Customer Due Diligence and Beneficial Ownership

1. Why Customer Due Diligence and Beneficial Ownership Matter

Money laundering only works if criminals can disguise who really owns and controls the money. Every laundering scheme, from placement through layering to integration, depends on the ability to hide the natural person behind a transaction, an account, or a company. Customer Due Diligence (CDD) and beneficial ownership identification are the anti-money laundering (AML) controls designed to defeat exactly that strategy. They are the front line of the entire AML framework.

For the Certified Fraud Examiner (CFE) exam, this topic appears primarily in the Financial Transactions and Fraud Schemes section (within Money Laundering) and overlaps with the Law section, where the Bank Secrecy Act (BSA), the USA PATRIOT Act, and international standards such as the Financial Action Task Force (FATF) Recommendations are tested. The ACFE expects candidates to understand not only what CDD is but why a risk-based approach is used, when enhanced measures are triggered, and how the beneficial ownership rules close the gap that shell companies and nominee structures exploit.

In practice, fraud examiners use CDD concepts constantly: when tracing assets through layered corporate structures, when evaluating whether a financial institution met its compliance obligations, when recognizing red flags in vendor or customer onboarding files, and when building a case that someone deliberately concealed ownership to launder proceeds of fraud.

2. What Customer Due Diligence Is

Customer Due Diligence is the process by which a financial institution or other regulated entity identifies its customer, verifies that identity, understands the nature and intended purpose of the business relationship, and monitors that relationship on an ongoing basis. It is closely tied to the concept of Know Your Customer (KYC), and the terms are often used interchangeably, although CDD is the more precise regulatory term.

Under FATF Recommendation 10, which forms the global baseline, CDD consists of four core elements:

1. Identifying the customer and verifying identity using reliable, independent source documents, data, or information.
2. Identifying the beneficial owner and taking reasonable measures to verify that identity, so that the institution is satisfied it knows who the beneficial owner is.
3. Understanding the purpose and intended nature of the business relationship.
4. Conducting ongoing due diligence, including scrutinizing transactions to ensure they are consistent with the institution's knowledge of the customer, the customer's business, and risk profile, and keeping information current.

In the United States, these elements were codified by the Financial Crimes Enforcement Network (FinCEN) in its 2016 CDD Final Rule (fully effective May 11, 2018), which described the "four pillars" of CDD as: (1) customer identification and verification, (2) beneficial ownership identification and verification, (3) understanding the nature and purpose of customer relationships to develop a risk profile, and (4) ongoing monitoring to report suspicious activity and update customer information on a risk basis.

CDD vs. CIP: a distinction the exam loves

The Customer Identification Program (CIP) was mandated by Section 326 of the USA PATRIOT Act (2001). CIP requires banks, broker-dealers, mutual funds, and certain other institutions to collect, at a minimum, four pieces of information before opening an account: name, date of birth (for individuals), address, and an identification number (such as a Social Security number, taxpayer identification number, or passport number for non-U.S. persons). The institution must verify this information through documentary methods (passport, driver's license, articles of incorporation) or non-documentary methods (database checks, contacting the customer, comparing with credit bureau data), check the customer against government lists such as the OFAC sanctions list, and keep records for five years after the account is closed.

CIP is a component of CDD. CIP answers "who is this customer on paper?" CDD goes further and asks "who really controls this customer, what do they intend to do, and does their behavior match that expectation?" If an exam question asks about the minimum identifying information required at account opening, the answer is CIP. If it asks about understanding the risk profile or identifying who ultimately owns a corporate customer, the answer is CDD.

3. The Risk-Based Approach and the Three Levels of Due Diligence

Modern AML regimes do not require the same intensity of scrutiny for every customer. Instead they mandate a risk-based approach: institutions assess the money laundering and terrorist financing risk of each customer, product, delivery channel, and geography, and allocate their compliance resources accordingly. This produces three tiers:

Simplified Due Diligence (SDD) is permitted where risk is demonstrably low, for example publicly listed companies subject to disclosure requirements, government entities, or regulated financial institutions in jurisdictions with strong AML regimes. SDD is never allowed where there is suspicion of money laundering or where higher-risk scenarios apply.

