Enhanced Due Diligence EDD

Enhanced due diligence is mandatory in the cases the Anti-Money Laundering Regulation (AMLR) names, and in any other case where the firm itself identifies a higher risk. Article 34(1) sets both limbs. The table lists the main named cases, the firms each binds and what it requires.

Only the last row leaves the choice of measures wholly to the firm. The correspondent relationship rules bind financial businesses, so a law firm or an accounting practice will not meet them. Countries that pose a specific and serious threat to the Union's financial system can be added under Article 31.

One duty attaches to transactions, not clients. Under Article 34(2), a firm must examine the origin and destination of the funds, and the purpose, of any transaction that is complex, unusually large, conducted in an unusual pattern or without an apparent economic or lawful purpose.

Article 34(4) lists seven measures. Enhanced due diligence "may include" them, and the firm applies them in proportion to the higher risk it has identified. Four are about information. The firm obtains additional information on the customer and the beneficial owners, on the intended nature of the relationship, and on the source of funds and source of wealth of the customer and the beneficial owners. It also obtains the reasons for intended or performed transactions and checks that they fit the relationship.

Three are about control. The firm obtains the approval of senior management to establish or continue the relationship. It monitors more closely, by increasing the number and timing of its controls and selecting patterns of transactions for further examination. It may require the first payment to come from an account in the customer's name at a credit institution subject to due diligence standards at least as strict as the AMLR's.

These measures add to the standard measures of customer due diligence and do not replace them.

Outside the named cases, the decision comes from the firm's own risk analysis of the client. Article 34(3) says what that analysis must take into account at least: the higher-risk factors in Annex III, the guidelines AMLA issues on risks from outside the Union, notifications from the financial intelligence unit, and the firm's business-wide risk assessment.

Annex III is a non-exhaustive list in three groups: customer factors such as a cash-intensive business or nominee shareholders, product factors such as private banking, and geographical factors such as countries subject to sanctions or embargoes.

A factor is evidence of potentially higher risk, not a verdict. The firm weighs it, and under Article 20(4) it must be able to show its supervisor that its measures are appropriate to the risks identified.

At least once a year. Article 26(2) ties the period between updates of customer information to the risk. It caps the period at 1 year for higher-risk customers, against 5 years for all others. The firm must also review the information whenever the customer's relevant circumstances change (Article 26(3)).

For a former politically exposed person, measures continue for at least 12 months after the person leaves the function (Article 45(2)).