Customer Due Diligence CDD

An obliged entity must apply customer due diligence in the six situations listed in Article 19(1) of the Anti-Money Laundering Regulation (AMLR). The most common is establishing a business relationship. That means a relationship expected to have an element of repetition or duration, with or without a written contract (Article 2(1)).

The second is an occasional transaction worth at least EUR 10,000, whether it is carried out in one operation or through linked transactions. The third is taking part in creating a legal entity or setting up a legal arrangement, whatever the value. The other three are triggered by doubt: a suspicion of money laundering or terrorist financing, doubts about identification data obtained earlier, and doubts about whether the person the firm is dealing with is the customer or someone authorised to act for the customer.

Some thresholds are lower. For an occasional cash transaction of at least EUR 3,000, the firm must at least identify the customer and verify their identity (Article 19(4)).

Article 20(1) lists nine measures, and a firm must apply all of them. It identifies the customer and verifies their identity. It identifies the beneficial owners and takes reasonable measures to verify who they are, so that it understands the customer's ownership and control structure. It establishes the purpose and intended nature of the relationship, and the nature of the customer's business or occupation.

It checks whether the customer or its beneficial owners are subject to targeted financial sanctions. It determines whether any of them is a politically exposed person, a family member of one or a close associate. It identifies anyone the customer is acting for, and it confirms that anyone acting for the customer is authorised to do so. It then monitors the relationship for as long as it lasts.

The list is fixed, but the depth is not. Under Article 20(2) the firm decides how far to take each measure from an individual analysis of the risk.

They are simplified, standard and enhanced due diligence. Standard is the default. A firm may apply simplified measures where the risk is lower and must apply enhanced measures where it is higher (Article 20(2)). The table shows what changes at each level. The enhanced measures are applied in proportion to the risk.

Simplified due diligence is not a waiver. The firm must still monitor enough to detect unusual or suspicious transactions. It must stop using simplified measures if it suspects money laundering or doubts the information it was given (Article 33).

Enhanced measures are set out in Article 34(4) and may include senior management approval for the relationship. For a politically exposed person that approval is mandatory, together with measures to establish source of wealth and source of funds (Article 42(1)).

More detail is due in technical standards. Article 28 gave the EU authority AMLA until 10 July 2026 to draft standards on the information to collect at each of the three levels.

The firm must not act for the client. Under Article 21(1), an obliged entity that cannot apply the measures must refrain from carrying out the transaction or establishing the relationship. It must end an existing relationship and consider reporting a suspicious transaction to the financial intelligence unit.

There is a limited exception for legal and advisory work. The rule does not apply to notaries, lawyers, auditors, external accountants and tax advisors to the extent that they are ascertaining a client's legal position, or defending or representing the client in judicial proceedings (Article 21(2)).

In every case the firm keeps a record of the actions taken and the decisions made, including where it refused or ended a relationship (Article 21(3)).