Standard CDD applies to most customers and includes all four pillars described above.

Enhanced Due Diligence (EDD) is required for higher-risk customers and relationships. EDD involves obtaining additional information about the customer and beneficial owners, establishing the source of funds and source of wealth, obtaining senior management approval to establish or continue the relationship, and conducting more frequent and intensive monitoring. Common EDD triggers include:

- Politically Exposed Persons (PEPs): individuals who hold or have held prominent public functions (heads of state, senior politicians, senior government, judicial or military officials, senior executives of state-owned enterprises, important political party officials), plus their family members and close associates. FATF requires EDD for foreign PEPs in all cases and a risk-based determination for domestic PEPs.
- Correspondent banking relationships, especially with foreign institutions. Section 312 of the USA PATRIOT Act requires EDD for correspondent accounts maintained for certain foreign banks and for private banking accounts of non-U.S. persons. Section 313 prohibits U.S. institutions from maintaining correspondent accounts for foreign shell banks (banks with no physical presence in any jurisdiction and not affiliated with a regulated financial group).
- Private banking and high-net-worth clients, where large balances and personalized service increase laundering risk.
- Customers from high-risk or non-cooperative jurisdictions, including those on the FATF "black list" (call for action) or "grey list" (increased monitoring).
- Cash-intensive businesses, money services businesses, casinos, dealers in precious metals and stones, and other sectors with historically elevated risk.
- Complex or opaque legal structures, such as trusts, nominee arrangements, bearer-share companies, or multi-layered holding structures spanning several jurisdictions.
- Non-face-to-face relationships where identity verification is harder.

4. Beneficial Ownership: The Core Concept

A beneficial owner is the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is being conducted, including the person who exercises ultimate effective control over a legal person or arrangement. The emphasis on "natural person" is critical: a beneficial owner can never be another company. The analysis must be followed up through every layer of corporate ownership until it reaches a human being.

Why does this matter so much? Because launderers routinely use shell companies (entities with no real operations), front companies (legitimate-looking businesses used to commingle illicit funds), nominee directors and shareholders (individuals or firms who appear on the registers but act on secret instructions from the true owner), bearer shares (where whoever physically holds the share certificate owns the company), and trusts (which separate legal title from beneficial interest) to create distance between themselves and dirty money. The 2016 Panama Papers and 2021 Pandora Papers leaks illustrated how pervasive these structures are.

The FinCEN CDD Rule beneficial ownership test (United States)

Under the FinCEN CDD Rule, covered financial institutions must identify and verify the beneficial owners of each legal entity customer (corporations, LLCs, limited partnerships, general partnerships, and similar entities created by filing with a state or foreign jurisdiction) at the time a new account is opened. The rule defines beneficial owners using a two-prong test:

1. Ownership prong: each individual who, directly or indirectly, owns 25 percent or more of the equity interests of the legal entity customer. This can produce zero to four individuals (because five people could each own exactly 20 percent, resulting in no one meeting the threshold).
2. Control prong: a single individual with significant responsibility to control, manage, or direct the legal entity, such as a CEO, CFO, COO, managing member, general partner, president, vice president, or treasurer. The control prong always yields exactly one person.

Therefore, every legal entity customer will have at least one beneficial owner identified (the control person) and at most five (four 25 percent owners plus one control person). Institutions may rely on the customer's certification of beneficial ownership, typically collected on a standardized form, unless they have knowledge of facts that would reasonably call the certification into question. Verification of beneficial owners follows the same risk-based documentary or non-documentary procedures used in CIP, but institutions are permitted to rely on copies of identity documents rather than originals.

Certain entities are exempt from the beneficial ownership requirement because their ownership is already transparent, including U.S. and state-regulated financial institutions, publicly traded companies listed on U.S. exchanges, government entities, registered investment companies and advisers, and certain pooled investment vehicles.

