CDD is more than an identity check
Initial customer due diligence establishes the relevant facts before a designated service begins. Section 28 covers the customer's identity, relevant people connected to the customer, authority to act, beneficial ownership for non-individual customers, PEP and targeted financial sanctions status, and the nature and purpose of the relationship or transaction.
The general rule is to establish these matters on reasonable grounds before starting the service. The Act and Rules contain particular exceptions and modified requirements. Do not turn the general rule into a claim that no exception exists, or treat an exception as permission to delay every case.
- Customer and authority
Establish who the customer is and who can act for them.
- Relevant people and purpose
Check beneficial ownership where relevant, and the nature and purpose of the service.
- Status and risk
Assess PEP and targeted financial sanctions status and customer risk.
- Evidence and decision
Collect and verify the relevant information, then record the conclusion.
Resolve the initial CDD questions
Suggested reading order; checks can overlap. The general timing rule is before service, subject to applicable exceptions and modified requirements.
Follow the process from top to bottom.
Use risk to select the evidence
Section 28 requires reasonable steps to establish that an individual customer is who they claim to be. It also requires identification of customer risk from reasonably available information, collection of appropriate KYC information, and verification of relevant information using reliable and independent data.
Collection and verification are separate actions. The minimum information may also depend on the customer type under the Rules. A successful electronic identity check therefore answers only part of the CDD question. It does not automatically establish why a company needs the service or whether the person instructing you has authority.
Worked example: opening a company file
A company supplies a registry number and an identity result for its contact person. The business can use these items in its checks, but important questions may remain. Is the contact acting for the company? Who ultimately owns or controls it? What work is requested, and why?
The staff member builds a short list of unresolved matters and gathers information relevant to each one. The example does not require the same documents from every company. It shows why a file should be reviewed against the facts that need establishing, rather than against the number of documents uploaded.
- Customer statement
Records what the customer says.
- Verification evidence
Checks information using reliable and independent sources as required.
- CDD conclusion
Establish the required matters on reasonable grounds. A completed form alone does not do this.
Separate information from a supported conclusion
Read this visual with the source conditions and explanation in this section.
Separate evidence questions. An answer to one does not settle the others.
Record the decision and remaining limits
A practical completion note can state the customer, designated service, evidence used, material checks, risk reasoning and any applicable special provision. If information conflicts, resolve or escalate the conflict before describing the check as complete. An unexplained tick is difficult for another person to assess.
Initial CDD gives the business a starting understanding. When the relationship changes, the business may need to review customer information and risk through its ongoing CDD process. Completing an initial file does not certify future transactions or confirm compliance with every obligation. Use the current provisions for the actual service and customer.