High-risk customers, opaque ownership structures, cross-border payment flows, and politically exposed persons force compliance teams to answer one question: do we actually understand who is behind the relationship and where the money is going? That is where enhanced due diligence earns its keep. In practice, it is less about collecting more documents and more about building a file that can survive scrutiny, explain the risk decision, and support monitoring after onboarding.
What matters most before you open or keep the account
- EDD is a risk-based escalation, not a blanket requirement for every customer.
- The core job is to verify identity, ownership, control, source of funds, and expected activity.
- Higher-risk cases need stronger corroboration, tighter approvals, and more frequent refreshes.
- Private banking, correspondent banking, politically exposed persons, money services businesses, layered entities, and high-risk jurisdictions usually deserve the most scrutiny.
- A weak narrative is often more damaging than a thin file, because it shows the team never really understood the relationship.
When enhanced due diligence is warranted
I treat enhanced review as an escalation triggered by risk, not by habit. The question is whether the customer, product, geography, ownership structure, or transaction pattern creates enough uncertainty that ordinary customer due diligence is no longer enough. In U.S. practice, that standard is risk-based, which means the depth of review should change with the facts rather than with a fixed checklist.
| Trigger | Why it matters | What I would verify first |
|---|---|---|
| Politically exposed person or close associate | Higher exposure to corruption, bribery, or misuse of public office | Role, ownership, family and associate links, source of wealth, and expected activity |
| Foreign correspondent or nested banking relationship | Funds can move indirectly through multiple institutions and jurisdictions | Purpose of the relationship, downstream activity, and control over the flow of funds |
| High-risk jurisdiction | Sanctions, weak controls, or elevated illicit finance exposure | Counterparty rationale, payment patterns, and the business reason for that geography |
| Layered or nominee ownership | Control may be hidden behind multiple entities or individuals | Ownership chart, control persons, and independent registry or filing checks |
| Negative media or law-enforcement indicators | Signals possible fraud, corruption, sanctions, or other misconduct | Whether the reports are current, credible, and tied to the actual customer |
| Cash-heavy or fast-moving business | Layering, structuring, or third-party activity can be easier to hide | Expected transaction volume, cash patterns, counterparties, and anomaly thresholds |
One point readers often miss is that a high-risk label does not automatically mean a relationship must be rejected. The real test is whether the institution can understand and justify the risk, then monitor it properly. Once the trigger is clear, the next question is what evidence belongs in the file.
What a defensible file should contain
A strong file answers five questions without making the reviewer guess: who is the customer, who controls it, why does the relationship exist, where did the money come from, and what activity should be expected. If the file leaves any of those questions open, the institution is relying on hope instead of proof.
| Evidence | Why it matters | Red flag if missing |
|---|---|---|
| Identity and formation documents | Confirms the legal existence of the customer and the parties behind it | The entity cannot be tied cleanly to real people or a valid business purpose |
| Beneficial ownership and control mapping | Shows who owns the entity and who can direct it in practice | Ownership is layered, inconsistent, or depends only on self-declaration |
| Source of funds evidence | Explains the immediate origin of deposits, transfers, or investments | Incoming money appears disconnected from the stated business model |
| Source of wealth evidence | Explains how the customer accumulated its assets in the first place | The customer is asset-rich but cannot explain the wealth trail |
| Expected activity profile | Creates a baseline for monitoring future transactions | There is no benchmark for what normal behavior looks like |
| Screening results and adverse media review | Shows whether sanctions, watchlist, or reputational issues exist | The team never reconciled alerts or checked recent information |
| Business contracts, invoices, or licenses | Supports the commercial logic of the relationship | The story sounds plausible but cannot be tied to evidence |
Read Also: Risk Assessment Explained - Practical Guide for US Compliance
Source of funds versus source of wealth
Source of funds is the immediate origin of the money entering the account. Source of wealth explains how the customer built the broader asset base. I keep those separate because a clean incoming wire does not prove the underlying wealth is low risk, especially in private banking or sudden-wealth cases. If the money story and the business story do not line up, I slow down.
The best files are not the thickest files. They are the ones that tell a coherent story and make it easy for a third party to see why the relationship was accepted. That leads directly to the process I would use from the first alert through final approval.