The Corporate Transparency Act (CTA)

Enacted as part of the Anti-Money Laundering Act of 2020, the Corporate Transparency Act required most small corporations and LLCs formed or registered in the United States to report their beneficial ownership information (BOI) directly to FinCEN, creating a centralized federal database accessible to law enforcement and, with consent, to financial institutions. The CTA definition of beneficial owner is broader than the CDD Rule: any individual who owns or controls 25 percent or more of the entity or who exercises substantial control (which can include multiple people, not just one). Reporting companies must also identify "company applicants" who filed the formation documents. Candidates should be aware that implementation of the CTA has been subject to litigation and regulatory revision (including a 2025 FinCEN interim rule narrowing its scope largely to foreign reporting companies), so exam questions are most likely to test the conceptual framework and definitions rather than current enforcement status. Know the policy purpose: to prevent anonymous shell companies by forcing disclosure of the natural persons behind them.

International standards

FATF Recommendations 24 and 25 require countries to ensure that adequate, accurate, and timely beneficial ownership information on legal persons and legal arrangements (trusts) is available to competent authorities. FATF uses a 25 percent threshold as an example but allows jurisdictions to set lower thresholds. The European Union's Anti-Money Laundering Directives (4AMLD, 5AMLD, and 6AMLD) use a 25 percent plus one share indicator and require member states to maintain beneficial ownership registers. For trusts, the beneficial owners generally include the settlor, the trustee(s), the protector (if any), the beneficiaries or class of beneficiaries, and any other natural person exercising ultimate effective control.

5. How CDD Works in Practice: The Lifecycle

Step 1: Onboarding and risk assessment. When a prospective customer applies, the institution collects CIP data, screens the name against sanctions and PEP databases, and gathers information about occupation, expected account activity, source of funds, and the geographic footprint of the business. For legal entities, it obtains formation documents, identifies beneficial owners through the two-prong test, and may request organizational charts for complex structures. The customer is then assigned a risk rating (low, medium, high) that determines the level of due diligence applied.

Step 2: Verification. Identity claims are tested against independent evidence. For individuals, this means government-issued photo identification, utility bills, or database checks. For entities, this means certificates of incorporation, registers of shareholders, and corporate registry searches. Discrepancies, such as an address that does not exist, an ID number that fails validation, or a director who appears as nominee on hundreds of other companies, are red flags requiring escalation.

Step 3: Establishing the customer profile. The institution documents what "normal" looks like for this customer: expected transaction volumes, counterparties, countries, and products. This baseline is essential because suspicious activity is defined largely by deviation from expected behavior.

Step 4: Ongoing monitoring. Transaction monitoring systems flag activity inconsistent with the profile: sudden large wire transfers to high-risk jurisdictions, structuring of cash deposits just below the $10,000 Currency Transaction Report threshold, rapid movement of funds with no apparent business purpose, or a dormant account suddenly becoming active. Flagged activity is investigated and, if suspicion remains, a Suspicious Activity Report (SAR) is filed with FinCEN (within 30 days of initial detection, or 60 days if no suspect is identified). The institution must never tip off the customer that a SAR has been filed.

Step 5: Periodic review and event-driven updates. CDD information must be refreshed on a risk basis, typically annually for high-risk customers and every three to five years for low-risk customers, and whenever a triggering event occurs, such as a change in beneficial ownership, a negative news hit, or a transaction pattern inconsistent with the profile.

Step 6: Record retention. CIP records must be kept for five years after the account is closed; beneficial ownership records for five years after the account is closed; and transaction records for five years from the date of the transaction. Fraud examiners frequently rely on these records when reconstructing fund flows.

When CDD must be performed (FATF triggers): establishing a business relationship; carrying out an occasional transaction above the applicable threshold (USD/EUR 15,000 under FATF) or a wire transfer in the circumstances covered by Recommendation 16; when there is a suspicion of money laundering or terrorist financing regardless of any threshold; and when the institution has doubts about the veracity or adequacy of previously obtained identification data. If CDD cannot be completed, the institution should not open the account, should not perform the transaction, should terminate the relationship, and should consider filing a SAR.

