Enhanced Due Diligence (EDD): When It Is Required

8/30/2026

Ask ten bankers to define enhanced due diligence and most will describe a longer questionnaire. That is the least important part of it. Enhanced due diligence (EDD) is the additional understanding a bank builds about a customer whose risk is higher than its standard due diligence is designed to handle, and, just as important, the additional controls it applies as a result.

The term covers two quite different things in U.S. banking. A small set of relationships trigger EDD because a regulation says so. Everything else is EDD the bank applies because its own risk assessment says it should. Mixing those categories up causes trouble in both directions: banks that treat regulatory EDD as optional, and banks that treat their own risk-based categories as if a regulation fixed them in place and then cannot explain why.

This post defines EDD, separates the mandatory cases from the risk-based ones, and covers what examiners look for in an EDD file.

A working definition

Enhanced due diligence is customer due diligence scaled up for higher risk. Under the bank AML program rule at 31 CFR 1020.210, every bank must maintain risk-based procedures for ongoing customer due diligence: understanding the nature and purpose of customer relationships to develop a customer risk profile, and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. "Risk-based" is the hinge. The more risk a relationship presents, the more the bank needs to know and the closer it needs to watch.

So EDD is not a separate legal regime for most customers. It is the high end of the same CDD obligation. In practice it usually involves some combination of:

• More information at onboarding, including source of funds and, for higher-risk individuals, source of wealth
• Deeper understanding of ownership and control, sometimes beyond the CDD rule's 25 percent threshold
• Senior management or BSA officer approval to open or continue the relationship
• More frequent periodic review of the relationship
• Tighter monitoring, through lower thresholds, specific scenarios, or manual review
• Site visits or other independent confirmation of the business
• A documented decision about whether the bank can manage the risk at all

The test of any EDD program is whether the extra information changes something. A file with three more pages and the same monitoring as every other customer has documentation but not much diligence.

When EDD is required by regulation

Section 312 of the USA PATRIOT Act added 31 U.S.C. 5318(i), which FinCEN implemented in two regulations. These are the cases where a bank does not get to decide whether enhanced procedures apply. Both rules are referenced directly in the bank program rule, which requires compliance with 31 CFR 1010.610 and 1010.620.

Correspondent accounts for certain foreign banks (31 CFR 1010.610)

Every bank that maintains correspondent accounts in the United States for foreign financial institutions must have a due diligence program with "appropriate, specific, risk-based, and, where necessary, enhanced" policies, procedures and controls. The general program must assess each account's risk using factors that include the nature of the foreign institution's business and markets, the type, purpose and anticipated activity of the account, the length of the relationship, the AML and supervisory regime of the chartering jurisdiction, and the foreign institution's AML record.

Enhanced due diligence under 1010.610(b) is mandatory for correspondent accounts maintained for a foreign bank that operates under:

1. An offshore banking license;
2. A banking license issued by a country designated as non-cooperative with international AML principles by an intergovernmental group or organization of which the United States is a member, where the U.S. representative concurs; or
3. A banking license issued by a country designated by the Secretary of the Treasury as warranting special measures due to money laundering concerns.

For those accounts, the bank must take reasonable steps to: conduct enhanced scrutiny of the account, including obtaining and considering information about the foreign bank's AML program and monitoring transactions; obtain information about anyone with authority to direct transactions through a payable-through account and the sources and beneficial owners of funds in it; determine whether the foreign bank maintains correspondent accounts for other foreign banks that use the U.S. account (nested relationships) and obtain information to assess that risk; and, for a foreign bank whose shares are not publicly traded, identify each owner of 10 percent or more of any class of its securities and the nature and extent of each owner's interest.

Private banking accounts for non-U.S. persons (31 CFR 1010.620)

A "private banking account" is defined in 31 CFR 1010.605 as an account, or combination of accounts, that requires a minimum aggregate deposit of not less than $1,000,000, is established for one or more non-U.S. persons who are direct or beneficial owners, and is assigned to or managed by a bank officer, employee or agent who acts as a liaison with the owner. All three elements must be present. A domestic customer's wealth-management relationship does not meet the definition, however large it is.

For accounts that do, the bank's program must take reasonable steps to ascertain the identity of all nominal and beneficial owners, determine whether any of them is a senior foreign political figure, ascertain the source of funds and the purpose and expected use of the account, and review account activity for consistency with that information.

Where a senior foreign political figure is a nominal or beneficial owner, the rule requires enhanced scrutiny reasonably designed to detect and report transactions that may involve the proceeds of foreign corruption. The definition of senior foreign political figure in 1010.605 is broad: current or former senior officials in a foreign government's executive, legislative, administrative, military or judicial branches; senior officials of major foreign political parties; senior executives of foreign government-owned commercial enterprises; entities formed for their benefit; immediate family members (spouses, parents, siblings, children, and a spouse's parents and siblings); and persons widely and publicly known, or actually known to the bank, to be close associates.

