. Exam Tips: Answering Questions on Enhanced Due Diligence: Triggers and Measures

Tip 1 — Think "risk-based" first. When a question asks what an institution should do, the CAMS-preferred answer is usually the one that applies enhanced measures proportionate to the identified risk, rather than automatic refusal or automatic acceptance. Options that say "always exit" or "treat all customers the same" are typically distractors.

Tip 2 — Identify the trigger before choosing the measure. Read the scenario and categorise the risk: customer, geography, product, channel, or event. The correct answer will usually address that specific risk. A PEP scenario points to senior approval and source of wealth/funds; a correspondent banking scenario points to understanding the respondent's AML controls and nested accounts; a shell-company scenario points to piercing ownership to natural persons.

Tip 3 — Know the mandatory versus risk-based distinctions. Foreign PEPs: EDD and senior management approval are mandatory under FATF. Domestic PEPs: risk-based. Shell banks: prohibited, not merely high risk. High-risk jurisdictions subject to FATF call for action: EDD required. These bright lines are frequent question targets.

Tip 4 — Distinguish source of funds from source of wealth. Source of funds is the origin of the specific money being deposited or transacted; source of wealth is how the customer accumulated their overall assets. If an answer option confuses them, eliminate it.

Tip 5 — Remember who approves. Senior management (not the relationship manager alone, and not just the front-line officer) must approve high-risk relationships, especially PEPs and correspondent banks. Compliance involvement is expected but the business owns the risk decision within the approved framework.

Tip 6 — EDD is not a one-time event. If the question involves an existing customer whose circumstances change, the correct response involves re-rating, refreshing due diligence, and increasing monitoring — not simply noting the change in the file.

Tip 7 — Watch for tipping-off and SAR traps. If the scenario includes suspicious activity, the right answer never involves telling the customer a SAR has been or will be filed. EDD may continue alongside a SAR; a decision to exit must be handled so as not to tip off the customer.

Tip 8 — Reliance does not transfer responsibility. If a question involves third-party introducers or reliance on another institution's CDD, remember the relying institution remains ultimately responsible and must be able to obtain the underlying documents promptly.

Tip 9 — Correspondent banking specifics. Expect questions on nested (downstream) correspondent accounts, payable-through accounts, the Wolfsberg questionnaire, and the requirement to understand the respondent's customer base and AML programme. The US Section 312 and the FATF Recommendation 13 elements are commonly tested.

Tip 10 — Documentation is part of the control. If an option emphasises documenting the rationale for the risk decision and retaining records, it is usually part of the right answer. Regulators judge EDD by what is evidenced.

Tip 11 — Eliminate extreme or absolute language. Answers containing "always," "never," "all customers," or "no further action" are often wrong in a risk-based framework, unless they reflect a true prohibition such as shell banks.

Tip 12 — Use the best-answer approach. CAMS questions often present several plausible actions. Pick the one that most directly mitigates the identified risk and aligns with international standards (FATF, Wolfsberg, Basel). The most complete, risk-proportionate, and documented response is generally correct.

8. Quick-Reference Summary

Triggers: PEPs; high-risk and sanctioned jurisdictions; complex/opaque structures; cash-intensive businesses; MSBs; correspondent banking; private banking; trade finance; non-face-to-face and intermediated channels; adverse media; SAR filings; unusual activity; material changes.

Measures: additional information on customer, beneficial owners, purpose, source of funds and wealth; independent verification; screening; senior management approval; enhanced and more frequent monitoring; more frequent periodic reviews; product or transaction restrictions; first payment from own account; documented rationale; exit where risk exceeds appetite.

Governance: policies defining triggers and measures; consistent risk-rating methodology; three lines of defence; board MI; training; independent testing; record retention.

Master the link between trigger → proportionate measure → documented approval → ongoing monitoring, and you will be well equipped to answer any CAMS question on Enhanced Due Diligence.