6. Red Flags Related to CDD and Beneficial Ownership

Fraud examiners and the CFE exam both emphasize recognizing warning signs. Key indicators include:

- Customer reluctance or refusal to provide identification or beneficial ownership information, or provision of information that is vague, inconsistent, or unverifiable.
- Use of shell companies, particularly those incorporated in secrecy jurisdictions, with no apparent business purpose, no employees, no physical premises, or an address shared with hundreds of other entities (a "registered agent" address).
- Complex ownership chains with multiple layers of holding companies across several jurisdictions, with no legitimate commercial rationale.
- Nominee shareholders or directors, especially corporate service providers appearing as directors, or individuals who cannot explain the company's business.
- Bearer shares or bearer share warrants.
- Frequent changes in ownership, directors, or company name without explanation.
- Beneficial owner who is a PEP but was not initially disclosed, or who is resident in a high-risk jurisdiction while the company operates elsewhere.
- Transactions that do not match the stated business purpose, such as a landscaping company receiving large international wires from commodity traders.
- Customers who seem unusually knowledgeable about reporting thresholds or who structure transactions to stay just below them.
- Trusts with unusual features, such as a settlor who is also sole beneficiary and retains full control, suggesting a sham arrangement designed solely for concealment.
- Source of wealth that cannot be substantiated or is inconsistent with the customer's known occupation and age.

7. How CDD Connects to the Wider Money Laundering Curriculum

Understand how this topic fits with neighboring concepts you will be tested on:

- The three stages of laundering (placement, layering, integration): CDD primarily attacks placement (knowing who is depositing cash) and layering (identifying who is behind the entities moving money).
- The Bank Secrecy Act: CDD is one of the pillars of a BSA/AML compliance program, alongside internal controls, independent testing, a designated BSA officer, training, and (since the CDD Rule) risk-based CDD procedures. Many references now describe five pillars of an AML program.
- Currency Transaction Reports and SARs: CDD generates the profile that makes suspicious activity recognizable.
- OFAC sanctions screening: performed as part of CIP and ongoing monitoring.
- Tracing and asset recovery: beneficial ownership records are among the most valuable evidence sources when following laundered funds through corporate layers.

8. Exam Tips: Answering Questions on Customer Due Diligence and Beneficial Ownership

Tip 1: Memorize the numbers. The exam tests precise thresholds. Beneficial ownership under the FinCEN CDD Rule is 25 percent or more equity. The control prong identifies one individual. CIP requires four data elements (name, date of birth, address, identification number). Records are retained for five years. SARs are filed within 30 days (60 if no suspect identified). The FATF occasional transaction threshold is USD/EUR 15,000. Correspondent and private banking EDD comes from USA PATRIOT Act Section 312; CIP from Section 326; the shell bank prohibition from Section 313.

Tip 2: Always answer "natural person." If a question asks what a beneficial owner is, the correct answer will always reference a natural person (a human being) who ultimately owns or controls the entity. Any option that says the beneficial owner can be a parent company or a trust is wrong.

Tip 3: Distinguish CIP, CDD, and EDD by the verb in the question. "Identify and verify minimum identifying information at account opening" points to CIP. "Understand the nature and purpose of the relationship" or "develop a risk profile" points to CDD. "Obtain source of wealth, senior management approval, and heightened monitoring" points to EDD.

Tip 4: PEPs always mean EDD. Any question involving a foreign government official, a senior politician, a state-owned enterprise executive, or an immediate family member or close associate of such a person is signaling that enhanced due diligence is required. Note that being a PEP is not itself evidence of wrongdoing; it is a risk indicator requiring heightened scrutiny.

Tip 5: Think "risk-based," not "one-size-fits-all." If an answer choice suggests that every customer must receive identical scrutiny, or that low-risk customers may be exempted entirely from CDD, it is likely wrong. The correct framing is that the depth of due diligence is proportionate to the assessed risk, but some baseline identification is always required.

