Customer Due Diligence (CDD) is a fundamental part of an effective Anti-Money Laundering (AML) compliance programme. It helps businesses understand who their customers are, verify their identities and assess whether their activities present potential money laundering or terrorist financing risks.
In the UAE, businesses subject to AML requirements must apply appropriate customer verification and monitoring procedures based on their regulatory obligations and the risks associated with each relationship.
However, not every customer presents the same level of risk. While standard due diligence may be appropriate for many relationships, higher-risk customers may require Enhanced Due Diligence (EDD), including additional verification and closer monitoring.
Understanding the difference between CDD and EDD helps businesses establish proportionate controls and avoid weaknesses in their compliance processes.
ᴛᴀʙʟᴇ ᴏғ ᴄᴏɴᴛᴇɴᴛs
- What is Customer Due Diligence?
- Why is CDD important in the UAE?
- Key components of customer due diligence
- What is Enhanced Due Diligence?
- When should businesses apply EDD?
- Difference between CDD and EDD
- Common compliance challenges
- Conclusion
ᴡʜᴀᴛ ɪs ᴄᴜsᴛᴏᴍᴇʀ ᴅᴜᴇ ᴅɪʟɪɢᴇɴᴄᴇ?
Customer Due Diligence is the process of identifying customers, verifying their identities and understanding the purpose and intended nature of a business relationship.
It allows organisations to determine whether a customer is genuine, understand their expected activities and identify potential financial crime risks.
CDD is not limited to collecting identification documents. Businesses may also need to establish beneficial ownership, understand the customer’s business activities and assess the source of funds, depending on the applicable requirements and risk level.
For example, when onboarding a corporate customer, an organisation may need to review its registration documents, ownership structure, authorised representatives and the individuals who ultimately own or control the entity.
ᴡʜʏ ɪs ᴄᴅᴅ ɪᴍᴘᴏʀᴛᴀɴᴛ ғᴏʀ ᴜᴀᴇ ʙᴜsɪɴᴇssᴇs?
The UAE has strengthened its AML/CFT framework to improve transparency and prevent financial crime. Businesses falling within the scope of applicable legislation must establish appropriate procedures for identifying and managing customer-related risks.
CDD supports these obligations by helping organisations:
- Verify customer identities before establishing relevant business relationships.
- Identify individuals who ultimately own or control legal entities.
- Understand the purpose of customer relationships.
- Detect potentially suspicious customer information or behaviour.
- Determine whether standard or enhanced checks are appropriate.
- Maintain records supporting compliance decisions.
Without reliable due diligence, businesses may unknowingly establish relationships with individuals or entities involved in financial crime.
ᴋᴇʏ ᴄᴏᴍᴘᴏɴᴇɴᴛs ᴏғ ᴄᴜsᴛᴏᴍᴇʀ ᴅᴜᴇ ᴅɪʟɪɢᴇɴᴄᴇ
An effective CDD process should cover several important areas.
1. Customer identification and verification
The first step is identifying the customer and verifying their identity using reliable, independent documents or information.
For individuals, this may involve reviewing valid identity documents and other relevant information.
For corporate customers, businesses may need to obtain and verify:
- Certificate of incorporation or commercial registration.
- Trade licence and registered business details.
- Memorandum and Articles of Association, where relevant.
- Details of directors and authorised representatives.
- Ownership and control information.
The documents and verification methods should be appropriate to the customer type and applicable regulatory requirements.
2. Identification of beneficial owners
Understanding who ultimately owns or controls a customer is essential for identifying hidden ownership structures and potential financial crime exposure.
Businesses should establish the natural persons who ultimately own or control a legal entity, applying the relevant legal thresholds and control tests.
Where ownership is spread across multiple companies or jurisdictions, additional information may be necessary to understand the complete structure.
The organisation should document its findings and address situations where beneficial ownership cannot be established through the usual process.
3. Understanding the purpose of the relationship
Businesses should understand why a customer wants to establish a relationship and what activities they are expected to conduct.
This may include reviewing the customer’s industry, business model, expected transaction volumes, payment methods and intended services.
For example, a company receiving frequent international payments should have a reasonable business explanation for its expected transaction activity.
This information provides a baseline against which future behaviour can be assessed.
4. Screening customers against relevant lists
Customer screening helps organisations identify potential exposure to sanctions, politically exposed persons and other relevant risk indicators.
Depending on the applicable requirements, screening may cover:
- Applicable UAE and other relevant sanctions lists.
- United Nations Security Council sanctions.
- Politically Exposed Persons (PEPs).
- Relevant adverse media.
- Connected individuals and beneficial owners.