The workflow I would use from intake to sign-off
The cleanest process follows a simple sequence: trigger, gather, verify, decide, monitor. The hard part is not the order; it is making each step produce an auditable record instead of a pile of attachments.
- Escalate with a reason code. State exactly what raised the risk: jurisdiction, ownership, screening hit, unusual behavior, or business model.
- Collect evidence that can be tested. A certificate or self-declared form is not enough when the structure is opaque; I want independent corroboration where possible.
- Reconcile the story. Match formation records, ownership, website claims, contracts, bank statements, and transaction expectations. If one document contradicts the others, the contradiction matters more than the document count.
- Set the approval level. Higher-risk files should not sit with the first-line analyst alone. A second set of eyes, and in some cases senior approval, gives the decision real weight.
- Document the monitoring plan. State the refresh cadence, the red flags that will trigger review, and the events that require immediate escalation.
For a straightforward high-risk file, I expect this process to take several business days. For a layered cross-border structure with poor documentation, two to four weeks is not unusual, and trying to force it faster usually produces a weaker file, not a faster one.
That workflow matters even more when the relationship sits in one of the categories that regulators and examiners focus on first.
The account types and scenarios that deserve the most attention
Some relationships deserve a stricter lens from the start because the risk is built into the model. In my view, these are the cases where teams should assume they will need more corroboration, more senior review, and more frequent monitoring.
| Scenario | Why it escalates | What I would add |
|---|---|---|
| Private banking | Wealth can be complex, inherited, or routed through multiple entities | Source of wealth evidence, tax or asset-sale support, and a clear control narrative |
| Foreign correspondent banking | Funds may move indirectly through multiple institutions and jurisdictions | Downstream visibility, purpose of the relationship, and ongoing transaction testing |
| Politically exposed persons | Corruption, bribery, or influence-peddling risk can be higher | Role verification, family and associate mapping, and stronger ongoing review |
| Money services businesses | High velocity and customer aggregation can obscure the true source of funds | Business model validation, licensing checks, and pattern-based transaction review |
| Layered ownership or nominee structures | Control can be hidden behind multiple legal entities | Ownership charting, control-person analysis, and independent filing checks |
| High-risk jurisdictions | Sanctions, corruption, or weaker supervision can increase exposure | Jurisdictional rationale, counterparty review, and tighter payment monitoring |
These are not automatic refusals. They are cases where I want the institution to show why the relationship is acceptable and what controls make it manageable. That distinction is where many files either stand up or fall apart.
Common mistakes that weaken the review
- Collecting documents without testing them. A thick file can still be a poor file if nothing is reconciled.
- Using the same checklist for every customer. Risk-based review means different evidence for different exposures.
- Stopping after onboarding. High-risk relationships change, and the monitoring plan has to change with them.
- Confusing screening with analysis. Negative media, sanctions, and watchlist results are inputs, not conclusions.
- Failing to explain the decision. If the narrative does not show why the risk is acceptable, the analyst’s conclusion is too fragile.
- Leaving ownership questions unresolved. If you cannot identify who controls the entity, the review is incomplete.
The practical lesson is simple: a compliance team does not win by collecting more PDFs; it wins by producing a coherent, testable story about the customer. That is also the easiest bridge to a process that is both faster and more defensible.
A practical operating model that keeps the process fast and defensible
If I were setting this up from scratch, I would keep the operating model lean and explicit. Four controls usually make the biggest difference.
- A trigger matrix that says when a case moves from standard due diligence to a higher-risk review.
- Evidence standards that define what counts as acceptable corroboration for identity, ownership, wealth, and purpose.
- An approval ladder that makes senior review mandatory for the riskiest relationships and exceptional cases.
- A refresh cadence that is shorter for high-risk relationships and event-driven whenever ownership, geography, activity, or media coverage changes.
I also like to set explicit quality checks: does the file explain the business model in plain English, do the documents align with the narrative, and would a third party understand why the account was accepted? If the answer is no, the file is not ready, no matter how much material is attached.
The best compliance programs do not confuse rigor with friction. They make it easy to escalate risk, hard to approve a weak file, and simple to show, later, why the decision was reasonable.
