Customer Due Diligence Checklist (Template)

9/2/2026

Most CDD failures happen at the desk, not in the BSA department. A beneficial ownership form missing the control person, an expected-activity field that says "normal," a nonprofit opened without anyone asking where its money goes: each of these gets discovered months later by an analyst trying to clear an alert against a profile that was never built.

This template is for account-opening staff and the people who review their work. It is organized by customer type, because what you need from a sole proprietor is different from what you need from a multi-member LLC or a foreign nonprofit. Copy it into your procedures, adapt it to your bank's risk assessment and systems, and use it as a quality-control checklist when sampling new accounts.

A note on what this is not. It is not a restatement of the rules, and it does not replace your bank's written CIP and CDD procedures, which should control wherever they differ. It also leaves out bank-specific thresholds and review intervals, because those come from your own risk assessment. For the underlying requirements, see our guide to KYC and customer due diligence.

How to use this checklist

Work in three passes:

Identify the customer and anyone else the rules require you to identify (beneficial owners, signers where your procedures require it).
Understand the relationship: nature and purpose, expected activity, and enough context to build a risk profile.
Decide: assign a risk rating, flag for enhanced due diligence if warranted, and record any open items.

Every section ends with documentation items. If the file does not show it, an examiner or independent tester will treat it as not done.

Part 1: Baseline for every customer

These apply to every new account, regardless of customer type.

CIP minimum information (collect before opening)

Under the bank CIP rule at 31 CFR 1020.220, the bank must obtain at least the following before opening an account:

[ ] Name
[ ] Date of birth (individuals)
[ ] Address: a residential or business street address for an individual (an APO/FPO box or a next-of-kin or contact person's street address if the individual has none); for a non-individual, a principal place of business, local office, or other physical location
[ ] Identification number: a taxpayer identification number for a U.S. person; for a non-U.S. person, a TIN, passport number and country of issuance, alien identification card number, or the number and country of issuance of another government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard

Two notes on the identification number. First, the CIP rule allows procedures for a customer who has applied for but not yet received a TIN: confirm the application was filed before opening and obtain the number within a reasonable time afterward. Second, a June 2025 order issued by the OCC, FDIC and NCUA with FinCEN's concurrence permits banks under those agencies to obtain TIN information from a reputable third-party source rather than directly from the customer. It is optional, and your procedures must say whether the bank uses it.

CIP verification (within a reasonable time)

[ ] Verification method recorded: documentary, non-documentary, or both
[ ] For documents: type, number, place of issuance, issue and expiration dates recorded; document unexpired
[ ] For non-documentary methods: method used and result recorded
[ ] Any substantive discrepancy resolved, with the resolution recorded
[ ] If identity cannot be verified: handled under the bank's procedure (restrict, do not open, close, consider a SAR)

Lists and notice

[ ] Customer screened against government lists as the bank's procedures require, including OFAC sanctions lists
[ ] Any potential match escalated and resolved before the account is used
[ ] CIP notice provided to the customer as the bank's procedures specify (lobby notice, online disclosure, or account-opening document)

Nature and purpose

[ ] Purpose of the account in specific terms ("operating account for landscaping business," not "business")
[ ] Expected sources of incoming funds
[ ] Expected activity by type: cash in, cash out, checks, ACH, wires (domestic and international), remote deposit capture
[ ] Rough expected volumes or ranges, as your system requires
[ ] Any foreign connections: countries for wires, foreign residence, foreign business operations

Rating and records

[ ] Customer risk rating assigned under the bank's model, with any override reasoned and approved
[ ] EDD flag set if the customer falls within the bank's EDD categories
[ ] All CIP and CDD records saved to the customer file in the required system

Part 2: Individuals

Standard consumer

[ ] Occupation and employer (or source of income if not employed)
[ ] Expected deposit sources: payroll, benefits, transfers from other banks
[ ] Whether the customer expects to use cash significantly, wire internationally, or receive foreign funds
[ ] Any third party who will transact on the account (authorized signer, agent under power of attorney), with identification handled as procedures require

Non-U.S. persons and nonresident aliens

[ ] Identification number collected as permitted for non-U.S. persons
[ ] Country of citizenship and residence
[ ] Reason for opening a U.S. account
[ ] Expected cross-border activity and countries involved
[ ] Source of funds for initial and expected deposits
[ ] Tax documentation required by the bank's procedures (outside the BSA, but often collected at the same time)

Individuals who may be politically exposed

[ ] Screening result reviewed
[ ] Position held, country, and whether current or former
[ ] Source of wealth, not only source of funds, where the bank's procedures call for it
[ ] Rating and EDD decision documented with reasoning
[ ] For a private banking account as defined in 31 CFR 1010.605 (minimum aggregate deposit of $1,000,000, established for non-U.S. persons, with a bank liaison), the requirements of 31 CFR 1010.620 apply, including enhanced scrutiny where a senior foreign political figure is an owner

Part 3: Sole proprietors and DBAs

A sole proprietorship is not a legal entity customer under the CDD rule, so there is no beneficial ownership certification. The owner is the customer for CIP.