When diligence cannot be done

Both rules require procedures for what happens when the bank cannot perform appropriate due diligence, including when to refuse to open the account, suspend activity, file a SAR, or close the account. That is part of the required program, not an afterthought.

Special measures

Separately, section 311 of the PATRIOT Act lets Treasury impose special measures against jurisdictions, institutions, classes of transactions, or types of accounts of primary money laundering concern. Some final rules issued under section 311 require banks to take specific due diligence steps, such as prohibiting or restricting correspondent accounts. These are point-in-time obligations published by FinCEN, so the BSA function needs a process to capture new ones as they are issued.

Source	Applies to	What is mandated
31 CFR 1010.610(a)	All correspondent accounts for foreign financial institutions	Risk-based due diligence program, periodic review of account activity
31 CFR 1010.610(b)	Foreign banks with offshore licenses, non-cooperative or special-measures jurisdictions	Enhanced scrutiny, nested-account inquiry, payable-through information, 10%+ owners of non-public banks
31 CFR 1010.620	Private banking accounts ($1M minimum, non-U.S. person, liaison officer)	Identify nominal and beneficial owners, screen for senior foreign political figures, source of funds, activity review
1010.620(c)	Private banking accounts with a senior foreign political figure	Enhanced scrutiny for proceeds of foreign corruption
Section 311 special measures	As specified in each FinCEN rule or order	Measure-specific steps

 

When EDD is required by risk

Outside those cases, nothing in the regulations lists customer types that automatically require EDD. That surprises some staff, who have been told that certain customers "always" need EDD.

FinCEN's CDD rule FAQs, consolidated and reissued in May 2026, say the CDD rule does not require a specific method or categorization for customer risk profiles, and does not require institutions to automatically treat products or customer types named in government publications as "high risk." What the bank must do is understand the risks of its own customers, with profiles detailed enough to distinguish between significant variations in risk.

That is why most EDD triggers live in the bank's own policy, justified by its risk assessment. Categories banks commonly include, depending on their footprint and products:

• Money services businesses, including check cashers and money transmitters
• Cash-intensive businesses whose activity exceeds what peers generate
• Nonresident aliens and foreign individuals with significant cross-border activity
• Politically exposed persons beyond the private banking rule
• Nonprofits with international disbursements, particularly to higher-risk regions
• Professional service providers holding client funds, such as attorneys' trust accounts and escrow agents
• Third-party payment processors
• Customers with complex or opaque ownership structures
• Businesses in industries the bank has flagged in its risk assessment, such as certain online gaming or virtual currency activity
• Customers with prior SAR filings or significant adverse media

Politically exposed persons outside private banking

There is no U.S. regulatory definition of "politically exposed person" outside the senior foreign political figure definition used in the private banking rule. In an August 21, 2020 joint statement, FinCEN and the federal banking agencies said the CDD rule does not create a regulatory requirement, and there is no supervisory expectation, for banks to have unique, additional due diligence steps for customers considered PEPs. The level and type of CDD should be appropriate to the customer's risk.

That does not mean PEPs are low risk. It means the bank decides, based on facts such as the person's position, the country, the products used and the source of wealth, how much additional diligence is warranted, and documents the reasoning. A local official from a low-risk country with a checking account and payroll deposits is not the same risk as a senior official from a country with high corruption risk moving funds through a trust.

De-risking is not EDD

Some banks respond to higher-risk categories by declining entire classes of customers. That is a business decision a bank may make, but it is not enhanced due diligence. The federal banking agencies have repeatedly said that banks should assess customer risk individually rather than terminate whole categories. If the bank does decide not to serve a category, the policy should say so and be applied consistently.

What EDD looks like in the file

Examiners do not grade EDD on length. They look for evidence that the bank understood the relationship, approved it at the right level, and watched it more closely than an ordinary account. A defensible EDD file typically contains:

4. The trigger. Why this customer is in EDD: which policy category, rating factor, or event.
5. Expanded profile. A specific description of the business or the individual's occupation and wealth, expected activity by type, volume and geography, and the counterparties the bank expects to see.
6. Source of funds and, where relevant, source of wealth. With corroboration proportionate to the risk: tax returns, financial statements, sale documents, public records.
7. Ownership and control. Beyond the CDD rule minimum where risk calls for it, for example lowering the ownership threshold or identifying additional managers.
8. Independent research. Adverse media, sanctions and PEP screening results, licensing and registration checks (for example, FinCEN MSB registration and state licensing for money transmitters), and how hits were resolved.
9. Site visit notes where the bank's procedures call for one.
10. Who approved opening or continuing the relationship, at what level, and on what date.
11. Monitoring plan. What will be watched differently: specific scenarios, thresholds, or manual review steps.
12. Review schedule and review history. Each periodic review dated, with a conclusion and any change in rating or controls.
13. Exit criteria. The circumstances that would lead the bank to restrict or close the relationship.

The monitoring plan is the item most often missing. An EDD file that ends at approval has not finished the job.