Tip 6: Know what to do when CDD fails. If a customer refuses to provide required information or verification cannot be completed, the institution should decline to open the account or terminate the relationship and consider filing a SAR. It should not open the account "provisionally" or rely on the customer's assurances.

Tip 7: Recognize the shell company fact pattern. When a question describes a company with no employees, no physical office, nominee directors, registration in a secrecy jurisdiction, and large wire transfers, the exam wants you to identify this as a shell company red flag for money laundering, and the appropriate response is EDD, escalation, and potential SAR filing, not simply "routine monitoring."

Tip 8: Read for the "best" answer. ACFE questions frequently present several partially correct options. Choose the one most complete and most aligned with regulatory language. For example, if asked what ongoing monitoring entails, an option that includes both "scrutinizing transactions for consistency with the customer profile" and "updating customer information on a risk basis" is better than one mentioning only transaction review.

Tip 9: Watch for true/false traps on exemptions. Publicly traded companies, regulated financial institutions, and government entities are generally exempt from beneficial ownership identification requirements. A statement claiming all legal entity customers without exception require beneficial ownership certification is false.

Tip 10: Connect CDD to the laundering stage. If a question asks which laundering stage a control most directly addresses, remember that account-opening due diligence attacks placement, and beneficial ownership transparency attacks layering through corporate structures.

Tip 11: Do not confuse SDD with no diligence. Simplified due diligence reduces the extent of measures but never eliminates identification entirely, and it is prohibited when suspicion exists.

Tip 12: Remember the tipping-off prohibition. Questions about SARs generated through CDD monitoring often test that the institution must not inform the customer that a report has been filed.

9. Worked Example Questions

Example 1: "A bank opens an account for XYZ Holdings LLC. The LLC is owned 40 percent by Anna, 30 percent by Ben, 20 percent by Carla, and 10 percent by Dev. Dev serves as the managing member with day-to-day authority. Under the FinCEN CDD Rule, whom must the bank identify as beneficial owners?" Answer: Anna and Ben under the ownership prong (each 25 percent or more) and Dev under the control prong. Carla and Dev do not meet the ownership threshold, but Dev is captured by the control prong. Total: three beneficial owners.

Example 2: "Which of the following customers would most likely require enhanced due diligence?" Options: a domestic publicly traded corporation; a local retail employee opening a checking account; the brother of a foreign cabinet minister opening a private banking account; a state university. Answer: the brother of a foreign cabinet minister, because family members of foreign PEPs trigger EDD, especially in private banking.

Example 3: "Which statement about the Customer Identification Program is true?" Answer: the one stating that CIP requires collecting name, date of birth, address, and an identification number and verifying identity through documentary or non-documentary means within a reasonable time after account opening. Distractors will typically add elements that belong to CDD (such as understanding the purpose of the relationship) or misstate the retention period.

Example 4: "A prospective customer insists on opening an account through a company registered in a secrecy jurisdiction, declines to name the shareholders, and offers to pay a premium fee for expedited processing. The most appropriate response is:" Answer: decline to open the account until beneficial ownership is identified and verified, and consider filing a SAR. Accepting the fee, opening the account provisionally, or relying on the customer's verbal assurance are all wrong.

10. Summary

Customer Due Diligence is the disciplined process of knowing who your customer really is, what they intend to do, and whether their behavior matches that expectation. Beneficial ownership identification extends that knowledge through corporate layers to the natural persons who ultimately own or control legal entities, defeating the shell companies, nominees, and trusts that launderers rely on. For the CFE exam, master the four pillars of CDD, the distinction between CIP, CDD, and EDD, the 25 percent ownership and single-person control prongs, the EDD triggers (especially PEPs, correspondent banking, and high-risk jurisdictions), the regulatory sources (BSA, USA PATRIOT Act Sections 312, 313, and 326, the FinCEN CDD Rule, the Corporate Transparency Act, and FATF Recommendations 10, 24, and 25), and the red flags that signal concealed ownership. Apply a risk-based mindset, always look for the natural person, and choose the most complete answer, and you will handle this topic confidently on exam day.