[ ] Owner identified and verified as an individual
[ ] Assumed name or DBA filing obtained if the business operates under a trade name
[ ] Nature of the business in specific terms: what it sells or does, to whom
[ ] Business location and whether it operates from a home or a storefront
[ ] Licenses required for the business type, where relevant to risk (for example, money transmission, check cashing, pawn, firearms, alcohol)
[ ] Expected activity, with particular attention to cash
[ ] Industry mapped to the bank's risk tiers

Part 4: Legal entity customers

This covers corporations, LLCs, limited partnerships and other entities created by a state filing, general partnerships, and similar foreign entities. It is where most account-opening errors occur.

Entity identification and existence

[ ] Legal name and any trade names
[ ] Principal place of business or other physical location
[ ] TIN, or for a foreign entity without one, alternative government-issued documentation certifying its existence
[ ] Documents showing existence: certified articles, certificate of good standing, partnership agreement, government-issued business license, or as procedures specify
[ ] Authority of the person opening the account (resolution, operating agreement provision, or equivalent)

Exclusion check

[ ] Determine whether the entity falls within an exclusion from the legal entity customer definition at 31 CFR 1010.230(e)(2), such as a regulated financial institution, a company with SEC-registered securities, a state-regulated insurance company, or a bank holding company
[ ] If excluded: evidence of the exclusion recorded (for example, exchange listing or regulator lookup), not only the conclusion
[ ] If a nonprofit corporation or similar entity that has filed organizational documents with the state: control prong only

Beneficial ownership (31 CFR 1010.230)

[ ] Certification obtained from the individual opening the account, on the Appendix A form or by another means that includes the certification
[ ] Ownership prong: each individual owning 25 percent or more directly or indirectly, or a record that no one meets the threshold
[ ] Layered ownership worked through to individuals; no entity left as the "owner"
[ ] Where a trust owns 25 percent or more: trustee identified
[ ] Control prong: exactly one individual with significant responsibility to control, manage, or direct the entity
[ ] Each beneficial owner's identity verified to at least the CIP standard for individuals (photocopies acceptable for documentary verification)
[ ] Any inconsistency between the certification and other documents in the file resolved and recorded
[ ] Whether this is the customer's first account at the bank, and whether the bank's procedures use FinCEN's February 2026 relief order allowing reliance on previously obtained ownership information for later accounts

Domestic companies are no longer required to file beneficial ownership information reports with FinCEN under the Corporate Transparency Act, following a final rule effective August 14, 2026. That does not affect this section. Do not request a FinCEN filing in place of the bank's own certification.

Business profile

[ ] What the business does, in specific terms
[ ] Customers it serves (consumers, businesses, government) and where
[ ] Number of locations and states of operation
[ ] Approximate annual revenue or size, as procedures require
[ ] Expected cash activity, and whether it is consistent with the business type
[ ] Expected wire and ACH activity, including counterparties and countries
[ ] Use of remote deposit capture, payroll services, merchant services
[ ] Industry mapped to the bank's risk tiers
[ ] Website or other public presence reviewed where useful

Part 5: Nonprofits and charities

Nonprofits vary enormously in risk. A local youth league and an organization funding programs abroad need very different files.

[ ] Entity documents and, where applicable, IRS tax-exempt determination
[ ] Control person identified (control prong only for qualifying nonprofit corporations)
[ ] Mission and programs in specific terms
[ ] Main funding sources: donations, grants, government contracts, events
[ ] Where funds are spent, including any foreign disbursements and countries
[ ] Who controls disbursements and how they are approved
[ ] Expected activity, particularly cash collections and international wires
[ ] EDD decision documented if the nonprofit has significant foreign activity or other risk factors

Part 6: Trusts and estates

Most trusts are not legal entity customers under the CDD rule, but they still need CIP and a sensible profile. Estates often involve a deceased accountholder workflow that sits alongside CDD.

[ ] Trust or estate identified and its existence documented (trust instrument or certification of trust; letters testamentary or of administration)
[ ] Trustee or personal representative identified and verified as procedures require
[ ] Purpose of the account
[ ] Expected activity and sources of funds
[ ] Any foreign grantors, trustees, or beneficiaries noted for risk rating

Part 7: Higher-risk customer types

If the customer falls into a category your policy treats as higher risk, complete the relevant items in addition to the sections above. For what enhanced due diligence should look like in the file, see our post on money laundering red flags for the risk indicators analysts are trained to spot.

