AI is growing over time, and its active deployment can be seen in all sectors. From software houses to local shops, all businesses are readily accepting new AI-equipped tools and applications. They are smart, and with AI, they can perform better. Here comes a valid question: What is customer Due Deligence in KYC? What are its steps, levels, and how to get it successfully implemented?
KYC stands for Know Your Customer. It is how firms confirm who their customer is and check if the customer brings any risk. The process is based on the use of AI to check customers who need dedicated inspection of their activities, performance, statistics, or transaction history. Let’s take a deeper look at what is the first step.
This guide uses published sources and gives general information, not legal advice. Rules change, so confirm with the regulator or a compliance professional.
Last checked: October 9, 2026.
What Is Customer Due Diligence in KYC?
Customer due diligence (CDD) is the risk-based part of KYC. A regulated firm verifies who a customer is, understands why they want the account, rates the risk they bring, and keeps monitoring them. The depth of checking changes with the risk, from simplified to standard to enhanced due diligence.
KYC stands for Know Your Customer. It is the process of confirming a customer’s identity and learning enough about them to judge the risk. A closely related piece is the customer identification program (CIP), which verifies the identity of every new account holder. CDD builds on that identity check by asking how risky the customer is and what the account will be used for.
Due diligence is not unique to banking. The same idea of checking before trusting appears in other fields, such as AI due diligence, where a business checks an AI tool or vendor. In KYC, the thing being checked is the customer.
A beneficial owner is a real person who owns or controls a company. A legal entity customer is a company or similar entity that opens an account, such as a corporation or a limited liability company.
How Were These Facts and Sources Chosen?
This guide relies on the US regulator FinCEN, the text of the federal rule, and published explainers from compliance firms. The key facts were checked on October 9, 2026. Nothing here comes from testing software, and rules differ by country, so the focus stays on the United States with a note on the global FATF standard.
For every US rule, it is imperative that it comes from FinCEN’s own pages and its February 2026 order. At the same time, it is important to keep a balance since the definitions of the three levels cannot come only from explainers by Moody’s, Persona, nCino, Sanctions.io and ComplyCube, but also limit the user-friendliness, usefulness and smooth performance of the system. Hence, the guide has to say so where those sources disagree instead of picking a side without a reason, without compromising on security.
How Does CDD Differ From KYC?
KYC must concentrate on delivering the whole process of knowing a customer for security policies to be effectively enforced. CDD requires the part that rates and watches risk to be protected. This can be enforced by ensuring that, where sources disagree on which contains which, this guide uses one working definition: KYC is the umbrella, and CDD is its risk-based core. The comparison below must be able to show how KYC, CIP, CDD, and EDD fit. Let us have a look at how Moody’s says KYC can be a key part of CDD. Persona says CDD is a key component of KYC. This category includes Mobbeel, who describes KYC as the way a firm demonstrates CDD. These are generally small code snippets that can have one practical difference, which is timing. Many times, Persona notes that KYC checks, such as verifying an ID card or an address, are sometimes limited to the start of the relationship, while CDD calls for continuous monitoring.
- KYC, the whole process of knowing a customer, runs from a single IP address, while KYC is carried out via numerous devices forming a botnet to increase the chances of the attack’s success. With the growing number, complexity, and severity of customers joining and staying, it is a good practice to perform checks to assess your operating system’s resilience to them.
- CIP can be classified as a program that verifies the identity of every new account holder. An account opens when it applies, which is an unauthorized individual who penetrates into a system and exploits an authorized individual’s account.
- CDD is risk-based checks that build a customer risk profile and keep it current. Applies at onboarding and throughout the relationship, where an attacker takes over supervisory control and tries to evade access controls and audit collection.
- EDD is one of the most common and dangerous security threats: deeper checks for higher-risk customers. To exploit a significant risk factor, attackers identify a significant risk factor in a program and understand how the risk factor will be stored in process memory to finally alter the execution flow of the program.
What Are the Three Levels of Customer Due Diligence?
Customer due diligence usually involves three levels such as simplified, standard, and enhanced. This level is based on the customer’s risk and is compared with the database samples that already exist in the system. Low-risk customers get lighter checks, most customers get standard checks, and high-risk customers get deeper checks, such as extra screening and closer monitoring, only in case of a match.
