What Is Customer Due Diligence (CDD)? Requirements and Process (2026)

Quick answer: Customer due diligence (CDD) is how a regulated business finds out who its customers are and how much risk they pose. It covers verifying identity, identifying the beneficial owners of business customers, understanding what the relationship is for, and monitoring activity over time. CDD is a core part of Know Your Customer (KYC) and anti-money laundering (AML) programs.

The depth of CDD depends on risk. Low-risk customers may qualify for simplified due diligence, most customers get standard CDD, and higher-risk customers need enhanced due diligence (EDD). Our guide to the levels of due diligence compares all three.

Related Resources

SSN VerificationEIN VerificationIdentity Verification

Which Businesses Need to Follow CDD Rules?

CDD applies to businesses covered by anti-money laundering laws, not to every company. Internationally, FATF Recommendation 10 sets the standard that countries turn into national rules for banks and other financial institutions, and Recommendation 22 extends it to businesses such as casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries, and accountants.

In the US, FinCEN's CDD Rule (31 CFR 1010.230) applies to covered financial institutions: banks, brokers or dealers in securities, mutual funds, futures commission merchants, and introducing brokers in commodities. Other businesses covered by the Bank Secrecy Act, such as money services businesses and casinos, still need risk-based customer checks under their own AML program rules.

💡 Related Blog:

KYC Vs CDD – What is the difference

Situations that Require Conducting CDD

As we mentioned before, CDD involves assigning risk levels to its clientele based on the location, history, criminal and political records, and more of every client. However, if certain business activities are being performed, or are about to be performed, concerned organizations need to obligatorily conduct CDD.

Businesses need to conduct CDD in the following situations:

• Onboarding New Clients: Whenever a business is looking to create new relationships with clients, it needs to conduct CDD. This is to ensure that any client about to be onboarded does not have any prior connections or history that might flag them as high-risk.
• Occasional transactions above a threshold: Even without an ongoing relationship, CDD applies to larger one-off transactions. Under FATF standards, that means occasional transactions above USD/EUR 15,000, and wire transfers covered by Recommendation 16.
• Suspicious Activity: Businesses need to stay vigilant and flag any transactions that may be out of a client’s regular patterns. These might turn out to be legal and legitimate, but CDD suggests a precautionary approach to these situations. Suspicious activity can be a sudden increase in the number of deposits or withdrawals, a sudden rise in the amount of regular deposits, and more.
• Identity Verification Issues: In case a customer has submitted a piece of identification that is difficult to verify, or raises suspicions about its authenticity, businesses need to conduct CDD and ensure that there is no mischief at play.

What are the Requirements of CDD?

So far we’ve mentioned the situation under which an organization may need to conduct due diligence on its customers, but what exactly are the activities that comprise CDD? Let’s find out:

Under the US CDD Rule, a CDD program has four core elements:

1. Identify and verify the customer. Collect the customer's identifying information and verify it using documents, databases, or other reliable sources. For banks, this is the Customer Identification Program (CIP).
2. Identify and verify beneficial owners of legal entity customers. That means each individual who owns 25% or more of the entity, and one individual with significant responsibility to control it, such as a CEO or managing member.
3. Understand the nature and purpose of the relationship. Know what the customer will use the account for, so you can build a risk profile and spot activity that doesn't fit.
4. Monitor on an ongoing basis. Watch for suspicious transactions and update customer information on a risk basis, for example when monitoring flags a change.

Higher-risk customers need more. Watch especially for politically exposed persons (PEPs), customers on sanctions lists, and people with a criminal record.

CDD Rules: What Changed in 2025 and 2026

• Beneficial ownership on new accounts (February 13, 2026): A FinCEN order lets covered institutions skip re-identifying and re-verifying beneficial owners each time an existing legal entity customer opens another account. They still collect it at the first account, when they have reason to doubt the information on file, and as their risk-based procedures require.
• Corporate Transparency Act reporting: In March 2025, FinCEN exempted US companies and US persons from beneficial ownership reporting to FinCEN, and a final rule that took effect on August 14, 2026 made this permanent. It doesn't change banks' own CDD duty to collect beneficial ownership from their customers.
• AML program reform: FinCEN proposed a rule in April 2026 to overhaul AML/CFT program requirements. It is still a proposal with no effective date.
• European Union: The EU AML Regulation applies from July 10, 2027 and will set a single CDD rulebook across member states, with detailed standards from the new EU AML Authority.

How Signzy Can Help With Customer Due Diligence

Enforcement shows why this matters. In 2023, Binance agreed to pay more than $4.3 billion to resolve US charges that included anti-money laundering and sanctions failures, one of the largest penalties of its kind.

Signzy's KYC and AML screening APIs automate the identity verification, beneficial ownership, and screening steps of CDD. Book a demo to see how they fit your onboarding flow.