Money services businesses

[ ] FinCEN MSB registration confirmed where the business is required to register
[ ] State licensing confirmed where required
[ ] Services offered: check cashing, money transmission, currency exchange, prepaid access
[ ] Agent relationships, if the business is an agent of a larger MSB
[ ] The MSB's own AML program reviewed to the extent the bank's procedures require
[ ] Expected volumes and geographies

Cash-intensive businesses

[ ] Expected cash deposits compared with what is typical for the business type and size
[ ] Currency transaction report exemption eligibility assessed if the bank uses exemptions
[ ] Site visit completed if procedures call for one

Third-party payment processors and professional service providers holding client funds

[ ] Nature of the underlying merchants or clients
[ ] Processor's or professional's own controls over who it serves
[ ] Expected flow of funds and returns

Foreign financial institutions

[ ] Route to the BSA or correspondent banking function; due diligence for correspondent accounts follows 31 CFR 1010.610, including enhanced procedures for certain foreign banks

For all higher-risk accounts

[ ] Source of funds documented, and source of wealth where warranted
[ ] Approval obtained at the level the policy requires
[ ] Monitoring plan noted (what will be watched differently)
[ ] Review date set if the bank uses review intervals

Part 8: Reviewer sign-off

Use this section when a second person reviews new accounts, or when compliance samples files.

[ ] CIP information complete before opening
[ ] Verification completed within the bank's reasonable-time standard
[ ] Beneficial ownership complete: both prongs addressed, certification present
[ ] Profile specific enough that an analyst could tell normal activity from unusual activity
[ ] Rating consistent with the profile, override reasoned if any
[ ] EDD triggered where policy requires
[ ] Open items listed with owner and due date
[ ] Reviewer name and date

Keeping the checklist current

The rules behind several items changed recently: the 2025 TIN collection order, FinCEN's February 2026 beneficial ownership relief order and the consolidated CDD FAQs that followed in May 2026, and the narrowing of Corporate Transparency Act reporting. FinCEN has also said it still expects to revise the CDD rule itself, and its April 2026 proposal to reform AML/CFT program requirements was still a proposal as of this writing. Assign an owner to this checklist and review it whenever the bank's procedures change.

Training the people who use it

A checklist only works if staff understand why each item is there. Front-line employees who understand that the control prong is always required, or that "normal activity" is useless to an analyst, fill in better files. Our Certificate in BSA and AML Compliance covers the customer due diligence framework within the full BSA/AML program, and the BSA/AML FAQs answer common front-line questions. For business account mechanics, see opening business accounts.

Put it to work

Take one customer type at a time, starting with the one that produces the most exceptions in your independent testing, and build the checklist into your account-opening workflow. Then sample ten new files a month against it. If your team needs a stronger grounding in why the items matter, the Certificate in BSA and AML Compliance is a structured way to build it.

Frequently Asked Questions

What should a customer due diligence checklist include?

At minimum: CIP information collected before opening (name, date of birth for individuals, address, identification number), identity verification and how it was done, list screening, the nature and purpose of the account, expected activity, beneficial ownership for legal entity customers, a risk rating, and an EDD decision where the customer falls into a higher-risk category. Each item should leave a record in the file so a reviewer can confirm it was done.

What is the difference between CIP and the CDD process?

CIP is the identification and verification of the customer at account opening, set out in 31 CFR 1020.220. CDD is broader and ongoing: understanding the nature and purpose of the relationship to build a risk profile, identifying and verifying beneficial owners of legal entity customers, and monitoring activity and updating information on a risk basis. A checklist covers both at onboarding, but CDD continues for the life of the relationship.

Do sole proprietors need a beneficial ownership certification?

No. A sole proprietorship is not a legal entity separate from its owner, so it is not a legal entity customer under the CDD rule. The owner is identified and verified as an individual customer under CIP. Banks should still build a business profile: what the business does, where it operates, any required licenses, and expected activity, especially cash.

Do we still need beneficial ownership now that CTA reporting has ended for U.S. companies?

Yes. The Corporate Transparency Act reporting change, effective August 14, 2026, removed the obligation for U.S. companies to report beneficial ownership to FinCEN. The bank's obligation under the CDD rule is separate and continues. FinCEN's February 2026 relief order changed when the bank must repeat collection for existing customers, but collection is still required when a legal entity customer first opens an account.

Is this KYC due diligence checklist enough for higher-risk customers?

It flags the additional items most banks collect for higher-risk customers, such as money services businesses, cash-intensive businesses, foreign customers, and politically exposed persons. But the depth of enhanced due diligence should come from your bank's own policy and risk assessment. Mandatory enhanced procedures for certain foreign correspondent and private banking accounts follow specific regulations and are usually handled by the BSA function rather than the branch.

How should we use the checklist for quality control?

Sample new accounts regularly, check each file against the relevant section, and record exceptions by item. Track which items fail most often and by which branch or channel. Repeated exceptions on the same item usually point to a training or system design problem rather than individual error, and fixing the root cause is more effective than correcting files one at a time.