Simplified due diligence
This includes customers whose risk is demonstrably low. A user is authenticated with lighter checks, since less intrusive checks are permitted at this level, according to nCino. A sourced example specifies who can have access to a system resource and what type of access each entity has: listed companies or government entities. A security administrator maintains an authorization database to specify that the risk must be shown to be low, not assumed. This database is consulted by the access control function for determining whether firms adjust their vigilance to each customer’s risk profile, so the level can change when the risk does.
Standard due diligence
Intrusion Detection Systems monitor most customers. IDS helps identify the regular identity and risk checks a firm applies by default. Persona says standard due diligence is generally required by law to monitor any customer or transaction that does not qualify for simplified due diligence. Some sources call it basic due diligence, thus defining the traffic that is authorized to pass through it. Firewalls are effective means to protect any customer outside the simplified group from all network-based security threats. Countermeasures to avoid a one-time check include compile-time defense, which aims to harden a program to resist an attack to enhance software security; or runtime defense, which detects and aborts attacks in an executing program, because monitoring continues while the customer stays.
Enhanced due diligence
The first of such due diligence systems could be used for higher-risk customers. Their due diligence capabilities involve extra screening and checks, as the screening and checks are extra. This helps Moody’s say that when a significant risk factor is identified, additional screening and checks might be run, known as enhanced due diligence. The sourced example of any customer who shows a significant risk factor has pretty much remained the same, but the significant risk factor has been updated continuously. The deeper checks can slow onboarding with the help of checks that are being run on powerful computers, and Transactionlink notes that firms must balance thorough CDD against a smooth customer experience.
What Are the Steps of Customer Due Diligence?
These back-end due diligence steps analyze the steps and distribute them to the front end for monitoring: identify the customer, verify that identity, understand the purpose of the relationship to build a risk profile, and monitor the account over time. These steps largely match the core duties in the US rule as well as the global FATF approach.
- Identify the customer: This is because the first step consists of identifying the customer. The firms that make these checks then started to collect basic details about who the customer is in order to find a solution. In some commercial companies, it is usually asked who owns or controls the car park at the entrance and exit of the car park.
- Verify the identity: They are used for capturing and processing the details of the identity that enters or exits the building. If there is a detail entering the building, then the firm confirms those details against reliable evidence to check that the customer is who they claim to be. The same goes for teams that often work from due diligence checklists, and Ondato describes a customer due diligence checklist as a list of requirements found in most due diligence procedures.
- Understand the relationship: In these cases, the relationship is understood using specialized due diligence software, and the driver gets a fine via post or on this mobile. For commercial firms, these give them an ideal solution to solve the problem of why the customer wants the account and what activity to expect. These steps can not only place the customer in a risk category but also set the level of due diligence.
- Monitor over time: Furthermore, when you use these steps for your due diligence, you can monitor over time. By providing all the checks with a touch screen pay option as well as display machines, the checking does not end at onboarding. As the firm is fully automated, you will eliminate the need for every account to display a ticket to enter, and the firm monitors the account and updates the customer’s information on a risk basis. As more and more industries make sure of these due diligence checks to maintain safety and security on their property, Financial Crime Academy describes this as ongoing customer due diligence for as long as the customer stays.
What Are FinCEN’s Four Core CDD Requirements?
There is an ever-growing demand for FinCEN’s CDD Rule as covered financial institutions try to maintain control over four core requirements: identify and verify customers, identify and verify the beneficial owners of legal entity customers, understand the nature and purpose of each relationship, and monitor accounts to report suspicious activity and update customer information on a risk basis.
While FinCEN says covered financial institutions are banks, mutual funds, brokers or dealers in securities, futures commission merchants, and introducing brokers in commodities, there are still some challenges that need to be overcome. These institutions must keep written policies and procedures that are reasonably designed to meet all four requirements.
The second requirement is one of the best ways by which it can have two tests without any hassle. Aside from a beneficial owner, there is no harm in using any individual who owns 25 percent or more of a legal entity, plus one individual who controls it, to help the firm secure its legal entity against several controls. For instance, the firm can consider collecting each owner’s name, address, date of birth, and an identification number.
As a result, FinCEN can say the aim is to improve financial transparency and prevent criminals from misusing companies to disguise illicit activity.
