KYC, CDD and EDD, in the Right Order

Ask five people in financial crime compliance to define KYC, CDD and EDD and you will often get five overlapping but slightly different answers. The terms themselves aren’t ambiguous. People just use them loosely in daily practice, and the looseness is contagious.

Getting the hierarchy precise matters, because the hierarchy is what a risk-based AML programme is built on.

KYC is the umbrella, not a step

Know Your Customer is the overall obligation and programme rather than a single procedure. It is the regulatory expectation that a financial institution understands who its customers are, what they are likely to do with the relationship, and whether that matches what they actually do.

Everything below it — identification, verification, risk rating, ongoing monitoring — is a component of KYC. Not a separate parallel process running alongside it.

CDD is the baseline procedure every customer gets

Customer Due Diligence is the specific defined procedure applied to every customer at onboarding, scaled to risk. Under the frameworks most institutions build to, which means FATF Recommendation 10 globally and, in the UK, Regulations 27 and 28 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“the MLRs”), baseline CDD requires four things:

1. Identifying the customer and verifying that identity using documents or information from a reliable and independent source.
2. Identifying the beneficial owners of legal-entity customers, broadly anyone holding more than 25% of the shares or voting rights — the same threshold Companies House uses for its People with Significant Control register — plus taking reasonable measures to verify who they are.
3. Understanding the nature and purpose of the customer relationship well enough to build a risk profile.
4. Conducting ongoing monitoring to identify and report suspicious transactions, and keeping customer information current over time.

Crucially, CDD is not optional and is not reserved for risky customers. It is the floor. Every customer gets it. What changes with risk is how much further you go, which is where EDD comes in.

EDD is CDD’s escalation, triggered by risk

Enhanced Due Diligence is not a separate framework. It is additional depth applied to those same four components once a customer’s risk profile crosses a threshold.

Regulation 33 of the MLRs sets out when it is mandatory in the UK: business relationships or transactions involving a high-risk third country, politically exposed persons and their family members or known close associates, correspondent relationships, and any transaction that is complex, unusually large, follows an unusual pattern, or has no apparent economic or legal purpose.

What it adds, practically:

• Source of wealth and source of funds analysis. Not just where this particular deposit came from, but how this person or entity accumulated the wealth they now hold.
• Senior management sign-off on establishing or continuing the relationship, rather than analyst-level approval on its own.
• Shortened review cycles. A PEP relationship might be reviewed annually or more often, rather than on the standard clock.
• Adverse media and sanctions research that goes past a single screening hit — checking beneficial owners, close associates and related entities, not only the named customer.

“High-risk third country” is not a fixed list. It changed its own definition in 2024

Most training treats it as a stable category whose members you memorise. It isn’t, and that is worth knowing, because the definition has moved twice in four years while most people’s mental model has stayed put.

Before Brexit the UK simply followed the EU’s list. From 26 March 2021 it broke away entirely and maintained a bespoke list in Schedule 3ZA of the MLRs, amended by HM Treasury statutory instrument each time anything changed. Then, from 23 January 2024, the approach changed again: Schedule 3ZA was removed, and “high-risk third country” now means, by direct reference, whatever FATF currently lists on either its Call for Action list or its Increased Monitoring list.

So the UK no longer runs a separate high-risk country list at all. It is tied straight to FATF’s, updating automatically whenever the FATF plenary updates, with no UK statutory instrument required in between.

An analyst working from a list they memorised a year or two ago, or from an EU list predating 2021, is working from a framework that has been replaced twice over. The habit that survives this is the same one that applies to beneficial ownership registries: check the current source, don’t trust a remembered set of country names.

Why the distinction matters more than it looks

The failure mode I see most often, in training materials and in live programmes both, is treating EDD as a binary flagged/not-flagged gate rather than as a dial.

A risk-based approach means EDD scales with the specific risk factors present. A foreign PEP running a transparent, well-documented business at modest transaction volume warrants a different depth of review from a domestic PEP moving high volumes through a shell structure in a secrecy jurisdiction, even though both are technically “PEP, therefore EDD.”

An analyst who can articulate which specific risk factor triggered escalation, and what additional evidence that particular factor requires, is doing risk-based compliance. An analyst applying a fixed EDD checklist to every flagged file regardless of why it was flagged is performing a compliance-shaped ritual. The gap between those two is what regulators and hiring managers are both screening for, though neither will phrase it that way.

What changes when an agent drafts the EDD research

Agentic AI tools already run the first pass of EDD research at some firms — pulling adverse media, drafting a source-of-wealth narrative, summarising a beneficial ownership chain, all before a human analyst opens the file.

Genuine efficiency gain on the mechanical part of CDD components two and three, which is gathering information. Not a shortcut on the part that matters, which is judgment: deciding whether what was gathered actually supports the risk profile, and standing behind that decision.

The risk-based principle from the previous section transfers here without modification. An agent running the same fixed EDD checklist against every file regardless of the risk factor present has automated the ritual rather than the compliance.

Worse, the output carries a failure mode a human researcher doesn’t. A fabricated citation. A plausible-sounding but wrong summary of a source document, delivered in the same confident register as an accurate one. The MLRs require CDD measures to use information from a reliable, independent source, and a hallucinated adverse media summary that was never checked against anything fails that standard exactly as surely as not checking at all. It is simply much harder to spot, because it does not look unfinished.