How often to review

Here, too, the regulations do not fix a number. FinCEN's FAQs state there is no categorical requirement to update customer information on a continuous or periodic schedule; updating is risk-based and occurs as a result of normal monitoring. Most banks still set a periodic review interval for EDD customers, often more frequent than for standard customers, because a calendar-driven review is the simplest way to show that higher-risk relationships are being revisited.

If you set an interval, two things matter. Justify it in the policy, and meet it. A policy that says high-risk customers are reviewed annually, paired with a backlog of reviews two years overdue, is a finding the bank wrote for the examiner. Pair the calendar with event triggers: unexpected activity, adverse media, a SAR filing, a change in ownership, or a law enforcement inquiry should all prompt a review regardless of the schedule.

Common EDD weaknesses

• Treating EDD as onboarding only. The questionnaire is complete, the monitoring is unchanged, and no one has looked at the customer since.
• Generic narratives. "Customer is a convenience store with cash activity consistent with business type" tells a reviewer nothing they could test.
• No source-of-wealth work for individuals whose deposits are not explained by income.
• Missing approvals or approvals by someone without authority under the policy.
• Section 312 gaps, such as no nested-account inquiry for a foreign correspondent, or a private banking file that never screened for senior foreign political figures.
• Blanket categories that put every nonprofit or every PEP into EDD without regard to risk, which spreads EDD resources so thin that the genuinely high-risk files get the same attention as the rest.
• Reviews that only update dates. A periodic review that changes nothing for five consecutive years deserves a second look.

Building EDD capability

EDD depends on judgment more than any other part of CDD. Analysts need to recognize when a stated business model does not fit the activity, how to corroborate source of wealth, and when the honest answer is that the bank cannot manage the risk. Those skills come from training and from reviewing well-built files. For the red flags analysts should be calibrated to, see money laundering red flags, and for the regulatory framework around foreign high-net-worth clients, our post on private banking services and regulation. Screening practices that support EDD are covered in OFAC compliance for banks.

The Certificate in BSA and AML Compliance places customer due diligence, including enhanced due diligence, in the context of the full BSA/AML program. Teams looking for broader options can browse our anti-money laundering training.

Next step

Start with your policy's list of EDD triggers and ask, for each one, whether it comes from a regulation or from the risk assessment. Mandatory section 312 cases need procedures that track the rule text. Risk-based categories need a documented rationale. If your staff need a grounding in how EDD fits the five-pillar program, the Certificate in BSA and AML Compliance is a structured place to build it.

Frequently Asked Questions

What is enhanced due diligence in banking?

Enhanced due diligence is customer due diligence scaled up for higher-risk relationships. It typically means collecting more information at onboarding, including source of funds and sometimes source of wealth, obtaining senior approval, monitoring more closely, and reviewing the relationship more often. For most customers it is not a separate legal regime but the high end of the bank's risk-based CDD obligation under 31 CFR 1020.210. A few situations, such as certain foreign correspondent accounts and private banking accounts, are mandated by regulation.

When is enhanced due diligence required by law?

Section 312 of the USA PATRIOT Act, implemented at 31 CFR 1010.610 and 1010.620, requires enhanced procedures for correspondent accounts maintained for foreign banks operating under an offshore license or licensed in a jurisdiction designated as non-cooperative or warranting special measures, and for private banking accounts for non-U.S. persons. Private banking accounts with a senior foreign political figure as an owner require enhanced scrutiny for proceeds of foreign corruption. Section 311 special measures can add further requirements.

Enhanced due diligence is usually required for which customers?

Beyond the section 312 cases, banks commonly apply EDD to money services businesses, cash-intensive businesses, foreign individuals with significant cross-border activity, politically exposed persons, nonprofits with international disbursements, third-party payment processors, professional service providers holding client funds, and customers with opaque ownership or prior SARs. These categories come from the bank's own risk assessment, not from a regulatory list, so each bank's policy should explain why it includes them.

Do politically exposed persons always require enhanced due diligence?

Not automatically. Outside the private banking rule for senior foreign political figures, there is no U.S. regulatory requirement for unique due diligence steps for PEPs. A 2020 joint statement from FinCEN and the federal banking agencies said the level and type of CDD should be appropriate to the customer's risk. Many PEPs do warrant EDD, but the bank should decide based on factors such as position, country, products, and source of wealth, and document why.

How often should EDD customers be reviewed?

No regulation sets a review frequency. FinCEN's CDD FAQs say there is no categorical requirement to update customer information on a periodic schedule; updates are risk-based and driven by monitoring. Most banks still set a calendar interval for higher-risk customers and combine it with event triggers such as unusual activity, adverse media, a SAR filing, or an ownership change. Whatever interval the policy sets, the bank needs to meet it.

What is the difference between CDD and EDD?

CDD is the baseline every customer receives: identifying the customer, understanding the nature and purpose of the relationship, building a risk profile, identifying beneficial owners of legal entities, and monitoring activity. EDD adds depth for higher-risk relationships, such as source-of-wealth work, senior approval, tighter monitoring, site visits, and more frequent review. The difference should be visible not only in the file but in how the account is monitored.