Screening should be conducted using reliable information and appropriate procedures for reviewing potential matches. A name similarity alone does not establish that a customer is a sanctioned individual or presents a confirmed risk.
5. Ongoing customer monitoring
CDD should continue after onboarding.
Businesses should periodically review customer information and monitor whether transactions remain consistent with the customer’s known profile.
Changes in ownership, business activities, geographic exposure or transaction patterns may require reassessment and updated documentation.
ᴡʜᴀᴛ ɪs ᴇɴʜᴀɴᴄᴇᴅ ᴅᴜᴇ ᴅɪʟɪɢᴇɴᴄᴇ?
Enhanced Due Diligence is a more detailed level of customer verification and monitoring applied when a relationship presents higher money laundering or terrorist financing risks.
While standard CDD establishes the customer’s identity and general risk profile, EDD involves additional measures to understand the nature and extent of the risk.
Depending on the circumstances, enhanced measures may include:
- Obtaining additional identity and ownership information.
- Establishing the source of funds and source of wealth.
- Understanding the customer’s business relationships and transaction patterns.
- Conducting more detailed adverse media checks.
- Obtaining senior management approval where required.
- Increasing the frequency of customer reviews.
- Applying closer transaction monitoring.
EDD should be proportionate to the identified risks rather than applied automatically to every customer.
ᴡʜᴇɴ sʜᴏᴜʟᴅ ᴜᴀᴇ ʙᴜsɪɴᴇssᴇs ᴀᴘᴘʟʏ ᴇᴅᴅ?
Businesses should consider enhanced checks when customer relationships or transactions present higher risks under applicable legislation and their risk assessment.
Common situations include:
Politically Exposed Persons
PEPs may have access to public funds or positions of influence, creating potential exposure to bribery, corruption and related financial crimes.
Businesses subject to relevant requirements should apply appropriate additional measures when dealing with PEPs, including establishing source of wealth and source of funds where required and obtaining appropriate senior management approval.
High-risk geographic connections
Customers, beneficial owners or transactions connected to jurisdictions presenting higher financial crime risks may require additional scrutiny.
Businesses should consider applicable sanctions, relevant national and international risk assessments and the specific circumstances of the relationship.
Complex ownership structures
Corporate customers with multiple layers of ownership, nominee arrangements or unclear control structures may require further investigation.
The objective is to identify the natural persons who ultimately own or control the entity and understand the commercial rationale behind the structure.
Unusual or suspicious transactions
Transactions that do not match a customer’s known business profile may indicate the need for additional investigation.
Examples include unexplained transfers, unusual third-party payments and sudden changes in transaction volumes.
Where suspicion arises, businesses should follow the applicable internal escalation and regulatory reporting procedures.
ᴅɪғғᴇʀᴇɴᴄᴇ ʙᴇᴛᴡᴇᴇɴ ᴄᴅᴅ ᴀɴᴅ ᴇᴅᴅ
| Area | Customer Due Diligence | Enhanced Due Diligence |
| Purpose | Establish customer identity and risk profile | Investigate higher-risk relationships in greater detail |
| Verification | Standard identity and ownership checks | Additional verification and supporting evidence |
| Risk level | Appropriate for standard-risk relationships | Used where higher risks are identified |
| Source of funds | Based on applicable requirements and risk | More detailed investigation where necessary |
| Monitoring | Ongoing monitoring | Closer or more frequent monitoring |
| Approval | Standard onboarding authority | Additional senior approval where required |
Both processes form part of a broader risk-based AML programme. EDD does not replace CDD; it builds on the initial due diligence process.
ᴄᴏᴍᴍᴏɴ ᴄᴅᴅ ᴀɴᴅ ᴇᴅᴅ ᴄʜᴀʟʟᴇɴɢᴇs
Businesses may face practical difficulties when implementing customer due diligence procedures.
Common challenges include:
- Receiving incomplete or inconsistent customer documents.
- Identifying beneficial owners in complex corporate structures.
- Verifying information from overseas jurisdictions.
- Managing false-positive screening results.
- Keeping customer records updated.
- Applying appropriate risk ratings.
- Ensuring employees follow consistent verification procedures.
These challenges can be reduced through clear policies, reliable verification systems, employee training and periodic reviews of customer files.
ᴄᴏɴᴄʟᴜsɪᴏɴ
Customer Due Diligence and Enhanced Due Diligence are essential components of effective AML compliance in the UAE. CDD helps businesses establish customer identities and understand their activities, while EDD provides additional scrutiny when higher risks are identified.
Businesses should ensure their procedures are proportionate, properly documented and aligned with the requirements applicable to their sector. By combining reliable verification, beneficial ownership checks, appropriate screening and ongoing monitoring, organisations can strengthen their controls and reduce exposure to financial crime.