FinCEN’s Four Core CDD Requirements at a Glance
Customer due diligence can feel abstract until you see the exact duties behind it. The table below summarizes the four core requirements in the US rule and what each one means for a covered firm.
| Requirement | What the firm does | Key detail |
|---|---|---|
| 1. Verify customers | Identifies customers and verifies their identity | Written policies and procedures must be reasonably designed to meet this duty |
| 2. Verify beneficial owners | Identifies and verifies the real people behind a company account | Covers any individual who owns 25 percent or more, plus one individual who controls the company |
| 3. Understand the relationship | Learns the nature and purpose of the customer relationship | Used to build a customer risk profile |
| 4. Monitor over time | Watches for suspicious transactions and updates customer information | Updates follow a risk-based approach |
What Changed in the US Rules in 2026?
When issuing an order on February 13, 2026, FinCEN should not overlook the importance of giving covered institutions relief from identifying and verifying a legal entity customer’s beneficial owners at every new account opening at any cost. In addition, institutions should still do it at the first account, when facts call its reliability into question, and when their risk-based procedures call for it.
By doing so, an institution had to identify and verify a legal entity customer’s beneficial owners each time that customer opened an account, even if little time had passed. Now it can help it limit those checks to three situations: the first account, any time facts call earlier information into question, and when its risk-based procedures require it.
For example, the institution may rely on earlier information if the customer confirms, verbally or in writing, that it is still accurate, and it must keep a record of that confirmation. For that reason, the institution must identify and verify the owners again if the customer cannot confirm.
Thus, other duties remain. Besides, FinCEN says institutions must focus on ongoing monitoring to report suspicious transactions and, on a risk basis, update customer information. This way, the relief is also optional, and FinCEN says it can revoke it.
What Are the Limits of Customer Due Diligence?
As far as customer due diligence is concerned, it has limits. Furthermore, rules differ by country, sources disagree on terms, and heavy checks can slow onboarding. When this guide covers general US rules, not legal advice, a firm should confirm duties with its regulator or a compliance professional before relying on any summary.
Similarly, the FinCEN rule should also concentrate on covering only certain institutions, so a business outside that list may face different duties. Unfortunately, terms also shift between sources: some say basic where others say standard, and the order of KYC and CDD is not settled. Therefore, Transactionlink adds a practical limit, which is that firms must balance thorough checks against a smooth customer experience.
Customer Due Diligence in KYC FAQs
In these answers, we will shed light on the questions readers ask most about CDD and KYC and then relate it to customer due diligence in KYC. This led each answer to reflect the sources checked on October 9, 2026 and apply to the United States unless noted. Because confirming rules with the regulator before acting is just one stage, but requirements change and differ by country and by type of firm is another stage.
Q1. Is customer due diligence the same as KYC?
Not exactly. Besides that, KYC is the wider process of knowing a customer, while CDD is the risk-based part that verifies identity, rates risk, and keeps monitoring. Most sources describe the link in different ways, but they agree the two work together.
Q2. What is the difference between CDD and EDD?
So, CDD is the overall risk-based process, and enhanced due diligence is its deeper level. As per Moody’s, additional screening and checks might be run when a significant risk factor is identified. Although all kinds of due diligence, whether simplified or standard, are the lighter levels, the firm is still in a better place to pick the level that fits each customer’s risk.
Q3. Is customer due diligence a one-time check?
No. The first checks happen at onboarding, but FinCEN’s rule also requires ongoing monitoring to report suspicious transactions and, on a risk basis, to keep customer information up to date. But when it comes to ongoing customer due diligence for as long as the customer stays, Financial Crime Academy clearly describes it there.
Q4. Did the 2026 FinCEN order end beneficial ownership checks?
No. As of now, the February 13, 2026 order was able to relieve covered institutions of the need to repeat the check at every new account opening, but it is beyond the capabilities of the order to end beneficial ownership checks. Covered institutions’ main objective was to identify and verify beneficial owners at the first account, when facts question earlier information, and when their risk-based procedures require it. FinCEN has also said the relief can be revoked.
What Should You Remember About Customer Due Diligence in KYC?
Customer due diligence has also been the risk-based core of KYC: verify the customer, understand the relationship, rate the risk, and keep monitoring. The process of matching the depth to the risk often leads to checking current rules, since the 2026 FinCEN order changed how often beneficial owners are checked again.
The core ideas are simple: know who the customer is, judge the risk, and keep watching. To apply the levels, the four steps, and the four FinCEN requirements requires that all follow from that. In response to companies, the US rule on beneficial owners of legal entity customers is written into federal regulations as part of anti-money laundering programs. Therefore, it is a need of the hour that companies confirm the current rules with the regulator before relying on any summary.
Haroon writes about contact management and keeping your Outlook data clean. He covers how to find and remove duplicate contacts, calendars, and tasks the easy way.